A multinational with operations on both sides of the Atlantic discovers a screening gap. Payments have been processed for a counterparty that appeared on a blocked-persons list. The compliance team asks two questions simultaneously: does this get reported to OFAC? Does it get reported to OFSI? The answers differ – and managing both disclosures without understanding those differences is one of the most consequential errors a cross-border business can make.
A voluntary self-disclosure (VSD) is a proactive report to a sanctions regulator of an apparent violation, made before that regulator identifies the conduct independently. Under OFAC, VSD is a well-defined process governed by IEEPA and the agency's enforcement guidelines, and a timely, complete disclosure can reduce a civil penalty base by a material factor. OFSI operates a parallel but structurally distinct process under SAMLA and its own enforcement guidance – with different timelines, different evidentiary standards, and a different relationship between disclosure and penalty mitigation. As of March 2026, the two regimes have never been formally harmonised, and the divergences carry real operational consequences for any business subject to both.
This analysis maps those divergences across the full disclosure lifecycle: the trigger, the filing mechanics, the investigation that follows, the penalty calculus, and the cross-border coordination problem that catches businesses off-guard when both regulators are in play at once.
What triggers a VSD obligation under OFAC and OFSI?
Neither OFAC nor OFSI imposes a hard statutory duty to self-disclose every apparent violation – but both treat voluntary disclosure as a significant factor in the enforcement calculus, and both can treat the absence of disclosure as an aggravating circumstance where the business clearly identified the problem and remained silent.
Under OFAC, the trigger is an apparent violation – meaning the facts, on a reasonable assessment, suggest that a transaction or dealing may have breached a prohibition. OFAC's enforcement guidelines place VSD in a distinct procedural track. The business makes an initial notification within a short window after the apparent violation is identified, then submits a full written disclosure within a defined period after that initial contact. The guidelines treat the initial notification as the anchor: it is the date from which OFAC measures timeliness. Businesses that investigate internally for months before making any approach to OFAC risk losing the timeliness credit entirely.
OFSI's trigger is functionally similar but textually different. Under SAMLA and the relevant thematic sanctions regulations, a person who knows or has reasonable cause to suspect that they hold frozen funds or that a breach has occurred must report to OFSI. That reporting obligation is a legal duty, not a discretionary choice. The VSD framework sits alongside it. OFSI's enforcement guidance distinguishes between the mandatory statutory report (which satisfies a legal requirement) and a fuller voluntary disclosure (which attracts mitigation credit in the penalty calculation). A business that makes only the mandatory report without engaging the fuller disclosure process may find that OFSI treats this as compliance with the minimum – not as a mitigating VSD.
In our cross-border practice, the most common error at the trigger stage is treating the two processes as equivalent. They are not. A business that has made its OFAC initial notification has not thereby notified OFSI. Each regulator requires its own, separate engagement.
How the filing mechanics differ: timelines and content
The procedural architecture of VSD under OFAC and OFSI diverges sharply on timelines, content requirements, and the role of counsel in the submission.
Under OFAC, a business first submits an initial notice – a brief, factual notification that an apparent violation has occurred and that a full submission will follow. OFAC's enforcement guidelines set a target of 180 days from the initial notice within which the complete written submission should be delivered. That submission must cover the full factual record: the nature of the violation, the parties involved, the value and volume of transactions, the cause of the failure, and the remediation steps taken or planned. OFAC expects a candid, well-evidenced account. A submission that is incomplete, inconsistent with discoverable evidence, or that minimises the business's own role will not attract the full VSD mitigation credit – and may be treated as a negative factor.
OFSI does not operate an equivalent initial-notice/full-submission two-stage process. OFSI expects a single, integrated disclosure. The timeline for submission is measured against the point at which the business identified the issue, and OFSI's enforcement guidance is clear that delay in reporting – for any reason, including ongoing internal investigation – will weigh against the business in the penalty assessment. In our experience, OFSI moves faster than many businesses expect: a disclosure submitted several weeks after the apparent violation is identified will often be treated as less timely than one made within days.
