The New Education Compliance Reality in 2026
Why sanctions screening, payment-chain review, and audit-ready documentation can no longer be treated as optional campus controls.
Prepared for school heads, CFOs, business officers, general counsel, compliance leaders, admissions teams, finance teams, and trustees.
Sanctions Compliance Is No Longer Just a Banking Problem
For years, many schools assumed sanctions compliance was mainly a banking problem. That assumption no longer holds.
In February 2026, the Office of Foreign Assets Control (OFAC) announced a $1.72 million settlement with IMG Academy tied to sanctions compliance failures involving tuition payments and enrollment relationships. Around the same time, the U.S. Department of Education released 2025 foreign funding disclosures showing more than 8,300 transactions worth over $5.2 billion in reportable foreign gifts and contracts, reinforcing that foreign-source oversight in education is now a matter of public accountability and national-security attention.
This is the new operating environment for education:
Why Education Compliance Just Got More Real
1OFAC Enforcement Reached Education
The February 2026 OFAC settlement involving IMG Academy changed the conversation. The school settled 89 apparent violations of the Kingpin Act regulations: tuition agreements with, and payments from, two parents on the SDN List, much of it paid by third-party wires and cards on file. The case showed that educational institutions are not outside the reach of sanctions enforcement merely because they are schools, and OFAC's release said that, as a starting point, it may be advisable to screen “students, counterparties to tuition agreements, and payors.”
Schools with international touchpoints must stop assuming that sanctions risk belongs somewhere else.
2Federal Visibility Into Foreign Funding Is Increasing
On February 11, 2026, the U.S. Department of Education released 2025 Section 117 foreign funding data showing over $5.2 billion in reportable foreign gifts and contracts across more than 8,300 transactions, from reports filed through December 16, 2025. Its new public portal followed an April 2025 executive order calling for stronger Section 117 enforcement, and in mid-2026 the Department began identifying reported foreign sources that also appear on U.S. government restricted-party lists. Section 117 applies to colleges and universities that receive federal financial assistance, but the direction of travel is the same for every school: know who is on the other side of the money.
For institutions, this means a bigger expectation gap: know who is paying, know who is sponsoring, know who is connected to the transaction, and be able to show what was reviewed and when.
3Compliance Is Moving Closer to Operations
The old model was policy on paper, with review happening only when something looked strange. The new model is operational: screening, review, escalation, documentation, and retained evidence built into the workflow itself.
Regulators and auditors do not only ask whether a policy exists. They ask whether the institution can show what it actually did.
Where Schools and Universities Are Actually Exposed
A lot of education leaders still think only about the student name. That is too narrow.
The real exposure often lives in the full relationship and payment chain.
Tuition & Fee Payments
Funds from parents, sponsors, corporate payers, third-party senders, scholarship intermediaries, or overseas remitters. Risk can sit with the source of funds, not only the enrolled student.
Enrollment Agreements
Contractual or financial relationships entered before screening has happened, creating avoidable exposure if a party is restricted.
Donations & Sponsorships
International donors, family foundations, or intermediaries accepted by development offices with limited screening discipline.
Visiting Scholars & Vendors
International visitors, research partners, consultants, and vendors creating sanctions or export-control implications where funds, services, or controlled technologies are involved.
Refunds & Disbursements
Returning money is not automatically risk-free. Refunds or outbound payments can create additional exposure if counterparties are restricted.
A costly assumption
“We use Blackbaud / Flywire, so we’re covered.”
Two widely deployed platforms are sometimes assumed to cover a school's sanctions screening: Blackbaud and Flywire. Both handle money or constituent data, and both are strong at what they do. Neither replaces the institution's own record of who it screened, what matched, and why it went ahead. The category mismatch is what creates exposure.
Blackbaud
Primarily a fundraising, constituent-relationship-management, financial accounting, and tuition-payment platform. Raiser’s Edge NXT, Financial Edge NXT, and Blackbaud Tuition Management are built to manage donor relationships, fund accounting, and payment collection, and their product pages do not describe sanctions screening or OFAC adjudication. (Blackbaud’s grantmaking products do offer watchlist checks, for grant recipients rather than for a school’s students, payors, and donors.) Using Blackbaud well still leaves the institution responsible for screening the parties it transacts with.
