A North American trading company with operations on both sides of the forty-ninth parallel discovers a potential sanctions hit mid-transaction. One counterparty shows a match against a list maintained under the US regime; a parallel review surfaces a related exposure under the Canadian programme. Two separate investigations must now run – under different legal authorities, different reporting obligations, and different enforcement postures. Which regime takes priority? What do the timelines look like? And does a voluntary self-disclosure in one jurisdiction help, hurt, or have no effect on the other?
Internal sanctions investigations under OFAC and the Canadian sanctions regime diverge on four axes: the legal authority triggering the investigation, the mechanics of voluntary self-disclosure, the evidentiary standard for penalty mitigation, and the structural approach to enforcement. OFAC operates under a detailed, published enforcement methodology with explicit mitigation credit for VSD (voluntary self-disclosure to a regulator). Canada's regime, administered by Global Affairs Canada (GAC) and supported by the Royal Canadian Mounted Police for criminal matters, is less procedurally codified at the administrative level and more frequently routes serious matters toward criminal prosecution. As of March 2026, neither regime's current enforcement posture should be treated as stable without live verification.
This analysis maps each divergence in turn, identifies the practical risk flags for businesses operating across both regimes, and explains when cross-border counsel becomes essential rather than optional.
What legal authority governs each regime, and why does it matter for an investigation?
OFAC derives its sanctions authority primarily from the International Emergency Economic Powers Act (IEEPA) and, in specific programmes, the Trading with the Enemy Act (TWEA). Those statutes empower OFAC to promulgate programme-specific regulations and to impose civil penalties. The enforcement methodology OFAC uses – how it scores apparent violations, what counts as egregious, how mitigation credit is calculated – is set out in published agency guidance that is publicly available and extensively practised. For a business running an internal investigation, this transparency is operationally important: the investigation's scope, documentation standard, and disclosure decision can all be calibrated against a known framework.
Canada's economic sanctions regime rests on several distinct statutory instruments. The Special Economic Measures Act (SEMA) governs most autonomous Canadian sanctions, the United Nations Act (UNA) implements UN Security Council obligations, and the Justice for Victims of Corrupt Foreign Officials Act covers targeted Magnitsky-type designations. GAC administers the lists and the licensing function. Enforcement diverges from the OFAC model in a significant way: SEMA and the UNA do not create a civil penalty track of the kind OFAC operates. Serious violations are referred for criminal prosecution under the relevant statute, which means the enforcement consequence is binary – prosecution or no action – rather than the graduated civil-penalty spectrum familiar from OFAC practice. That binary character shapes every decision in a Canadian internal investigation, because the stakes of a referral are qualitatively different from a civil settlement.
The governing authority question also affects jurisdiction. OFAC's reach is extraterritorial for US-person transactions and for US dollar clearing. A business that runs payments through US correspondent banks, employs US nationals, or is a US-incorporated entity is within OFAC's jurisdiction regardless of where the underlying transaction occurred. Canada's sanctions, by contrast, apply to persons in Canada and Canadians abroad, but do not assert the same extraterritorial dollar-clearing jurisdiction. A transaction with no Canadian-person nexus and no Canadian-routed payment falls outside SEMA even if it involves a designated person. For a business with dual exposure, mapping jurisdiction first – before designing the investigation – is essential.
How does voluntary self-disclosure work under each regime?
Under OFAC, a VSD – submitted promptly, accurately, and completely – qualifies as a mitigating factor in the civil penalty calculation, with OFAC's published guidance indicating it can reduce the base penalty amount by a significant proportion. The OFAC enforcement process distinguishes between the initial notification (which establishes the VSD and preserves the mitigation credit) and the full submission (which contains the facts, the root-cause analysis, the remediation steps, and the compliance-programme improvements). Timing the initial notification correctly is one of the most consequential decisions in any OFAC internal investigation. Delay – even where the full submission arrives promptly – can affect how OFAC characterises the disclosure.
What constitutes "prompt" is not arithmetically fixed in OFAC guidance in a manner that would place it within the verified facts available here; we treat that question qualitatively. In our cross-border practice, the first question after an apparent violation is identified is always: does the clock start from the first reasonable suspicion, from the point of confirmed identification, or from the completion of the initial fact-gather? OFAC's practice suggests the answer leans toward the earlier date. That is a question your investigation protocol should answer before the issue arises, not after.
Canada does not have a published VSD procedure equivalent to OFAC's. There is no GAC administrative process that formally exchanges a voluntary disclosure for a defined mitigation credit against a civil penalty, because civil penalties under SEMA do not operate in the same way. In practice, a business that identifies a potential SEMA violation and proactively contacts GAC or, where appropriate, the RCMP, may benefit from prosecutorial discretion – but that outcome is discretionary, not procedurally guaranteed. The practical implication is significant: a business running a dual-regime investigation that issues an OFAC VSD first should consider carefully whether that disclosure, and the facts it contains, could become available to Canadian authorities and affect the Canadian exposure. Conversely, a disclosure to Canadian authorities does not constitute an OFAC VSD and provides no procedural protection in the US.
