A compliance team at a mid-size engineering company discovers that a shipment of precision components cleared customs six months ago without the required export licence. The buyer is in a jurisdiction subject to heightened scrutiny. The components have a dual-use classification. Now the question is not whether a violation occurred – it is whether the exposure is civil, criminal, or both, and under which regime the risk is sharpest.
Criminal exposure in export-control cases arises under both the US regime – administered by OFAC and BIS under IEEPA and the Export Control Reform Act – and the UK regime administered by OFSI and ECJU under the Sanctions and Anti-Money Laundering Act ("SAMLA") and the Export Control Order. The two regimes reach the same conduct from different angles, carry different intent thresholds, and impose different criminal penalties. Understanding where they diverge is essential before any compliance decision is taken.
This analysis compares the criminal exposure architecture under OFAC and OFSI, maps where the two regimes diverge on intent, penalty, and procedure, and sets out the practical steps a cross-border business should take when criminal risk is in play. As of March 2026, both regimes are in an active enforcement posture.
What governs criminal exposure in export-control cases: the legal architecture
Criminal liability in export-control matters under the US regime flows from two separate but overlapping authorities. OFAC operates under IEEPA, which carries its own criminal penalty provision for wilful violations. BIS, the Bureau of Industry and Security, enforces the Export Administration Regulations (the EAR) under the Export Control Reform Act, which also provides for criminal prosecution. A single shipment can attract enforcement attention from both agencies simultaneously, and DOJ may bring criminal charges that draw on evidence gathered by either.
Under the UK regime, OFSI administers financial sanctions under SAMLA and the relevant thematic financial-sanctions regulations. Export-licensing enforcement sits with ECJU under the Export Control Order. Criminal prosecutions are brought by HMRC or by the Crown Prosecution Service. The two UK authorities are operationally distinct in a way that is structurally different from the US, where OFAC and BIS share both the regulated community and frequent referral pathways.
The EU adds a further layer for businesses with European operations. The relevant Council regulations imposing sanctions carry criminal liability provisions that member states implement through national law. Divergence between member-state criminal codes is significant. We regularly advise businesses that a single cross-border shipment can engage the criminal law of three or more jurisdictions at once.
How does the intent threshold differ between OFAC and OFSI?
The most operationally significant divergence between OFAC and OFSI is the intent standard required for criminal liability. Under IEEPA, criminal sanctions require a "wilful" violation. That word carries a heavy burden: the prosecutor must show that the defendant knew the conduct was unlawful and chose to proceed. Under the EAR, a "knowing" standard applies to many offences, which is a lower bar – awareness that a licence was required or that the end-use was prohibited may suffice without proof of deliberate law-breaking.
Under SAMLA and OFSI's enforcement guidance, the criminal standard turns on whether the person knew or had reasonable cause to suspect that a dealing involved a designated person's funds or economic resources. That formulation – "reasonable cause to suspect" – is objective in character. It does not require proof of subjective awareness. A compliance officer who fails to run an adequate screen may be exposed even if they did not consciously suspect a violation.
That distinction is not academic. In our experience, the "reasonable cause to suspect" standard catches mid-level compliance staff in ways that a strictly subjective "wilful" standard would not. Businesses operating across both regimes often assume that if their people did not intend a violation, criminal exposure is remote. Under OFSI's test, that assumption is wrong.
ECJU applies its own intent thresholds for export-licensing offences. Strict-liability elements exist for some offences – where the act of exporting without a licence is itself the offence regardless of awareness. That places UK export-control criminal exposure on a markedly different footing from the US wilful standard, particularly for smaller exporters without dedicated compliance resource.
What are the criminal penalties and who brings the prosecution?
Under IEEPA, criminal penalties for wilful violations include significant fines per transaction and imprisonment for individuals. Under the EAR, the Export Control Reform Act provides for criminal fines per violation and custodial sentences. These are statutory maxima; actual sentencing turns on the facts. Critically, both OFAC and BIS can refer matters to DOJ, and DOJ may pursue charges independently of whether an agency civil enforcement action has concluded.
Under SAMLA, the maximum custodial sentence for financial-sanctions offences is seven years on indictment. Under the Export Control Order, imprisonment terms apply to the most serious export-licensing offences. HMRC is the primary enforcement body for customs and export offences; ECJU investigates export-control breaches and may refer to the Crown Prosecution Service. OFSI's enforcement powers are primarily civil at the administrative level, with criminal matters referred to the relevant prosecuting authority.
