A payment firm processes a wire transfer on behalf of a client. Three days later, a routine screening review flags that the beneficiary may have been on the SDN List (OFAC's list of Specially Designated Nationals and blocked persons) at the time of processing. The compliance team faces an immediate question: is this an apparent violation, and what must it do next? The answer differs markedly depending on whether OFAC or OFSI (the UK's Office of Financial Sanctions Implementation) governs – and for a business with operations in both jurisdictions, the divergence is not academic. It is a matter of deadlines, disclosure obligations, and the size of the exposure.
An apparent-violation assessment is the structured process by which a firm identifies whether a potential sanctions breach has occurred, evaluates its severity under the governing regime's published criteria, and determines the appropriate response – including whether to make a voluntary self-disclosure (VSD, a proactive disclosure to the regulator before it initiates contact). Under OFAC, the assessment feeds directly into the agency's penalty-calculation methodology. Under OFSI, it triggers separate reporting obligations and a distinct enforcement track. The two regimes use overlapping concepts but apply them through different mechanisms, timelines, and evidentiary standards.
This analysis sets out how each regime structures the apparent-violation assessment, where the key divergences lie, and what a cross-border business should do when a potential breach touches both jurisdictions simultaneously.
What is the legal basis for apparent-violation assessment under each regime?
OFAC derives its enforcement authority from the International Emergency Economic Powers Act (IEEPA) and, for older programmes, the Trading with the Enemy Act. Apparent violations are assessed against OFAC's published enforcement guidelines, which set out the factors the agency weighs in deciding whether to issue a finding of violation, a cautionary letter, or no-action, and how it calculates a civil monetary penalty. The guidelines are not statute, but they function as the operative standard in practice. Every compliance team working through an OFAC assessment should treat those guidelines as the primary reference.
OFSI draws its authority from the Sanctions and Anti-Money Laundering Act (SAMLA) and the relevant thematic regulations made under it. Its enforcement framework is set out in published enforcement guidance that distinguishes between reporting obligations (which arise on knowledge or reasonable cause to suspect) and enforcement action (which follows investigation). Unlike OFAC, OFSI also operates within the broader UK financial-crime architecture, and a potential financial-sanctions breach may engage concurrent obligations under anti-money laundering and proceeds-of-crime rules. That interaction is a complication that does not have a direct US parallel.
As of March 2026, both agencies continue to publish updated guidance and enforcement decisions. The pace of change in both regimes makes it essential to verify the current position of any specific factor before relying on it. In our cross-border practice, we have seen firms apply an outdated OFAC framework to a matter that had already been updated – a costly error when penalty factors shift.
How does OFAC structure the apparent-violation assessment?
OFAC's assessment proceeds in two stages: first, whether the conduct constitutes an apparent violation at all; second, if so, how severe it is. The second stage drives the penalty recommendation.
On the first stage, OFAC asks whether the conduct falls within a prohibition. That question turns on the scope of the programme, the identity of the counterparty (including through the 50 percent rule – OFAC's rule treating entities owned 50 percent or more by blocked persons as themselves blocked), and the nature of the transaction. A firm that screened correctly but missed an indirect ownership chain may still have committed an apparent violation; the screen's quality is a mitigating factor, not a defence.
On severity, OFAC weighs a structured set of aggravating and mitigating factors. Aggravating factors include whether the conduct was wilful or reckless, whether management was aware, whether it produced a significant harm to the sanctions programme's objectives, and whether the firm has a prior enforcement history. Mitigating factors include the existence of a compliance programme that meets the five components OFAC describes in its framework guidance, whether the firm self-disclosed before OFAC initiated contact, and whether the violation was isolated.
The VSD point is material. A timely, accurate voluntary self-disclosure can reduce the base penalty significantly – OFAC's guidance identifies it as a factor that can result in a substantially lower penalty. Timing matters: disclosure before OFAC contact is categorically different from disclosure after the agency has already begun an inquiry. Have you identified the exact moment that "OFAC contact" begins for the purpose of that calculation? The answer is less obvious than it appears.
How does OFSI's apparent-violation process differ?
OFSI's enforcement process diverges from OFAC's at the reporting stage. Under the relevant thematic regulations, a person who knows or has reasonable cause to suspect that they hold frozen funds, or that they have committed a financial-sanctions breach, is subject to a statutory obligation to report to OFSI. This is a hard legal duty, not a discretionary disclosure in the way that a VSD to OFAC is framed. The distinction is fundamental: under OFSI, failure to report can itself constitute a separate offence.
OFSI applies a monetary-penalty regime that was significantly strengthened under amendments to SAMLA. Penalties can be calculated as a percentage of the transaction value or as a fixed amount, whichever is higher – and the thresholds are not modest. Equally important, OFSI can publish details of a breach even where it does not impose a penalty, a power it has used to create reputational consequences that fall outside the purely financial calculation. That combination – publication without penalty – has no precise equivalent in the OFAC enforcement scheme.
