A mid-sized trading house discovers, mid-quarter, that a payment processed six months earlier cleared through a bank account connected to a listed entity. The transaction is done. The money has moved. Now the question is not whether a violation occurred – it is how bad the consequences will be, and which regulators will come knocking. Under OFAC the answer turns on aggravating and mitigating factors that are publicly documented. Under the EU the calculus is different, the timelines diverge, and the options available at each stage do not map cleanly onto one another.
Penalty defence and settlement under OFAC and the EU follow distinct procedural tracks, different aggravating-factor hierarchies, and fundamentally different settlement cultures. OFAC runs a structured civil-penalties process governed by IEEPA and its published enforcement guidelines, with a publicly documented base-penalty matrix and a voluntary self-disclosure (VSD – a proactive report to a regulator of an apparent violation before the regulator discovers it independently) route that can reduce the base penalty by a significant proportion. The EU operates through national competent authorities applying Council regulations, with no single settlement procedure and wide variation in how member states treat cooperation and disclosure.
This analysis maps the two regimes side by side: the legal authority, the penalty calculation methodology, the role of VSD, cooperation credit, and the practical divergence that cross-border businesses consistently under-estimate. It closes with the risk flags that most often determine whether a matter settles on favourable terms or escalates.
What legal authority governs each regime?
OFAC derives its civil-enforcement authority primarily from IEEPA and the Trading with the Enemy Act (TWEA), acting through the Office of Foreign Assets Control within the US Treasury. Its published enforcement guidelines establish how apparent violations are assessed, how the base penalty is calculated, and what factors move a case toward or away from the maximum. The guidelines are public, updated periodically, and form the primary reference for defence counsel in any OFAC matter.
The EU sanctions enforcement architecture is deliberately decentralised. Council regulations create the substantive prohibitions – asset freezes, transaction bans, sector restrictions – but enforcement sits with each member state's designated competent authority. Germany, France, the Netherlands, and other major member states each apply their own procedural rules, their own penalty ranges, and their own approach to cooperation credit. There is no EU-level equivalent of OFAC's single published enforcement scorecard.
This structural divergence is the first thing a cross-border business needs to internalise. A company with operations in New York, Amsterdam, and Frankfurt that encounters an apparent violation touching all three jurisdictions is not managing one enforcement risk. It is managing at least two – and the strategies that work before OFAC may not transfer to the relevant national authority in a member state.
How does OFAC calculate the civil penalty base?
OFAC's published enforcement guidelines establish a base-penalty matrix tied to the transaction value and the classification of the violation as either egregious or non-egregious. The base amount is then adjusted upward or downward based on a list of aggravating and mitigating factors that the guidelines enumerate in detail.
Aggravating factors include: wilful or reckless conduct; management awareness of the conduct; a pattern of violations rather than an isolated event; harm to US sanctions policy objectives; and obstruction of the investigation. Each factor is weighted, and the combination determines where within the statutory range the final penalty lands.
Mitigating factors carry equal formal weight. They include: a VSD submitted promptly and completely; a compliance programme that was operative and genuinely effective at the time (not retrofitted after the fact); remedial steps taken quickly; no prior sanctions history; and cooperation that went beyond the minimum required. In our cross-border practice, we have seen the distance between the maximum statutory penalty and the final settlement figure span an order of magnitude on the same transaction value, depending entirely on how these factors are documented and presented.
One figure that practitioners and businesses can cite with confidence, and that appears in OFAC's own materials: a timely and complete VSD can reduce the base penalty calculation by up to 50 percent. That is not a negotiated concession. It is a published rule. The consequence of failing to file a VSD when one was warranted – or of filing one that is incomplete – is therefore not merely procedural. It changes the arithmetic of the outcome.
What role does voluntary self-disclosure play across both regimes?
VSD is the single most consequential procedural decision in an OFAC enforcement matter. The decision to disclose, and the timing and completeness of that disclosure, can define the outcome more than any other factor. OFAC's guidelines treat a timely and complete VSD as the most powerful mitigating factor available to a respondent.
Timing matters sharply. A VSD is timely when it is submitted promptly after the business discovers the apparent violation – before OFAC has commenced its own investigation through other means. A disclosure made after OFAC has already received information pointing to the same conduct does not receive the same credit. In our experience, businesses that delay a VSD while conducting an overly cautious internal review often forfeit the timeliness credit, achieving a less favourable outcome than had they disclosed earlier with a commitment to supplement the record.
The EU position is more fragmented. Several member states – notably those with more developed financial-sanctions enforcement traditions – do provide formal or informal credit for proactive disclosure to the competent authority. But the mechanism, the timing requirements, and the degree of credit are not standardised across the union. A disclosure made to one national authority in accordance with its local practice may not satisfy the expectations of a different authority with jurisdiction over the same transaction through a different group entity. Businesses must verify the position in each relevant member state before committing to a disclosure strategy.
