A freight-forwarding group discovers that an export shipment it cleared three months ago included an item that may have required a licence under the Export Administration Regulations. Simultaneously, a payment it processed touched a counterparty whose majority shareholder appears on OFAC's SDN List (OFAC's list of Specially Designated Nationals and blocked persons). Two agencies. Two enforcement regimes. Two sets of mitigation factors. The outcomes can diverge sharply – and the missteps that comfort one regulator can aggravate the other.
As of March 2026, both OFAC and BIS apply published mitigation frameworks that weigh aggravating and mitigating factors to set the penalty range for an apparent violation. The frameworks share a common architecture – voluntary self-disclosure, compliance programme strength, and harm to sanctions policy are assessed by both – but they differ materially on weighting, procedural mechanics, and the credit awarded for particular facts. Understanding where they align and where they diverge is the central task for any cross-border business managing a dual-exposure matter.
This analysis maps those divergences criterion by criterion, identifies the risk flags that practitioners watch most closely, and explains when the interaction between the two regimes changes the strategic calculus for enforcement counsel.
How the two enforcement architectures compare
Both OFAC and BIS operate penalty frameworks that begin with a base penalty – derived from the statutory maximum and the transaction value – and then adjust that base through a structured assessment of aggravating and mitigating factors. The formal posture is similar. The mechanics differ.
OFAC applies its enforcement guidelines under IEEPA and its other enabling authorities. The guidelines identify a set of general factors that can increase or decrease the penalty. Those factors span: wilfulness and recklessness; awareness of the conduct; harm to sanctions policy objectives; individual characteristics of the subject; compliance programme adequacy; and remedial response. Each factor can move the penalty up or down within a published range. The range itself is anchored to the greater of a statutory maximum per transaction or the value of the underlying transaction.
BIS applies its own export-enforcement guidelines under the Export Control Reform Act and the EAR (the Export Administration Regulations, administered by the Bureau of Industry and Security). BIS structures its analysis around a broadly similar set of factors – wilfulness, prior violations, harm to export-control policy, and the quality of the VSD (voluntary self-disclosure to a regulator) – but it weights them differently and applies them through a distinct procedural channel. Where OFAC reaches a civil settlement through its own administrative process, BIS coordinates civil export-enforcement matters through the Office of Export Enforcement and can refer criminal matters to DOJ. The two agencies do not conduct joint penalty assessments, and a business facing both inquiries simultaneously must manage two parallel tracks with distinct timelines and distinct evidentiary standards.
What does that mean in practice? A business that has already settled with OFAC cannot assume that BIS will extend the same credit for the same facts. The agencies share information, but penalty credit does not automatically transfer.
Voluntary self-disclosure: where the credit diverges
Voluntary self-disclosure – submitting a VSD before a regulator initiates a formal inquiry – is the single most powerful mitigating factor under both regimes, but the credit awarded differs materially.
Under OFAC's framework, a timely and complete VSD is treated as a significant mitigating factor. OFAC's published guidance indicates that a VSD, combined with a strong compliance programme and no aggravating factors, can result in a penalty at the bottom of the applicable range or a non-public finding of a violation with no monetary penalty. In our experience, the quality and completeness of the VSD – covering the facts, the root cause, and the remedial steps – matters as much as the timing. A partial or hedged disclosure can be treated less favourably than no disclosure at all if the regulator determines that it was incomplete.
BIS applies a parallel framework. A VSD submitted to BIS that is timely, accurate, and complete can result in a reduction of the base penalty by a substantial fraction – the guidelines have historically treated a full VSD as warranting a significant downward adjustment, though the precise quantum is a matter of case-by-case assessment and practitioners should verify the current position before relying on any specific figure. One structural difference: BIS distinguishes between an initial notification (a short-form disclosure filed quickly to preserve the timing benefit) and a final submission (the full narrative). OFAC does not apply the same two-stage structure in the same way. A cross-border business disclosing to both agencies simultaneously must manage two submission timelines that do not run in parallel.
The interaction risk is real. Disclosing to OFAC first can affect the narrative available to BIS. We regularly advise clients to sequence submissions carefully and to ensure that the factual account in each disclosure is consistent – inconsistencies discovered by one agency and shared with the other compound the problem rather than resolving it.
Compliance programme strength: the five-element standard and its BIS counterpart
A well-tested compliance programme is a mitigating factor under both regimes, but the standards against which each agency assesses "adequacy" are not identical.
