A mid-size technology exporter ships a component to a distributor in a third market. Six months later, an internal audit flags that one end-user on the shipment list appeared on the SDN List (OFAC's list of Specially Designated Nationals and blocked persons) at the time of delivery. The compliance team freezes. Was this an OFAC matter, a BIS matter, or both? What filings, if any, are required? How does the analysis differ between the two US agencies – and what happens when a UK or EU regulator is also watching? These are the questions that define post-breach exposure.
When a potential breach touches both OFAC and BIS, businesses face two distinct enforcement regimes with different legal bases, different penalty structures, and different approaches to voluntary disclosure. Under OFAC, the analysis turns on whether blocked property was involved or a prohibited transaction occurred under IEEPA or another authority. Under BIS and the EAR (the Export Administration Regulations, the US Commerce Department's export-control rules), the question is whether a controlled item moved without a required licence. Both agencies operate voluntary self-disclosure programmes, but the procedural paths, the mitigating weight of a disclosure, and the interplay with parallel UK, EU, and other proceedings differ substantially.
This analysis maps the enforcement risk after a breach under each regime, identifies where businesses most commonly misjudge their position, and explains when cross-border counsel is essential rather than merely advisable.
What governs the two US regimes and why the distinction matters from day one?
OFAC administers economic and trade sanctions under IEEPA, the Trading with the Enemy Act, and a series of country- and thematic-specific authorities. BIS administers export controls under the Export Control Reform Act and the EAR. The two regimes share a physical address in Washington, but they are structurally separate: different legal bases, different triggering facts, different penalty maxima, and different disclosure mechanics.
This structural separation is the first thing businesses miss. A company that receives an inquiry from one agency will often assume the other is not watching. That assumption is wrong. OFAC and BIS both have referral relationships with the Department of Justice, and a matter that begins as an apparent EAR violation – say, a shipment to an entity on the Entity List (BIS's list of foreign persons subject to elevated licence requirements) – can surface an OFAC dimension if the same transaction involved blocked property or a SDN-linked intermediary. The reverse is equally common.
The governing instrument in each case is specific. OFAC enforcement is set out in its regulations, published enforcement guidelines, and the Economic Sanctions Enforcement Guidelines that describe how OFAC weighs aggravating and mitigating factors. BIS enforcement is governed by the EAR and by BIS's own penalty guidelines. Neither agency is bound by the other's findings, but in practice each monitors the other's published enforcement actions. In our experience, a company that has settled with one agency is immediately scrutinised more closely by the other.
The position above covers the standard case. Your facts – the goods, the parties, the route, the regime in play – change the analysis materially.
For an assessment of your cross-border exposure, contact Calder & Vance at info@caldervance.com.
How does OFAC assess a breach, and what mitigates the penalty?
OFAC's enforcement analysis is structured. It begins with a classification of the conduct as either an apparent violation (the agency's designation for a potential breach under review) or a confirmed violation, and it weighs aggravating factors against mitigating ones to determine the base civil monetary penalty and any reduction from that base.
The mitigating factors OFAC weighs include whether the business had a sanctions compliance programme in place before the conduct occurred, the degree of management knowledge of or involvement in the breach, whether the business voluntarily self-disclosed, and the speed and quality of the business's cooperation during the investigation. The aggravating factors include prior OFAC history, the value and volume of transactions involved, whether the conduct was wilful or reckless, and whether the business took steps to conceal the activity.
Voluntary self-disclosure to OFAC – technically a VSD (a voluntary self-disclosure to the regulator) – carries significant weight. OFAC's published guidelines treat a timely and complete VSD as a mitigating factor that can reduce the base penalty substantially. The question of whether to submit a VSD is therefore not academic: it is a strategic decision with direct consequences for the final penalty, the agency's characterisation of the conduct, and the likelihood of a no-action outcome. Timing matters acutely. A VSD submitted before the agency has independently learned of the conduct is treated more favourably than one submitted after an inquiry letter has already issued.
What businesses frequently underestimate is the five-year look-back. OFAC can pursue apparent violations that occurred within a defined statutory period, and the agency's investigators will examine not only the transaction in question but the broader pattern of the business's dealings during that window. A single disclosed transaction can open the door to a much wider inquiry.
How does BIS approach an EAR breach differently?
BIS enforcement under the EAR addresses the unauthorised export, re-export, or transfer of items on the Commerce Control List (CCL) (the BIS list of controlled goods, software, and technology classified by ECCN) and certain end-use and end-user violations. The analytical framework has surface similarities to OFAC's, but several structural differences change the risk calculus for businesses.
