A software company meets sanctions in four places: the customers it bills, the users who log in, the software it ships, and the resellers and contractors it works with. Most small SaaS businesses only think about the first. OFAC's case against SAP came from the other three.
This guide takes each place in turn, explains the Russia software bans in the US, UK and EU, and ends with the record that answers an enterprise customer's sanctions questions.
Why software is a sanctions question
Providing software is a service, and downloading it from your servers can be an export. A US software company is a US person under OFAC's rules wherever its customers are. A UK software company is bound by UK sanctions in the same way.
OFAC's settlement with SAP shows how. In April 2021, the German software company settled with OFAC for 190 apparent violations of the Iran sanctions. The enforcement release describes two problems:
- Resellers in Turkey, the UAE, Germany and Malaysia sold SAP licenses and maintenance to companies in third countries, including companies controlled by Iranian firms. Those companies passed the software to users in Iran. The software was delivered from SAP servers in the United States.
- Two of SAP's US cloud subsidiaries sold cloud subscriptions to customers outside Iran that made the services available to their employees in Iran.
SAP also settled with the Commerce Department and the Justice Department over the same conduct. None of this needed a customer in Iran on SAP's books.
1. Customers: who you bill
Start where the money is. Every customer you invoice or charge is a party to a transaction, and OFAC's rules bar US persons from dealing with anyone on the SDN list, unless the dealing is exempt or authorized by OFAC.
What to check:
- At signup or first invoice, screen the customer's legal name against the lists that bind you. For a US company that is OFAC's lists. For a UK company it is the UK Sanctions List, plus OFAC if you bill in dollars or use US banks.
- The billing country and address. A customer in a comprehensively sanctioned country is a problem even if its name is not listed.
- Ownership, for larger accounts. A company owned 50% or more by blocked persons is blocked under OFAC's 50 Percent Rule, even if its name is on no list.
- Recheck when the lists change. A customer that was clear at signup can be designated later.
Self-serve signups make this harder, because you may only have a name, an email and a card. Screen what you have, and use the login data in the next section.
2. Users: where they log in
A customer in one country can have users in another. That is how the SAP cloud violations happened.
US agencies expect companies to use the location data they already collect. The SAP release says internal audits recommended tools to verify the location of users downloading software as early as 2006, and recommended geolocation IP address screening in 2014. SAP did not put it in place until 2015.
The 2024 Tri-Seal Compliance Note from OFAC, the Commerce Department and the Justice Department makes the expectation general. It says companies should ensure that know-your-customer information, such as countries of residence and addresses, "and geolocation data are appropriately integrated into compliance screening protocols."
For a small SaaS company, a practical baseline is:
- block signups and logins from comprehensively sanctioned countries and regions at the IP level
- compare billing country, IP country and email domain, and review accounts where they don't fit
- log what you blocked and when
The carve-outs for communications services
OFAC has general licenses that allow some internet communications services in sanctioned countries. For Iran, 31 CFR 560.540 authorizes services incident to the exchange of communications over the internet, such as instant messaging, email, social networking, collaboration platforms and video conferencing. For Cuba, 31 CFR 515.578 covers a similar list.
These licenses have conditions and exclusions, and they turn on what the service does and who uses it. Ordinary business software, such as accounting or ERP, is not covered just because it is delivered online. Sales to government bodies have separate rules. If your product is a messaging or collaboration tool, test it against the text of the regulation, and get advice before you rely on it.
3. Product: export rules for software
Export controls decide what you may send, separately from who you may deal with. In the US they are run by the Bureau of Industry and Security (BIS) under the Export Administration Regulations (EAR).
Software that customers download, including desktop and mobile apps, is subject to these rules. Most commercial software uses standard encryption for logins and data, so the encryption rules are usually where classification starts. BIS's encryption controls page and 15 CFR 740.17 explain how mass-market encryption software is handled. Under those rules, mass-market encryption software can often go to most countries without a license. Embargoed countries and parties on the BIS Entity List are the usual exceptions.
That last point brings export rules back to screening. Our guide to the US Consolidated Screening List covers the Entity List and the other BIS lists. If you are unsure how your product is classified, ask an export controls adviser. This guide does not classify products.
4. Russia: the software and IT services bans
The US, UK and EU have each restricted software and IT services to Russia. The rules differ in detail.
| United States | United Kingdom | European Union | |
|---|---|---|---|
| What is banned | IT consultancy and design services; IT support and cloud-based services for enterprise management and design and manufacturing software | Sectoral software, including enterprise software such as ERP and CRM, and IT consultancy and design services | Enterprise management and design and manufacturing software listed in Annex XXXIX, and related services |
| To whom | Any person located in Russia | Persons connected with Russia, or for use in Russia | Russian government bodies and entities established in Russia |
| Since | 12 September 2024 | 16 December 2022 (IT consultancy); 24 April 2025 (software) | December 2023 |
| Covers SaaS? | Covers cloud-based services for the listed software | Yes, the 2025 rules cover SaaS | Covers the listed software and related services. See the Commission FAQs. |
| Primary source | OFAC FAQ 1184 | SI 2025/504 and UK services guidance | Commission software FAQs |
Each regime has exceptions and licences. The US determination excludes services to Russian entities owned or controlled by US persons. The UK has a general trade licence covering business enterprise software for multinational clients headquartered outside Russia, under conditions set out in the licence. It was first published in July 2025 and has been replaced since. Check the current text before you rely on any of them.
OFAC says the aim "is not to prohibit all activity relating to the provision of IT and software-related services to Russia," and that the measures do not prohibit internet access or internet-based communications.
5. Resellers, marketplaces and contractors
SAP's resellers sold to pass-through companies in other countries. A small software company faces the same risk at a smaller scale.
Resellers and marketplaces
If a reseller or marketplace sells your licenses, you may not know the end customer. Put sanctions terms in reseller agreements. Ask for end-customer names on larger deals. Screen resellers themselves, and watch for orders from countries next to sanctioned ones that don't fit the reseller's normal business.
Contractors and freelancers
Software companies often pay developers, designers and support staff abroad, directly or through a marketplace. Each one is a vendor you pay. Screen the person, or the company they invoice through, before the first payment, and note the country they work from. A marketplace's own checks protect the marketplace. Our guide to whether your bank or payment platform screens for you explains why that leaves a gap.
What enterprise customers ask, and the record that answers it
Larger customers send security and vendor questionnaires. Many include questions like these:
- Do you screen your customers and suppliers against sanctions lists?
- Which lists, and how often?
- Do you restrict access from sanctioned countries?
- Is your company, or any owner, on a sanctions list?
A clear answer needs evidence. For the access question, that is your IP blocking configuration and logs. For the screening questions, it is a dated record of each check on the customers and vendors in your accounting system.
Sanctions Verified, opening to QuickBooks Online and Xero users, screens every customer and vendor in your books against OFAC, the UK, EU and UN lists, the US export lists, and the Australian and New Zealand lists. It rechecks them when the lists change and keeps a dated certificate for each check. You can check one name now with the free check.
If something matches
Stop provisioning and billing for that account, and do not delete its data. Check the match against the list entry using identifiers such as address and registration number, following OFAC's FAQ 5. If it looks real, get legal advice before you restore access, refund money or send anything. US persons must report blocked property to OFAC within 10 business days. For the general steps on a true match, see sanctions compliance for small businesses.
