A logistics business discovers that a shipment cleared customs six months ago – goods that, properly classified, required an export licence under the EAR (the Export Administration Regulations, administered by the US Department of Commerce Bureau of Industry and Security). At the same time, a payment in the same transaction touched a counterparty that OFAC's screening tools flag retrospectively. Two US enforcement agencies. Two different penalty regimes. Two divergent settlement tracks. The compliance team asks: which matters more, and what do we do first?
Penalty defence and settlement under OFAC and under BIS / EAR follow distinct statutory authorities, procedural timelines, and penalty-calculation methodologies – and the gap between them is wide enough to decide whether a business resolves a matter quietly or faces a public enforcement action. As of March 2026, both regimes have active enforcement dockets and publish their settlement terms; neither is dormant. Understanding where they converge and where they diverge is the first task for any business that has identified an apparent violation.
This analysis maps the two enforcement regimes side by side, identifies the procedural points businesses most commonly miss, and explains when – and why – the cross-regime interaction changes the defence strategy.
The legal authority behind each regime: two agencies, two bodies of law
OFAC administers US economic sanctions under the authority of IEEPA and, for older programmes, TWEA; BIS administers export controls under the Export Control Reform Act and the EAR. Both can impose significant civil penalties for violations, but they derive that power from different statutes, apply different evidentiary standards, and operate entirely separate settlement processes.
OFAC's enforcement work centres on whether a person has engaged in a transaction that is prohibited under a specific sanctions programme – whether payments were made, assets were transferred, or services were provided involving a blocked person or a sanctioned territory. The analysis is largely binary at the transaction level: did the prohibition apply or not? BIS, by contrast, focuses on the export, re-export, or in-country transfer of items subject to the EAR, and the penalty analysis requires a classification inquiry – what was the item, what was its ECCN (Export Control Classification Number under the US Commerce Control List), what licence exception, if any, applied, and what end-use and end-user concerns were present.
The distinction matters for defence preparation. An OFAC matter will turn heavily on transaction records, counterparty ownership and control analysis, and whether a general licence (a standing authorisation that permits a defined category of transactions without a separate application) or specific licence covered the activity. A BIS matter will turn on export documentation, classification records, and end-use certificates. A business that conflates the two bodies of evidence wastes time and – critically – creates gaps in its production to the agency that did not benefit from the conflation.
How each agency calculates civil penalties: where the divergence begins
OFAC calculates civil penalties against a statutory maximum that is adjusted periodically for inflation; BIS applies its own penalty ceiling under separate statutory authority. In our cross-border practice, we consistently observe that the headline maximum figures receive far more attention from clients than the factors that actually drive the settlement number downward – and those factors differ substantially between the two agencies.
OFAC uses a published framework of aggravating and mitigating factors. On the aggravating side, the factors include whether the conduct was wilful or reckless, whether senior management was involved, whether the violations caused harm to sanctions-programme objectives, and whether the business has a prior enforcement history. Mitigating factors include a compliance programme that was in place and functioning, prompt self-disclosure, and co-operation with OFAC's investigation.
BIS uses a similar-in-structure but substantively different set of factors. The degree of culpability, the value of the exports, the harm to export-control objectives, and the quality and speed of the self-disclosure all feature. But BIS places particular weight on the classification question: a business that exported an item in genuine, documented reliance on an incorrect classification – and that can show the classification analysis it performed at the time – is in a materially different position than one that made no classification inquiry at all.
What businesses miss most often is this: the two penalty frameworks are not interchangeable, and a defence narrative built for one will not, without reconstruction, serve well before the other. Have you prepared a separate evidentiary record for each agency, or are you relying on a single set of documents to do double duty?
Voluntary self-disclosure: the procedural fork in the road
A VSD (voluntary self-disclosure to a regulator) is the single most consequential decision a business faces after identifying an apparent violation – and the procedural rules, and the practical benefit, differ between OFAC and BIS in ways that are poorly understood even by experienced compliance teams.
Under OFAC's published enforcement guidance, a timely, complete, and accurate VSD is treated as a significant mitigating factor. OFAC's guidance contemplates that a VSD, combined with other mitigating factors, can reduce the penalty base substantially. The disclosure must be made before OFAC has already opened an investigation, and it must be complete: a partial disclosure that OFAC later finds to be understated erodes the mitigation credit and can aggravate the overall position.