Content requirements also differ. OFAC's guidelines specify the categories of information a full submission should address in some detail. OFSI's guidance is less prescriptive, but the agency expects a clear chronological account of what happened, how it was identified, and what the business has done since. Both regulators expect evidence of remediation. Neither accepts a bare admission without explanation.
One structural difference has practical significance: OFAC permits and in practice encourages counsel to lead the submission process. The submission is typically a formal legal letter, prepared and signed by counsel on the business's behalf. OFSI accepts – and in enforcement matters it is advisable to use – counsel involvement, but OFSI staff will often engage directly with the disclosing party's compliance officers as well, not solely through a legal intermediary. Businesses that assume the OFSI process mirrors OFAC in deferring entirely to the legal team can be surprised by direct contact from OFSI's enforcement staff early in the process.
The penalty calculus: where VSD credit diverges most sharply
VSD generates a material penalty reduction under both regimes – but the mechanics of how that reduction is calculated, and what can offset it, differ in ways that matter to any business weighing whether and how quickly to disclose.
Under OFAC's enforcement guidelines, VSD is classified as a substantial mitigating factor. A voluntary self-disclosure that meets the timeliness and completeness requirements reduces the applicable base penalty by a significant proportion. The base penalty itself is calculated by reference to the statutory maximum per-transaction figure, the number of transactions, and whether the violation was egregious or non-egregious. Aggravating factors – prior violations, management involvement, harm to sanctions policy objectives – can erode the VSD credit. OFAC has published the general structure of this calculation, and experienced counsel can model the penalty exposure with reasonable precision before the submission is made. That modelling matters: it affects the strategic decision about how much detail to disclose and in what sequence.
OFSI's penalty framework operates differently. Under SAMLA and OFSI's enforcement guidance, OFSI can impose civil monetary penalties up to the greater of a fixed statutory ceiling or a percentage of the value of the breach. VSD is listed as a mitigating factor but its weight is not mechanically specified in the way OFAC's guidelines specify it. OFSI exercises more discretion in calibrating how much weight to give a disclosure, and its enforcement guidance signals that the quality of the disclosure – candour, completeness, speed – matters as much as the fact of disclosure itself. A business that discloses but withholds material facts, or that frames the disclosure in minimising terms, may find the VSD credit substantially reduced.
There is another divergence that practitioners must flag: OFSI can now impose penalties directly on businesses without needing to pursue a criminal prosecution first, and it has done so with increasing frequency. OFAC's civil penalty track has always operated separately from DOJ criminal referrals. But the interplay between the two tracks is structurally similar: VSD to the civil regulator does not guarantee immunity from criminal exposure, and in serious cases, the disclosure itself may be shared with prosecuting authorities. This is a point where early counsel involvement is essential – not optional.
What does the divergence mean in practice? If a business faces exposure under both regimes – a cross-border payment that violated both OFAC programme rules and the relevant UK thematic sanctions – the penalty calculations run in parallel. A perfectly executed OFAC VSD earns maximum credit from OFAC. It earns nothing from OFSI unless a separate OFSI disclosure is also made. The two regulators do communicate, but they do not apply credit on each other's behalf.
Cross-border coordination: what happens when both regulators are in play?
For a business subject to both OFAC and OFSI jurisdiction, a single underlying event can require simultaneous management of two separate regulatory processes – each with its own timeline, its own content standards, and its own relationship with the business's legal team.
The practical complexity starts at the trigger. OFAC jurisdiction arises from US nexus – US persons, US dollars, US financial institutions, goods with US origin content. OFSI jurisdiction arises from UK nexus – UK persons, UK financial institutions, assets and transactions within the UK. A cross-border payment routed through a US correspondent bank and a UK clearing institution can engage both simultaneously. The fact pattern that triggers one will very often trigger the other.
Coordination problems emerge at three points. First, timing: the OFAC initial-notice mechanism allows a business a short window to notify before the full submission is due. OFSI expects a more immediate, integrated report. Running both processes in parallel without a coordinated timetable means that the OFSI disclosure may need to be made before the internal investigation is complete – which creates a risk of inconsistency between the OFSI account and the fuller OFAC submission that follows weeks later. Regulators compare notes. An OFSI disclosure that says one thing and an OFAC submission that says a materially different thing is a serious problem.
