A Canadian subsidiary of a US parent closes a payment to a third-party intermediary. Three weeks later, the compliance team flags that the intermediary's ultimate beneficial owner appears on the SDN List (OFAC's list of Specially Designated Nationals and blocked persons). The payment processed through a US correspondent bank. Two regulators now potentially have a view: OFAC in Washington and Global Affairs Canada ("GAC") in Ottawa. Each will apply a different test, use different factors, and reach a different conclusion about how serious the apparent breach was. Which framework governs? What should the business do first?
An apparent-violation assessment (the structured internal review a business conducts once it suspects a sanctions breach may have occurred) follows materially different paths under OFAC and the Canadian autonomous sanctions regime administered by GAC. OFAC uses an eleven-factor framework to evaluate whether to issue a Finding of Violation or impose a civil monetary penalty; the Canadian regime operates through a distinct legal architecture with different disclosure expectations and a narrower set of published enforcement guidance. The gap between the two is not merely procedural – it changes the order in which evidence is gathered, the decision on whether to self-report, and the ultimate exposure.
This analysis works through the OFAC framework first, then maps the Canadian position against each structural element, surfaces the points of sharpest divergence, and identifies the risk flags that cross-border businesses most commonly overlook. The comparison draws on our practice advising businesses with simultaneous OFAC and GAC exposure.
What does an apparent-violation assessment actually require?
An apparent-violation assessment under OFAC is the structured internal inquiry a regulated party undertakes between first identifying a potential breach and deciding how to engage with the regulator. OFAC does not prescribe a single mandatory form for this inquiry, but its published enforcement guidelines establish the analytical categories that will govern any subsequent agency review – which means those categories must organise the internal assessment too. There is no safe shortcut: a business that presents a disorganised factual record to OFAC has already disadvantaged itself.
The assessment has three practical objectives. First, it must establish the facts: what happened, who was involved, what value moved, across which jurisdictions, and on which dates. Second, it must characterise the conduct against OFAC's statutory and regulatory criteria – was the violation wilful, reckless, or the result of non-egregious conduct? Third, it must produce a decision recommendation: self-disclose as a voluntary self-disclosure ("VSD," a formal submission to OFAC that can reduce a base penalty), disclose to other regulators where legally required, or manage the matter internally as a compliance finding without agency disclosure.
In our cross-border practice, businesses frequently underestimate the first phase. Fact reconstruction – recovering transaction records, correspondent-bank messaging, screening logs, and counterparty ownership documentation – takes longer and costs more than legal analysis of the exposure. Starting that process early preserves options. Delaying it narrows them.
Under the Canadian regime, the equivalent exercise begins with a similar factual gathering exercise but diverges quickly. GAC has published less granular enforcement guidance than OFAC. The Canadian legal architecture does not contain a direct analogue to OFAC's published eleven-factor penalty matrix. A business assessing a potential Canadian apparent violation therefore works with a thinner body of published authority and must rely more heavily on the statutory text of the applicable regime and on legal counsel's reading of the enforcement posture GAC has demonstrated in recent actions.
How does OFAC's eleven-factor framework structure the analysis?
OFAC's enforcement guidelines set out eleven factors that determine whether an apparent violation is treated as egregious and how a base civil penalty is adjusted. Understanding this matrix is the core technical skill in any OFAC apparent-violation assessment. The factors fall into two functional groups: culpability factors and mitigation factors.
The culpability side asks whether the subject had actual knowledge of the violation, whether it was reckless rather than merely negligent, whether management was aware, and whether the violation was part of a pattern rather than isolated. These factors can push the penalty toward the statutory maximum, which for most OFAC programmes is calculated per-transaction and can accumulate rapidly across a series of payments.
The mitigation side recognises: voluntary self-disclosure; a compliance programme that was in place and was not structurally deficient; prompt remediation; co-operation with the investigation; and whether the entity was a small business or had limited sanctions nexus. A VSD in a non-egregious case can reduce the base penalty significantly – a concrete reason why the self-disclosure decision is made early in the assessment rather than after the factual record is complete.
The practical implication of this framework is that an OFAC apparent-violation assessment must track all eleven factors simultaneously from the beginning. Evidence that is relevant to culpability is also relevant to the self-disclosure decision. A business that runs a purely factual inquiry and only later layers on the legal analysis will have to revisit its fact-gathering – wasting time and, if a deadline is approaching, potentially losing the benefit of prompt remediation as a mitigating factor.
Does the Canadian regime use a comparable matrix? Formally, no. GAC's published enforcement approach does not reproduce the granular factor-by-factor structure that OFAC has articulated. However, in practice, any competent apparent-violation assessment under the Canadian regime will address similar substantive questions – knowledge, recklessness, compliance programme quality, remediation, co-operation – because these are the universal markers of a credible response to a regulator. The absence of a published matrix is not a simplification; it is an ambiguity that increases the demand on legal judgment.
Where do OFAC and Canada diverge most sharply?
The sharpest divergence between OFAC and the Canadian regime lies in three areas: the self-disclosure mechanism, the penalty base, and the extraterritorial reach of the US rules.