A key structural difference is the role of DOJ. In the United States, DOJ is an active participant in export-control enforcement and regularly prosecutes individuals – company officers, logistics staff, freight forwarders – alongside or instead of the corporate entity. In the United Kingdom, corporate criminal liability under the relevant law operates on different principles, and individual prosecution of junior employees is less common, though it is not absent from the enforcement record.
What does this mean for a cross-border business? The US criminal machinery has more moving parts and more actors with independent enforcement authority. That makes the overall criminal risk, in many cross-border fact patterns, more acute on the US side – even where the underlying conduct primarily involved UK or EU exporters.
Where do the regimes diverge on voluntary self-disclosure?
Voluntary self-disclosure (a proactive report by the regulated entity to the relevant authority, disclosing an apparent violation before enforcement action is taken) is the single most important procedural choice in an export-control criminal matter. The regimes treat it differently, and that difference determines the risk calculus for a cross-border business.
Under the OFAC regime, a voluntary self-disclosure (VSD) is a formal mitigation factor. OFAC's own guidance states that a VSD, where it meets the procedural requirements, can result in a significant reduction in the base penalty. Under the EAR, BIS has its own VSD process with its own mitigating effect. The two US processes are separate. A business that discloses to BIS does not thereby disclose to OFAC, and vice versa. In our experience, failing to recognise that both disclosures may be required is one of the most common and costly procedural errors in cross-border enforcement matters.
Under the OFSI regime, OFSI's enforcement guidance identifies self-disclosure as a mitigating factor in civil penalty determinations. There is no statutory VSD process equivalent to the OFAC scheme. ECJU has a separate reporting mechanism for export-control breaches. Again, the two UK bodies are distinct: a report to ECJU does not constitute a disclosure to OFSI.
The EU position adds further complexity. Some member states have formal leniency or self-reporting mechanisms; others do not. The absence of a pan-EU VSD scheme means that a business disclosing to OFAC and to ECJU may still have live criminal exposure in multiple EU member states without having made any disclosure there. This is an area where early cross-border counsel is essential, not optional.
The position above covers the standard case. Your facts – the counterparty, the goods, the route, the regimes in play – change the analysis materially. For a confidential assessment of your exposure, contact Calder & Vance at info@caldervance.com.
What risk flags signal elevated criminal exposure?
Not every export-control breach carries the same criminal risk profile. Certain factual patterns consistently signal that criminal exposure – rather than civil enforcement alone – is more likely. Understanding those flags before engaging the regulator is essential.
Under both the US and UK regimes, the following patterns raise the risk of criminal referral or investigation materially:
- Repeated similar violations – a pattern of conduct suggests systematic rather than isolated non-compliance, undermining a good-faith defence.
- Involvement of a dual-use item (goods or technology with both civil and military applications) destined for an end-user in a jurisdiction subject to heightened controls.
- Evidence of deliberate classification errors – for example, assigning an incorrect ECCN (Export Control Classification Number under the US Commerce Control List) to avoid a licence requirement.
- A nexus to a person on the SDN List (OFAC's list of Specially Designated Nationals and blocked persons) or on the BIS Entity List, even if the direct counterparty is not listed.
- Transactions structured to avoid screening – for example, splitting shipments, routing through intermediaries, or using nominee end-users – which regulators view as evidence of intent regardless of stated purpose.
- Failure to maintain records. Under the EAR, exporters are required to keep records for a defined period; under OFSI's guidance, five years is the relevant record-keeping period. A missing paper trail, whether by design or negligence, is treated as aggravating.
- Prior notices of concern, warning letters, or previous enforcement actions from either OFAC or BIS that were not followed by remedial action.
The cross-regime interaction matters here. A shipment that attracts BIS attention for an EAR licence violation may simultaneously reveal a nexus to an OFAC-designated party. That dual exposure means a civil BIS matter can escalate into an OFAC criminal referral. Have you mapped both exposure vectors before deciding how to engage?
The decision sequence: what a cross-border business must do when criminal risk is in play
The steps taken in the first days after an apparent violation is identified are often the ones that determine whether a matter stays civil or becomes criminal. The sequence below applies where both US and UK exposure is possible; adapt it where the EU or other regimes are also in scope.
- Preserve all relevant records immediately. Do not alter, delete, or export documents relating to the shipment, the counterparty, the classification, or the licensing decision. Instruct custodians in writing. This applies under both regimes and is a prerequisite to any subsequent engagement with regulators.
