OFAC vs Canada: Early account and settlement schemes compared

A multinational with subsidiaries in both the United States and Canada receives a regulator inquiry. The compliance team suspects that transactions over an 18-month period touched a designated counterparty. Criminal exposure sits in the background. The General Counsel's question is immediate: is it better to come forward, and if so, under which regime's scheme – and does the answer differ depending on where the conduct occurred?

Early account and settlement schemes are the principal mechanisms by which both OFAC and the Canadian sanctions enforcement authorities allow a business to achieve a reduced penalty outcome in exchange for cooperation, transparency, and remediation. The regimes share a common logic – voluntary disclosure and early engagement reduce the enforcement burden – but they differ materially in structure, procedural sequencing, and the quantum of discount available. As of January 2026, understanding those divergences is essential for any cross-border business that operates under both sets of rules.

This analysis maps the principal divergences between the two regimes across seven dimensions: legal authority, the disclosure mechanism, cooperation credit, penalty arithmetic, procedural timelines, the interaction with criminal exposure, and the practical decisions a business must make before it commits to a route.

What legal authority underpins each scheme?

OFAC's early-account and settlement scheme is not a creature of statute in the conventional sense; it is grounded in OFAC's published Enforcement Guidelines under IEEPA (the International Emergency Economic Powers Act), which set out the framework for assessing civil penalties and for treating voluntary self-disclosure and cooperation as mitigating factors. The scheme is administrative in character. OFAC is a bureau of the US Treasury, and its civil-penalty jurisdiction is strict-liability: a violation exists whether or not the subject knew of the sanctions prohibition at the time. That strict-liability foundation matters for the settlement calculus because a business cannot use ignorance as a shield; it can only use cooperation as a discount.

Canada's enforcement regime operates through a different statutory architecture. Sanctions are principally administered under the Special Economic Measures Act (SEMA) and the Justice for Victims of Corrupt Foreign Officials Act (JVCFOA), with Global Affairs Canada (GAC) carrying administrative and policy responsibility. Criminal enforcement is handled through the Royal Canadian Mounted Police and the Public Prosecution Service of Canada. Unlike OFAC, Canada does not publish a single codified enforcement-guidelines document that sets out a penalty matrix with defined mitigating factors in the way that OFAC's Enforcement Guidelines do. Cooperation and early engagement are treated as relevant to outcome, but the mechanism is less formalised.

The structural divergence is immediate. A business in OFAC's jurisdiction can read a published framework and calculate – at least in rough terms – what cooperation credit it expects to receive. A business in Canada must engage with the relevant authorities in a less rule-bound environment. In our cross-border practice, that difference in transparency shapes the advice at the outset: an OFAC matter has a visible map; a Canadian matter requires earlier and more direct engagement with the regulator to understand the live position.

How does voluntary self-disclosure function under each regime?

Under OFAC's Enforcement Guidelines, voluntary self-disclosure (a proactive, timely report to OFAC of an apparent violation before the agency learns of it independently) is one of the most powerful mitigating factors available. It is formally listed in the guidelines as a factor that can reduce the base-level civil-monetary penalty substantially. Critically, the disclosure must be genuinely voluntary – OFAC will not treat a disclosure as voluntary if the agency has already begun an investigation or received information from a third party that would lead it to the same conduct. The timing rule is strict, and acting quickly once an apparent violation is identified is essential.

Where a disclosure qualifies as voluntary, OFAC's guidelines indicate that the transaction value used for penalty calculation is reduced. Combined with other mitigating factors – a strong compliance programme, a lack of prior violations, and full cooperation with the investigation – a voluntary self-disclosure can move a matter from the high end of the civil-penalty range to an outcome materially below the statutory maximum. The reduction is not a fixed percentage; it operates within the "non-egregious / voluntary" categorisation of the Enforcement Guidelines framework.

