A logistics group with operations spanning New York, Amsterdam, and Singapore closes what it believes is a routine trade-finance transaction. Months later, it receives an administrative subpoena from OFAC. Simultaneously, an EU member-state authority opens a parallel inquiry under the applicable Council regulation. Two enforcement actions. Two procedural regimes. Two very different ideas about how settlement works.
Penalty defence and settlement under OFAC and the EU sanctions regime diverge in structure, transparency, and negotiating leverage. OFAC operates a documented civil-penalty process anchored in its enforcement guidelines, with a published base-penalty matrix and explicit credit for voluntary self-disclosure. The EU embeds enforcement in member-state criminal and administrative law, producing a patchwork where the penalty currency, the settlement route, and the evidentiary burden differ by jurisdiction. Neither regime guarantees a fixed outcome; both reward early, well-prepared engagement.
This analysis maps the key divergences across six dimensions: legal authority and enforcement structure, how each regime calculates the penalty base, the role of voluntary self-disclosure, the settlement and resolution process, evidentiary standards and the burden of proof, and the cross-border coordination risk that arises when both regimes fire at once.
What legal authority governs each enforcement regime?
OFAC derives its civil-enforcement authority from the International Emergency Economic Powers Act ("IEEPA") and, for older programmes, the Trading with the Enemy Act ("TWEA"). OFAC issues its own enforcement guidelines – a publicly available document that sets out the analytical framework, the base-penalty matrix, and the aggravating and mitigating factors the agency applies. The process is administrative: OFAC acts as investigator, prosecutor, and adjudicator within the executive branch, subject to judicial review in the federal courts.
The EU regime is structurally different. The relevant Council regulations create the prohibition and identify the conduct that is unlawful. Enforcement, however, sits with member states. Each member state implements a domestic enforcement statute – the applicable country regime – and that statute determines whether a violation is prosecuted as a criminal offence, a civil administrative breach, or both. The result is that a single EU-wide restriction can produce enforcement in multiple jurisdictions, each with its own penalty ceiling, its own prescription period, and its own procedural rules.
For a cross-border business, this divergence is not merely academic. A payment routed through a US correspondent bank may expose the originating bank in Amsterdam to OFAC's jurisdiction, to Dutch enforcement under the applicable country regime, and potentially to German or French enforcement if group entities there are implicated. In our experience, companies often underestimate how quickly a single transaction generates a multi-authority exposure map.
The position above covers the structural baseline. Your facts – the jurisdictions involved, the entities that processed the transaction, and the goods or services at issue – will determine which authorities have actual jurisdiction and in what sequence.
For a detailed assessment of exposure under the EU enforcement architecture, our team advises on apparent violation assessment under EU sanctions, a structured first step that scopes the legal risk before a formal response is filed.
How does each regime calculate the penalty base?
OFAC's penalty calculation begins with a base-penalty figure derived from the transaction value, subject to published statutory caps per violation, and then adjusts upward or downward according to a matrix of aggravating and mitigating factors. The maximum civil monetary penalty under IEEPA is set by statute and is adjusted periodically for inflation – verify the current figure before relying on it. Where a violation is wilful or reckless, the cap rises. Where the violator has no prior history, the transaction was commercially routine, and the harm to sanctions-programme objectives was minimal, the base penalty can fall substantially.
The published nature of OFAC's matrix is a defence tool. A well-prepared presentation of mitigating factors – demonstrating the compliance programme, the immediate remediation steps, the absence of prior violations, and management's response – directly reduces the calculated base. That transparency is absent in most EU member-state regimes, where the penalty is set by prosecutorial or administrative discretion within a statutory range, and where the range itself varies enormously by jurisdiction.
Some EU member states impose criminal penalties for wilful violations: custodial sentences, director-level liability, and confiscation orders. Others operate purely administrative regimes with fixed scales. A few provide for negotiated administrative fines. There is no EU-level enforcement authority with the power to impose a harmonised sanction; the European Commission does not enforce member-state sanctions breaches directly. This means that the "EU penalty" is in practice whatever the competent authority in the relevant member state decides it should be, within its domestic legal ceiling.
What does this mean for defence strategy? Under OFAC, the defence effort is concentrated: one agency, one framework, one negotiation. Under the EU, the effort may need to be replicated across two or three national jurisdictions, each requiring local counsel in the relevant jurisdiction and each running on its own timetable.
Does voluntary self-disclosure change the outcome – and how differently across OFAC and the EU?