Self-disclosure. OFAC has a well-established and granular VSD procedure. A timely, accurate, and complete VSD to OFAC in a non-egregious matter is a significant mitigating factor that can reduce the base penalty, and in some cases leads to a Finding of Violation rather than a penalty. The Canadian regime does not have an identically structured VSD mechanism with equivalent published guidance. Businesses with simultaneous exposure in both jurisdictions must therefore calibrate a disclosure strategy across two regulators with different procedural expectations – and the timing of a VSD to one regulator can affect the posture before the other. This is one of the most common areas where we see cross-border businesses make the wrong sequencing decision.
Penalty base. OFAC's civil penalty base is transaction-specific and can be calculated at the greater of the transaction value or a statutory maximum per violation. For major OFAC programmes, the published penalty maximums are substantial on a per-transaction basis. The Canadian penalty regime has its own statutory maximum structure, which differs from OFAC's in its calibration and which applies to conduct that violates the applicable Canadian sanctions regulations rather than OFAC's rules. A business exposed in both jurisdictions faces two separate and non-offsetting penalty calculations.
Extraterritorial reach. This is the element businesses most consistently miss. OFAC's rules apply to US persons (broadly, any US citizen, permanent resident, US-incorporated entity, and any person while in the United States) and, under a number of OFAC programmes, to transactions that touch the US financial system – including US-dollar correspondent clearing. A Canadian entity that routes a payment through a US correspondent bank or that transacts in US dollars has a potential OFAC nexus even if no OFAC primary-sanctions programme names that entity as a subject. The Canadian entity's exposure to GAC arises from different triggers: it is a Canadian person, or the transaction involves a person or activity caught by the Canadian regime. Both exposures can exist simultaneously, and neither displaces the other. In our experience, this stacking of jurisdictions is the single most underappreciated aspect of cross-border apparent-violation assessment.
A further divergence: the concept of secondary sanctions risk (the exposure of non-US persons to OFAC action for conduct outside the United States that involves a designated person or a sanctioned jurisdiction) is principally an OFAC construct. The Canadian regime does not operate an equivalent secondary-sanctions architecture. This means the OFAC exposure for a Canadian business can extend well beyond the scope of the directly applicable Canadian rules – and the OFAC assessment must address that secondary-sanctions dimension even when it does not produce a primary violation.
What does the cross-border escalation path look like?
When a business identifies a potential apparent violation involving both OFAC and GAC nexus, the escalation path needs to be structured immediately. Allowing the two inquiries to proceed informally and in parallel – without a unified privilege and disclosure strategy – creates serious risk. Statements made to one regulator can be inconsistent with positions taken before the other. Documentary production in one jurisdiction can waive privilege that was intended to be preserved in the other.
The recommended structure is a single lead counsel co-ordinating both regulatory responses, supported by local counsel in the relevant jurisdiction where GAC advice requires qualified Canadian legal input. The lead engagement letter should cover the full multi-jurisdictional scope from day one. This is not administrative tidiness – it directly affects what documents are created, who they are addressed to, and what they say about the underlying facts.
The position above covers the standard case. Your facts – the counterparty, the goods, the financial channels used, the US nexus, the Canadian persons involved, and the timing of discovery – change the analysis materially. For a confidential assessment of your cross-border exposure, contact Calder & Vance at info@caldervance.com.
The escalation path for a purely OFAC-facing matter is more prescribed. OFAC's published guidance sets out how an entity should characterise and present an apparent violation. A VSD must be submitted within a defined period from the date the business has sufficient information to make the disclosure. The submission must be complete and accurate; partial disclosures that are later corrected can damage credibility and reduce the weight OFAC gives to the VSD as a mitigating factor. In our cross-border practice, we regularly advise businesses on the timing and content of VSD submissions – the decision to self-disclose and the quality of the submission itself are equally important.
On the Canadian side, the escalation path requires early engagement with qualified Canadian sanctions counsel to assess whether any reporting obligation is triggered under the applicable regime and whether proactive engagement with GAC is warranted or strategically preferable. Canada's enforcement history is less extensively published than OFAC's, but GAC has demonstrated willingness to act, and the reputational and commercial consequences of a GAC enforcement action can be severe for businesses operating in Canadian markets.
What risk flags do cross-border businesses most commonly miss?
The most consequential risk flags in a cross-border OFAC and GAC apparent-violation assessment cluster around six recurring patterns. Each is capable of converting a manageable compliance finding into a significant enforcement matter.
The US-dollar clearing point. Businesses assume that because they are not US persons and the counterparty is not US, OFAC is irrelevant. US-dollar transactions routed through US correspondent banks create an OFAC nexus that can expose a non-US entity to a licence requirement, a blocking obligation, or an apparent violation. This nexus is independent of corporate nationality.
The 50 percent rule (OFAC's rule treating entities owned 50 percent or more in the aggregate by blocked persons as themselves blocked, even if not separately listed) is the second recurring gap. A counterparty's direct name-screen comes back clean. The compliance team approves the transaction. Three layers up the ownership chain, a blocked person holds a controlling stake. The aggregate threshold is met, and the entity was blocked throughout. Screening tools that check only the counterparty's direct name entry – and do not map the full beneficial ownership chain – will miss this.