OFSI's assessment of seriousness mirrors some OFAC factors – knowledge, scale, duration, mitigating steps taken – but the weighting is different. OFSI places particular emphasis on whether the firm co-operated fully and promptly. In our experience, the pace and quality of a firm's initial response to OFSI is itself treated as evidence of its compliance culture, well before any formal penalty analysis begins.
A cross-border business facing both an OFAC and an OFSI exposure on the same transaction must assess both regimes concurrently. The timelines and the disclosure standards are different. Acting to satisfy one without considering the other can inadvertently prejudice the position under the second. That is the trap we most frequently see in dual-regime matters.
Where do the regimes diverge most sharply?
The sharpest divergence is on disclosure. OFAC's VSD is voluntary – the firm has a choice, and the benefit is a penalty reduction. OFSI's reporting obligation is, in relevant circumstances, compulsory. A firm that applies OFAC logic to an OFSI matter and treats disclosure as optional may commit a second, independent breach in the process of managing the first.
The second divergence is on the ownership and control test. OFAC's 50 percent rule is mechanical: add up the percentages, and if they reach fifty, the entity is blocked. OFSI (and the EU) apply an additional control test: a listed person who does not own fifty percent but who controls an entity can still cause it to be treated as a designated person. That divergence matters at the assessment stage, because the underlying question – "was the counterparty subject to the prohibition?" – may have a different answer under OFAC and under OFSI for the same counterparty. We have acted on matters where OFAC's threshold analysis produced a clean result but the OFSI control test produced a breach.
Third, the penalty structures differ. OFAC's guidance describes a range of potential outcomes from cautionary letter to significant civil penalty, calibrated by the aggravating and mitigating framework. OFSI's regime allows a percentage-of-value calculation that can, in large transactions, produce very large absolute figures. For a trade-finance transaction of significant size, the OFSI exposure may dwarf the OFAC exposure even on materially similar facts.
Fourth, publication. OFAC publishes enforcement actions and settlements, which are searchable by the public and by counterparties. OFSI can publish breach details independently of whether it imposes a penalty. Both mechanisms carry reputational risk, but the OFSI publication power – exercisable without a penalty – operates in a category of its own.
What are the critical risk flags in a cross-border apparent-violation matter?
The first risk flag is conflating the two regimes. A firm that runs its OFSI exposure through an OFAC checklist will miss the mandatory reporting obligation and may under-assess the publication risk. The frameworks share vocabulary – "compliance programme", "self-disclosure", "mitigating factors" – but the legal effects behind those terms differ.
The second risk flag is the "knowledge" threshold. Under OFSI's reporting trigger, "reasonable cause to suspect" is a lower bar than OFAC's emphasis on wilfulness and recklessness in the penalty analysis. A firm may conclude that it has no duty to act under an OFAC-led assessment and still be in breach of its OFSI reporting obligation on the same facts.
The third risk flag is the compliance programme. Both OFAC and OFSI treat the existence of a genuine, tested compliance programme as a mitigating factor. "Genuine and tested" is doing heavy lifting in that phrase. A programme that exists on paper but has not been reviewed against current screening standards, or whose ownership-chain analysis is limited to direct holdings, will not carry the weight that firms expect. In our experience, regulators on both sides of the Atlantic have declined to give full mitigation credit to programmes that were structurally sound but operationally deficient at the time of the violation.
The fourth risk flag is the concurrent EU position. If the business has EU nexus – EU-incorporated entities, EU-person directors, Euro-denominated clearing – the EU sanctions regulations may engage on the same facts. The EU ownership-and-control test is similar to OFSI's but applied by member-state authorities, not a single central body. A matter that starts as an OFAC/OFSI dual-regime problem can rapidly become a three-regime problem. Have you mapped all the jurisdictions in which your group has legal presence that might be engaged by the underlying transaction?
A mid-size logistics firm recently came to us after a transaction was flagged by its bank as a potential sanctions issue. The firm had self-assessed under OFAC criteria and concluded the matter was low-severity. It had not separately assessed its OFSI obligations, and the transaction had routed through a UK branch. Our review identified a distinct OFSI reporting obligation that had not yet been satisfied. We assisted the firm in making a timely report, preparing a compliance review, and structuring its response. Early engagement meant the matter was managed before it escalated.
The EU dimension: a third assessment layer
For businesses with EU operations, the apparent-violation assessment does not stop at OFAC and OFSI. The EU's sanctions regulations, adopted by Council decision and implemented in member-state law, impose their own prohibitions and their own enforcement obligations. The EU ownership-and-control test asks both whether a designated person owns the entity (applying an aggregate ownership threshold similar in concept to OFAC's) and whether a designated person exercises control, with control defined broadly to capture indirect influence over decisions.