Under OFAC, a voluntary self-disclosure ("VSD") – a proactive report of an apparent violation to OFAC before the agency learns of it independently – is a codified mitigating factor. OFAC's enforcement guidelines treat a qualifying VSD as reducing the base penalty by a significant proportion. This creates a genuine incentive to disclose and to disclose promptly. The VSD must be timely, must be followed by a full and accurate account, and must not be merely reactive to an ongoing investigation. A VSD that arrives after OFAC has already opened an inquiry does not qualify for the same reduction.
The EU has no equivalent harmonised VSD mechanism. Some member states have introduced self-reporting incentives in their domestic enforcement statutes, and competent authorities in several jurisdictions do treat proactive cooperation as a mitigating factor in penalty determination. But the credit for disclosure is not codified in a published matrix, the discount is not guaranteed, and the risk of criminal self-incrimination in jurisdictions with criminal enforcement regimes complicates the calculus significantly. In those jurisdictions, any disclosure must be advised with criminal-law privilege firmly in mind.
In our cross-border practice, we regularly advise businesses that face the question of whether to disclose to OFAC, to an EU member-state authority, or to both – and in what sequence. The sequencing matters. A disclosure to OFAC that does not accurately map the EU-touching elements of the same transaction may later expose inconsistencies when the EU authority runs its own inquiry. Conversely, an EU-focused disclosure may describe a transaction in terms that, read by OFAC, look worse than a carefully structured OFAC VSD would have framed it.
Does your compliance programme have a VSD-decision protocol that accounts for multi-regime exposure? If it does not, the first enforcement action will create the protocol under pressure – which is not the moment to be designing it.
How does settlement work – and where do the processes diverge most sharply?
OFAC settlement follows a defined administrative process. After the agency issues a pre-penalty notice, the respondent has a statutory window to submit a written response, to present mitigating evidence, and to request a meeting. Settlement – in OFAC's terminology, a settlement agreement accompanied by a civil monetary penalty – is then negotiated. OFAC may accept an undertaking to implement remedial compliance measures in lieu of a higher monetary penalty. The published settlement notices, which OFAC releases after resolution, provide a record of how the agency has treated comparable fact patterns and what compliance undertakings it has required.
This transparency is a strategic asset for defence counsel. We have acted for businesses where the published record of analogous settlements – the penalty level, the compliance commitments, and the described mitigating factors – formed the backbone of the negotiating submission. OFAC is not bound by those precedents, but the published framework creates a legitimate basis for argument.
EU member-state settlement processes vary. In administrative regimes, the competent authority may accept a negotiated resolution, a compliance undertaking, or a consent order, depending on the applicable country regime. In criminal regimes, the position is more constrained: criminal prosecution does not typically conclude by settlement in the same way, and deferred-prosecution arrangements, where they exist at all, are a function of domestic criminal-procedure law rather than sanctions-specific legislation. The transparency of published outcomes is also inconsistent across member states; some authorities publish enforcement notices routinely, others publish only summaries, and a few publish very little at all.
One practical divergence is timing. OFAC's administrative process, from the issuance of a pre-penalty notice to final resolution, typically runs over many months and can extend to well over a year for complex matters. EU criminal proceedings can run for several years. Administrative EU proceedings are generally faster, but the variation is wide. A business managing parallel OFAC and EU proceedings must budget for the two processes running on different clocks, with different information demands and different interplay between what is disclosed in each forum.
For an in-depth comparison of how a second enforcement action in another regime intersects with a live OFAC matter, see our related analysis at penalty defence and settlement: OFAC and EU – further analysis.
What evidentiary standards and burdens apply, and how do they affect defence preparation?
OFAC's civil-penalty process is administrative, not criminal. The standard of proof is the civil administrative standard: OFAC determines, on the evidence before it, whether an apparent violation occurred. The burden is effectively on the respondent to demonstrate that the facts support a lower penalty or no penalty, because OFAC begins with a presumption that its pre-penalty notice reflects a supportable finding. A respondent that fails to submit a substantive response, or submits one that is inconsistent or incomplete, forfeits the opportunity to reduce the penalty.
The documentary record is therefore central. OFAC expects the respondent to produce transaction records, ownership-and-control analysis, screening documentation, compliance-programme materials, and evidence of remediation. In our experience, the quality of that documentary record – how complete, how consistent, how credibly presented – makes a measurable difference to the outcome. A compliance programme that was imperfect at the time of the violation but has been genuinely upgraded can support a significant reduction in the calculated penalty; a paper programme that was never operationalised does not.