Does the absence of a pan-EU VSD procedure mean that disclosure to EU authorities is strategically less valuable? Not necessarily. In states where proactive disclosure is treated as genuine cooperation, the practical benefit can be significant. The risk is assuming that the OFAC model applies directly – and discovering, after disclosure, that the local authority operates on different expectations.
Where do the regimes diverge on penalty defence and settlement?
The divergence runs deeper than procedure. It reaches the underlying philosophy of what a penalty is for. OFAC's published framework is explicitly deterrent and expressly graduated: it publishes settlement amounts as a matter of public record, names the settling party, and describes the conduct. That transparency is intentional. It creates a body of precedent that defence counsel can use to calibrate expectations and build arguments by analogy.
EU member states vary considerably in how public their enforcement outcomes are. Some publish names and amounts; others settle through administrative processes that are not routinely announced. The absence of a consolidated public record means that benchmarking an EU penalty against comparable prior outcomes requires jurisdiction-specific expertise that is not available from a centralised source.
Settlement culture also differs. OFAC operates a settlement process that is adversarial in form but often pragmatic in practice. Once an apparent violation is referred for civil-penalty proceedings, the respondent has the right to respond, to submit evidence, and to negotiate a settlement amount through the formal process. The agency has a genuine interest in resolution short of administrative hearing. That interest is shared by most respondents.
The EU member-state processes vary from administrative penalty notices with a right of appeal, to negotiated undertakings, to criminal-law referrals in jurisdictions where sanctions violations can be prosecuted. The applicable regime in a given member state may offer no equivalent of OFAC's structured settlement negotiation at all – the penalty is issued and the only recourse is an appeal to the competent court or tribunal.
For a cross-border business managing apparent violations in both jurisdictions simultaneously, this means two separate strategies are required. They may need to run in parallel but cannot be treated as a single combined response.
Which regime is stricter on penalty defence and settlement?
Strictness is not a single variable; it depends on what aspect of the defence is being assessed. On transparency of the penalty calculation, OFAC is more structured and, in one sense, more predictable: the methodology is published, the factors are named, and precedent is available. On maximum penalty exposure, OFAC's IEEPA-based authority supports very significant civil penalties per violation, and multiple violations can aggregate rapidly in a case involving repeated transactions.
EU member-state penalties vary widely. Some jurisdictions impose penalties that are lower in absolute terms than OFAC's maximums on comparable conduct. Others – particularly where criminal enforcement is available – present greater personal liability for individual officers than the OFAC civil process, which is directed primarily at the entity.
OFAC is broadly understood as having the more active and resource-intensive enforcement posture among the major Western sanctions regimes. Its global reach through the US financial system, and the secondary-sanctions exposure it can create for non-US businesses, means that even a company with no US nexus beyond dollar-clearing is potentially within OFAC's enforcement reach. EU enforcement, while increasingly serious, has historically been less uniformly vigorous across member states – though that is changing, and businesses should not treat lower historical enforcement frequency as a forward-looking indicator.
In our practice, the answer to "which regime is stricter?" is almost always "it depends on the specific conduct, the specific member state, and whether there is personal liability risk for individuals." That is not a non-answer. It is the practical reason why a comparative analysis of both regimes is essential before any defence strategy is finalised.
What are the risk flags that escalate a matter?
Six patterns consistently move a matter from manageable to serious, whether the regulator is OFAC or an EU national authority.
First: management knowledge. If internal records show that a senior person was informed of the risk and the transaction proceeded, the "wilful or reckless" finding that aggravates a penalty becomes much harder to resist. Document preservation is critical from the moment a potential violation is identified.
Second: pattern conduct. A single transaction involving an apparent violation is treated very differently from a series of similar transactions over an extended period. Where screening systems failed repeatedly, or where a workaround was applied consistently, the pattern is an aggravating fact that no amount of post-hoc remediation fully neutralises.
Third: remediation that appears cosmetic. Both OFAC and EU authorities assess whether the steps a company took after discovering the violation were genuine and effective, or whether they were designed to satisfy the regulator rather than to fix the underlying problem. A compliance programme rebuilt in the three months between discovery and disclosure, without documented root-cause analysis, rarely receives full credit.
Fourth: incomplete disclosure. A VSD that omits transactions, understates the scope, or fails to identify all the relevant entities is worse than a complete one. OFAC has access to financial records through its own processes; if the agency identifies transactions that the disclosing party did not include, the incomplete disclosure itself becomes an adverse fact.
