A trading company receives two simultaneous requests: one from OFAC, demanding records relating to a payment that may have touched a blocked party, and one from BIS, seeking documentation on an export of dual-use goods. The compliance team has days, not weeks. Two US government agencies. Two distinct legal authorities. Two different procedural postures. The stakes – civil penalties, criminal referrals, and reputational damage – are real.
Responding to regulator information requests under OFAC and BIS / EAR follows materially different procedural rules, timelines, and strategic logics. OFAC operates under IEEPA and its programme-specific regulations; BIS derives its authority from the Export Control Reform Act and the EAR. As of March 2026, both agencies can impose substantial civil penalties for non-compliance and can refer matters to the Department of Justice for criminal prosecution. The right response strategy depends on which agency has asked, on what authority, and what the request signals about the agency's investigative posture.
This analysis sets out the procedural architecture of each request type, where the two regimes diverge, and where cross-border exposure – including potential OFSI and EU dimensions – changes the calculus for a multi-jurisdictional business.
What authority does OFAC use when it asks for information?
OFAC's power to demand records derives from IEEPA and from the administrative subpoena provisions in its programme regulations, giving it broad authority to compel production of documents, data, and explanations from any person subject to US jurisdiction. An OFAC information request is not always a formal subpoena. It may arrive as a request for voluntary production, a pre-penalty notice information request, or a demand accompanying a formal subpoena. The form matters: voluntary requests carry no statutory deadline, but declining or delaying them typically accelerates enforcement. Formal subpoenas carry deadlines that are legally enforceable.
In our cross-border practice, the first and most consequential decision is whether the request is voluntary or compelled. That distinction sets the entire strategic posture. A business that treats a voluntary request as if it were a subpoena, and over-produces, can inadvertently create a roadmap for OFAC that the agency would not otherwise have. The converse error – treating a compelled request as if negotiation is possible – risks contempt findings and sharply increased penalty exposure.
OFAC also operates a Specially Designated Nationals (SDN List) screening context: where the information request concerns whether a party is owned 50 percent or more by a blocked person, the agency may be applying the aggregation rule across a complex ownership chain. These requests often arrive with a short response window. Verify the current response deadline applicable to your notice before acting.
How does BIS frame an information request under the EAR?
BIS derives its demand authority from the Export Control Reform Act and the EAR, and its Office of Export Enforcement (OEE) has statutory power to conduct administrative searches, issue subpoenas, and compel testimony in connection with apparent violations. A BIS information request frequently relates to the classification of goods, the use of an export licence exception, or the destination and end-use of a controlled item. Unlike OFAC, where the concern is typically a financial transaction touching a prohibited party, a BIS inquiry almost always involves a physical item – hardware, software, or technology – and its movement across a border.
The evidentiary universe is therefore different. BIS will want shipping records, export control classification numbers (ECCN – the Export Control Classification Number on the Commerce Control List), end-user statements, and inter-company communications about the item's intended use. OFAC, by contrast, focuses on payment records, beneficial-ownership data, and counterparty due diligence files.
One feature common to both agencies: neither is required to tell you at the outset whether you are the subject of the investigation, a third-party witness, or somewhere in between. Experienced practitioners read the scope of the request, the documents demanded, and the phrasing of the cover letter to form an initial assessment. In a recent matter, a manufacturing business received a BIS request framed as a "voluntary inquiry" that, on analysis, revealed the agency had already identified a specific transaction and was seeking corroboration. That framing, left unanalysed, would have led the company's internal team to produce far more than the request legally required.
Where do OFAC and BIS diverge in procedural posture?
The procedural divergence between OFAC and BIS is significant across four dimensions: the nature of the demand, the applicable deadlines, the role of voluntary self-disclosure, and the penalty calculus that informs settlement discussions.
First, on the nature of the demand. OFAC's requests are typically narrower in scope and more focused on financial records. BIS requests, particularly those arising from OEE administrative searches, can be broader and may encompass physical inspection rights. A business facing a BIS OEE search at a facility has fewer procedural protections than a business responding by document production to an OFAC letter.
Second, on deadlines. Neither agency's standard response window is uniform across all request types. Both allow extensions in appropriate circumstances, but the bar for obtaining an extension differs. In our experience, OFAC grants extensions more readily when a request involves large volumes of foreign-language documents or cross-jurisdictional records. BIS is generally less flexible on extension requests where goods are in transit or where the agency suspects ongoing activity.