OFAC has published a compliance programme framework built around five core elements: management commitment; risk assessment; internal controls; testing and auditing; and training. A programme that demonstrably satisfies all five elements – and that has produced real-time detection of the apparent violation – carries significantly more weight than a programme that exists on paper but failed to flag the transaction before it executed. In our practice, the most common compliance-programme failing that OFAC cites in aggravation is not the absence of a programme but the presence of a programme that was not implemented consistently at the operational level.
BIS evaluates compliance programmes through a lens shaped by the specific risks of export-control law: correct classification of goods by ECCN (Export Control Classification Number under the US Commerce Control List), end-use and end-user screening, red-flag review, and technology-transfer controls. A programme strong on sanctions screening but weak on export classification will not attract the same credit from BIS as it might from OFAC. The two programmes have overlapping but not identical content requirements.
For businesses operating across both regimes, the practical implication is that a single compliance framework must address both sets of requirements. That is achievable, but it requires deliberate design. An off-the-shelf sanctions compliance programme repurposed for export control will leave gaps in classification procedures, end-use controls, and red-flag documentation that BIS will identify. Have you tested your programme against both agencies' benchmarks, or only one?
Wilfulness and recklessness: how each agency reads the same facts
The degree of intent attached to the apparent violation is the most consequential aggravating factor under both frameworks – and the factor where the two agencies can reach different conclusions from the same underlying facts.
OFAC treats wilfulness as the most serious aggravating factor. A transaction executed with actual knowledge that the counterparty was on the SDN List, or with reckless disregard for red flags that a reasonable compliance programme would have detected, moves the penalty toward the top of the range. OFAC also considers whether senior management were aware of, directed, or failed to prevent the conduct. A wilful violation at the management level is treated as qualitatively more serious than an operational failure.
BIS applies a structurally similar analysis. Wilful violations – particularly those involving deliberate misdescription of goods, false end-use certificates, or deliberate routing through jurisdictions outside the reach of the controls – are treated as the most serious category and can be referred to DOJ for criminal prosecution under the applicable export-control statutes. The criminal threshold under the export-control regime has historically been interpreted broadly: conduct that might be treated as negligent for OFAC purposes can be treated as reckless for BIS purposes if it involves deliberate disregard of classification requirements.
In a recent matter, a manufacturing business in the technology sector faced parallel inquiries after a component it had exported without a licence was found in a controlled end-use application in a third country. OFAC's inquiry focused on the payment chain and the SDN exposure of the end-user's financier. BIS's inquiry focused on the classification decision and whether internal red flags had been suppressed. We assessed the apparent violation for both agencies, prepared a sequenced VSD, and managed the parallel correspondence. The two proceedings resolved on different timelines; the BIS matter took materially longer to close. That timing asymmetry is itself a risk management issue – a matter that is open with one agency while the other has closed creates ongoing legal exposure and management distraction.
Harm to policy objectives: a structural divergence between the regimes
The "harm to policy objectives" factor is where the two regimes diverge most sharply, because the policy objectives they are protecting are different in character.
OFAC's sanctions programmes are designed to give effect to US foreign-policy and national-security objectives. The harm analysis therefore focuses on whether the apparent violation undermined the specific programme in question – whether value reached a designated party, whether a financial channel was used that the programme was designed to close, whether the violation was detected before or after the harm occurred. A violation that resulted in actual value reaching a designated party is treated more seriously than a technical processing failure where the transaction was blocked before completion.
BIS's export-control policy objectives centre on preventing the proliferation of controlled goods and technology to destinations, end-users, or end-uses that would harm US national security and foreign-policy interests. The harm analysis therefore focuses on whether the controlled item reached a controlled destination or a controlled end-user, whether a licence exception was misused, and whether the violation contributed to the diversion of US-origin goods into controlled programmes. A violation that resulted in an item reaching a prohibited end-user is treated as more serious than a paperwork failure where the goods went to a permissible destination.
The divergence matters for cross-border businesses because the same transaction can score differently on the harm analysis under each regime. A payment that touched an SDN-affiliated account but did not result in any economic benefit reaching the designated party may attract a lower OFAC penalty than the statutory maximum would suggest. But if the same transaction involved the export of a controlled component to a restricted destination, the BIS harm analysis may point in the opposite direction. The two assessments do not offset each other.
Remedial response and the timeline for action
Both agencies award credit for a prompt and genuine remedial response – but the elements of that response, and the timeline within which they must occur, differ.
OFAC expects a business that has identified an apparent violation to take action across three dimensions: reporting (the VSD), remediation (fixing the root cause), and cooperation (responding fully and promptly to agency requests). A business that discloses but fails to implement meaningful remediation – or that cooperates on facts while resisting requests for programme-related information – will not receive full mitigation credit. OFAC's assessment of remediation focuses on whether the business has addressed the root cause, not merely the symptom. Updating a sanctions list feed is not remediation if the root cause was a deficient ownership-screening procedure.
