A multinational discovers, mid-quarter, that a payment it processed three months ago moved funds through a correspondent chain that included a blocked entity. The transaction is done. The money has settled. Two enforcement teams – one in Washington, one in Brussels – could open files on the same set of facts. How each authority measures culpability, calculates a penalty base, and responds to remediation tells you almost everything about which exposure is larger and which disclosure to make first.
Enforcement risk after a breach under OFAC and the EU sanctions regime diverges sharply on four axes: the legal basis for liability, the penalty-calculation methodology, the weight given to voluntary self-disclosure (VSD – a voluntary report made to the regulator before it learns of the conduct independently), and the role of proportionality in the final sanction. As of early 2026, OFAC uses a multi-factor matrix that can, in principle, produce a civil penalty calibrated to transaction value, whereas the EU operates through national competent authorities applying domestic criminal and administrative law with no harmonised penalty ceiling. Neither regime promises leniency; both reward genuine cooperation, but on different terms and timelines.
This analysis maps the key divergences across the full enforcement lifecycle – from the moment a potential breach is identified, through the disclosure decision, to penalty resolution – and draws out the practical implications for a business facing exposure on both sides of the Atlantic.
How does OFAC establish liability and measure the penalty base?
OFAC establishes civil liability for an apparent violation (any transaction that on its face contravenes a sanctions prohibition, before intent is assessed) through an administrative process governed by IEEPA and the relevant programme regulations. The agency does not require proof of intent for civil liability, though intent is central to the aggravating and mitigating analysis that follows.
The penalty base for a civil violation is the higher of a statutory maximum or, in many programmes, the transaction value – whichever produces the larger figure. Because OFAC aggregates multiple transactions into a single enforcement action, a pattern of small payments can produce a penalty base that is a large multiple of any individual transfer. This aggregation dynamic is one of the most underestimated features of OFAC enforcement, and in our experience it catches compliance teams who price each transaction in isolation.
OFAC's published enforcement guidelines set out a series of aggravating factors – management awareness of the conduct, systemic programme failures, harm to sanctions policy objectives, prior history of violations, and whether the subject is a financial institution with heightened responsibility. Each factor can move the settlement figure upward from a notional base. Mitigating factors work in the opposite direction: a well-designed compliance programme, a genuine record of voluntary disclosure, cooperation with the investigation, and prompt remedial action all reduce the final number. The relationship between these factors is not a formula; it is a judgment call exercised at the agency level.
What the OFAC process does not offer is a statutory appeal route once a civil penalty is agreed. The settlement is final. Challenging a penalty notice in federal court is possible, but the standard of review is deferential to the agency. For most businesses, the real contest happens inside the administrative process – in the VSD, in the pre-penalty notice response, and in the conference, if one is requested.
How does EU enforcement operate differently at source?
EU sanctions enforcement does not have a single authority equivalent to OFAC. The EU Council enacts the substantive prohibitions through Council Regulations, but enforcement is delegated entirely to the competent authorities of each member state. A French bank, a German logistics company, and a Dutch commodities trader each face enforcement action in their home jurisdiction, under domestic administrative or criminal law, applying the EU prohibitions as incorporated into national legislation.
This decentralisation has a direct consequence: penalty levels, procedures, prosecutorial discretion, and the availability of deferred prosecution arrangements vary markedly across the EU. A disclosure made to one national authority does not automatically inform another, nor does it create a common record across all jurisdictions where the same entity operates. A group with subsidiaries in five member states could, in principle, face five separate enforcement proceedings arising from the same underlying conduct – a point that often surprises compliance teams accustomed to the OFAC model, where a single Washington settlement resolves the entire US position.
In our cross-border practice, we regularly advise groups operating across multiple EU member states on the need to map their regulatory footprint before deciding where – and in what order – to make disclosures. The sequencing decision is consequential. A disclosure that triggers criminal proceedings in one jurisdiction can complicate a parallel administrative process in another.
The EU does not have a harmonised VSD regime. Some member states treat voluntary disclosure as a formal mitigating factor under their administrative penalty rules; others treat it informally, with no statutory credit. The 2021 EU Dual-Use Regulation introduced a clearer compliance-programme assessment for export-control violations, but financial sanctions enforcement remains largely unharmonised. This is a live divergence, and one that the European Commission has signalled it intends to address through its ongoing legislative programme on sanctions enforcement harmonisation – though the timeline for concrete change remains subject to the legislative process.
Does voluntary self-disclosure reduce enforcement risk equally under both regimes?
