A multinational trading house discovers that a payment processed six months ago touched a counterparty with indirect links to a person on the SDN List (OFAC's list of Specially Designated Nationals and blocked persons). The transaction was small. The exposure was inadvertent. But the question that follows is not small: does the business disclose, and if so, to which authority, under what procedure, and with what consequence? When the business also holds Canadian operations, the same underlying facts may trigger a parallel obligation under Global Affairs Canada's sanctions enforcement regime – and the two paths do not run in the same direction.
Remediation after a sanctions breach under OFAC and under the Canadian regime share a core logic – identify, stop, disclose, remediate – but diverge sharply on procedure, penalty calculation, and the weight given to a voluntary self-disclosure (VSD, the act of proactively reporting an apparent violation to the regulator before it is detected). As of March 2026, OFAC operates a structured civil-penalty framework with published aggravating and mitigating factors, while Canada's regime under the applicable statutes applies a criminal-law overlay that makes the disclosure calculus materially different.
This analysis sets out the governing authority in each regime, the remediation procedure step by step, where the two regimes diverge on the key decision points, and the practical implications for a business with exposure on both sides of the border.
What are the governing authorities and legal bases in each regime?
OFAC administers the US sanctions regime under authority derived principally from the International Emergency Economic Powers Act (IEEPA) and the Trading with the Enemy Act (TWEA), supported by regime-specific executive orders. OFAC holds both civil and – by referral to the Department of Justice – criminal enforcement authority. Its published enforcement guidelines set out the factors that determine whether an apparent violation results in a no-action letter, a cautionary letter, or a civil monetary penalty. Those guidelines are public, detailed, and form the operational backbone of any remediation strategy.
Canada's financial-sanctions regime rests on the Special Economic Measures Act (SEMA) and, for UN-mandated measures, the United Nations Act. Global Affairs Canada (GAC) administers the regime. Unlike OFAC, GAC does not publish a single consolidated enforcement-factors document analogous to OFAC's penalty guidelines. Enforcement has historically operated through criminal-law mechanisms, with the Royal Canadian Mounted Police and prosecutors involved in serious cases. That distinction – civil administrative enforcement under OFAC versus criminal-law exposure in Canada – defines the strategic difference between the two paths.
A business with US-dollar transactions, US persons, or US-incorporated subsidiaries must assume OFAC jurisdiction regardless of where it is headquartered. The Canadian regime applies to persons in Canada and Canadians abroad. Where both jurisdictions are engaged, a single underlying transaction can simultaneously trigger OFAC's civil enforcement process and Canadian criminal investigation risk. In our cross-border practice, this dual exposure is the single most common driver of complexity in post-breach matters.
The position above covers the standard case. Your facts – the counterparty, the payment route, the location of the relevant persons, and the specific programme in play – change the analysis significantly. For an assessment of your exposure under either regime, contact Calder & Vance at info@caldervance.com.
How does OFAC's remediation procedure work in practice?
OFAC's remediation procedure begins from the moment a business identifies an apparent violation and runs through a sequence of defined steps, each carrying its own legal and strategic weight. The sequence is not merely administrative – each decision shapes the penalty outcome.
The first step is containment. Stop the activity, freeze the funds or assets involved if blocking obligations apply, and instruct relevant personnel. The second step is scoping: map the full population of transactions affected, trace the ownership chain of the counterparty against the applicable list, and assess whether the 50 percent rule (OFAC's rule treating entities owned 50 percent or more by blocked persons as themselves blocked) extends the exposure beyond the directly named party. The third step is the disclosure decision.
OFAC distinguishes between a voluntary self-disclosure – proactive reporting before OFAC discovers the apparent violation independently – and an involuntary disclosure made after the agency has already identified the matter. A timely VSD carries significant weight under OFAC's published enforcement guidelines: it is listed as a mitigating factor that can reduce the base civil monetary penalty. The initial VSD notice should be submitted promptly, typically within a short window of the decision to disclose, and followed by a more detailed submission once the internal investigation is complete.
The fourth step is the full written submission. This sets out the facts, the root cause, the remediation steps taken, and the compliance programme enhancements implemented or planned. OFAC assesses the submission against the published aggravating and mitigating factors. Aggravating factors include: awareness of conduct at senior levels, harm to programme objectives, concealment, and pattern of conduct. Mitigating factors include: a well-tested compliance programme at the time of the apparent violation, VSD, small transaction value, and co-operation. The fifth step is resolution – a no-action determination, a cautionary letter, or a civil monetary penalty order. No outcome is guaranteed, and we do not represent otherwise.
One procedural point that firms frequently underestimate: OFAC's initial notice of the apparent violation triggers a statute of limitations clock, and the agency can issue a pre-penalty notice that demands a written response within a defined period. Missing or under-responding to that notice is itself an aggravating factor. Have you verified that your internal escalation process would capture that deadline?
How does Canada's remediation path differ from OFAC's?
Canada's post-breach path diverges from OFAC's at the foundational level: the primary enforcement mechanism is criminal rather than civil administrative. A sanctions violation under SEMA or the United Nations Act constitutes a criminal offence punishable by imprisonment and a fine. There is no published civil-penalty schedule comparable to OFAC's enforcement guidelines, and there is no formal VSD programme with a codified penalty-reduction benefit.