BIS places similar emphasis on remediation but adds a procedural dimension: the quality and completeness of the VSD itself is assessed as a component of the remedial response. A BIS VSD that identifies the violation, traces its root cause, quantifies the exposure, and sets out concrete remedial steps carries more weight than a disclosure that merely notifies the agency of a transaction. BIS also considers whether the business has taken steps to prevent recurrence specifically within the export-compliance programme – updated ECCNs, revised end-use controls, improved red-flag procedures – rather than generic improvements to general compliance infrastructure.
The timing pressure is real under both frameworks. A business that waits to disclose until it has a complete picture risks losing the timeliness credit; a business that discloses prematurely without adequate factual foundation risks the credibility of the submission. In our cross-border practice, we typically advise clients to file an initial notification with BIS early to preserve the timing benefit, while preparing a more complete submission for both agencies in parallel. The sequencing decision must account for the relative urgency of each agency's timelines – and those timelines are not the same.
The cross-regime interaction: secondary exposure and the UK/EU dimension
A matter that begins as a US enforcement issue rarely stays within US borders. The OFAC and BIS frameworks operate extraterritorially, and a business with operations in the United Kingdom or the European Union faces a parallel set of obligations that can create their own mitigation calculus.
Under OFSI's enforcement guidance, the factors relevant to a penalty decision in the United Kingdom share a common structure with OFAC's framework – the quality of the compliance programme, the promptness of reporting, and the degree of cooperation are all relevant – but OFSI operates under its own statutory authority under the Sanctions and Anti-Money Laundering Act and applies its own published guidance. A voluntary report to OFSI is assessed by OFSI on its own merits; OFAC credit does not transfer. Similarly, the EU Council regulations and the enforcement postures of EU member state competent authorities apply independently. A business that has managed an OFAC matter well but has not reported to OFSI or the relevant EU authority where that authority has jurisdiction may find that its mitigation position before those regulators is weaker than it would have been had it disclosed promptly.
The UN Consolidated List adds a further layer for businesses operating in jurisdictions that implement UN Security Council designations directly. Where a transaction involves a UN-listed person, the UN dimension does not substitute for national-level obligations – it adds to them. A business that resolves its OFAC exposure does not thereby discharge its UK, EU, or other national obligations.
For an analysis of how OFAC's mitigation framework compares with EU enforcement practice specifically, see our related analysis at OFAC vs EU: Mitigation factors in enforcement compared. For the OFSI and Australia comparison, see OFSI vs Australia: Mitigation factors in enforcement compared.
Common misconceptions and the myth of the "safe harbour" VSD
A persistent misconception in cross-border compliance practice is that a voluntary self-disclosure creates a binding safe harbour – that once a VSD is filed, the regulator is obliged to treat the matter as resolved at a reduced penalty. Neither OFAC nor BIS operates a safe harbour of that kind.
A VSD is a significant mitigating factor. It is not a cap on the penalty. Both agencies retain discretion to treat a disclosure as aggravating if it is incomplete, misleading, or filed in bad faith. A VSD that omits material facts – transactions that were reviewed and not disclosed, related violations in adjacent product lines, prior enforcement history – can be treated as worse than no disclosure at all, because it suggests that the business is managing the disclosure process rather than genuinely cooperating with the agency.
A second misconception is that a strong compliance programme at the time of the violation is irrelevant if the violation occurred. OFAC and BIS both treat the compliance programme as a relevant factor regardless of whether it prevented the specific violation at issue. A programme that was strong, well-implemented, and genuinely operating at the time of the violation – but that failed on this occasion because of an isolated operational failure – is treated more favourably than the absence of a programme. The programme does not need to have succeeded; it needs to have existed, been tested, and been genuinely in use.
A third misconception, particularly for businesses with US-origin technology, is that BIS exposure ends when the item leaves the United States. The EAR applies to US-origin items regardless of where they are located, and BIS can pursue an enforcement action against a foreign entity that has re-exported a US-origin item without the required authorisation. That extraterritorial reach means that a European or Asian trading house can face BIS enforcement for a transaction that had no direct US nexus at the point of the re-export – and that the mitigation factors available to that entity in a BIS proceeding may be different from those available to a US person.
Related practices
- Apparent Violation Assessment – EU – scoping, disclosure strategy, and penalty defence for EU sanctions enforcement matters
- OFAC vs EU: Mitigation factors in enforcement compared – criterion-by-criterion analysis of the US and EU enforcement frameworks