Second, the relationship between disclosure and privilege. In OFAC matters, the full submission is typically a privileged legal document, prepared under legal professional privilege and submitted by counsel. Privilege protects the investigative notes and legal analysis that underpin it. OFSI matters are subject to UK legal professional privilege principles, which are broadly similar in structure but not identical in application. Where a business uses the same internal investigation to support both submissions, the privilege position needs to be assessed separately for each jurisdiction. Assumptions that a common investigation memo is equally protected in both do not always hold.
Third, personnel exposure. OFAC enforcement can, in egregious cases, involve referral to DOJ for criminal prosecution. OFSI enforcement is civil only, but separate criminal liability under UK law can arise in serious cases, and the UK Serious Fraud Office has jurisdiction over conduct that overlaps with sanctions evasion. A business managing disclosures in both jurisdictions needs to assess whether any individual within the organisation has personal exposure before the disclosure is finalised. In our experience, businesses that prepare a well-coordinated dual-regime disclosure under counsel's direction, with privilege carefully maintained, manage this risk far better than those who run the two processes as independent compliance tasks.
If you are managing an apparent violation that engages both OFAC and OFSI, the time available to act is short. Regulators measure timeliness from when the business identified the issue, not from when it completed its investigation or took legal advice. Contact Calder & Vance at info@caldervance.com for an immediate assessment of your disclosure position.
The investigation that follows: how OFAC and OFSI differ in their scrutiny
A VSD does not end the regulatory process – it begins a structured engagement with the regulator that may last months and that will involve substantive scrutiny of the business's compliance programme, not merely the specific transactions disclosed.
Under OFAC, following receipt of a full submission, the agency may request additional information, seek interviews, or issue a subpoena if it determines that the voluntary process has not produced a complete picture. OFAC's enforcement guidelines contemplate an iterative process of information exchange between the submitting party and the agency. In practice, the complexity and duration of this engagement correlates with the seriousness of the apparent violation, the size of the business, and the quality of the initial submission. A well-prepared, complete, and candid submission typically results in a more focused – and shorter – follow-up process. An incomplete or inconsistent submission typically results in a more intrusive one.
OFSI's post-disclosure investigation follows a similar logic but operates under different institutional constraints. OFSI is a smaller agency than OFAC, and its enforcement resources are more concentrated. OFSI's investigation of a VSD will typically focus on the specific transactions, the ownership and control chain involved, and the steps the business has taken since the violation. OFSI has powers to require information and to conduct interviews. It uses them. In our experience, OFSI investigations following a VSD move faster than their OFAC counterparts – which can be an advantage for a business seeking certainty, but also means that the preparation window is shorter.
Both regulators assess the root cause of the failure as a key part of the post-disclosure process. A business that can demonstrate that it has identified the root cause, corrected the specific failure, and redesigned its compliance programme to prevent recurrence will receive a materially more favourable outcome than one that has simply stopped the specific conduct. Remediation is not an optional enhancement to the VSD – it is a substantive element of both OFAC and OFSI's enforcement calculus.
A point that businesses consistently underestimate: the regulator will look beyond the disclosed transactions. OFAC has stated explicitly in its enforcement guidelines that it reviews the broader compliance programme of disclosing entities as part of the enforcement process. OFSI's enforcement guidance reflects a similar orientation. If the internal investigation that preceded the VSD surfaces additional apparent violations that were not included in the initial disclosure, those must be addressed – either in the original submission or in a supplementary disclosure. Omitting known violations from a VSD submission is not a defensible compliance strategy.
Risk flags: the situations that most commonly go wrong
Practitioners who advise regularly on VSD matters under both regimes observe a consistent pattern of errors. The following risk flags represent the situations that most commonly produce avoidable outcomes.
Delayed identification and delayed disclosure. A business that has a weak screening programme may not identify an apparent violation until weeks or months after the underlying transactions. By that point, if the regulator has already identified the issue independently, the VSD track is closed. A business that discovers the violation but delays disclosure while conducting an internal investigation faces the risk that the regulator identifies the conduct during the delay and treats the eventual disclosure as non-voluntary. Both OFAC and OFSI measure timeliness from identification, not from the conclusion of internal investigation. Does your compliance programme have the detection capability to identify violations quickly enough to preserve the VSD option?