Canada's equivalent mechanism is less formally defined. GAC and the prosecution authorities recognise cooperation and early engagement as relevant to the exercise of enforcement discretion and to any eventual penalty or prosecutorial decision. However, there is no published document equivalent to OFAC's Enforcement Guidelines that maps the cooperation credit to a specific penalty-reduction formula. A business that self-discloses in Canada does so in the expectation of a more favourable outcome, without the ability to point to a published schedule to substantiate that expectation. That asymmetry of information places a premium on direct dialogue with the authority before the disclosure is made.

What does that mean for a cross-border business? If the conduct occurred in both jurisdictions, the disclosure decisions are not necessarily simultaneous. A voluntary self-disclosure to OFAC runs on OFAC's clock and under OFAC's rules. A parallel engagement with Canadian authorities runs separately. The two processes do not wait for each other, and material provided in one disclosure can, in principle, inform the other authority. Coordinating the two requires careful sequencing – a point we return to when addressing criminal exposure below.

Where do cooperation-credit frameworks diverge most sharply?

OFAC's Enforcement Guidelines establish a structured dichotomy between "egregious" and "non-egregious" cases, and between those with voluntary self-disclosure and those without. The penalty base and the range of outcome shift materially depending on which quadrant a matter falls into. A non-egregious case with voluntary self-disclosure is treated most favourably; an egregious case without disclosure is treated most harshly. OFAC publishes the penalty framework, and enforcement case studies – made public by OFAC in its settlement announcements – illustrate how the framework operates in practice. Those announcements do not carry case numbers that can be cited here, but the pattern is visible: cooperation reduces the outcome, and the reduction is substantial.

OFAC liability is strict in the civil context: knowledge or intent is not required for the violation itself. It is relevant, however, to the egregiousness assessment. A violation committed with knowledge of the sanctions prohibition is treated as more egregious than one that arose from a systemic screening failure. That distinction affects the penalty quadrant into which the matter falls, and therefore the available range. Canada draws a different line: its criminal enforcement framework requires proof of mental state, which changes the decision tree for a business considering whether to cooperate.

The EU settlement regime – relevant where a group entity is also subject to EU sanctions – introduces a further data point for comparison. The EU directive on the criminalisation of sanctions violations sets minimum penalties for serious offences, including maximum terms of imprisonment and corporate fines expressed as a percentage of worldwide turnover, as currently in force. Canada's criminal penalties are statutory and similarly structured around maximum terms, rather than around an administrative penalty-reduction matrix. OFAC, operating in the civil space, uses a penalty-value framework. A business straddling all three regimes must manage three different definitions of what "cooperation" means and what it yields.

What are the procedural timelines and sequencing requirements?

Under OFAC's regime, the clock starts with the date of the apparent violation or the date the business becomes aware of it. Blocked-property reports and rejected-transaction reports are due to OFAC within 10 business days of the blocking or rejection, as currently in force. Those immediate reporting obligations run independently of any voluntary self-disclosure and are not a substitute for it. A business that fails to file a timely blocked-property report while simultaneously preparing a voluntary self-disclosure has compounded its exposure rather than reduced it. In our experience, compliance teams sometimes conflate the two obligations; they are separate, and the 10-business-day window moves regardless of the state of any internal investigation.

Beyond the immediate reporting window, OFAC does not publish a fixed deadline for voluntary self-disclosures. The requirement is that the disclosure is timely in the sense of being made before OFAC has independent knowledge of the matter. The practical window is therefore determined by when OFAC might learn of the conduct – from a bank's own regulatory filing, from a counterparty disclosure, from a customs record, or from a tip. A business that delays while conducting an internal investigation is taking the risk that OFAC's independent knowledge clock runs out before the self-disclosure is filed.

Canada's procedural framework does not carry a published 10-business-day equivalent for all reporting scenarios. Certain sectors – particularly financial institutions with AML obligations – have their own suspicious-transaction and dealing-in-property reporting windows, which interact with the sanctions framework. For a general corporate operator, the Canadian position on timing is that earlier is better, but the penalty for delay is expressed through the exercise of prosecutorial and regulatory discretion rather than through a published schedule. That qualitative character of the Canadian framework makes sequencing decisions harder to calibrate precisely.