- Scope the apparent violation. Identify which goods, which transactions, which jurisdictions, and which legal instruments are in play. The answer determines which authorities need to be considered. A dual-use classification issue under the EAR is a different problem from an OFAC-nexus issue, even if both arise from the same shipment.
- Assess the intent evidence. What did the relevant personnel know, and when? What records exist of classification decisions, screening results, and licence assessments? The answer shapes both the criminal exposure and the mitigation strategy.
- Evaluate the VSD question under each regime separately. In the US, consider both OFAC and BIS. In the UK, consider both OFSI and ECJU. Each process has its own form, timing requirements, and procedural consequences. A disclosure that is too early may be incomplete; one that is too late loses its mitigating value.
- Consider the cross-border footprint. If the goods moved through or from EU territory, assess member-state criminal exposure. If any transaction involved a Swiss, Canadian, or Australian nexus, those regimes' obligations may also be triggered.
- Instruct counsel before any regulator contact. Communications with OFAC, BIS, OFSI, or ECJU before the legal position is fully scoped can inadvertently waive privilege, create admissions, or narrow mitigation options. This is not a step to take without specialist advice.
If a transaction has already been flagged, or a preliminary inquiry received, early legal review can preserve options that narrow rapidly with time. Contact Calder & Vance at info@caldervance.com for a confidential review.
A common myth: "our conduct was not intentional, so criminal exposure is low"
The most persistent misconception we encounter in cross-border enforcement matters is that criminal exposure requires proof of a deliberate plan to violate sanctions or export controls. Under the US EAR, the "knowing" standard means that awareness of a high probability of a violation may suffice; under OFSI, the "reasonable cause to suspect" test is objective. Neither regime requires proof of a calculated scheme. Negligent screening, inadequate classification procedures, and poor record-keeping have all featured in criminal and civil enforcement actions under both regimes. The absence of intent is relevant to sentencing; it is not a complete defence to the charge.
A related myth is that corporate liability shields individuals from criminal prosecution. Under both the US and UK regimes, individuals – including compliance officers, logistics managers, and company directors – can be prosecuted personally. The US enforcement record under IEEPA and the EAR includes prosecutions of individuals who were not the architects of a scheme but who failed to escalate concerns or falsified shipping documentation. Personal criminal liability is not a theoretical risk. It is a documented feature of export-control enforcement in both jurisdictions.
In our practice, we have acted for individuals facing personal criminal exposure in cross-border export-control matters. The experience of being personally named in an enforcement referral – even before formal charges are filed – is qualitatively different from corporate penalty proceedings. Early, confidential advice is essential.
Cross-regime interaction: where the EU and other regimes compound the exposure
For a business with operations or counterparties in the EU, Switzerland, Canada, or Australia, the criminal exposure from a single export-control violation can multiply across jurisdictions. This is the extraterritorial dimension that in our experience is most often underweighted at the time of the original compliance failure.
Under the EU's dual-use rules and the relevant Council regulations, member states are required to provide for criminal penalties. The level of those penalties and the intent thresholds differ materially between member states. A shipment that originates from an EU member state, transits through a second, and involves an end-user in a third may engage three separate national criminal codes. There is no single EU prosecutor for export-control offences. Each national authority acts independently.
Swiss SECO, Canada's Global Affairs Canada (GAC), and Australia's DFAT each administer autonomous sanctions and export-control regimes that carry their own criminal provisions. Singapore and Japan have export-control regimes with criminal penalties under their applicable national instruments. None of these regimes defers to OFAC or OFSI enforcement. A VSD to OFAC does not extinguish Swiss, Canadian, or Australian criminal exposure.
The practical implication is this: a business that manages its OFAC and OFSI exposure well but fails to address EU member-state or other jurisdiction exposure may still face criminal proceedings. A cross-border enforcement strategy must map every jurisdiction in which the conduct has a legal footprint. In our cross-border practice, we coordinate with local counsel in the relevant jurisdictions to ensure that the disclosure and remediation strategy is coherent across all applicable regimes simultaneously.
Related practices
- Apparent violation assessment (EU) – scoping EU-regime exposure and preparing the enforcement response
- Criminal exposure in export-control cases: OFSI vs EU compared – analysis of the UK and EU criminal enforcement architectures
- Enforcement mitigation factors: BIS/EAR vs EU analysis – how mitigation works across the US and EU export-control regimes