A trading company headquartered in Frankfurt receives an OFAC administrative subpoena on a Tuesday morning. Three days later, its Amsterdam-based subsidiary receives a formal request from the European Commission seeking documents on the same underlying transaction. The compliance team faces two separate regulators, two different evidentiary standards, and two sets of potential consequences – all running in parallel. How a business responds to each, and in what order, can determine whether the matter closes quietly or escalates into a full enforcement proceeding.
Responding to regulator information requests under OFAC and the EU sanctions regime involves materially different procedural obligations, timelines, and privilege considerations. OFAC operates under broad administrative subpoena authority grounded in IEEPA, with response windows that are often short and carry civil and criminal exposure for non-compliance. The EU regime distributes enforcement authority across Member State competent authorities and, at the Commission level, applies its own investigative powers under the relevant Council regulations. The two systems diverge sharply on document-production scope, legal professional privilege, and the risk calculus of partial responses.
This analysis maps the key procedural differences across both regimes, identifies the points where a cross-border response strategy must be stress-tested, and explains when – and why – a business should involve sanctions counsel before submitting a single document.
What authority does OFAC hold to demand information?
OFAC's power to compel document production derives from its administrative subpoena authority under IEEPA and the Trading with the Enemy Act ("TWEA"). That authority is broad. OFAC may require any person subject to US jurisdiction to produce records, answer written interrogatories, and appear for examination in connection with an apparent violation or a compliance inquiry. The scope of the demand typically runs to transaction records, communications, ownership documentation, screening records, and internal audit findings – and OFAC does not confine requests to the specific transaction under review.
Response windows under OFAC information requests are frequently tight. In our experience, the initial production deadline can be as short as a matter of weeks, and extensions – while sometimes granted – are not guaranteed. A failure to respond fully and accurately is itself a potential violation, separate from any underlying conduct. OFAC's enforcement guidelines treat non-cooperation as an aggravating factor that can increase a civil monetary penalty significantly above the base amount. For a multinational whose US nexus is limited, the jurisdictional reach question – whether the entity is truly "subject to US jurisdiction" – is worth examining carefully before responding.
One practical point that catches businesses off guard: OFAC is not the only US authority that may be involved. Where the underlying conduct raises potential criminal export-control concerns, the Department of Justice may be engaged separately, creating a parallel criminal thread that the civil OFAC response must not inadvertently prejudice.
The position above covers the standard case. Your facts – the counterparty structure, the goods, the transaction route, and which OFAC programme is in play – change the analysis materially. For an assessment of your OFAC exposure before you respond, contact Calder & Vance at info@caldervance.com.
How does EU enforcement authority compare?
Under the EU sanctions regime, enforcement authority is principally exercised at Member State level. Each Member State designates a competent authority – typically a financial intelligence unit, a central bank, or a ministry of finance – responsible for investigating and sanctioning breaches of the relevant Council regulation on its territory. The European Commission has a supervisory and coordination role, and can itself investigate suspected breaches of EU sanctions by natural or legal persons in certain circumstances, but the primary investigative interaction a business will face is with the competent authority of the relevant Member State.
This distributed architecture creates an immediate practical problem for a cross-border business. A group operating in five Member States may face five separate competent authorities, each with its own procedural rules, its own evidentiary expectations, and its own penalty regime. There is no single EU-wide "OFAC equivalent" that coordinates the group's response centrally. In our practice, we regularly advise multinationals on aligning response strategies across jurisdictions where the same transaction has triggered inquiries in multiple Member States simultaneously.
The temporal dimension also differs. EU competent authorities typically operate within statutory investigation windows defined by national administrative law, which vary materially between Member States. Some regimes impose short-form administrative response requirements that run in parallel with a longer formal investigation. Others allow extended periods of informal correspondence before a formal request issues. The absence of a standardised EU-wide timeline for information requests means that the clock in Frankfurt may run very differently from the clock in Warsaw or Amsterdam.
Where do legal privilege and confidentiality protections diverge?
Legal professional privilege and its equivalents are among the most practically consequential points of divergence between the OFAC and EU regimes. Under US law, attorney-client privilege and work-product protection apply in the OFAC context, but both must be properly claimed and documented. OFAC's position on privilege claims in administrative proceedings requires care: a blanket privilege log that is not sufficiently particularised risks being disregarded, and a partial production that inadvertently discloses privileged material can be treated as a waiver with respect to the full category of related documents.