Sanctions records must be kept for five years in the OFAC context, as currently in force. Canada's record-keeping obligations under its sanctions and AML framework operate on their own timeline, and a business should verify the current retention requirements for its specific sector and the applicable regime before finalising its documentation approach.

How does criminal exposure interact with the civil settlement route?

For OFAC, the civil and criminal tracks are formally separate. OFAC administers civil penalties; the US Department of Justice handles criminal prosecution for sanctions violations. A voluntary self-disclosure to OFAC does not automatically extend to DOJ and does not constitute a pre-emptive admission in a criminal proceeding. However, the material disclosed to OFAC – documents, transaction data, internal communications – can be accessed by other US government agencies. A business that self-discloses to OFAC without considering the criminal-law implications of the disclosed material is making a significant and irreversible decision.

In our practice, the first question in any matter with potential criminal dimensions is whether legal professional privilege attaches to the investigation and the disclosure. A well-structured internal investigation, conducted under proper instructions, preserves privilege over the legal advice. The underlying documents and data are a separate question. A business should make the privilege position explicit before it begins compiling any disclosure package.

Canada presents a structurally different challenge. Because the primary enforcement route for serious sanctions violations in Canada is criminal – through RCMP investigation and PPSC prosecution – cooperation in that process engages the criminal-law privilege framework directly. A business in Canada does not have a civil-settlement track of the OFAC variety available to it as a first port of call. It is engaging, from the outset, with a system in which the consequences of cooperation and non-cooperation are framed in criminal rather than administrative terms. That changes the risk calculus fundamentally: the potential outcome of a Canadian criminal proceeding is not a civil penalty but a criminal conviction.

For a cross-border business, the interaction between the two frameworks creates a genuine dilemma. A decision to cooperate with OFAC and to provide a full account of the conduct may accelerate a Canadian criminal investigation if the material is shared. Conversely, a decision to manage the Canadian criminal exposure first may delay a voluntary self-disclosure to OFAC past the point at which it qualifies as voluntary. There is no single answer to that dilemma; the sequence must be determined by a careful assessment of where the principal exposure lies, which regime has the broadest jurisdictional reach, and what the realistic enforcement appetite is on each side of the border. Is the conduct primarily US-nexus or primarily Canadian? That question drives the sequencing decision.

What is the penalty arithmetic in each regime?

OFAC's civil-penalty arithmetic under IEEPA is organised around the transaction value at the time of the violation and the applicable statutory maximum. OFAC's Enforcement Guidelines define a base penalty amount, which is then adjusted by the mitigating and aggravating factors – including voluntary self-disclosure, cooperation, compliance-programme quality, and prior history. The result is a penalty that is expressed as a specific figure in a settlement agreement, not as a percentage of turnover or a formula applied universally. A non-egregious matter with voluntary self-disclosure and strong cooperation can settle significantly below the statutory maximum; an egregious matter without disclosure can reach it. OFAC's civil-penalty authority is substantial, and individual settlements have in practice reached significant amounts, though no specific figures appear here that are not in our verified facts registry.

Canada's criminal-penalty structure is defined by the statutory maximum terms available under SEMA and JVCFOA. Fines are available alongside imprisonment, but the penalty arithmetic is not published in a transparent matrix equivalent to OFAC's. The court – in a criminal proceeding – considers the nature of the offence, the degree of cooperation, and the harm caused. A corporate entity cannot be imprisoned; fines and other orders are the available tools. For a large multinational, a corporate criminal fine in Canada is a significant reputational and regulatory event, independent of its monetary value.

One cross-cutting point applies equally to both regimes: a penalty imposed in one jurisdiction does not give credit for a penalty paid in another. OFAC will assess and settle on the basis of the OFAC violation; a Canadian court or regulator will assess on the basis of the Canadian violation. A business that resolves both matters pays both, subject to any specific coordination that the relevant authorities agree to – which is rare and not to be assumed. The full cross-border exposure is the sum of the two potential outcomes, not the larger of them.

What risk flags indicate that the position is materially worse than it appears?

Several indicators suggest that an apparent violation will be treated more harshly than the baseline position, and that the available cooperation credit may not be sufficient to avoid a significant outcome.