This does not mean disclosure is irrelevant in Canada. Co-operation with GAC and, where the matter is referred, with law-enforcement authorities, remains a relevant consideration in any prosecutorial discretion analysis and in sentencing. However, the decision to disclose in Canada must be evaluated against the risk of providing evidence that advances a criminal investigation. That risk has no direct parallel in OFAC's civil process.
A second divergence is the role of the compliance programme. Under OFAC's regime, demonstrating a pre-existing, effective compliance programme – tested against the agency's five-element framework – directly reduces the penalty base. Canada does not have an equivalent codified five-element standard. Programme quality still matters in practice, particularly for prosecutorial discretion and sentencing, but the evidential pathway is less structured.
Third, the Canadian regime does not have the same graduated outcome ladder that OFAC publishes. OFAC can close a matter with a no-action letter or a cautionary letter at the non-public end. Canada's criminal structure means that if a matter is referred for prosecution, the outcomes are binary in a way that OFAC's civil process is not. In our experience, this asymmetry means that Canadian counsel involvement at the earliest possible stage is critical – and that the sequencing of disclosures to the two regulators requires careful legal co-ordination.
Where do the regimes diverge most sharply on the key decision points?
The divergences between OFAC and the Canadian regime are most acute at four decision points: the VSD calculus, the penalty framework, the compliance-programme credit, and the interaction with criminal process.
On the VSD calculus: OFAC's published framework creates a strong presumption in favour of proactive disclosure for a business with a well-tested compliance programme and a genuinely inadvertent violation. The risk-benefit analysis is relatively legible. In Canada, the absence of a structured VSD programme and the criminal-law backdrop make the calculus less transparent. Whether to disclose, when, and to whom requires a judgment call that cannot be made by applying a published checklist – it requires legal advice on the specific facts before anything is put on paper.
On the penalty framework: OFAC calculates civil penalties by reference to a statutory maximum per-transaction figure and applies its aggravating and mitigating factors to that base. Canada's criminal penalties are framed as maxima set by statute, with the actual exposure determined through prosecutorial and judicial discretion. The structures are not comparable, and translating risk between the two for a board presentation requires care.
On compliance-programme credit: OFAC's five-element framework – management commitment, risk assessment, internal controls, testing and auditing, training – is published and well-understood. A business that can demonstrate it had all five elements operating at the time of the apparent violation has a documented argument for penalty reduction. Canada has no equivalent published standard; the argument for programme credit must be constructed from general principles of prosecutorial discretion and sentencing.
On the criminal-process interaction: a disclosure to OFAC does not shield the disclosing entity from a parallel DOJ criminal investigation in the US. Similarly, a disclosure to GAC does not eliminate Canadian criminal exposure; it may in fact advance it. Both regimes can run civil and criminal tracks simultaneously, and in cross-border matters both national criminal tracks can run in parallel with each other. This is the risk environment in which the remediation strategy must be designed.
If a transaction has already been flagged, or a filing has been refused, an early review can preserve options that narrow with time. Contact Calder & Vance at info@caldervance.com for a confidential review.
What risk flags should trigger immediate legal review?
Certain facts patterns should move any post-breach matter from the compliance team's queue to external counsel's desk without delay. These are not hypothetical edge cases; in our cross-border practice, we regularly advise on matters where one or more of these flags were present and the window for managing exposure was already narrowing.
The first flag is senior management awareness. If any officer, director, or senior manager was aware of the conduct – or was warned and failed to act – the OFAC aggravating-factor analysis changes sharply. The same fact pattern opens individual criminal liability considerations in Canada. The remediation strategy must account for this from the outset.
The second flag is a pattern of conduct. A single isolated transaction is assessed differently from multiple transactions over an extended period. Volume, frequency, and temporal spread all bear on whether OFAC treats the matter as a single violation or a series. In Canada, pattern evidence is equally relevant to prosecutorial and sentencing discretion.
The third flag is a pre-existing OFAC or GAC interaction. A business that has previously received a cautionary letter, a penalty notice, or a compliance commitment from either authority is in an aggravated position on a second matter. The mitigating weight of a VSD is diminished when the authority can point to a prior warning that was not acted upon.
The fourth flag is jurisdictional spread. When the same underlying transaction touches a US person, a Canadian business, a UK financial institution, and a correspondent bank in another jurisdiction, the remediation strategy must sequence disclosures across multiple regulators. A disclosure to OFAC may need to be considered alongside potential obligations to OFSI in the United Kingdom, to the EU-based counterparty's regulator, and to GAC. Missing one leg of the disclosure chain – or making disclosures in the wrong order – creates new exposure. For analysis of the UK-side position, see our related piece on OFAC vs OFSI: post-breach remediation compared.
The fifth flag is evidence of concealment. Any indication that records were altered, communications were deleted, or counterparty identity was obscured – even without intent to deceive a regulator – transforms the matter into one that requires immediate privilege-protected legal advice. This is the flag that most rapidly exhausts the available options.
How should a cross-border business structure its remediation response?
