A North American trading group discovers a payments error. A subsidiary transferred funds to a counterparty that, on closer inspection, had an indirect ownership link to a sanctioned person. The compliance team has twenty-four hours to decide: self-disclose to OFAC, notify Global Affairs Canada, both, or neither? That decision will shape penalty exposure for months.
Both OFAC and Canada's sanctions enforcement authority treat voluntary self-disclosure (a proactive report of an apparent violation made before an authority opens its own inquiry) as a significant mitigating factor. The mechanisms, however, differ in procedure, timing, and the weight each regime assigns to the disclosure. Getting the sequencing wrong in a dual-regime matter can prejudice one filing while protecting the other.
This analysis maps the two regimes side by side – the legal basis, the procedure, the mitigation benefit, and the cross-border complications that arise when both apply at once.
What is the legal basis for voluntary self-disclosure in each regime?
Under OFAC, voluntary self-disclosure (VSD) operates as a formal mitigating factor under the agency's Economic Sanctions Enforcement Guidelines. Those guidelines, issued under IEEPA and related authorities, set out a two-stage process: an initial notification followed by a full written report. OFAC's framework is explicit – a timely, complete, and accurate VSD reduces the base civil monetary penalty, in qualifying cases, by a significant proportion. The submission is made directly to OFAC and typically addressed to the relevant sanctions programme team.
Canada's regime is grounded primarily in the Special Economic Measures Act ("SEMA"), the Justice for Victims of Corrupt Foreign Officials Act, and related regulations administered by Global Affairs Canada ("GAC"). Unlike OFAC, Canada has not published a detailed, standalone VSD framework. The mitigating benefit of a proactive disclosure nonetheless exists in practice: GAC and the Royal Canadian Mounted Police ("RCMP") both treat early cooperation as a factor bearing on the decision to prosecute or to recommend a penalty. In our cross-border practice, we regularly advise clients that the absence of a published Canadian VSD protocol does not mean the disclosure is valueless – it means the submission must be drafted with greater care, because there is no standard template to follow.
That structural asymmetry is important from the outset. OFAC gives practitioners a well-defined path. Canada asks for judgment about where to send the disclosure, in what form, and to whom.
How does the OFAC VSD procedure work in practice?
The OFAC process has two stages. First, a brief initial notification – submitted within a short window of discovering the apparent violation – places the business in the VSD queue and notifies OFAC that a fuller report is coming. Second, a complete report follows, typically within a period that OFAC can extend on request, containing a factual account of what occurred, how the violation arose, what remedial steps have been taken, and what compliance improvements have been implemented.
The initial notification is deliberately short. It need not contain a complete legal analysis. Its purpose is to establish the timing of the disclosure relative to any independent agency inquiry. Timing is decisive: a disclosure made after OFAC has already opened an investigation does not qualify as voluntary and loses the primary mitigation benefit. Have you confirmed, before submitting, that OFAC has not already opened a matter?
The full written report is where the substantive work sits. OFAC assesses the voluntary nature of the disclosure, the completeness of the facts presented, the seriousness of the underlying conduct, the adequacy of the remediation, and the firm's prior compliance history. Each factor feeds into the penalty calculation under the enforcement guidelines. Compliance counsel preparing the full report typically structures it to address each of those criteria explicitly, because OFAC's reviewers work through the same checklist.
In a recent matter, a financial services business operating across multiple jurisdictions identified a screening gap that had permitted a series of low-value payments to pass through an entity later found to have a blocked beneficial owner. We assessed the apparent violation, advised on the VSD eligibility criteria, prepared the initial notification, and then drafted the full report with a detailed account of the remediated screening programme. The outcome, as is always the case, depended on the specific facts; but the availability of a structured VSD route was central to managing the exposure.
How does the Canadian VSD process differ procedurally?
Canada does not operate a formal two-stage VSD protocol equivalent to OFAC's. A business wishing to make a proactive disclosure in a Canadian sanctions matter must identify the correct receiving authority – GAC for the civil/administrative side, the RCMP for potential criminal referrals – and frame the disclosure in a way that the authority will treat as cooperative and complete.