Flywire
A payment platform for education, best known for international tuition. As a licensed payment company, Flywire screens its clients’ and payers’ transactions against sanctions lists under its own obligations, and says so to its clients. That program serves Flywire’s compliance. It is not the school’s screening program, and a cleared Flywire payment is not the school’s documented OFAC review of the payor relationship for the school’s own compliance file.
Why this matters. OFAC’s prohibitions apply to the institution itself, and so, for colleges and universities that receive federal financial assistance, does Section 117 reporting. A vendor running its own compliance program for its own business does not take over the school’s own screening, review, and record-keeping. A processor’s “the payment cleared’’ log is a different artifact than the school’s screening decision, reviewer identity, decision rationale, and timestamped audit trail of why a payor, sponsor, or donor was approved.
The most preventable gap is the school that assumes the vendor “handled it” and has no auditable record showing the institution itself screened the counterparty. Treat Blackbaud and Flywire as the payment and CRM tools they are, and run institutional sanctions screening alongside them, not instead of them.
The 5 Compliance Failures That Keep Showing Up
These patterns appear repeatedly across schools and universities of all sizes.
Screening Only the Student
The institution screens the applicant, but not the parent, sponsor, donor, beneficial payer, or wire originator.
Screening Only Once
A one-time check at admission or enrollment is not enough. Lists change. People change. Relationships change.
No Documented Adjudication Process
Potential matches handled informally through email, hallway discussion, or memory. Weak evidence and inconsistent decisions.
No Retained Audit Package
Even when staff make the right call, many schools cannot later prove what was screened, what result appeared, who reviewed it, and why.
Disconnected Ownership
Admissions, finance, advancement, and compliance operate in separate lanes. Risk moves between those lanes faster than accountability does.
What an Audit-Ready Education Compliance Program Looks Like
Institutions do not need a giant bureaucracy. They need a practical operating model built on five pillars.
Define Who Gets Screened
Define When Screening Happens
Use Human-Reviewed Adjudication
Preserve Evidence in One Place
Assign Ownership Clearly
90-Day Action Plan for Education Leaders
Move from ad hoc review to a stable operating process in four phases.
Foundation
Policy & Process
Scale
Operationalize
Questions Trustees and Senior Leadership Should Be Asking
These six questions reveal whether an institution has moved from policy to practice.
Do we know every party connected to incoming tuition and donation flows?
Are we screening only students, or the full payment chain?
OFAC requires records of covered transactions for ten years (31 CFR 501.601). Could we show what we screened, and why, for as long?
Who owns sanctions and counterparty screening at our institution?
If regulators, auditors, or counsel ask for documentation, how fast can we produce it?
Are our current processes policy-deep but workflow-thin?
How SecurePoint Education Fits This Need
SecurePoint Education is built around the idea that educational screening needs to be operational, documented, and easy to defend.
For institutions, that means less scrambling, clearer accountability, and stronger audit readiness. The key question is not “does it screen?” The key question is: can our institution run a real workflow and prove what happened later?
Case Example: What Good Looks Like
An independent school receives enrollment paperwork for an internationally sponsored student. Tuition will be paid by a family-owned company through a third-party sender.
Weak Process
Admissions clears the student record. Finance receives the funds. No one screens the sponsor or sender. Later, questions arise about the payment source, and the institution has no unified record of what was checked.
Stronger Process
Student, sponsor, and payment-related parties are loaded into the screening workflow. A potential match is flagged, routed to a human reviewer, supporting details compared. The reviewer clears one party as a false positive, escalates another for counsel review. Decision record preserved with timestamps and rationale. Exportable evidence packet available.
Final Takeaway
Education compliance has changed. The message from 2026 is clear: schools and universities with international students, sponsors, donors, and cross-border relationships can no longer treat sanctions screening and related documentation as edge cases.
The institutions that respond well will not be the ones with the most complicated policy manuals. They will be the ones with a simple, enforced workflow:
That is how schools protect students, protect operations, protect leadership, and protect the institution.
Ready to Move From Ad Hoc to Audit-Ready?