The sequencing question – which regime to disclose to first, whether simultaneous disclosure is manageable, and how to structure the two submissions so that neither prejudices the other – is one of the most technically demanding aspects of cross-border sanctions enforcement work. In our experience, businesses that approach this as a single-disclosure problem routinely create unnecessary exposure in the second jurisdiction.
How do the two regimes assess the severity of an apparent violation?
OFAC's published enforcement methodology scores apparent violations on two axes: the penalty base (the greater of the transaction value or a statutory maximum per violation) and the egregious/non-egregious classification. The egregious classification turns on factors including whether the violation was wilful or reckless, whether senior management was involved, whether the business had reason to know, and the harm to US sanctions policy. Those factors map directly onto the scope of an internal investigation: to make the mitigation case, the investigation must produce evidence on each of them. A well-documented internal investigation that establishes absence of wilfulness, identifies the root cause, and demonstrates pre-existing compliance programme investment is the factual record on which OFAC's penalty determination rests.
Canada's statutory scheme, for criminal prosecutions under SEMA or the UNA, does not use the OFAC egregious/non-egregious classification. Prosecutorial factors under Canadian criminal procedure apply: public interest, the nature and seriousness of the offence, the degree of culpability, and the likelihood of a successful prosecution. For a business conducting an internal investigation with potential Canadian exposure, these factors shape the investigation differently. The Canadian investigation needs to build the factual record for prosecutorial discretion, not for a civil penalty mitigation argument. That means documentary evidence of innocent intent, of compliance systems in place, and of the steps taken to prevent recurrence carries more weight than the transactional analysis that dominates an OFAC submission.
One practical divergence that often surprises businesses: OFAC's penalty base is transactional. Each prohibited transaction can constitute a separate violation, each carrying its own penalty base. Where a business has processed multiple transactions over a period, the aggregate exposure can be very large even if each individual transaction was modest. SEMA's criminal framework operates differently; prosecutorial charging decisions do not mechanically multiply by transaction count in the same way. The aggregate exposure profile is therefore structured differently between the two regimes, and that affects how an internal investigation scopes its look-back period and transaction universe.
Where do the evidentiary and privilege standards diverge?
Attorney-client privilege and work-product protection are among the most contested issues in any internal investigation, and the US/Canada divergence here is technically significant. Under US law, communications between counsel and client for the purpose of seeking legal advice, and the work product of counsel in anticipation of litigation, attract protection. For an OFAC investigation, the legal-advice communications between external sanctions counsel and the client, and the underlying interview memoranda prepared by counsel, ordinarily fall within these protections – subject to the established rules on waiver. The risk of waiver arises acutely when a business decides to share investigation materials with OFAC as part of a VSD submission. What to share, what to withhold, and how to structure the submission to preserve privilege over the investigative work product is a judgment that requires careful US-law analysis.
In Canada, privilege principles under common law are broadly analogous, but the interaction between privilege and regulatory/prosecutorial demands differs. A business producing materials to the RCMP or to a Crown prosecutor in a SEMA matter operates in a context where the criminal-procedure rules on production, search, and seizure apply. The protections available in a civil-administrative OFAC context do not translate automatically into the Canadian criminal context. Materials that would be withheld from OFAC under work-product doctrine may be subject to production requirements under Canadian criminal process in a way that has no close parallel on the OFAC side.
For a business running parallel investigations, the evidentiary structure should be designed at the outset to accommodate both regimes. That typically means retaining separate counsel in each jurisdiction, using clearly delineated privilege logs, and avoiding the production of joint investigation materials to either regulator without a deliberate decision about the cross-jurisdictional consequences. In our practice, the most avoidable privilege problems arise when a business treats a dual-regime investigation as a single legal matter and manages it through a single file.
What are the risk flags that indicate cross-border counsel is needed immediately?
Not every sanctions compliance issue warrants external counsel. A first-level screening false positive on a transaction that has not yet settled, where the internal team can confirm the non-match within normal review cycles, is an operational matter. The threshold for external involvement rises quickly when specific risk factors appear.
The first risk flag is jurisdictional overlap. If a transaction has both a US-person or US-dollar nexus and a Canadian-person or Canadian-incorporated entity nexus, both regimes are potentially engaged. An internal team handling only one side of that exposure creates a gap the other regime can walk through.
The second flag is the apparent violation threshold. Under both regimes, once the internal review reaches a conclusion that a probable violation has occurred – not merely that a hit has been identified – the legal character of the investigation changes. In the OFAC context, that is the point at which the VSD clock issues become live and the decision to disclose cannot be deferred indefinitely. In the Canadian context, it is the point at which the prospect of a referral for prosecution becomes real. External counsel who can advise on that threshold in both jurisdictions simultaneously is not a luxury at that stage.