Fifth: cross-border coordination failure. Where the same apparent violation touches OFAC and an EU national authority, a response strategy built for one regulator without regard to the other creates inconsistency. Inconsistent representations to two separate authorities – even if each is individually accurate – can produce an evidentiary problem that neither the US nor the EU strategy anticipated.
Sixth: delay in preserving records. Sanctions enforcement investigations, whether under OFAC or the applicable EU member-state procedure, turn on documentation: transaction records, screening logs, counterparty due-diligence files, email chains. Where records are lost, overwritten, or not preserved from the moment the potential violation is identified, the gap in the record is rarely interpreted favourably.
If you have identified any of these patterns in a current matter, the time to involve counsel is now – not after the regulator's first contact.
How does secondary-sanctions risk affect EU businesses in an OFAC matter?
Secondary-sanctions exposure is the dimension of OFAC enforcement that EU businesses most consistently under-estimate. Secondary sanctions are restrictions that apply not because a non-US company has a direct US nexus, but because of the conduct itself – and the consequence of that conduct on US persons, the US financial system, or designated counterparties. A European business that processes a payment through a correspondent bank in New York, even as a mechanical step in a euro-denominated transaction, has created a US nexus sufficient for OFAC to assert jurisdiction.
The practical consequence is that an EU company managing an apparent sanctions violation must assess OFAC exposure in parallel with the local national competent authority, not as an afterthought. The company's lawyers in Frankfurt or Amsterdam may be focused entirely on the German or Dutch enforcement risk. If no one is simultaneously assessing the OFAC dimension, the company may be making decisions – about disclosure timing, about remediation steps, about counterparty notifications – that are suboptimal from an OFAC perspective even while being well-managed from a local perspective.
This is exactly the kind of cross-border coordination gap that produces avoidable escalation. In our cross-border practice, we regularly advise clients on mapping both exposure tracks before any external communication is made. The sequencing of disclosure, the framing of cooperation, and the documentation of remediation need to be coherent across both regimes from the outset.
The EU Blocking Regulation adds a further layer of complexity for businesses with US and EU operations simultaneously. Where OFAC-listed conduct touches EU-protected trade, the EU business faces potentially conflicting legal obligations – a compliance dynamic that requires specialist advice, not a choice made unilaterally by the local legal team.
What should a cross-border business do about penalty defence and settlement?
The first three actions after identifying a potential violation determine more of the outcome than anything that happens later. They are: preserve all relevant documentation immediately; assess the OFAC exposure and the EU national-authority exposure as separate but parallel tracks; and obtain advice on VSD eligibility and timing before making any external communication.
Document preservation is not discretionary. It should be treated as an operational trigger: the moment a compliance officer identifies a potential violation, document-hold procedures should engage automatically. The same standard applies whether the enforcement risk is OFAC or EU.
VSD eligibility assessment must happen before the disclosure decision, not after. The question is whether the violation is the kind of matter for which a VSD will receive meaningful credit, whether it is timely (i.e., before the regulator has already discovered it), and whether the company can deliver a complete and accurate initial disclosure. A VSD that fails any of these tests should be approached with caution.
Parallel-track assessment means mapping the OFAC exposure, the relevant EU member-state exposure, and any additional regulatory risk (including the UK through OFSI, if there is a UK nexus) before the response strategy is finalised. Where a company has entities in multiple jurisdictions, each entity's exposure must be assessed separately: a settlement reached by the US parent does not automatically resolve the liability of the EU subsidiary under the applicable member-state regime.
The decision matrix runs as follows. Where the apparent violation is isolated, involves no management knowledge, and the business has a demonstrably effective compliance programme, the case for a prompt and complete VSD is strong in both the OFAC and many EU contexts. Where the violation involves a pattern, management awareness, or a gap in the compliance programme, the response is more complex: a VSD is still likely valuable, but the documentation supporting the mitigating factors needs to be carefully prepared before submission. Where personal liability risk for officers or directors is in play under the applicable member-state criminal law, the strategy diverges sharply and individual counsel must be engaged for the relevant individuals.
If a filing has already been refused, or if OFAC has made first contact, the window for the most advantageous positioning is narrowing. An early review of the facts, the documentation, and the applicable penalty methodology can preserve options that close quickly.
For a confidential review of a potential breach under OFAC or the applicable EU regime, contact Calder & Vance at info@caldervance.com.
Related practices
- Apparent Violation Assessment (EU) – early-stage scoping of EU enforcement exposure and disclosure options
- OFSI vs Australia: Penalty Defence and Settlement – comparative analysis of UK and Australian enforcement postures
- Post-Breach Enforcement Risk: BIS/EAR vs EU – export-control enforcement comparison for dual-use and controlled-goods businesses