FEBRUARY 2026 ENFORCEMENT Action
The $1.72 Million lesson boarding schools are learning the hard way. Why relying on your payment processor for OFAC screening leaves your school strictly liable for international sanctions violations.
IMG Academy, LLC — Fined $1,720,000 by OFAC — February 12, 2026.
This is not a hypothetical scenario involving an obscure defense contractor in a faraway country. IMG Academy is an elite private sports academy in Bradenton, Florida—one of the most internationally recognized prep schools in the United States.
OFAC fined them $1.72 million just months ago. The penalty is published directly on OFAC's civil penalties page. This happened to a school serving the exact same demographic profile as your international applicants.
Schools with healthy international enrollments often believe they are OFAC-compliant because their payment processor (like Flywire or Stripe) "screens transactions."
They are wrong. Let’s look at how Flywire’s compliance actually works, directly from their own security documentation:
“Flywire also maintains robust anti-financial crimes compliance programs as required by our global regulators to ensure our business complies with regulations where we operate.”
Read that phrase carefully: "to ensure our business complies." Not your school's business. Flywire's money transmission license is what they are protecting.
Where the processor's legal liability ends, the school's strict liability begins.
| The Compliance Gap | Why it creates liability for your school |
|---|---|
| Student Identity vs. Payer Identity | The student attending the school is the relationship. The payer is just the wire sender. Processors only screen the sender, leaving the core relationship unchecked. |
| The 50 Percent Rule | Entities 50%+ owned by sanctioned persons are also sanctioned by law—even if they are never published on a list. Basic wire checks do not traverse complex corporate family structures. |
| Ongoing Monitoring | Sanctions lists change. A student who arrives clean in year 1 may be connected to an entity sanctioned in year 3. A one-time payment check captures no ongoing updates. |
| Institutional Audit Trail | When federal regulators knock, they demand to see your screening records. Pointing at a Flywire receipt does not constitute an institutional OFAC program. |
| Broader Sanctions Programs | The SDN list is only one list. OFAC enforces sweeping country-based embargoes, sectoral sanctions, and non-SDN restricted lists that simple bank screening misses. |
OFAC is unequivocally clear on who holds the liability. From their official guidance:
"All U.S. persons must comply with OFAC sanctions, including all individuals and entities within the United States..."
Private schools are U.S. entities. There is no legal exception for "we thought our payment processor handled it." In the eyes of the government, maintaining a compliance program is your non-delegable duty.
OFAC sanctions violations operate under strict liability. Intent does not matter. You do not have to "knowingly" enroll a sanctioned student or accept dirty money. If the transaction occurs, you are liable. The $1.72M settlement against IMG Academy is the terrifying proof point for schools offering international services.
Get weekly insights on sanctions, export controls, and visitor compliance delivered to your inbox.
No spam. Unsubscribe anytime.
Related posts
More guidance on sanctions, export controls, and visitor management for regulated facilities.
As the United States celebrates its 250th anniversary, the battle to protect U.S. sovereignty has shifted from factory floors to digital and physical perimeters. Here is why securing the supply chain is the modern patriotic duty.
Most people don't get into compliance — they get handed it. Seven sanctions and export-control terms (the OFAC 50% Rule, deemed exports, adjudication, restricted parties, CUI vs. FCI, and more) explained without the jargon, plus the free SecurePoint Compliance Academy that covers the rest.
Under ITAR (22 CFR 120.17), releasing controlled technical data to a foreign person is an export — even inside the U.S. Here's why foreign-national visitor access is the regulated event, who counts as a foreign person, and how to screen, escort, and document it.