BIS operates a parallel VSD process through its Office of Export Enforcement, and it too treats timely self-disclosure as a significant mitigating factor. The BIS process has its own submission requirements – a narrative of the conduct, an export history, and an account of the corrective actions taken. Where a matter involves both OFAC and BIS violations arising from the same underlying facts, the question of whether to file with both agencies simultaneously, or sequentially, is genuinely strategic. In our experience, filing without considering both tracks – and without coordinating the factual narratives – creates avoidable inconsistencies that undermine the overall settlement position.
The bridge between the two processes is not automatic. Neither agency notifies the other as a matter of course, but enforcement actions in high-profile matters have produced parallel proceedings. A business that prepares for one and ignores the other takes a risk that is rarely justified.
What is the practical difference between an OFAC and a BIS settlement outcome?
A settlement with OFAC is typically documented as a settlement agreement and an accompanying civil penalty; BIS settlements are documented through a Settlement Agreement and Order or a related instrument. Both are publicly disclosed. That transparency matters: a counterparty, correspondent bank, or major customer running a due diligence check will find the settlement, read the facts, and form a judgment about the business's compliance culture.
OFAC settlements frequently include a compliance commitment – a structured set of undertakings about how the business will improve its sanctions screening, its ownership and control analysis, or its recordkeeping. BIS settlements similarly require corrective-action commitments, particularly around classification procedures, export-documentation controls, and end-user screening. In both cases, the settlement is not the end of the exposure: the undertaking creates a benchmark against which future conduct will be measured, and a subsequent violation against a backdrop of a settled prior matter is treated far more severely.
One divergence that surprises clients: OFAC's published Economic Sanctions Enforcement Guidelines identify the base penalty calculation methodology in detail, and OFAC frequently publishes a web notice with the settlement amount and a factual summary. BIS's penalty orders are similarly public. A business negotiating a settlement with either agency needs to understand that the factual framing in the public notice is not a formality – it is read by banks, by insurers, and by other regulators, and the description of the conduct and the compliance failures is as consequential as the dollar amount.
Cross-border interaction: OFSI, the EU, and secondary-sanctions exposure
No analysis of OFAC and BIS penalty defence is complete without considering the cross-border dimension. A transaction that gives rise to a US enforcement action will often involve non-US parties, non-US financial institutions, and conduct in non-US jurisdictions – and each of those elements can trigger a parallel investigation by OFSI in the United Kingdom, by a competent authority under an EU Council regulation, or by another regime.
OFAC's secondary-sanctions risk is distinct from its primary prohibitions. A non-US financial institution that processes a dollar payment in a transaction that OFAC regards as sanctions-prohibited may face secondary-sanctions consequences even without a nexus to US territory, US persons, or US-origin goods. That extraterritorial dimension means that a European or Asian bank involved in the same transaction as a US exporter may be managing its own regulatory exposure simultaneously with the US entities – and the defence strategies do not always align.
OFSI, the UK's Office of Financial Sanctions Implementation, operates under SAMLA and the relevant thematic sanctions regulations. Its enforcement posture has strengthened materially since SAMLA was amended to introduce a strict-liability civil penalty regime: OFSI does not require proof of knowledge or intent to impose a civil penalty, though knowledge and intent remain relevant to the level of that penalty. That contrast with OFAC – where wilfulness and recklessness are central to the aggravating-factor analysis – is a meaningful one for a business managing parallel proceedings in both jurisdictions. We regularly advise clients that the defence narrative appropriate for OFAC's aggravated-factor framework needs to be reconstructed, not simply translated, for an OFSI enforcement context.
The EU adds a further layer. Each Member State has its own competent authority for enforcement under Council regulations, and enforcement posture and penalty levels vary between Member States. A business with operations in multiple EU jurisdictions – or with EU-incorporated subsidiaries involved in the same transaction – may face enforcement by more than one competent authority, each applying the same underlying Council regulation but with different procedural rules and different enforcement cultures.
The practical question for a business in this position: have you mapped every jurisdiction in which the underlying transactions were performed, and identified every regulatory authority with a plausible jurisdictional claim? In our experience, businesses that begin with OFAC and add the other regimes as afterthoughts – rather than mapping all of them at the outset – find that corrective-action commitments made in the US settlement create commitments that are inconsistent with the position taken before a European authority.
