Your Iran-related specific license applications just got harder. On September 10, 2026, OFAC announced a major change in how it reviews Iran-related licensing requests: every application now carries a presumption of denial. This isn't a new prohibition, but it closes the licensing pathway that many compliance programs relied on to manage narrow Iran exposure.
Here's what you need to verify in your sanctions compliance framework.
What This Checklist Covers
This checklist addresses the operational compliance requirements triggered by OFAC's September 2026 Iran sanctions updates, including the suspended aviation authorizations, the revised licensing policy, and the 27 new airline designations added to the SDN List under Executive Order 13902. It's designed for sanctions analysts and compliance officers to ensure their programs reflect the current regulatory posture.
Prerequisites
Before starting this checklist, confirm you have:
- Current access to OFAC's SDN List (updated September 8 and September 10, 2026)
- A copy of the suspended ITSR provisions (31 CFR 560.522, 560.528, 560.529, and GL J-1)
- Documentation of any Iran-related activity your organization conducts or has conducted in the past 12 months
- Your organization's Iran risk assessment and country risk rating methodology
- Access to your name screening system's configuration settings
Checklist Items
1. Update your SDN screening lists to include the 27 Iranian airlines designated on September 8, 2026.
Pull the latest SDN List refresh. Verify your screening vendor or internal system has ingested the September 8 additions, which include airlines and entities in the UAE, UK, Türkiye, Malaysia, and Kazakhstan tied to Mahan Air's networks. Ensure you have a dated confirmation from your vendor showing the refresh timestamp, plus a test screen of one newly designated airline returning a match.
2. If your organization operates aircraft or provides aviation services, confirm whether you relied on the suspended authorizations.
Review 31 CFR 560.522 (overflight and emergency landing payments), 560.528 (aircraft safety transactions), 560.529 (bunkering and emergency repairs), and GL J-1 (temporary sojourn reexports). These were suspended indefinitely as of September 8. Document whether you conducted activity under these provisions and have ceased as of September 8.
3. If you had transactions authorized under the suspended provisions, verify you completed wind-down by September 23, 2026.
General License DD expired on September 23. If you didn't complete wind-down by that date, you may now be in violation. Ensure transaction records show final payments or contract terminations dated on or before September 23, with a compliance memo documenting the wind-down.
4. Flag any pending Iran-related specific license applications for re-evaluation.
As of September 10, OFAC applies a presumption of denial to all Iran-related license applications. If you have applications in process, assess whether they fall into the narrow exceptions (risk to life or limb, required by law, environmental safety). Maintain a tracking spreadsheet of pending applications with a column noting the exception category or a decision to withdraw.
5. Revise your Iran licensing policy to reflect the presumption of denial standard.
Your internal guidance should now state that Iran-related licenses are presumed denied unless they meet specific exceptions and are reviewed case-by-case. This affects how you advise business units on Iran exposure. Update your policy document with version control showing the September 10, 2026 change and communicate this to relevant stakeholders.
6. Review your customer base for exposure to the newly designated entities in Iraq, Lebanon, UAE, and Türkiye.
OFAC's September 10 action targeted individuals and entities tied to Kata'ib Hizballah and Hizballah. Screen your customer and vendor files against these additions. Document a screening report showing zero matches or escalation records for any matches with disposition notes.
7. If you have US persons providing services related to Iran, confirm they understand the ITSR prohibitions on management consulting.
The September 10 settlement involved a US lawful permanent resident who paid $1,427,230 to settle 39 apparent violations for providing management consulting services to an Iranian software company. Your US persons must know this is prohibited. Maintain training records or signed acknowledgments from US persons confirming they do not provide services to Iranian entities.
8. Assess whether your organization should establish or update a sanctions whistleblower intake process.
FinCEN offers awards of 10 to 30 percent of collected penalties for tips on Iran-related illicit finance. While this is primarily a public-facing program, consider whether your internal reporting channels adequately capture Iran-related concerns. Review whether your existing whistleblower or escalation process is sufficient or recommend enhancements.
9. Update your transaction Transaction Monitoring Rules to reflect FinCEN's Iran-related typologies.
The Whistleblower Bulletin includes red flags for Iran-related illicit finance. Review these against your transaction monitoring rules to confirm coverage. Conduct a gap analysis comparing the bulletin's typologies to your existing scenarios, with recommendations for rule adjustments if gaps exist.
10. Document your compliance with these updates in your next sanctions risk assessment.
Your annual or periodic sanctions risk assessment should reflect the September 2026 policy changes and your organization's response. Ensure a risk assessment dated after September 2026 references the licensing policy shift, the suspended aviation authorizations, and any mitigating controls you've implemented.
Common Mistakes
Treating this as a new prohibition rather than a licensing policy change. The ITSR prohibitions didn't expand. What changed is OFAC's willingness to grant exceptions. Don't over-correct by blocking activity that was never prohibited in the first place.
Assuming the aviation suspensions don't affect you because you're not an airline. If you provide financial services to aviation companies, process payments for aircraft parts, or handle correspondent banking for institutions that serve the aviation sector, you're exposed. The suspensions affect the entire service chain.
Waiting for a formal license denial before adjusting your risk posture. The presumption of denial is OFAC's signal that Iran-related activity carries heightened risk. Adjust your customer risk ratings and enhanced due diligence triggers now, not after you receive a denial letter.
Ignoring the settlement's emphasis on management consulting. OFAC found the conduct egregious and not voluntarily self-disclosed. If your US persons provide any advisory, strategic, or operational support to Iranian entities, you're in violation territory. This includes remote work arrangements.
Next Steps
After completing this checklist, schedule a review meeting with your MLRO or sanctions compliance lead to discuss any gaps identified. If you found exposure in items 2, 3, or 7, consider whether voluntary self-disclosure is appropriate. Update your sanctions compliance training materials to reflect the new licensing posture, and set a calendar reminder to refresh your SDN screening lists weekly until Iran-related designations stabilize.
The presumption of denial doesn't make Iran transactions impossible, but it does make them presumptively non-compliant. Adjust your framework accordingly.