Incomplete disclosure. A VSD that covers some of the apparent violations but not all of them will be treated by OFAC as a partial disclosure. The credit for timeliness and completeness attaches only to what was disclosed. Undisclosed violations that surface later will be treated as non-VSD matters, and the regulator's view of the business's candour will be materially damaged. OFSI takes a similar position. The investigation that precedes the disclosure must be thorough enough to capture the full scope of the issue.
Failure to coordinate the two disclosures. As noted above, an OFAC submission and an OFSI disclosure that tell materially different versions of the same events create a serious credibility problem. Both regulators share information, formally and informally, particularly in the context of enforcement matters involving major financial institutions. Inconsistency between accounts – even unintentional inconsistency arising from the different content requirements of the two regimes – will be noticed.
Underestimating the compliance-programme scrutiny. Businesses that prepare a VSD as a purely transactional exercise – disclose the transactions, pay whatever penalty results, move on – frequently find that the regulator uses the VSD process as the entry point for a broader review of the compliance programme. Businesses that simultaneously submit a credible, well-evidenced remediation plan, demonstrating genuine systemic improvement, manage the broader review far better than those who treat it as an unexpected intrusion.
Individual exposure not assessed before disclosure. Where senior management or specific employees were involved in, or aware of, the apparent violation, the business's VSD does not protect those individuals from personal liability. Both OFAC and OFSI can take action against individuals as well as entities. Preparing a disclosure without assessing and managing individual exposure is a risk that counsel must address at the outset.
If a transaction has already been flagged by a regulator, or if your firm has received any form of regulatory inquiry that may relate to a potential violation, obtaining legal advice before responding is essential. Contact Calder & Vance at info@caldervance.com for a confidential review of your position.
A myth practitioners encounter: "VSD always results in a lower penalty, so the calculation is straightforward"
The assumption that VSD automatically produces a lower penalty, and that the calculation of whether to disclose is therefore always simple, is one of the most persistent misconceptions we encounter in advising cross-border businesses on OFAC and OFSI matters.
VSD is a material mitigating factor under both regimes – but it is not a guaranteed discount applied mechanically to a known base. The credit for VSD is calibrated against the quality, completeness, and timeliness of the disclosure; the severity of the underlying violation; the presence or absence of aggravating factors; and, critically, the remediation evidence. A VSD in an egregious case – where senior management was involved, where the conduct was repeated, or where the business failed to act on prior warnings – will attract a materially lower VSD credit than a VSD in a non-egregious case involving a systemic control failure with no management knowledge.
There is also a cost asymmetry that the myth ignores. Preparing a credible, complete VSD submission requires significant internal investigation, legal counsel involvement, and management time. That investment is justified where the penalty exposure is material and the VSD credit is likely to be substantial. Where the apparent violation is minor, the transactions are few, and the penalty base is low, the proportionality of the full VSD process relative to the likely penalty reduction is a question that experienced counsel can help a business assess. Not every apparent violation warrants a formal VSD submission to OFAC or OFSI; some may be handled through other engagement routes. The choice requires legal judgment applied to the specific facts.
A related misconception: that making a VSD protects the business from criminal referral. It does not. OFAC's civil enforcement programme operates alongside DOJ's criminal jurisdiction. OFSI's civil track operates alongside the UK's criminal law enforcement architecture. A well-executed VSD to the civil regulator is a significant factor in the civil penalty calculus. It is a relevant but not determinative factor in the criminal exposure assessment. The two tracks must be assessed separately.
Related practices
- Apparent Violation Assessment (EU) – scope, analyse, and respond to apparent EU sanctions violations before enforcement begins.
- OFSI vs EU: Voluntary Self-Disclosure Analysis – a companion analysis comparing the OFSI and EU disclosure regimes for cross-border businesses.
- OFSI vs EU: Voluntary Self-Disclosure – Further Analysis – extended comparison of OFSI and EU VSD mechanics, timelines, and penalty calibration.