Violating OFAC sanctions can result in extreme consequences, including prison for up to 30 years and fines in the millions of dollars. It would be prudent and reasonable for Apple to do nothing rather then to do something that invites this type of inquiry. To do nothing invites, at most, a de minimis amount of reputational risk.

Reputational risk can lead to security risk if researchers think Apple is not paying bounties anymore.

If you’re a security researcher who potentially falls under OFAC sanctions. Everyone else will likely still get paid.

Yes, of course, they can't work around OFAC sanctions, but donating the bounty to a charity would probably have been 100% fine, and a show of good will.

It's not the first time we've seen Apple not playing nice with their bug bounty programme, so it's something of a pattern of behaviour. "A show of good will" is exactly what they need.

“probably fine” is not the comment I would’ve wanted from my lawyer. There are tons of ways this could’ve gone south. For example, which charity? What if Kaspersky benefited from a tax break as a result. Etc. etc. why take a chance?

So why are they even able to have the Massachusetts subsidiary? Is every vendor doing business with that corporation also violating sanctions?