Under OFAC, a timely and complete VSD is one of the most reliable ways to reduce civil-penalty exposure. OFAC's enforcement guidelines treat a qualifying VSD as a significant mitigating factor, capable of reducing the base penalty substantially. The VSD must be genuinely voluntary – meaning it is made before OFAC has initiated an investigation or received information about the conduct from another source – and it must be full and accurate. A partial disclosure that is later found incomplete can be treated as an aggravating factor rather than a mitigating one.
The mechanics matter. A VSD that accurately describes the conduct, identifies the sanctions programme involved, quantifies the transactions, and attaches supporting documentation earns more credit than a brief notification followed by months of incomplete responses to agency requests. OFAC assesses the quality of cooperation throughout the investigation, not just the act of initial disclosure. A business that discloses promptly and then manages the agency's requests poorly will not receive the full benefit of its early decision.
The EU position is more varied. In member states with formal administrative-penalty regimes for sanctions violations, voluntary disclosure is generally treated as a mitigating circumstance under domestic administrative law – but the procedural requirements, deadlines, and quantum of credit differ. In member states that primarily prosecute sanctions violations as criminal offences, the applicable rules are those of criminal procedure, and the effect of a disclosure depends on factors including whether it constitutes cooperation with an ongoing investigation, whether it precedes or follows the opening of proceedings, and the discretion of the public prosecutor. There is no equivalent of OFAC's published framework that allows a practitioner to estimate, even roughly, the percentage reduction that a good-quality VSD is likely to produce.
What does this mean in practice? A cross-border business with parallel OFAC and EU exposure should not assume that a disclosure strategy optimised for OFAC will work equally well in every EU jurisdiction. The two decisions – whether to disclose to OFAC and whether, when, and where to disclose in the EU – need to be assessed separately, against the specific legal environment of each relevant member state. Coordinate them, but do not conflate them.
How does each regime assess the quality of a compliance programme?
OFAC's compliance-programme analysis is structured. The agency applies a five-pillar model – management commitment, risk assessment, internal controls, testing and auditing, and training – and assesses the adequacy of a firm's programme against that model when determining the appropriate sanction. A demonstrably well-designed and genuinely implemented programme is a significant mitigating factor. A paper programme that exists in documentation but not in practice is, in OFAC's published view, an aggravating factor: it suggests the firm was aware of its obligations and failed to meet them in substance.
The EU approach, again, varies by member state. National competent authorities in larger financial centres tend to have developed their own compliance-programme assessment criteria, often drawing on sector-specific guidance from their financial supervisory authorities. Smaller or less-resourced authorities may have no published standard at all. This means a compliance programme that satisfies the rigorous assessment of one national authority may be assessed very differently – or not assessed at all – by another.
One convergence worth noting: both the OFAC framework and the more sophisticated EU national frameworks treat the existence of an effective compliance programme as distinct from the absence of a violation. A strong programme does not prevent a breach from occurring. What it does is inform the regulator's view of whether the breach was the product of systemic failure or of an isolated control gap. That distinction drives a significant difference in outcome.
We have acted for businesses in sectors where regulators on both sides of the Atlantic have scrutinised programme quality in detail. The pattern we observe is consistent: firms that can demonstrate a genuine culture of compliance, with documented risk assessments, tested controls, and board-level engagement, have a meaningfully stronger negotiating position than those whose programme exists primarily on paper.
What are the key risk flags for cross-border businesses facing dual exposure?
The primary risk flag is jurisdictional overlap without a coordinated response. A business that settles with OFAC and then discovers that the same conduct is being investigated by a national authority in an EU member state – without having prepared the EU disclosure separately – is in a materially weaker position than one that managed both tracks from the outset. OFAC settlements are public. National enforcement authorities in the EU monitor OFAC enforcement actions involving entities with a European footprint.
The second risk flag is aggregation under OFAC combined with fragmentation in the EU. Because OFAC aggregates all transactions in a programme into a single penalty analysis, a business's full exposure under OFAC may be visible from the outset. In the EU, by contrast, the same transactions may produce separate proceedings in multiple member states, each with its own penalty ceiling and procedural timetable. The total EU exposure may, in certain cases, exceed the OFAC figure – but it will only become clear progressively, as each national authority completes its investigation.