SEMA creates criminal offences for breach of Canada's autonomous sanctions regulations. The maximum penalty exposure is substantial. Because a self-disclosure could contain admissions relevant to both administrative and criminal proceedings, the disclosure strategy must account for potential use of the report in a subsequent prosecution. This is a material complication that does not arise in the same form under OFAC's civil enforcement track, where the VSD is made to a civil regulator operating under a penalty-based rather than a prosecution-based system.
The absence of a published timing rule for Canadian disclosures creates its own risk. There is no equivalent of the OFAC initial notification period. In our experience, that vacuum leads some businesses to delay indefinitely – waiting for legal clarity that does not arrive – while the window for a genuinely proactive disclosure narrows. The practical position is that earlier is better, and that the disclosure should be submitted before any indication that an authority has opened an inquiry.
A further distinction: Canada's regime interacts differently with the UN Consolidated List and with allied-regime designations than OFAC does. A person designated solely by OFAC may not be designated under a Canadian sanctions programme, and vice versa. The legal analysis of whether a violation occurred under each regime is therefore separate. Do not assume that an apparent OFAC violation is automatically a Canadian violation – or that it is not.
Where do the two regimes diverge on mitigation benefit?
OFAC's published enforcement guidelines quantify the mitigation benefit in explicit terms. A qualifying VSD in a non-egregious case can reduce the base penalty to a materially lower figure than would otherwise apply. The guidelines also create a category of cases – where the violation is non-egregious and the VSD is complete – in which OFAC may issue a no-action letter or a cautionary letter rather than a penalty notice at all. That outcome is not guaranteed and depends heavily on the specific facts, but the pathway exists in the published framework.
Canada does not publish a comparable schedule of mitigation reductions. The benefit of a proactive Canadian disclosure is therefore harder to predict and is assessed case by case. This means that a cross-border business subject to both regimes may be able to quantify its OFAC exposure with reasonable confidence after a thorough VSD analysis, while its Canadian exposure remains inherently more uncertain. That asymmetry in predictability is one of the most operationally significant divergences between the two regimes.
A second divergence concerns aggravating factors. OFAC's guidelines set out specific aggravating factors – concealment, senior management involvement, harm to sanctions programme objectives, repeat violations – that can override the mitigation benefit and push the penalty higher. Canada similarly treats concealment and deliberate evasion as serious aggravating factors, but the published guidance on how those factors interact with a proactive disclosure is less granular. In practice, this means that a Canadian disclosure strategy cannot be calibrated solely against a published matrix; it requires a judgment about prosecutorial discretion that is less mechanically predictable.
Related practices
- Apparent violation assessment – scoping an apparent breach and advising on the disclosure decision across regimes
- OFAC vs OFSI: voluntary self-disclosure compared – the UK regime's mitigation structure alongside the OFAC framework
The position above covers the standard case. Your facts – the goods or funds involved, the counterparty ownership chain, the applicable regime or regimes in play, and the timing of discovery – change the analysis significantly. For an assessment of your exposure under OFAC or the Canadian sanctions regime, contact Calder & Vance at info@caldervance.com.
What are the cross-border risk flags when both regimes apply?
A business that is simultaneously exposed to OFAC and Canadian sanctions enforcement faces a sequencing problem. Filing a VSD with OFAC first provides clear benefits under the OFAC guidelines, but the content of that disclosure – including admissions of fact about the underlying conduct – may then inform a Canadian inquiry if the disclosure becomes known to GAC or the RCMP. The two submissions need to be carefully co-ordinated in substance and timing.
Privilege is the first structural concern. Under OFAC's process, the VSD is a communication between the firm and a regulator, not a confidential legal advice document. In Canada, the interaction between solicitor-client privilege and regulatory disclosures is also well-established – but the precise boundaries differ from the US position, particularly where in-house counsel are involved. A submission drafted primarily for OFAC may not carry the same privilege protections in a Canadian context, and vice versa. We regularly advise clients to structure the internal investigation and external disclosure under a consistent privilege framework from the outset.