In EU criminal proceedings, the standard shifts to the criminal standard: proof beyond reasonable doubt or its domestic equivalent. Director-level defendants may face personal criminal liability, which changes the defence calculus fundamentally. Evidence obtained in an administrative context – a self-disclosure to OFAC, an internal investigation report shared with OFAC counsel – may not be privileged in a later EU criminal proceeding, depending on the applicable domestic rules on privilege and on the use of compelled testimony. This is a risk that must be managed from the outset, not addressed retrospectively.
Administrative EU proceedings operate closer to OFAC's civil standard, but the precise rules – what evidence the authority can compel, what notice it must give, and what right of challenge the respondent has – depend on the applicable country regime. The EU General Court has jurisdiction to annul Council listings and, in appropriate cases, to review the legal basis for a sanction, but it is not an appellate body for member-state enforcement decisions. Those challenges go through the domestic judicial-review route.
What cross-border coordination risks arise when OFAC and EU enforcement run in parallel?
Parallel enforcement is the hardest situation to manage and, in our practice, the most frequently underestimated risk. A transaction that touches a US correspondent bank, an EU-based originator, and a third-country beneficiary can simultaneously engage OFAC's jurisdiction over the US leg, the member-state authority's jurisdiction over the EU leg, and potentially the UN Consolidated List if a designated party is involved at any node.
Three coordination risks stand out. First, inconsistency of narrative: statements made to OFAC in a VSD or a pre-penalty response may be inconsistent with statements made to an EU authority if the underlying facts are not precisely mapped before either filing is submitted. OFAC and EU authorities do share information in appropriate cases, and a business whose US filing contradicts its EU filing is in a materially worse position than one that managed both disclosures from a single, carefully constructed factual record.
Second, sequencing of privilege: internal investigation reports, legal memoranda, and counsel communications may be privileged under US law but not under the law of the member state conducting the EU inquiry. Whether attorney-client privilege or legal professional privilege attaches, and whether it survives compelled disclosure in another jurisdiction, must be assessed before any document is produced to any authority.
Third, the risk of debarment or collateral consequences: an OFAC settlement agreement may require the business to implement specific compliance upgrades. An EU criminal conviction or a debarment order in a member state may affect the business's ability to operate in EU markets, obtain public contracts, or maintain a banking relationship. These consequences interact. A settlement that resolves OFAC exposure does not extinguish EU enforcement exposure, and the business must ensure that its remediation plan addresses all pending authorities, not only the one that moves first.
If enforcement notices have already been received, the window to preserve strategic options closes quickly. An early review of the cross-jurisdiction exposure map is the first and most time-sensitive step.
For a comparison of how the UK regime under OFSI compares with Australia's autonomous-sanctions enforcement posture, see our analysis at penalty defence and settlement: OFSI vs Australia.
Common myths – and what the evidence actually shows
One persistent myth is that the EU is systematically more lenient than OFAC on corporate sanctions violations. The basis for this view is usually a comparison of published penalty totals, which in the US have historically been larger. That comparison is misleading. OFAC's published penalty figures are the product of a centralised enforcement machine with a single public register. EU enforcement is distributed across twenty-seven member-state authorities, many of which publish limited data. The true EU enforcement tally, aggregated across all member states and including criminal proceedings, is not visible in any single database.
The practical position for a multinational is that both regimes can produce material exposure. What differs is the transparency of the process, not its severity. OFAC's published matrix creates predictability. EU enforcement creates uncertainty – which, for a business managing its risk, may be the harder outcome to plan for.
A second myth is that an internal investigation that clears the business at the OFAC level will satisfy the EU authority. It will not, automatically. The scope, methodology, and conclusions of an internal investigation that is designed to meet OFAC's evidentiary expectations may not map cleanly onto what an EU authority in a particular member state expects to see. We have acted in matters where an OFAC-focused investigation had to be substantially supplemented for EU purposes, at considerable additional cost and delay.
A third myth is that a business with a strong compliance programme at the time of the violation has nothing to worry about. A well-designed compliance programme is a significant mitigating factor under OFAC's published framework – and under most EU administrative regimes. But it is a mitigating factor, not a defence. The question is not whether a programme existed; it is whether the programme would have caught this transaction, and why it did not.
Related practices
- Apparent Violation Assessment – EU – structure your EU exposure before a formal response is required
- Penalty Defence and Settlement: OFAC and EU – Further Analysis – extended review of process mechanics and settlement precedents