The third flag is senior-management or board involvement in the transactions under review. OFAC's egregious classification turns partly on management involvement; Canadian prosecutorial discretion weighs individual culpability. Where the investigation surfaces evidence that decisions were made at senior levels – even with ostensibly good intent – the investigation's scope and its legal management need to expand accordingly.
The fourth flag is prior history. A business that has previously received an OFAC finding, a cautionary letter, or has been subject to a prior VSD is in a materially different position in a subsequent investigation. OFAC weighs prior history as an aggravating factor. Presenting a new matter without accounting for that history, or without a strategy for addressing it, is a significant error that an experienced internal team without specialist sanctions input can easily make.
If a transaction has already been flagged, or a filing has been refused, an early review can preserve options that narrow with time. To discuss the specifics of a potential apparent violation or to assess whether a dual-regime investigation is properly structured, contact Calder & Vance at info@caldervance.com.
How do the two regimes treat remediation and compliance-programme improvements?
OFAC's enforcement guidance treats remediation as a distinct mitigating factor. A business that, in the course of the internal investigation, identifies systemic root causes and takes documented steps to address them – enhanced screening controls, revised onboarding procedures, retraining of relevant staff, updated policies – can present that remediation record as part of its civil penalty mitigation case. OFAC's published methodology lists the elements of an effective compliance programme, and a business that demonstrates its programme meets those elements, or is being strengthened to meet them, positions itself better on the mitigation analysis.
The five elements OFAC has identified as hallmarks of an effective sanctions compliance programme are management commitment, risk assessment, internal controls, testing and auditing, and training. An internal investigation that surfaces a violation is, simultaneously, evidence that one or more of these elements failed. The remediation plan therefore needs to address each point of failure specifically and document both the diagnosis and the fix.
In the Canadian regime, remediation matters differently. For a prosecution decision, evidence that the business identified the problem, stopped the conduct, and put controls in place to prevent recurrence is relevant to the public-interest analysis. A Crown prosecutor weighing whether to proceed is less likely to do so against a business that has visibly remediated a compliance failure than against one that continues the conduct or takes no steps. But there is no formal five-element standard against which Canadian remediation is scored in published guidance, and the credit for remediation is less procedurally predictable than under OFAC's framework.
Where the two regimes converge is on the importance of documentation. Under both frameworks, verbal assurances of remediation carry little weight. The investigation file needs to contain the evidence: the root-cause analysis, the gap assessment, the specific measures adopted, and – critically – testing evidence that those measures work. A compliance-programme improvement that has been designed but not tested is, at best, a plan; it is not a remediation. In our experience, businesses that present unfinished remediation plans to OFAC, or to Canadian authorities in a voluntary approach, routinely find those plans treated as incomplete submissions rather than as mitigation.
Common misconceptions about running dual-regime investigations
A persistent misconception in the businesses we advise is that an OFAC VSD automatically resolves the Canadian exposure, or that GAC's relative procedural silence means the Canadian risk is lower. Neither inference is reliable.
On the first point: OFAC's civil resolution has no legal effect on a Canadian criminal referral. The two proceedings are legally independent. OFAC settling a civil matter does not constitute a finding in any Canadian proceeding, nor does it operate as a bar to Canadian prosecution. A business that completes an OFAC process, receives a settlement, and then treats the matter as closed without addressing the Canadian dimension has managed half the exposure.
On the second point: procedural silence from a regulator is not the same as low enforcement risk. Canada's relatively limited volume of publicly announced SEMA prosecutions does not mean that referrals do not occur, or that the risk is negligible for a business with clear exposure. The enforcement environment can shift with policy priorities, and a business that has identified a probable violation under SEMA but has done nothing because "Canada doesn't really enforce" is in a fragile position.
A third misconception is that the same legal team can manage both investigations without specialist input in each jurisdiction. The technical demands of OFAC enforcement – the penalty methodology, the VSD timing, the privilege architecture, the egregious/non-egregious analysis – are distinct from the demands of a potential SEMA criminal matter. In a genuinely dual-regime investigation, separate specialist counsel in each jurisdiction, coordinated by lead cross-border counsel who understands both frameworks, produces a better outcome than a single team that is expert in one and approximate in the other.
Related practices
- Apparent Violation Assessment (EU) – assessing exposure and building the mitigation record under EU sanctions enforcement.
- OFAC vs OFSI: Internal Investigations Compared – divergences in VSD procedure, penalty mechanics, and privilege between the US and UK regimes.
- OFSI vs EU: Internal Investigations Compared – how the UK and EU enforcement approaches differ on disclosure, mitigation, and remediation credit.