Third, and critically, on voluntary self-disclosure (VSD – a voluntary disclosure to the relevant regulator). Both agencies have VSD programmes, but the penalty reduction attributed to a timely VSD differs. Under OFAC, a VSD is one of the aggravating and mitigating factors set out in the agency's enforcement guidelines. Under the EAR, BIS has published specific guidance describing the treatment of initial notifications and supplemental disclosures. The sequence matters: a VSD filed before an information request arrives is treated more favourably than one filed in response to an agency inquiry that has already begun. If you have already received a request, the VSD window may not be fully open, but it may still be partially available.
Fourth, on the penalty calculus. Both agencies can impose civil penalties on a per-transaction basis. The absolute ceiling per violation differs between the two regimes, and both ceilings are periodically adjusted. We do not reproduce specific figures here because both are subject to regulatory revision; confirm the current maximum before relying on any figure. What is clear is that the base penalty in both regimes can be calculated either by reference to the value of the transaction or by a statutory per-violation amount – whichever is greater. That dual basis makes even a small number of apparent violations financially significant.
The position above covers the standard case. Your facts – the counterparty, the goods, the route, and the regime in play – change the analysis. For an assessment of your OFAC or BIS exposure, contact Calder & Vance at info@caldervance.com.
What does the cross-border dimension add for OFSI, EU, and other regimes?
A US information request does not arrive in isolation for most multi-jurisdictional businesses. The same transaction that triggers an OFAC enquiry may also engage OFSI (the UK's Office of Financial Sanctions Implementation) and the relevant EU Council regulation, depending on the currencies involved, the nationality of the parties, and where goods physically moved. This is where the cross-border dimension becomes acutely complex.
OFSI has its own information-gathering powers under the UK Sanctions and Anti-Money Laundering Act (SAMLA) and the relevant thematic regulations. OFSI can require any person to provide information or produce documents relevant to a suspected breach. The ownership-and-control test under the UK regime differs from OFAC's 50 percent rule: OFSI applies both ownership (50 percent or more) and a control test, which can capture entities where a designated person exercises effective control without holding a majority stake. A response to OFAC that resolves the ownership question under the mechanical OFAC test may leave the OFSI control question open.
The EU presents a further complication. The EU General Court has developed a body of case law on the procedural rights of parties in Council designation proceedings. An EU-connected party responding to a US agency request must consider whether production of documents in a US proceeding could affect its position in a parallel EU administrative or judicial process. The EU Blocking Regulation also creates a direct legal tension for EU-incorporated entities: compliance with certain foreign legal demands can itself trigger Blocking Regulation obligations. This is a genuine conflict of laws that requires specialist analysis before any production decision is made.
For businesses with Singapore, UAE, or Japanese operations, the same transaction can trigger reporting obligations under those jurisdictions' autonomous sanctions regimes. We regularly advise clients on the sequencing of parallel regulatory disclosures to avoid one disclosure pre-empting or undermining another.
If a transaction has already been flagged, or a filing has been refused, an early cross-regime review can preserve options that narrow with time. Write to info@caldervance.com to discuss the position.
What are the primary risk flags in an agency information request?
Practitioners working across these two regimes regularly identify a set of signals that indicate an information request has a higher enforcement probability than its neutral language suggests. Recognising these markers early changes the resource allocation, the legal-privilege decisions, and the disclosure strategy.
The first risk flag is specificity of the request. A broad "please produce all records relating to transactions with [jurisdiction]" suggests a sweep. A request naming a specific date range, a specific wire reference, or a specific shipment number suggests the agency already has the anchor document and is testing for corroboration or gaps. BIS requests of the latter type frequently indicate that an export manifest, a bank record, or a freight forwarder's filing has already been obtained through a third-party channel.
The second flag is the agency's stated authority. A request citing the agency's administrative subpoena power, with a stated return date and a statement of the consequences for non-compliance, is a compelled production. A request on agency letterhead with no explicit legal authority cited may be voluntary. Many businesses, without specialist counsel, treat both identically – and that uniformity costs them.
