FEBRUARY 2026 ENFORCEMENT Action
Your Payment Processor Isn’t
Your Compliance Program
The $1.72 Million lesson boarding schools are learning the hard way. Why relying on your payment processor for OFAC screening leaves your school strictly liable for international sanctions violations.
The Devastating Reality Check
IMG Academy, LLC — Fined $1,720,000 by OFAC — February 12, 2026.
This is not a hypothetical scenario involving an obscure defense contractor in a faraway country. IMG Academy is an elite private sports academy in Bradenton, Florida—one of the most internationally recognized prep schools in the United States.
OFAC fined them $1.72 million just months ago. The penalty is published directly on OFAC's civil penalties page. This happened to a school serving the exact same demographic profile as your international applicants.
The False Sense of Security
Schools with healthy international enrollments often believe they are OFAC-compliant because their payment processor (like Flywire or Stripe) "screens transactions."
They are wrong. Let’s look at how Flywire’s compliance actually works, directly from their own security documentation:
“Flywire also maintains robust anti-financial crimes compliance programs as required by our global regulators to ensure our business complies with regulations where we operate.”
Read that phrase carefully: "to ensure our business complies." Not your school's business. Flywire's money transmission license is what they are protecting.
What Processors Screen
- The payment sender at the exact moment of the transaction.
- The sender against the OFAC SDN list to clear the wire.
- Basic Anti-Money Laundering (AML) checks for the bank.
What They DO NOT Screen
- The actual student or the family. (A clean 3rd party agent sending the wire passes just fine).
- Beneficial Owners under OFAC's 50% Rule.
- It never creates your school's compliance record.
The 5 Gaps Payment Processors Cannot Close
Where the processor's legal liability ends, the school's strict liability begins.
| The Compliance Gap | Why it creates liability for your school |
|---|---|
| Student Identity vs. Payer Identity | The student attending the school is the relationship. The payer is just the wire sender. Processors only screen the sender, leaving the core relationship unchecked. |
| The 50 Percent Rule | Entities 50%+ owned by sanctioned persons are also sanctioned by law—even if they are never published on a list. Basic wire checks do not traverse complex corporate family structures. |
| Ongoing Monitoring | Sanctions lists change. A student who arrives clean in year 1 may be connected to an entity sanctioned in year 3. A one-time payment check captures no ongoing updates. |
| Institutional Audit Trail | When federal regulators knock, they demand to see your screening records. Pointing at a Flywire receipt does not constitute an institutional OFAC program. |
| Broader Sanctions Programs | The SDN list is only one list. OFAC enforces sweeping country-based embargoes, sectoral sanctions, and non-SDN restricted lists that simple bank screening misses. |
The Harsh Legal Reality: Strict Liability
OFAC is unequivocally clear on who holds the liability. From their official guidance:
"All U.S. persons must comply with OFAC sanctions, including all individuals and entities within the United States..."
Private schools are U.S. entities. There is no legal exception for "we thought our payment processor handled it." In the eyes of the government, maintaining a compliance program is your non-delegable duty.
The Trap of Strict Liability
OFAC sanctions violations operate under strict liability. Intent does not matter. You do not have to "knowingly" enroll a sanctioned student or accept dirty money. If the transaction occurs, you are liable. The $1.72M settlement against IMG Academy is the terrifying proof point for schools offering international services.