Pegasus pays OFAC $175,015 after screening a sanctioned supplier's new name only

What happened

Pegasus Worldwide Logistics, a California-based freight forwarder, agreed to pay $175,015 to settle potential civil liability with the US Treasury’s Office of Foreign Assets Control, or OFAC. OFAC’s enforcement release of October 9, 2026 describes four apparent violations of the Illicit Drug Trade Sanctions Regulations and six of its Reporting, Procedures and Penalties Regulations. OFAC found the violations non-egregious and not voluntarily self-disclosed, against a base penalty of $205,900.

On May 30, 2023, OFAC designated Youli Technology Development Co., Ltd., a China-based supplier of pill press and packaging equipment, and listed its phone number and email address. Youli later renamed itself Huizhou Youli Fushi Co., Ltd. but kept its other identifiers. In August 2023, a US nutritional supplement company engaged Pegasus to coordinate shipment of a $5,950 sugar packet-filling machine from Youli. OFAC’s release says the machine’s intended purpose was legitimate commercial activity, and the Drug Enforcement Administration indicated it has little utility for packaging narcotics.

On September 12, 2023, Pegasus instructed Youli to arrange shipping through an email address associated with Youli on OFAC’s list of specially designated nationals, the SDN List. The shipping documents carried the new name and the unchanged phone number. Pegasus’s procedure did not say when to check the list. It screened only the new name, just before departure from China, and got a null result. OFAC says screening the other identifiers, “including through a basic internet search, would have yielded a positive match.”

US Customs and Border Protection, known as CBP, notified Pegasus on November 3, 2023 that it had detained the machine and named OFAC as the responsible agency. Neither the notice nor the OFAC reference prompted Pegasus to investigate, and CBP seized the machine as blocked property on December 6, 2023. OFAC had issued an administrative subpoena shortly before the seizure. On February 1, 2024, Pegasus certified that it had no responsive information. After OFAC presented the arrival notice, Pegasus found records and sent a revised response on August 8, 2024, saying it had not given its attorney all necessary information when the first response was prepared.

Why it matters

OFAC found reckless disregard in the failure to screen information Pegasus held and the failure to investigate after the detention. It weighed mitigating factors too: no OFAC enforcement action in the five years before the earliest transactions, small size, low transaction values, and extensive remediation including an outside sanctions consultant.

This suggests the exposure came from control design, not an undetectable hit. A name-only screen fails exactly when a designated party changes the one field being checked. OFAC’s release calls name screening a baseline tool and says controls should account for efforts by SDNs to obfuscate their involvement.

Low value gave no cover. OFAC says any dealing in blocked property, however small, is generally prohibited without authorization. The subpoena episode adds a second lesson: a response process is itself a control, and OFAC warns that failing to respond accurately can risk standalone penalties.

Practitioner angle

The lessons apply to freight forwarders and equally to banks financing trade. Put these questions to your own controls:

• Do you screen every identifier on the SDN entry, including phone numbers, email addresses, addresses, websites, and former and alias names, or only the name?
• When OFAC updates an entry or a counterparty changes its name, do you re-screen existing customers and suppliers?
• Does screening start with the transaction, not just before shipment or payment?
• Do staff treat a customs detention, or any OFAC reference in a notice, as a mandatory escalation trigger?
• Does your information-request protocol search every repository and give counsel everything before anyone signs a certified response?

Then run one test. Put a designated party’s phone number into a record under a different name and see whether your tool flags it. Test the phone number, not just the name.