The third flag is parallel proceedings. An OFAC request that arrives contemporaneously with a BIS OEE inquiry, or with a DOJ criminal investigation referral, suggests coordinated enforcement. In our experience, coordinated referrals require a unified privilege strategy from day one. Responses to different agencies that are individually accurate can collectively create an inconsistency that becomes the basis for a separate allegation.
The fourth flag concerns record-keeping. Both OFAC and BIS impose record-keeping requirements for transactions within their respective jurisdictions. If the request covers a period for which records should have been maintained, and those records are incomplete, that gap itself becomes an aggravating factor. OFAC's enforcement guidelines expressly identify inadequate compliance programmes and poor record-keeping as factors that increase penalty. Verify the current retention period applicable to your transactions before responding.
The fifth flag is the extraterritorial dimension. OFAC is explicit that its jurisdiction extends to US persons and their foreign branches, and it takes the position that dollar-denominated transactions routed through US correspondent banking infrastructure bring non-US parties within reach. A non-US company receiving an OFAC request should immediately assess whether it is within OFAC's jurisdictional reach before it decides how to respond.
How should a business sequence its response?
The response sequence for a regulator information request should follow a defined decision path, not a reactive production of whatever records are immediately to hand. The sequence we apply in practice is this.
First, triage the request within forty-eight hours. Confirm the agency, the legal authority cited, whether the request is voluntary or compelled, the stated return date, and the subject matter. Identify immediately whether a VSD window is still available. Notify legal counsel before producing anything.
Second, assess jurisdictional reach. Confirm whether the requesting agency has jurisdiction over the legal entities and individuals being asked to produce. This is not a formality: a non-US entity receiving an OFAC subpoena may have grounds to contest jurisdiction, and exercising that right is separate from a decision about voluntary cooperation.
Third, identify privilege boundaries. Determine which documents are potentially covered by attorney-client privilege or attorney work product. Both OFAC and BIS have produced guidance on privilege claims in response to their requests. Producing privileged material inadvertently can waive privilege in parallel or subsequent proceedings.
Fourth, assess whether a parallel filing – a VSD to OFAC under its self-disclosure guidelines, or an initial notification to BIS under the EAR – is available and advantageous. Timing matters enormously: in our practice, the question "should we file a VSD now or wait?" is one of the most consequential strategic decisions in an enforcement matter. There is no universal answer. It turns on what the agency already knows, what the records will show when produced, and how many transactions are potentially affected.
Fifth, coordinate across regimes. If there is any OFSI, EU, or other regime dimension, align the response strategies before the first document is produced. A response to OFAC that implicitly concedes a factual point can create complications in a concurrent OFSI or EU proceeding if the applicable legal tests differ.
Sixth, manage the production itself. This means a defined document review, consistent privilege logs if any documents are withheld, and a cover letter that accurately characterises what has been produced and what, if anything, has been withheld and on what basis.
What distinguishes a well-managed response from a poorly managed one is not the volume of documents produced but the degree of control exercised at each of these stages.
A common misconception: "We cooperated, so the penalty will be reduced substantially"
A persistent belief among compliance teams is that cooperation – producing documents promptly and engaging constructively with agency queries – will, by itself, produce a meaningful penalty reduction. This is an oversimplification. Cooperation is a mitigating factor under both OFAC's and BIS's published enforcement guidelines. But cooperation is weighed alongside the nature and duration of the violation, the adequacy of the company's compliance programme, whether the conduct was voluntary or disclosed, whether any senior manager was involved, and whether harm to sanctions policy objectives resulted.
We have acted for businesses that cooperated fully and still faced a substantial civil penalty – because the underlying violations were numerous, involved a sensitive programme, or the compliance programme was found to be inadequate. Conversely, the combination of a timely VSD, a strong compliance programme, and a well-prepared penalty defence has produced significant mitigation in cases where the underlying facts were not straightforward.
The practical lesson: treat cooperation as a necessary but not sufficient condition of a favourable outcome. Cooperation without a credible remediation plan, a well-structured VSD, and a rigorous penalty defence is cooperation that does not fully convert into mitigation.
Related practices
- Apparent violation assessment – EU – structuring and presenting an EU enforcement defence for apparent sanctions violations.
- OFAC vs EU regulator information requests – comparative analysis of OFAC and EU procedural postures on information demands.
- OFSI vs Australia regulator information requests – UK and Australian approaches to sanctions enforcement information demands compared.