The first difference is jurisdictional reach. The EAR applies to all items "subject to the EAR", which includes items of US origin wherever they are in the world, items incorporating a sufficient proportion of US-origin content (de minimis threshold), and items produced abroad using certain US technology or software (the foreign direct product rule, which extends US jurisdiction to foreign-made items produced using US technology). This extraterritorial reach means that a non-US company, not itself operating in the US, can face BIS enforcement if its product meets one of these criteria. In our cross-border practice, this is among the most frequently misunderstood aspects of EAR exposure.
The second difference concerns disclosure mechanics. BIS operates a Voluntary Self-Disclosure programme administered by the Office of Export Enforcement. A well-constructed VSD can result in a no-action letter, a warning letter, or a reduced civil penalty – but the programme has specific procedural requirements. An initial notification must be submitted promptly, followed by a full written disclosure. Delay between the discovery of the potential violation and the initial notification is itself an adverse factor. BIS's published penalty guidelines describe the factors it weighs, and these map partially but not fully onto OFAC's framework.
The third difference is criminal exposure. BIS matters can be referred to the DOJ for criminal prosecution under the Export Control Reform Act. Wilful violations carry severe criminal penalties. OFAC matters can also generate criminal referrals, but the criminal-law route in export-control cases is more commonly exercised and more frequently results in indictment. Any post-breach analysis for a business with significant EAR exposure must therefore include a criminal-law assessment alongside the administrative-penalty question.
Where do the two regimes diverge most sharply on post-breach procedure?
The procedural divergence between OFAC and BIS is most pronounced in four areas: the disclosure obligation trigger, the role of prior violations, the treatment of remedial measures, and the interaction with non-US regulators.
On disclosure triggers, OFAC does not impose a legal obligation to self-disclose an apparent violation – but the decision not to disclose is itself a factor in any subsequent penalty determination. BIS follows a similar structure. Neither agency has a mandatory-disclosure rule equivalent to the reporting obligation that applies to financial institutions that hold or identify blocked property (which operates on a distinct and shorter timeframe). However, both agencies treat a failure to disclose known violations, once discovered internally, as an aggravating circumstance if the violation is later identified independently.
On prior violations, both agencies treat a history of prior enforcement action as a significant aggravating factor. A company that has received a warning letter from BIS and then commits a further apparent violation faces a substantially worse starting position than a first-time offender. OFAC's published guidelines make clear that the agency considers whether a prior penalty or finding of violation occurred within the preceding five years. The two agencies also share information with each other and with DOJ, so a prior BIS settlement is visible to OFAC investigators and vice versa.
On remedial measures, both agencies weigh the steps a business has taken after discovery: whether it suspended the relevant operations, strengthened its compliance programme, appointed external counsel, and cooperated fully with the investigation. In our experience, the businesses that fare best are those that begin documenting their remedial steps from the moment the potential violation is identified – not after the agency makes contact.
On the non-US dimension, a transaction that triggers an OFAC or BIS inquiry will often simultaneously engage OFSI in the United Kingdom, an EU competent authority, or another national regulator. These regimes are legally independent: a settlement with OFAC does not bind OFSI, and a no-action determination from BIS does not foreclose an EU enforcement proceeding. The divergence in how each regime weighs a prior settlement in another jurisdiction is a critical cross-border planning question. We return to this below.
What are the cross-border dimensions a business in the UK or EU must not miss?
For a business operating under both US and UK or EU oversight, the post-breach position is structurally more complex than a purely domestic US analysis. Three cross-border dimensions create the greatest practical risk.
First, simultaneous jurisdiction is the rule, not the exception. A payment processed through a US correspondent bank, a component of US origin, or a US-person employee involved in the transaction can engage OFAC jurisdiction over conduct that also triggers an OFSI or EU competent-authority inquiry. Managing two or more parallel proceedings requires careful coordination: statements made in one jurisdiction, documents produced in one proceeding, and admissions made in a VSD to one authority can all be relevant in another. There is no automatic privilege harmonisation across the US, UK, and EU legal systems.
Second, the disclosure obligations differ. OFSI imposes a mandatory reporting obligation on persons who know or have reasonable cause to suspect that they hold funds or economic resources owned or controlled by a designated person, and that obligation runs to a specific statutory period. This is structurally different from the discretionary VSD mechanism in the US. A business that has identified a potential OFAC breach must immediately consider whether the same facts trigger a mandatory OFSI report. The consequences of a missed OFSI report are serious and independent of any OFAC outcome.
Third, the EU framework – operating through national competent authorities rather than a single federal agency – introduces further procedural variation. An EU business facing a potential breach under the relevant Council regulation must assess which national authority has jurisdiction, what that authority's investigation powers are, and how the penalty calculus in that member state compares to the OFAC or OFSI outcome. In our practice, the EU dimension is frequently the last to be addressed by businesses that are focused on the US regulator – and that sequencing error compounds exposure.
For a focused analysis of post-breach risk under EU sanctions, see our companion piece at post-breach enforcement risk: OFAC vs EU. For the UK and Australian comparison, see OFSI vs Australia: post-breach enforcement risk.