The EU position is more complex still. The EU General Court and the Court of Justice have confirmed that legal professional privilege protects confidential communications between a client and an independent lawyer for the purpose of obtaining legal advice in the context of judicial proceedings or proceedings that may lead to them. However, the protection does not extend, under EU competition and sanctions enforcement practice, to in-house counsel communications in the same way it does under US doctrine. A multinational that has relied on in-house legal reviews to document its compliance programme may find that those documents are not privileged in an EU competent authority investigation even though equivalent materials would attract protection in the OFAC context.
This divergence creates a genuine document-stratification problem in parallel proceedings. A production to OFAC that includes in-house legal memoranda could be used by an EU competent authority on a mutual legal assistance or information-sharing basis. Conversely, material that the EU competent authority treats as non-privileged may – if produced without proper reservation – affect the company's ability to assert privilege in the US proceeding. Getting this sequencing right before any production is made is one of the most important functions of cross-regime counsel in a dual-track matter.
If a transaction has already been flagged, or a formal request has issued, an early review of the privilege and sequencing issues can preserve options that narrow quickly with time. Write to us at info@caldervance.com before the first document is sent.
How do voluntary self-disclosure and cooperation credit differ between regimes?
Both OFAC and the EU sanctions enforcement regimes treat cooperation as a mitigating factor, but the mechanisms – and the weight given to cooperation – operate differently. Under OFAC's enforcement guidelines, a voluntary self-disclosure (VSD – a company's proactive report to OFAC of an apparent violation before OFAC has independently identified it) is treated as a significant mitigating factor and can reduce the base civil monetary penalty substantially. OFAC's published framework establishes that a timely and complete VSD, combined with full cooperation and remediation, can result in a no-action letter or a substantially reduced penalty. The decision to disclose is therefore not merely a compliance posture – it is a material economic and legal calculation.
The EU position on voluntary disclosure is less uniform and, in many Member States, less well-developed as a doctrine. Several EU competent authorities do take voluntary disclosure into account as a mitigating factor under national administrative penalty frameworks. Others apply a more mechanical approach that weights the disclosure less heavily than the underlying conduct. There is no EU-wide equivalent of OFAC's published VSD guidance that standardises the benefit a business receives for coming forward.
For a cross-border business assessing whether to disclose the same apparent violation to both OFAC and the relevant EU competent authority, this asymmetry matters. The timing of a US VSD and the timing of an EU disclosure need not – and often should not – be identical. A disclosure to OFAC that runs ahead of the EU investigation can trigger the EU authority's attention before the business is ready to engage that investigation. Conversely, waiting for the EU process to mature before disclosing to OFAC risks losing the mitigating credit if OFAC independently identifies the matter in the interim.
We have acted for businesses navigating exactly this sequencing problem across OFAC and EU proceedings, and the right approach turns heavily on the specific programme, the counterparty profile, and the nature of the underlying conduct. For analysis of the VSD calculus across the EU and third regimes, see our analysis of voluntary self-disclosure under EU sanctions compared with SECO practice.
What are the key risk flags in a dual-track information request?
Dual-track information requests – where OFAC and one or more EU competent authorities are both seeking information about the same matter – present a cluster of risks that single-regime enforcement does not. Five flags recur in our cross-border enforcement practice.
Inconsistent representations. Where a company's response to OFAC and its response to an EU competent authority are prepared separately and not coordinated, factual descriptions of the same transaction can diverge in ways that are difficult to explain. Each regulator may share information with the other; inconsistency is treated as a credibility problem and, in some circumstances, as evidence of lack of good faith.
Premature production. Producing documents to one regulator before assessing the privilege and confidentiality position under the other regime can strip material of protection it would otherwise carry. This is particularly acute where OFAC receives in-house legal memoranda that would not be privileged under EU doctrine and that could then be sought by an EU competent authority on an information-sharing basis.
Missing the cooperation window. OFAC's cooperation-credit framework rewards early, complete, and proactive engagement. A business that is focused on managing the EU process – where the timeline is often longer and the procedural stakes feel more immediate – can miss the OFAC cooperation window without realising it.
Inadequate ownership and control mapping. Information requests routinely require the responding party to describe the ownership structure of counterparties and transaction parties. Where that mapping has not been done rigorously before the request arrives, the business faces the choice of producing an incomplete response – which OFAC and EU authorities treat as non-cooperative – or delaying production while the mapping is completed, which can itself appear evasive.
