OFAC told foreign banks on 5 October they can be sanctioned without notice. FAQ 156 points to a list that holds one bank

OFAC's alert of 5 October 2026 runs to two pages and names no new target. It tells foreign banks that those still transacting with sanctioned Iranian financial institutions "could be targeted at any time without advance notification" and should end those relationships.

Page one lists the actions taken since Treasury Secretary Scott Bessent announced Operation Economic Outcast on 24 August. It cites wider secondary-sanctions risk under Executive Order 13902 for digital assets, technology, gold, aviation and shipping, then action against Banque Misr UAE on 28 August, Golden Global Bank on 4 September and VTB Bank on 14 September. Page two is about shadow banking, the front and shell companies that launder money from Iranian oil and other commodities, and points banks to three FinCEN publications.

The same day OFAC amended FAQ 156, which answers how a bank learns, under the Iranian Financial Sanctions Regulations, that Treasury has restricted its correspondent accounts in the United States. There are two routes. Strict conditions come as an order or regulation in the Federal Register. A prohibition on the accounts puts the bank's name on the CAPTA List.

We counted how many banks that list holds.

The alert reads as one campaign. In the files OFAC publishes, the four actions look like this.

Two details are easy to lose. First, the alert says Treasury "took action to sever" Banque Misr UAE's US correspondent access. Treasury's 28 August release says FinCEN proposed a rule that would do so, with comments closing 30 days after publication in the Federal Register. Treasury estimates that between January 2024 and June 2026 the bank processed about $1.8 billion for 103 companies that may belong to Iranian shadow banking networks.

Second, VTB was not new to the list. It was already blocked under Russia authorities. The 14 September update added the [IRAN-EO13902] tag, a Tehran address and the line "Subject to Secondary Sanctions" to the existing entry, and made the same change to VTB's entry on the Sectoral Sanctions Identifications List. A file that stores "VTB: SDN match" had the bank before the alert and learns nothing from it.

We searched the SDN and Consolidated files, primary and alias names, for the word Misr. The hits were Ajnad Misr, Irano Misr Shipping Company and two aliases of HASM, an Egyptian group. None is a bank.

OFAC's page for the CAPTA List was last updated on 6 April 2022. The list file carries the same date and one institution, Bank of Kunlun, printed three times: under its current name and under two former ones, Karamay City Commercial Bank and Karamay Urban Credit Cooperatives. The basis given is 31 CFR 561.201(c), a prohibition on US correspondent and payable-through accounts.

The Consolidated Sanctions List data file, downloaded on 9 October, says the same. It holds 482 primary records for the non-SDN lists, and exactly one carries the tag 561-Related. Its SWIFT code is CKLBCNBJ.

None of the four actions in the alert changed that. Golden Global and VTB could not have, because OFAC states that the CAPTA List does not include banks on the SDN List. A blocked bank goes on the SDN List. A bank that is only barred from US correspondent accounts goes on the CAPTA List. Today it names one bank, and it is not an Iranian one.

FAQ 156 now carries a date of 5 October and opens with a reference to the alert. We could not see the earlier text, so we cannot say what else changed. FAQ 156 describes the milder tool, short of blocking the bank. FAQ 155 says that a finding that the bank knowingly engaged in sanctionable activity has to come first.

The 5 October entry on OFAC's Recent Actions page is mostly something else. Treasury's release calls it the third round of sanctions removals in its modernisation initiative: 125 individuals and entities removed, 22 entries updated. We counted 22 update pairs. The removals section prints 181 lines, tagged SDNT (114), IRAQ2 (59), VENEZUELA (4) and BELARUS-EO14038 (4). The page prints aliases as separate lines, which is where much of the gap between 181 and 125 comes from: AL-BAZZAZ, Hikmet Abdallah and AL-BAZAZ, Hikmet Abdullah are one former Iraqi minister, printed twice. We did not reconcile the two figures line by line. None of the four tags is an Iran programme.

A removal only matters to you if your file keeps old matches alive after the entry is gone.

The sanctions risk in the alert belongs to the bank. A company's exposure is indirect, and what follows is our reading, not the alert's.

A bank told that it may be sanctioned without notice has reason to ask more of customers who touch Iran. The alert tells it where to look: dealings with sanctioned Iranian banks, services to their subsidiaries or branches in third countries, and the front-company patterns in the FinCEN guidance. An EU payment firm or an exporter with Iran-linked counterparties is the customer most likely to be asked.

Whether a payment firm is itself a "foreign financial institution" under the alert is not something its two pages settle. That is a question for counsel.

1. Check which OFAC files you load. If you load the SDN file and not the Consolidated file, you cannot see CAPTA. Count the CAPTA rows. The expected number is one.
2. Match banks on SWIFT/BIC as well as on name. The entries carry them: GOGYTRIS for Golden Global Yatirim Bankasi, VTBRRUMM for VTB Bank, CKLBCNBJ for Bank of Kunlun. There is no code for Banque Misr UAE in any OFAC file, because the bank is not in them.
3. Keep a watch item for the FinCEN rule. A proposed section 311 measure is in no list file today. If it is finalised, the question is whether your sources load it.
4. Re-screen intermediaries, not only customers. The alert's own examples run through intermediaries: subsidiaries and branches of Iranian banks in third countries, and front and shell companies.
5. Record the list and the tag with every match. "SDN" is not an answer when the same bank can be SDN, CAPTA or neither.

A name check is only as wide as the files behind it. The source register shows which OFAC files ScreenVeritAI loads; read it before relying on a no-match result for a bank. Run the correspondent banks in your payment chain through a batch screening and read the list and programme against each match, not just the match.

This is a report of what OFAC and Treasury published on 5 October 2026 and on the four earlier dates the alert cites, and of what OFAC's list files contained when we downloaded them on 9 October. We did not read the three FinCEN documents the alert recommends, the Federal Register or the earlier wording of FAQ 156. We did not check whether FinCEN's proposed rule on Banque Misr UAE has been published or made final.

These are US measures. An EU or UK obligation comes from an EU or UK instrument and has to be checked separately. We take no position on the merits of any designation, and nothing here says whether a given institution is sanctionable. The count of one on the CAPTA List is a count of institutions in OFAC's published file on the day we looked.