Third: beneficial ownership documentation that is out of date. Ownership structures change. A counterparty that was clean at onboarding may have had a new investor enter above the threshold since the last review. Periodic re-screening of the ownership chain, not just the counterparty entity, is the control that catches this.
Fourth: the record-keeping gap. OFAC requires businesses to maintain records of transactions and blocked property. When an apparent violation surfaces, the ability to reconstruct a complete transaction record quickly – screening logs, blocking decisions, communications with counterparties about the basis for a refusal or a delay – is critical to the assessment. Businesses that cannot produce this documentation are handicapped in every subsequent step of the enforcement response.
Fifth: treating the compliance programme as a static artefact. OFAC's published guidance weights the quality and adequacy of a compliance programme heavily in the egregious/non-egregious determination. A programme that was designed for a lower-risk business profile, or that has not been updated to reflect changes in the firm's operations or in the applicable sanctions programmes, will not attract the mitigation credit it would otherwise earn.
Sixth, and specific to the Canada comparison: assuming that because the Canadian regime is less extensively litigated it is less serious. GAC has statutory authority and has used it. A business that responds rigorously to its OFAC exposure but treats the Canadian dimension as secondary may find that its co-ordination failure – inconsistent positions, unco-ordinated document production – is the fact that draws GAC's sharpest scrutiny.
If a transaction has already been flagged, or a voluntary self-disclosure is under consideration, an early structured review preserves options that narrow with time. Contact Calder & Vance at info@caldervance.com for a confidential assessment.
A common myth: a VSD automatically resolves the matter
A recurring misconception in this area is that submitting a voluntary self-disclosure to OFAC closes the matter, or at least guarantees a specific outcome. It does neither. A VSD is a significant mitigating factor in a non-egregious case, but OFAC retains full discretion to determine the penalty, issue a Finding of Violation without a monetary penalty, or – in egregious cases where the VSD does not change the culpability analysis – pursue the full statutory maximum.
The VSD's practical value depends entirely on its quality. A VSD that is incomplete, that omits material transactions, or that characterises the facts inaccurately can be worse than no VSD at all – because it creates an additional record of a non-co-operative posture. OFAC's published guidance is clear that a VSD must be accurate and must include all apparent violations, not only the ones the business has already reconstructed at the time of filing. The submission is, in practice, an ongoing obligation: supplemental disclosures are expected if further violations surface during the internal investigation.
In our practice, we have acted for businesses in apparent-violation matters where the initial instinct was to file quickly and deal with the details later. We consistently advise against that approach. The factual record should be sufficiently complete to make the initial VSD accurate before it is filed. A phased investigation can be run, with a preliminary notification to OFAC if the statutory window requires it, followed by a comprehensive submission once the record is assembled. This is the approach that protects both the mitigation credit and the firm's credibility with the regulator.
The Canadian regime does not have the same VSD architecture, so this myth is less prevalent in the GAC context – but the underlying principle applies: a proactive engagement that is incomplete or inaccurate is worse than a carefully prepared one that comes slightly later. Regulators on both sides of the border value accuracy over speed.
How does the analysis interact with adjacent enforcement risks?
An OFAC apparent-violation rarely exists in isolation. The same conduct that generates an OFAC exposure frequently creates parallel risk under the Bank Secrecy Act (for US financial institutions), anti-money-laundering rules (in the US and Canada), and, in some cases, criminal exposure under US law where wilful conduct is involved. The criminal dimension is outside OFAC's civil enforcement domain – it sits with the US Department of Justice – but the factual record assembled in a civil apparent-violation assessment is the same record that would be reviewed in any criminal inquiry. Document creation, privilege decisions, and co-operation posture must be calibrated with that possibility in mind, even in cases where criminal liability is not the primary concern.
The EU dimension is also relevant for businesses with European operations. The EU autonomous sanctions regime does not map directly onto OFAC's rules, and EU-nexus conduct that is not an OFAC violation can still be an EU violation – and vice versa. A business managing a cross-border apparent-violation assessment that involves EU persons or EU-routed transactions needs to run a parallel EU analysis. Our analysis of the OFAC and EU apparent-violation frameworks is available at apparent-violation assessment: OFAC compared further. For a broader comparison that includes the UK position under OFSI, see our analysis at OFAC vs OFSI: apparent-violation assessment compared.
The interaction with export-control compliance is a second adjacency that practitioners must consider. If the transaction that generated the apparent sanctions violation also involved a controlled item under the Export Administration Regulations ("EAR"), a separate apparent violation may exist before BIS. The factual record, the disclosure decision, and the privilege architecture must address both regulators from the outset. For businesses with dual-use items in their supply chain, the apparent-violation assessment is therefore never purely a sanctions exercise.
For guidance on how Calder & Vance manages apparent-violation assessments that engage the EU enforcement dimension, see our service page at apparent-violation assessment – EU enforcement service.