A multinational financial institution processes a payment. Days later, internal screening flags that the counterparty shares identifying details with an entity appearing on a sanctions list. The transaction has already settled. The compliance team faces an immediate question that divides into two: what does OFAC require, and what does OFSI require – and can the firm handle both simultaneously with a single response strategy?
Remediation after a sanctions breach under OFAC and OFSI follows materially different procedural paths. OFAC operates a voluntary self-disclosure (VSD – a formal submission to the Office of Foreign Assets Control acknowledging an apparent violation before enforcement action commences) process that, when well-executed, can reduce a base civil penalty by a significant proportion. OFSI operates a mandatory reporting obligation with a strict statutory window, after which a breach of the reporting duty itself becomes a separate offence. As of early 2026, both regimes have sharpened their enforcement posture – and a response calibrated to one jurisdiction alone will almost certainly misfire in the other.
This analysis maps the key divergences across five dimensions: the reporting trigger and deadline, the disclosure mechanics and content, how each regulator weighs cooperation and remediation, the penalty calculus, and the practical cross-border implications for a business that has exposure under both regimes simultaneously.
What triggers the remediation obligation and when?
The reporting trigger under OFAC and OFSI diverges at the threshold question of what counts as a "breach" requiring action. Under OFAC, no mandatory reporting obligation attaches to a civil apparent violation. The VSD regime is voluntary: a firm that identifies an apparent violation must decide – as a strategic matter – whether to disclose. That decision carries consequences either way. A well-timed VSD can reduce the base civil monetary penalty by a substantial amount under OFAC's enforcement guidelines. A decision not to disclose, followed by OFAC discovering the violation independently, produces an aggravated penalty calculation.
Under OFSI, the position is structurally different. The UK regime imposes a mandatory reporting obligation once a person knows or has reasonable cause to suspect that they hold funds or economic resources belonging to, owned, held, or controlled by a designated person. The statutory window for that report runs to 10 business days. Missing the window is itself a criminal offence under the Sanctions and Anti-Money Laundering Act ("SAMLA") and the relevant thematic regulations. The trigger is therefore suspicion-based and automatic – there is no strategic optionality of the kind that OFAC's VSD structure creates.
In our cross-border practice, this asymmetry is the single most common source of procedural error. A compliance team conditioned by US practice instinctively treats the disclosure question as strategic. In the UK context, the same instinct can cause a firm to miss a mandatory legal deadline while it deliberates.
How does each regime treat voluntary disclosure and cooperation?
Under OFAC, a VSD must satisfy several substantive requirements to attract the penalty mitigation its name implies. The submission must be made before OFAC has opened an investigation, must describe the apparent violation with specificity, must identify the apparent cause and the compliance gap that allowed it, and must be accompanied – or promptly followed – by a full remediation plan. OFAC's enforcement guidelines treat a deficient VSD that is vague, delayed, or unsupported by a credible remediation commitment as significantly less mitigating than a comprehensive submission. The difference between a thorough VSD and a perfunctory one can, in our experience, move the outcome by more than one penalty tier.
OFSI's licensing and enforcement regime does not operate a VSD structure in the OFAC sense. OFSI receives mandatory reports and, separately, may consider a firm's cooperation conduct when calculating a monetary penalty. OFSI's published enforcement guidance identifies cooperation, self-reporting, and prompt remediation as factors that weigh in the firm's favour during a penalty assessment. However, the legal mechanics differ: OFSI assesses penalties on a "reasonable and proportionate" basis, taking into account the seriousness of the breach, the size of the firm, and any steps taken to address the breach. There is no formal schedule that converts a cooperation rating into a defined percentage reduction in the way OFAC's guidelines do.
Does that mean OFSI cooperation is worth less? No – but the credit is less predictable and more discretionary. OFAC's guidelines create, at least in theory, a more formulaic path from full cooperation to a defined outcome. OFSI's published guidance is directional rather than algorithmic. That difference matters enormously when a legal team is advising a board on expected-value grounds.
What does the remediation plan itself require under each regime?
A credible remediation plan is the operational centrepiece of a post-breach response under both regimes, but the expected content differs in emphasis. Under OFAC, the plan accompanying or following a VSD must demonstrate that the firm has: identified the root cause of the violation; taken immediate steps to prevent a recurrence; addressed any systemic screening or governance failure; and, where the violation involved a counterparty relationship, has terminated or restructured that relationship. OFAC's enforcement guidelines place particular weight on whether the violation was the result of a systemic compliance failure or an isolated incident – the former attracting much heavier scrutiny of the remediation proposals.