The second risk flag is divergence in the legal classification of the underlying conduct. A payment that constitutes an apparent violation under an OFAC sanctions programme may not engage the same Canadian programme, or may engage it differently, depending on which sanctions list the counterparty appeared on and which regulatory instrument applies. Running the two analyses independently – rather than assuming that a breach of one is automatically a breach of the other – prevents both over-disclosure and under-disclosure.
The third risk flag is the interaction with other regimes. A matter with an OFAC and a Canadian dimension may also engage UK OFSI sanctions (if a UK-connected entity is involved), EU Council regulations (if EU-regulated persons or entities are in the chain), or the UN Consolidated List. Each of those regimes has its own enforcement posture and its own approach to proactive disclosure. Where multiple regimes apply, the overall disclosure strategy needs to address all of them, not just the two most visible.
If a transaction has already been flagged internally, or an external inquiry has been signalled, an early cross-regime review can preserve options that narrow with time. Contact Calder & Vance at info@caldervance.com to discuss how to structure a multi-regime disclosure.
Is OFAC or Canada stricter on voluntary self-disclosure?
OFAC is more structured and in some respects more demanding procedurally, while Canada is less predictable but potentially more severe in the specific case where criminal referral is in play. The answer depends on what "stricter" means for the business in front of you.
OFAC's enforcement guidelines create a high bar for a qualifying VSD: the disclosure must be voluntary, timely, complete, and accurate. A disclosure that is incomplete – whether through omission of relevant facts or inaccurate characterisation of the conduct – can be treated as no disclosure at all, and in some circumstances as an aggravating factor. OFAC expects an affirmative account of what happened, not a minimising narrative. Experienced sanctions lawyers drafting OFAC VSD reports frame every fact that OFAC would find anyway, because discovering an omission during OFAC's review is significantly worse than including a bad fact in the initial submission.
Canada's criminal exposure under SEMA means that the maximum theoretical consequence – a custodial sentence and a substantial fine – exceeds what OFAC can impose through its civil enforcement track alone. OFAC civil penalties are significant, but they do not carry criminal consequences for individuals in the ordinary case. This creates a different risk calculus: the Canadian exposure, where criminal referral is plausible, requires a disclosure strategy that is sensitive to the criminal dimension from the outset, whereas the OFAC framework is primarily civil and operates accordingly.
The myth worth dispelling here is that Canada's less formal VSD process makes it easier to manage. In our experience, the absence of a published framework can create the false impression that a Canadian disclosure requires less preparation. The opposite is true. A disclosure to a regulator that has broad prosecutorial discretion and no published calibration of mitigation benefits requires more careful drafting, not less, because there is no formula to rely on. Rigorous preparation is the only risk-management tool available.
When should a cross-border business involve sanctions counsel?
The decision to self-disclose should never be taken without legal advice. The assessment has at least four components: whether a violation actually occurred under the applicable regime (not all apparent violations are real ones); whether the disclosure would be voluntary by the relevant legal standard; what the disclosure should contain; and how to sequence a multi-regime matter.
Each of those questions has a legal dimension that is not apparent from the published guidelines alone. The threshold question – whether a violation occurred – requires an analysis of the applicable sanctions programme, the ownership and control position of the counterparty at the time of the transaction, and the availability of any general licence or exemption that might apply. A business that self-discloses a transaction that turns out not to have been a violation has created an unnecessary adverse record without any corresponding benefit. That outcome is avoidable with proper prior analysis.
The timing question is equally important. OFAC's VSD framework turns critically on whether the agency has already opened an inquiry. Determining that requires a review of any agency correspondence, subpoenas, or indirect signals – a port-of-entry hold, a customs query, a banking-sector report to FinCEN – that might indicate prior agency interest. In our practice, the initial consultation on a potential VSD almost always begins with that question: is this actually voluntary?
For the Canadian dimension, the involvement of counsel is even more important given the absence of a published framework. Sanctions counsel with cross-border experience can advise on the co-ordination of the OFAC and Canadian submissions, the privilege structure of the internal investigation, the timing of each disclosure, and the identification of any further regimes that need to be addressed in the same exercise.