EU enforcement is conducted by member-state competent authorities, not a single central body. This creates variance: enforcement intensity and enforcement timelines differ by member state. A firm whose transaction touches Germany, the Netherlands, and France simultaneously may face three national enforcement processes proceeding in parallel, each applying the same underlying EU regulation but with different procedural rules.
The EU Blocking Regulation adds a further layer for businesses also exposed to US secondary sanctions. The Regulation restricts compliance with certain extraterritorial US measures by EU operators, creating a direct tension between OFAC compliance and EU legal obligations for some transactions. Managing that tension requires a sequenced analysis: establish the factual basis of the apparent violation, map the jurisdictions in play, and then assess whether any compliance step in one regime creates a legal problem in another.
For a deeper treatment of the EU side of the same comparison, see our analysis at OFSI vs EU: apparent-violation assessment compared, which sets out the divergences between the OFSI and EU positions in detail.
How should a cross-border business structure its response when a potential violation is identified?
The first step is containment: identify the facts as quickly as possible, and do not take further steps under the flagged transaction until the legal position is clear. Continuing a transaction that may be prohibited is itself an additional apparent violation. Speed matters here, and it matters most in the OFSI context where a reporting obligation may be running from the moment of knowledge or suspicion.
The second step is jurisdiction mapping. For each entity, person, and leg of the transaction, identify which regimes are engaged. A transaction between two non-US parties that is denominated in US dollars and clears through a US correspondent bank will engage OFAC jurisdiction even in the absence of a US counterparty. That is one of the most frequently misunderstood aspects of OFAC's extraterritorial reach.
The third step is legal assessment under each applicable regime. The factual record – the counterparty, the goods or services, the payment route, the date of each transaction leg – is the foundation. The legal assessment maps those facts onto the prohibition, the ownership and control tests, and the applicable defences or exceptions.
The fourth step is disclosure assessment. Under OFAC: is the VSD appropriate, given the severity assessment and the timing? Under OFSI: is there a mandatory reporting obligation, and has the reporting window been engaged? Under the EU: what do the relevant member-state rules require?
The fifth step is remediation. A compliance programme reviewed and updated following an apparent violation, and before the regulator has reached a penalty decision, carries substantially more mitigating weight than one updated after the fact.
Situation A – a single-regime OFAC matter, isolated transaction, genuine compliance programme: the appropriate route is likely VSD, supported by a compliance remediation report. The timeline from identification to submission can be managed, but speed remains important.
Situation B – a dual-regime OFAC/OFSI matter, routed through a UK entity, transaction value material: the OFSI reporting obligation must be assessed against its own timeline, independently of the OFAC VSD decision. These are not the same disclosure, and the two processes should be managed concurrently.
Situation C – a triple-regime matter, EU nexus, large transaction value: the sequencing of disclosure across three authorities requires close coordination. Disclosure to one authority before another may affect the legal position under the second. This is the scenario where in-house teams most frequently need external coordination, and where early engagement with counsel preserves options that compress with time.
If a transaction has already been flagged, or a filing has been refused, an early review can preserve options that narrow with time. Contact Calder & Vance at info@caldervance.com for a confidential initial review.
A common misconception: "our compliance programme is a complete defence"
The most persistent misconception we encounter is the belief that a documented compliance programme, by itself, prevents or eliminates liability for an apparent violation. It does not. Under both OFAC and OFSI, a compliance programme is a mitigating factor – and in OFAC's framework, a "minimum contacts" finding can result in no action where the violation was genuinely inadvertent and the programme was well-tested. But "mitigation" is not "immunity."
OFAC's guidance is explicit that a compliance programme reduces exposure; it does not extinguish it. OFSI similarly treats a strong compliance programme as evidence of good faith and a factor in its seriousness assessment, but will still impose penalties for significant breaches by firms with compliance functions. The question is not whether you have a programme. The question is whether it was tested, current, and operationally effective at the time of the apparent violation.
Firms that have experienced a breach and then immediately updated their programmes often discover, when the regulator reviews the matter, that the update itself is treated as an implicit acknowledgment that the programme was deficient before. That is not a reason to delay remediation – far from it. It is a reason to document clearly the good-faith steps taken at every stage, so that the remediation narrative is coherent and supported by the record.
Our practice regularly assists firms in constructing that documentation, reviewing compliance programme gaps against the standards applied by both OFAC and OFSI, and presenting the remediation case in the most credible form available. See also our service page on apparent-violation assessment for EU matters, which covers the equivalent process under the EU regime.
Related practices
- Apparent-Violation Assessment – EU – the EU counterpart process: competent authorities, ownership-and-control test, member-state variance
- OFSI vs EU: Apparent-Violation Assessment Compared – a detailed cross-regime comparison of OFSI and EU enforcement frameworks
- Compliance Monitorship: BIS/EAR vs EU Analysis – how export-control compliance monitorships operate across US and EU regimes