If a transaction has already been flagged, or an internal audit has surfaced a potential breach, an early cross-regime review can preserve options that narrow with time. Contact Calder & Vance at info@caldervance.com for a confidential assessment.
What do businesses most commonly miss after a potential breach is identified?
The most common errors are not technical. They are sequencing errors – decisions made in the first days after discovery that foreclose better options later. Six patterns arise repeatedly in our practice.
The first is delay. Businesses that spend weeks in internal debate about whether a breach "really" occurred before consulting external counsel lose the benefit of early voluntary disclosure. Both OFAC and BIS treat the timeliness of a VSD as a factor in the penalty determination. An initial disclosure notification is not a full written report, and it does not need to be perfect – but it must be timely.
The second is scope under-assessment. A business that identifies one transaction as the apparent violation and discloses only that transaction, while missing related transactions in the same period, risks an aggravated outcome when the agency's own review uncovers the additional conduct. A thorough internal investigation, conducted under privilege, before the full written disclosure is submitted is essential.
The third is failure to map the non-US exposure. As described above, the same facts that produce an OFAC matter may simultaneously trigger OFSI, EU, or BIS proceedings. The sequencing of disclosures across jurisdictions, and the privilege and confidentiality analysis in each, requires coordinated cross-border advice.
The fourth is inadequate remediation documentation. Regulators on both sides of the Atlantic weigh what the business did after discovery. A business that suspends the relevant activity, commissions an independent review, retrains its staff, upgrades its screening, and appoints a compliance officer in response to the breach is in a materially better position than one that simply stops and waits. Every step taken should be documented at the time it is taken.
The fifth is conflation of OFAC and BIS. A business that routes all post-breach communications through a single team, treating the two agencies as interchangeable, will produce disclosures that are calibrated for one agency but not the other. OFAC and BIS have different disclosure formats, different evidentiary expectations, and different personnel reviewing the submission. Both deserve focused attention.
The sixth is underestimating the criminal dimension. Wilful export-control violations are prosecuted criminally. Even where the business's conduct was not wilful, the internal investigation may surface communications or facts that create criminal exposure for individuals. An assessment of individual criminal risk should be part of every post-breach analysis where BIS jurisdiction is engaged.
A practitioner scenario: dual-agency exposure in a technology supply chain
In a recent matter, a technology business discovered during an internal review that items subject to the EAR had been transferred to a subsidiary of an entity on the SDN List. The items had an ECCN classification that required a licence for the destination in question. Neither licence had been obtained. The same shipments involved payments routed through a US correspondent bank, engaging potential OFAC liability.
The business faced concurrent OFAC and BIS exposure. We assessed the apparent violations under each regime, confirmed that the facts engaged both agencies, and advised on the sequencing of disclosure. An initial notification to BIS was submitted promptly, followed by a full written disclosure after the internal investigation was complete. A parallel VSD to OFAC was submitted on the same timeline. Simultaneously, we assessed OFSI and relevant EU authority obligations and coordinated the disclosure strategy to avoid inconsistency across jurisdictions. Remedial steps – including a redesigned screening programme, updated ECCN classification procedures, and enhanced end-use controls – were documented throughout. The matter concluded without criminal referral and with penalty outcomes that reflected the voluntary cooperation and remediation record.
This scenario illustrates why the dual-agency, cross-border dimension cannot be treated as an afterthought. The decisions made in the first two weeks after discovery shaped every aspect of the outcome.
When is the myth of "the other agency won't find out" most dangerous?
A persistent misconception among businesses facing a potential breach is that settling quietly with one US agency insulates them from the other. It does not. OFAC and BIS routinely exchange information on enforcement matters, and both have referral relationships with DOJ. A settlement that resolves the OFAC dimension does not extinguish BIS jurisdiction over the same facts, and vice versa. Equally, a VSD submitted to BIS does not constitute a disclosure to OFAC.
The same misconception applies internationally. A business that settles with OFAC cannot assume that OFSI or an EU national competent authority has lost interest. Each regime operates independently. OFSI in particular has its own investigation capability and does not defer to OFAC's determinations. The EU competent authorities are under no obligation to align their penalty with the OFAC outcome. In a multi-regime enforcement environment, a closed OFAC matter can coexist with an active OFSI investigation of the same transaction.
The practical correction is straightforward. After a potential breach is identified, map every regime that may have jurisdiction before any disclosure is made to any of them. The mapping determines the sequencing. The sequencing shapes the outcome.
Related practices
- Apparent violation assessment – EU – scoping and advising on apparent violations under EU sanctions and export-control regimes.
- Post-breach enforcement risk: OFAC vs EU – comparative analysis of US and EU enforcement posture after a sanctions breach.