For a detailed analysis of how EU enforcement interacts with the US position, see our analysis at OFAC vs EU: Penalty defence and settlement compared.
Risk flags: what businesses miss most often
Across the matters we handle, a set of recurring procedural and substantive errors drives unnecessary exposure in both OFAC and BIS enforcement proceedings. Identifying them early – ideally before a disclosure filing, not after – is where experienced counsel adds the most measurable value.
Incomplete transaction scope. Businesses tend to identify the apparent violation and disclose the specific transaction. Both OFAC and BIS expect a disclosure to cover the full scope of conduct – not merely the event that triggered the internal review. A disclosure that OFAC or BIS later finds to be narrower than the actual violation is treated as understated, with consequences for the mitigation credit.
Inconsistent factual narratives across jurisdictions. A statement made to OFAC about the state of knowledge of senior management can be read by a different authority in a way that damages the position before that authority. Co-ordinating the factual narrative across every filing – US, UK, EU – requires a unified document strategy from the outset.
Treating classification as an afterthought in a BIS matter. Export-control violations frequently arise from classification errors made years before the enforcement inquiry. Reconstructing the classification analysis after the fact – showing what information was available at the time and what process the business used – is both difficult and time-sensitive. Documents that might support a good-faith classification defence are destroyed in routine records-retention cycles. Act before that window closes.
Assuming OFAC and BIS will co-ordinate on your behalf. They do not. A business that files with one agency and expects the other to hear about it, or to wait, takes a risk. Parallel filings with coordinated narratives are the standard of practice, not an optional refinement.
Undervaluing the compliance-programme remediation narrative. Both OFAC and BIS treat evidence of genuine, pre-existing compliance investment as a mitigating factor. A business that can show that it had a functioning screening programme, that the violation arose from a gap the programme did not cover, and that it has already remediated that gap is in a substantially better position than one that presents compliance-programme improvements as a future undertaking.
A common misconception here: some businesses believe that a compliance programme that failed to prevent the violation is itself evidence of inadequacy that OFAC will hold against them. That is not how OFAC's published guidance works. A programme that was genuine, appropriately designed, and not wilfully blind to the risk – even if it did not catch this specific event – supports, rather than undermines, the mitigation case.
When to involve counsel: the decision sequence
The moment at which a business first identifies an apparent violation is the moment at which the practical options are widest. That window narrows quickly, and the decisions made in the first days determine the trajectory of the matter.
Situation A: the business identifies an apparent OFAC violation before any agency contact. The route is to scope the full violation, prepare a voluntary self-disclosure, co-ordinate any parallel BIS or foreign-authority filings, and open dialogue with OFAC. The indicative timeline from identification to filing varies by matter complexity, but OFAC's guidance contemplates prompt disclosure. Risk: under-scoping the disclosure or filing without the parallel BIS analysis already completed.
Situation B: the business receives a subpoena, an administrative demand, or an enforcement letter from OFAC or BIS before any internal review has been completed. The route changes: the immediate task is to preserve documents, identify the scope of the demand, and engage counsel before producing anything. Filing a VSD after receiving an enforcement letter does not attract the same mitigation credit as a pre-contact self-disclosure, but it remains a meaningful option and is better than no disclosure at all.
Situation C: the business has already responded to an agency demand, made representations, and is now in settlement discussions. The focus shifts to the penalty calculation, the compliance undertaking, and the public-notice framing. At this stage, the quality of the legal and factual narrative in the settlement agreement itself – particularly the characterisation of the conduct and the compliance-programme response – is the primary lever.
In all three situations, cross-border analysis is not optional: the question of whether another jurisdiction has, or is likely to develop, a parallel enforcement interest must be answered before each filing, not after.
If a transaction has already been flagged, or a filing has been refused or challenged, an early review can preserve options that narrow with time. For a confidential review of an apparent violation or a current enforcement matter, contact Calder & Vance at info@caldervance.com.
Related practices
- Apparent Violation Assessment – EU – identifying and scoping EU sanctions enforcement exposure before any disclosure filing
- OFAC vs BIS / EAR: Penalty defence and settlement (part II) – deeper treatment of the penalty-calculation methodology and compliance-undertaking design