Senior management involvement is the most significant aggravating factor in OFAC's egregiousness framework. If the violation was known to – or directed by – senior management, OFAC treats that as a material aggravating circumstance. The same logic applies in Canada's criminal framework: a matter involving wilful corporate conduct at a senior level is treated as a more serious offence. For a cross-border business, the question is not only what happened but who knew. Have you mapped the internal knowledge chain from the operational level to the board?

Repeat-offender status is a further aggravator in both regimes. A business with a prior sanctions or export-control violation – whether in the US, Canada, or another major regime – will be assessed less favourably on cooperation credit. OFAC's Enforcement Guidelines explicitly treat prior violations as an aggravating factor. A compliance programme that failed once and was not remediated before a second failure is difficult to present as a serious control environment.

Concealment of a violation – or a pattern of conduct that suggests the business was aware of the issue and chose not to disclose it – is the most damaging circumstance in both regimes. In the OFAC context, conduct that suggests wilful concealment moves a matter firmly into the egregious category and eliminates the benefit of any late disclosure. In the Canadian criminal context, conduct that conceals evidence is itself a potential criminal offence. The myth that staying silent is safer than self-disclosing needs to be addressed directly: silence is not neutral in either regime. OFAC may discover the matter through a bank filing, a trade-data record, or a counterparty's own disclosure. Canadian authorities may receive information from RCMP intelligence or from a foreign regulator. A voluntary disclosure that becomes involuntary because the authority discovered the matter first yields no cooperation credit at all.

A poorly documented compliance programme is a further risk flag. Both regimes treat the quality and effectiveness of a business's pre-existing compliance programme as a factor in the overall assessment. A programme that exists on paper but is not tested, not trained, and not supervised will not be presented credibly as a mitigant. In our experience, the documentation of compliance efforts – including training records, screening-system validation, and escalation logs – is as important as the substance of the programme when a matter is presented to a regulator.

How do the regimes interact when one group entity is subject to both?

A multinational group with operating entities in both the United States and Canada may find that the same underlying conduct – a transaction with a sanctioned counterparty that was processed through both a US-nexus account and a Canadian entity – triggers OFAC jurisdiction over the US component and Canadian sanctions jurisdiction over the Canadian component. The jurisdictional analysis is not automatic; it turns on where the nexus lies, which persons are involved, and what the regulated item or transaction is.

OFAC's extraterritorial reach is broad. The facilitation prohibition – which catches a US person or US-nexus transaction that facilitates a transaction that would be prohibited if conducted directly – means that a non-US entity acting as an intermediary can draw OFAC jurisdiction over its conduct. A Canadian subsidiary of a US parent that processes a payment for a sanctioned counterparty is not automatically outside OFAC's reach. Whether the subsidiary is itself a "US person" within the meaning of the relevant OFAC program, or whether it has facilitated a prohibited transaction through its US parent, are threshold questions that determine which set of obligations apply.

Where two regimes both apply, the stricter prohibition governs the conduct of a person subject to both. A business cannot net out the two regimes or argue that compliance with OFAC's rules satisfies Canada's rules. The obligations are concurrent and independent. This means that the compliance assessment for a cross-border matter must address both regimes fully, and that the disclosure strategy must account for both authorities' expectations.

The UK and EU regimes add further dimensions for groups with European operations. OFSI's enforcement guidance and the EU's approach to civil and criminal enforcement sit alongside OFAC and Canada in the compliance analysis for a group that operates in multiple regions. We regularly advise on matters that simultaneously involve OFAC, OFSI, and EU jurisdiction, and the sequencing of disclosures across those regimes is among the most operationally complex decisions a General Counsel will face.

The position above covers the standard cross-border case. Your facts – the counterparty, the transaction nexus, the entities involved, and the jurisdiction of the relevant conduct – change the analysis materially.

Related practices

• Corporate Liability and Attribution (OFSI) – understanding how liability is attributed to corporate entities under the UK regime
• OFAC vs OFSI: Early account and settlement schemes compared – regime-by-regime comparison of cooperation credit under the US and UK frameworks

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.