Secondary-sanctions exposure for non-US affiliates. A European parent responding to an EU competent authority may not have fully analysed whether its US affiliate has independent OFAC exposure from the same transaction. A disclosure to the EU authority that describes the transaction in detail may, if shared with or seen by US counterparts, surface OFAC exposure that had not previously been identified.
How does the OFAC procedure compare with OFSI and other allied regimes?
Businesses operating across North Atlantic markets regularly face OFAC, OFSI, and one or more EU competent authority investigations arising from the same underlying facts. The procedural comparison between OFAC and the EU is therefore only part of the picture. For analysis of how OFSI's information-request procedures compare with those of other allied regimes, see our analysis of regulator information requests under OFSI compared with the Australian regime.
OFSI's regime under the Sanctions and Anti-Money Laundering Act ("SAMLA") and the relevant thematic regulations sits between the OFAC and EU models in several respects. OFSI has statutory powers to require information from persons it reasonably believes have information relevant to a suspected financial-sanctions breach. The response obligations under the UK regime carry their own compliance risks, and OFSI's enforcement guidance – updated at intervals and publicly available – describes how the authority weights cooperation and disclosure in its penalty calculations. The interaction between a UK enforcement process and an OFAC civil investigation raises the same document-stratification issues that arise in the EU context, with the additional complexity that the UK is no longer bound by EU procedural norms post-exit from the EU.
For businesses with both UK and US exposure – a common profile among international banks, commodity traders, and maritime operators – the three-way alignment of OFAC response strategy, OFSI engagement, and any parallel EU competent authority process requires active management from the outset. We have acted for clients in exactly this configuration, managing the sequencing of responses to keep each regime's cooperation-credit window open while protecting privilege across all three.
Related practices
- Apparent violation assessment under EU sanctions – scoping the legal exposure before you respond
- Voluntary self-disclosure: EU vs SECO – when and how to disclose across regimes
A common myth: responding fully to one regulator satisfies both
A persistent misconception among in-house teams is that a thorough and accurate response to OFAC – or to the primary EU competent authority – effectively resolves the information-request obligation across all relevant regimes. This is incorrect, and acting on the assumption can cause serious damage.
Each regime operates on its own legal basis and its own procedural rules. A document production that satisfies OFAC's evidentiary requirements may omit material that an EU competent authority considers central – for example, internal escalation records or board-level risk assessments that are standard EU administrative-law requests but less commonly sought by OFAC in the first instance. Conversely, a production tailored to EU expectations may include material that, under US law, should have been reviewed for attorney-client privilege before release.
There is also the question of timing. A response to OFAC that is filed before the EU competent authority has issued its formal request sets a factual record that the EU process will test. If the business learns additional facts between the two filings – as it almost always does during the investigation phase – the divergence between the OFAC record and the later EU record requires active management and, in some cases, supplemental submissions to OFAC.
In our experience, the businesses that manage dual-track information requests most effectively are those that treat the two proceedings as parts of a single coordinated matter from day one – with a unified factual record, a common privilege strategy, and a single point of accountability for the response timeline.
When should a business involve sanctions counsel?
The answer, in almost every case, is before the first response is submitted – and ideally before any informal communications with the regulator have occurred. The reason is structural: the decisions made in the first days of a regulator information request – what to produce, when to produce it, how to characterise the conduct, whether to assert privilege, and whether to offer a VSD – are among the most consequential decisions in the entire enforcement process. They are also the hardest to undo.
In a recent matter, a financial institution in the payments sector received concurrent information requests from OFAC and a European competent authority relating to the same series of transactions. The institution's initial instinct was to respond to each separately, using internal teams familiar with each jurisdiction. We were engaged after the OFAC request had been acknowledged but before any production had been made. We identified a privilege issue in the proposed document set, restructured the production sequence so that the OFAC cooperation credit window was preserved, and aligned the factual representations across both responses. The matter was resolved at the civil level without escalation to a formal enforcement action.
That outcome cannot be promised in any matter. But early involvement of counsel with cross-regime experience – across OFAC, the EU competent authorities, and where relevant OFSI and allied regimes – consistently produces better outcomes than late engagement after positions have already been taken.
For a confidential review of your information request or enforcement exposure, contact Calder & Vance at info@caldervance.com.