A cross-border business facing potential exposure under both OFAC and the Canadian regime should approach remediation through a structured sequence rather than reacting in parallel to each regulator independently. The sequencing decisions are consequential and are not reversible once made.
Step one is scoping under privilege. Retain external counsel promptly, so that the internal investigation and its outputs are protected by legal professional privilege. Do not send preliminary findings to the regulator before the scope of the apparent violation is understood. A partial disclosure that is later expanded creates credibility problems with both OFAC and GAC.
Step two is a dual-regime assessment. Map the transaction against both the OFAC framework and the Canadian regime simultaneously. Identify whether the underlying facts generate civil exposure, criminal exposure, or both in each jurisdiction. In our practice, we co-ordinate this with local counsel in Canada to ensure the criminal-law dimension is assessed by qualified counsel in that jurisdiction from the outset.
Step three is a disclosure sequencing decision. Where disclosure is warranted, determine the order, the timing, and the content of submissions to each authority. In many cross-border matters, simultaneous disclosure is not the right approach. The strategic question is which disclosure, if made first, preserves the most options under the second regime.
Step four is programme remediation. Both OFAC's published guidance and Canadian prosecutorial discretion weigh the quality and sincerity of the compliance remediation undertaken after the apparent violation. This means documented root-cause analysis, identified control failures, remediation actions with owners and deadlines, and enhanced monitoring of the affected exposure area. For EU-facing matters, a parallel apparent-violation assessment may also be warranted; see our apparent violation assessment service for EU matters.
Step five is a written submission that tells a coherent story. Whether the forum is OFAC's civil process or a Canadian prosecutorial assessment, the written record must present the facts accurately, explain the root cause without minimising responsibility, and demonstrate genuine remediation. A submission that reads as damage-limitation rather than genuine accountability rarely achieves its intended purpose with experienced enforcement officials.
For a broader cross-border comparison across multiple post-breach scenarios, see our extended analysis of OFAC vs Canada post-breach remediation.
The compliance-programme argument: what actually moves the needle?
The compliance-programme argument is the single most consequential tool available to a business seeking penalty mitigation under OFAC, and it requires more than producing a policy document. OFAC's enforcement guidance is explicit: the programme must have been operational and effective at the time of the apparent violation, not assembled in response to it. A policy written the week before the VSD submission does not carry the weight of a programme that was tested and audited before the breach occurred.
The five elements that OFAC assesses – management commitment, risk assessment, internal controls, testing and auditing, and training – each have an evidential counterpart. Management commitment means documented board-level engagement, a named compliance officer with authority and resources, and a culture that treats sanctions compliance as a business obligation rather than a legal-department task. Risk assessment means a current, documented analysis of the counterparties, geographies, products, and payment routes that generate sanctions exposure, updated when the risk environment changes. Internal controls means screening that covers the full counterparty population, with ownership-and-control logic that reaches indirect holdings. Testing and auditing means periodic, documented reviews by a function independent of the business line, with findings escalated and acted upon. Training means a documented programme, tailored to roles, with completion records.
In Canada, the equivalent argument is constructed differently. There is no published five-element checklist. The programme argument is advanced through the narrative of prosecutorial discretion: this business took its obligations seriously, invested in controls, and self-reported a failure that its own processes detected. That is a different argument, but it draws on many of the same underlying facts. The difference is that the Canadian argument must be constructed from first principles rather than aligned to a published standard. We regularly advise businesses on how to build and evidence the programme argument in parallel for both forums.
Is your compliance programme documented well enough to present as a penalty-mitigation argument? That question is worth asking before the next apparent violation surfaces, not after.
A common misconception: "we were compliant at the time"
The most persistent objection we encounter in post-breach matters is a variant of the following: "Our screening was running, our policy was in place, the transaction was approved by the compliance team – so we were compliant at the time." This framing conflates process activity with substantive compliance, and it does not hold up under OFAC or Canadian scrutiny.
OFAC does not award programme credit for the existence of a process. It assesses whether the process was well-tested, calibrated to the actual risk environment, and capable of catching the violation that occurred. A screening tool that was running but did not flag an SDN-listed entity because the ownership chain was not mapped beyond the first layer is not an effective internal control – it is a gap dressed as a control. OFAC's guidance is explicit that a nominally existent programme that failed to prevent the violation carries limited mitigating weight.
In Canada, the equivalent misconception is that an internal compliance policy provides a defence. A criminal-law analysis does not turn on whether a policy existed; it turns on whether the conduct constituted an offence and whether any available defences apply. The existence of a compliance policy may be relevant to prosecutorial discretion and to sentencing, but it is not a defence to the underlying charge.
The practical implication is that post-breach remediation requires an honest, privileged assessment of whether the compliance programme that was in place was genuinely effective or merely formally present. That assessment is better conducted under privilege by external counsel than disclosed prematurely to the regulator. We have acted for businesses at this stage and the outcome of the assessment consistently shapes the remediation strategy that follows.
Related practices
- EU apparent violation assessment – scoping and advising on EU-side sanctions breach exposure
- OFAC vs OFSI: post-breach remediation compared – the UK-side parallel for cross-border matters