A third flag is the treatment of parent and subsidiary liability. Under OFAC, the 50 percent rule (the rule treating entities owned 50 percent or more by blocked persons as themselves blocked) applies to both the blocked person and to the controlled entity. Liability for a sanctions violation runs to the entity that conducted the transaction. Parent liability is not automatic, but group-level compliance failures can be attributed upward if facts support it. In the EU, liability attribution rules are those of the applicable domestic corporate law in each member state – which introduces further variation.
Finally, document-preservation obligations diverge. OFAC's record-keeping requirements run for a period set out in the relevant programme regulations and OFAC's general guidance. EU member-state requirements vary, but in general businesses should preserve all records relevant to a potential violation until any investigation is formally closed, across every jurisdiction where they operate. Beginning a document-preservation hold only after a disclosure has been made – rather than at the point a potential breach is identified – is an error that is difficult to correct.
Does the extraterritorial reach of OFAC change the EU-based business's calculation?
It does, materially. OFAC's jurisdiction extends beyond US persons and US-incorporated entities. US-dollar-denominated transactions that clear through US correspondent banks, goods of US origin, and technology controlled under the EAR can all bring a non-US entity within OFAC's enforcement reach, even where the entity has no US operations, no US employees, and no US beneficial owners. This is the secondary-sanctions dimension: conduct that occurs entirely outside the United States can still produce US enforcement exposure if a US nexus – dollar clearing, US-origin goods, or US-person involvement – is present.
For an EU-based business, this means that an apparent violation that it would characterise as a domestic matter – a breach of an EU Council Regulation – may simultaneously constitute an OFAC violation, with a penalty base that reflects the full transaction value in US dollars and a penalty-reduction framework that demands a VSD made directly to a US regulator. The EU disclosure and the OFAC disclosure are separate obligations, to separate authorities, on potentially different timelines. Failing to address both – or addressing one without the expert input needed for the other – leaves a significant portion of the exposure unmanaged.
In our experience, EU-based compliance teams that have not previously dealt with OFAC enforcement consistently underestimate the speed at which the agency moves once it has identified a potential violation. The window to make a credible VSD before OFAC opens an investigation independently can be short, and the difference in outcome between a VSD and an agency-initiated investigation is substantial. Speed matters on the US track in a way that does not always translate to the EU administrative process, which tends to move more slowly.
The position above covers the standard cross-border case. Your specific facts – the currency of the transaction, the origin of the goods, the jurisdictions of the counterparties, and the regimes in play – will change the analysis. If a transaction has already settled or a filing has been refused, the options available narrow with time.
To discuss a confidential review of your potential exposure, contact Calder & Vance at info@caldervance.com.
A common misconception: settling with OFAC resolves the full cross-border exposure
The most persistent misconception we encounter is that an OFAC settlement – particularly a public one that involves a detailed statement of facts – resolves all enforcement risk arising from the same conduct. It does not. An OFAC settlement resolves the US civil sanctions exposure. It does not bind any EU national authority, any UK authority, any prosecutor in a member state that criminalises sanctions violations, or any financial supervisor assessing the adequacy of the firm's AML and sanctions controls.
In some cases, the OFAC statement of facts is used by EU authorities as an evidentiary starting point for their own proceedings. The detailed transaction-by-transaction analysis that OFAC publishes in a settlement – which is designed to demonstrate the agency's rigour and to deter future violations – can become a roadmap for a national authority that would otherwise have had to build the same factual record itself.
Does this mean a business should delay its OFAC settlement while managing EU proceedings? Not necessarily. It means the two tracks must be actively managed in parallel, with attention to how each public or formal step on one track affects the position on the other. The sequencing of disclosures, the scope of what is admitted in a settlement statement, and the timing of remediation announcements all have consequences that reach beyond the jurisdiction in which each decision is made.
A coordinated enforcement-defence strategy that addresses both the US and the EU dimensions from the outset is, in our view, materially more likely to produce a proportionate and manageable outcome than two separately managed processes that proceed without reference to each other. The firms that manage this well are those that involve cross-regime counsel early – before the disclosure is made, not after the settlement is agreed.
If a transaction has already been flagged or an investigation appears to be opening, an early review can preserve options that narrow as the process advances. Contact Calder & Vance at info@caldervance.com for a confidential assessment of your position.
Related practices
- Apparent Violation Assessment – EU – assess and scope apparent violations under EU sanctions regulations
- Enforcement risk after a breach: OFSI vs Australia – compare UK and Australian enforcement postures for cross-border matters
- Enforcement risk after a breach: OFSI vs Australia – further analysis – extended regime comparison for businesses with UK and Australian exposure