Under OFSI, the mandatory report satisfies the immediate legal obligation. Separately, OFSI may engage with the firm during an investigation and will examine what steps have been taken since the suspected breach. The substantive remediation content that OFSI expects overlaps significantly with OFAC's – root-cause analysis, screening improvements, governance changes – but the procedural vehicle is different. There is no "remediation plan submission" that carries the same formal status in the UK regime as a VSD package does under OFAC. The content is delivered through the mandatory report, through any subsequent engagement with OFSI, and through contemporaneous compliance records.
In a recent matter, a financial-services firm with operations in both the United States and the United Kingdom identified a suspected violation touching both regimes simultaneously. We advised on sequencing: the UK mandatory report had to be filed within the statutory window regardless of where the US VSD process stood. We prepared the OFSI mandatory report first, then structured the OFAC VSD to draw on the same underlying factual record without prejudicing the firm's legal position in either jurisdiction. The exercise confirmed that a single investigation record, properly structured from the outset, can serve both disclosure processes – provided the legal team understands where the procedural calendars diverge.
How does each regime calculate and mitigate civil penalties?
OFAC's civil penalty framework distinguishes between egregious and non-egregious violations. For a non-egregious apparent violation disclosed via a timely VSD, the penalty base is calculated as a proportion of the statutory maximum, with VSD and cooperation treated as substantial mitigating factors under OFAC's enforcement guidelines. For an egregious violation – one involving wilful or reckless conduct, senior management involvement, or harm to sanctions objectives – the base penalty rises sharply and VSD mitigation has less mechanical effect. OFAC's guidelines list aggravating and mitigating factors explicitly, giving practitioners a reasonably structured basis for penalty modelling.
OFSI's penalty structure operates on a different statutory footing under SAMLA and the relevant thematic regulations. OFSI may impose a monetary penalty up to the greater of a prescribed percentage of the total value of the breach or a defined maximum figure. The penalty decision involves a proportionality assessment rather than a schedule-driven calculation. OFSI's published enforcement guidance sets out the factors it weighs – including the nature, severity, and duration of the breach, any financial gain, steps taken to mitigate harm, and cooperation – but the weighting of those factors is ultimately a discretionary exercise by OFSI rather than an arithmetic one.
One practical divergence that consistently surprises clients: OFAC's "egregious case" designation can, in theory, produce a base penalty equal to the full statutory maximum per transaction. For a firm that has processed multiple affected transactions, the aggregate exposure can be very large. OFSI's maximum is structurally different and, for most commercial financial transactions, is set by reference to the value of the transaction rather than a per-occurrence figure. Neither regime is "lenient" – but the exposure profile differs, and a cross-border business should model both simultaneously rather than relying on whichever estimate is more familiar.
The position above covers the standard analytical framework. Your specific facts – the nature of the breach, the counterparty, the amount involved, the jurisdiction of the relevant entity – will shift the analysis materially.
For a confidential assessment of your exposure under OFAC and OFSI, contact Calder & Vance at info@caldervance.com.
Where do OFAC and OFSI diverge on the role of criminal referral?
Criminal exposure is a feature of both regimes, but the institutional pathways differ significantly. Under the US regime, OFAC handles civil enforcement directly. Criminal prosecutions for wilful sanctions violations are referred to the Department of Justice, which operates independently. In our experience, the decision to refer a matter for criminal investigation depends on the same aggravating factors that drive OFAC's egregious-case finding – but the criminal and civil tracks can run in parallel, and a VSD to OFAC does not insulate a firm or individual from a DOJ criminal inquiry. Civil and criminal counsel may need to be coordinated carefully from the outset.
Under OFSI and SAMLA, financial sanctions breaches can constitute criminal offences directly, without a separate referral step, where the breach is committed knowingly or intentionally. OFSI can pursue civil penalties; the relevant prosecuting authorities can pursue criminal charges. The interaction between a mandatory OFSI report and any criminal exposure requires careful privilege and sequencing analysis from the moment the apparent breach is identified. Voluntary disclosure to OFSI does not create the same formal mitigation mechanism as OFAC's VSD, but it remains a factor in any subsequent criminal sentencing or penalty decision.