See how SecurePoint Education gives your institution screening, adjudication, and evidence in one workflow, built for the way schools actually operate.
Frequently asked questions
Do schools and universities actually have OFAC obligations?
Sanctions obligations apply broadly to US persons and organizations, and enforcement has reached the education sector. Whether and how they apply to your institution depends on who you transact with and where, which is a determination for counsel rather than an assumption in either direction.
Which parties would an institution screen?
Typically the parties an institution exchanges money or access with: students, tuition payors, sponsors, donors, agents, faculty, and vendors. SecurePoint Education screens those party types and keeps the decision record against the case.
Does SecurePoint file with OFAC on our behalf?
No. SecurePoint does not file with OFAC, BIS, or DDTC for customers. The licensing capability is assessment and workflow support: it helps you evaluate whether a license question exists and track your own internal workflow. Filing, and the legal determination behind it, stay with your institution and its counsel.
What happens when a student or payor matches a list?
The record is held for review rather than passed. An authorized reviewer sees the matched source and the match detail and records a documented decision. That decision and its reasoning are retained and can be exported with the case.
What does an evidence pack contain for an audit?
The screening activity, the match context, the review decisions and who made them, and the audit trail, exported together against the date range and scope you choose.
Sources and revision history
First published March 2026. Last reviewed against the sources below and against SecurePoint's product as it stood that day. The sources are listed for traceability, not as endorsements; confirm current text with the issuing agency before relying on a citation.
- [1]OFAC Enforcement Release: IMG Academy, LLC (February 12, 2026)
$1,720,000 settlement of 89 apparent violations of the Foreign Narcotics Kingpin Sanctions Regulations (31 CFR Part 598). OFAC said that, as a starting point, it may be advisable to screen students, counterparties to tuition agreements, and payors.
- [2]U.S. Department of Education: Latest foreign funding disclosures (February 11, 2026)
Source for the 2025 totals: more than 8,300 transactions and over $5.2 billion in foreign gifts and contracts, from reports filed through December 16, 2025.
- [3]Foreign Funding in Higher Education (Section 117 data portal)
Current Section 117 data, updated as institutions file.
- [4]20 U.S.C. § 1011f: Disclosures of foreign gifts
Section 117. Applies to institutions that receive federal financial assistance; reporting threshold of $250,000 a year.
- [5]Executive Order 14282: Transparency Regarding Foreign Influence at American Universities (April 23, 2025)
Directs stronger enforcement of Section 117 disclosure.
- [6]31 CFR § 501.601: Records and recordkeeping requirements
OFAC records must be kept for ten years, effective March 12, 2025.
- [7]31 CFR Parts 500-599: OFAC sanctions regulations
Primary regulatory framework for the OFAC obligations described, including Part 598 (Kingpin Act).
- [8]Blackbaud products
Product positioning for Raiser's Edge NXT, Financial Edge NXT, and Blackbaud Tuition Management, checked October 2026. Blackbaud's grantmaking products offer watchlist checks for grant programs.
- [9]Flywire: Understanding the sanctions screening process
Client FAQ linked from Flywire's AML compliance page. Flywire says it screens its clients' and payers' transactions at the time of payment because, as a U.S.-domiciled, globally licensed payment company, it must comply with sanctions law. Checked October 2026.
Revision history
Re-checked the IMG Academy settlement and the Section 117 figures against OFAC and the Department of Education, and quoted OFAC's starting-point advice on whom to screen. Limited Section 117 to the colleges and universities it covers, corrected the vendor descriptions against Blackbaud's and Flywire's own materials, stated OFAC's ten-year record period, and described re-screening as the 30- or 90-day schedule the product runs.
First published as a guide for school and university leaders.
Informational only. This white paper is provided for general informational purposes only and does not constitute legal, regulatory, or compliance advice. It is not a substitute for review by school counsel, outside counsel, or other advisors familiar with your institution's sanctions, export-control, and foreign-funding-disclosure obligations.
Statistics, settlement amounts, and Section 117 figures reflect publicly available information as of the review date shown on this page and in the PDF. OFAC enforcement priorities and Department of Education disclosure rules change; verify with primary sources before acting on anything in this document. © 2026 SecurePoint USA LLC. All rights reserved.