This is a point where the two regimes create a genuinely uncomfortable cross-border dynamic. A firm making a mandatory OFSI report simultaneously with preparing an OFAC VSD must ensure that the content of each disclosure is legally privileged to the extent possible and that neither submission inadvertently prejudices the firm's position in the other jurisdiction.
What are the key risk flags that determine whether to engage counsel immediately?
Several factors, present in any post-breach review, should accelerate the decision to involve sanctions counsel rather than attempt internal resolution. The first is jurisdictional overlap: if the same transaction, goods, or party touches both OFAC and OFSI – or extends further to the EU or another regime – the procedural calendars diverge from day one and an error in one jurisdiction cannot easily be corrected by good practice in another. The second is the nature of the breach: a one-off screening miss is categorically different from a pattern of transactions that suggest a systemic failure. Systemic failures attract the highest penalty bands under OFAC's egregious-case analysis and attract heightened scrutiny from OFSI.
A third risk flag is senior-management involvement or awareness. Both OFAC and OFSI treat management-level knowledge of a violation as a significant aggravating factor. Where internal communications show that senior individuals were aware and the conduct continued, the remediation strategy must address that record directly. A fourth flag is the involvement of a financial institution subject to bank secrecy, anti-money-laundering, or prudential requirements: in that case, the breach may trigger parallel reporting obligations to other regulators, and the sequencing of those reports alongside the sanctions disclosures must be managed as a co-ordinated exercise.
If a transaction has already been flagged, or a filing has been refused, an early review can preserve options that narrow with time. Contact Calder & Vance at info@caldervance.com for an initial confidential assessment.
How does EU sanctions enforcement compare, and what is the cross-border picture?
A cross-border analysis of OFAC and OFSI remediation is incomplete without noting how the EU regime – and the growing enforcement posture of EU member-state authorities – fits into the picture. EU sanctions violations are enforced by national competent authorities in each member state rather than by a single central body. The EU has been moving toward greater harmonisation of criminal penalties for sanctions violations, and the relevant EU Council regulation framework imposes strict obligations on EU-persons and EU-nexus transactions that run alongside both OFAC and OFSI exposure for multinational groups.
Where a transaction touches a UK person (OFSI), a US person or a US-dollar clearing bank (OFAC), and an EU-incorporated entity (member-state enforcement under the relevant Council regulation), the breach response must address at least three separate procedural regimes with different reporting windows, different disclosure mechanics, and different penalty calculations. In our cross-border practice, we regularly advise clients who initially frame the problem as a single "sanctions issue" and discover that the full exposure map covers four or five regimes simultaneously. The divergence in reporting deadlines alone – a mandatory OFSI report within 10 business days, no mandatory VSD deadline under OFAC but strategic timing considerations, and varying national windows under EU member-state law – means that the first week after a breach is identified is frequently the most consequential.
The EU General Court provides a separate avenue for entities challenging designations, which is distinct from the enforcement-response question but relevant to the overall posture a firm adopts when a counterparty is the subject of a designation review.
Myth: a comprehensive remediation plan guarantees a favourable outcome
A persistent misconception in the cross-border compliance community is that a well-prepared VSD or a thorough post-breach remediation plan reliably produces a settlement, a penalty waiver, or a defined outcome. That view misreads how both OFAC and OFSI actually operate. OFAC's enforcement guidelines identify VSD and remediation as mitigating factors – they do not convert a serious violation into a guaranteed no-action outcome. OFSI's enforcement guidance acknowledges cooperation – it does not commit OFSI to any particular penalty level in return for a timely mandatory report.
What a thorough VSD and remediation plan do is shift the probability distribution of outcomes toward the lower end of the penalty range, preserve credibility with the regulator, and demonstrate that the firm takes its obligations seriously. Those are valuable – but they are not guarantees. In our experience, firms that approach the process with clear-eyed expectations about what remediation can and cannot achieve make better decisions about resource allocation, internal communication, and settlement strategy than firms that treat a VSD as an insurance policy with a defined payout.
Related practices
- Apparent violation assessment – EU regime – scoping and assessing EU-regime exposure following an apparent sanctions breach
- OFSI vs EU: post-breach remediation analysis – comparing UK and EU enforcement response obligations in detail
- Regulator information requests: BIS/EAR vs EU analysis – handling information requests from export-control authorities in the US and EU