A logistics firm operating across the Atlantic discovers a payments error. A subsidiary transferred funds to a counterparty that, on closer inspection, appears on a restricted list under both US and UK rules. The question arrives in the general counsel's inbox within hours: do we disclose, and if so, to whom, in what order, and on what timetable? The answer is not the same on both sides of the Atlantic – and the gap between the two approaches is wider than most compliance teams expect.
Voluntary self-disclosure (VSD – the act of proactively reporting an apparent violation to the relevant regulator before the regulator discovers it independently) is a formal mitigating factor under both OFAC and OFSI. As of early 2026, both regimes reward disclosure, but the procedural requirements, the weight given to the disclosure, and the interaction with parallel investigations differ in ways that materially affect a cross-border business's strategy. Choosing the wrong sequence, or disclosing to one authority without a plan for the other, can close options that were open at the outset.
This analysis sets out the legal basis and procedure for VSD under each regime, the key points of divergence, the risk flags a cross-border business must manage, and when to involve sanctions counsel before putting anything in writing.
What is the legal basis for voluntary self-disclosure under each regime?
Both OFAC and OFSI have published enforcement guidance that expressly treats a timely, complete VSD as a significant mitigating factor in penalty calculations – but the instruments and the mechanics differ. Under OFAC, the authority to impose civil monetary penalties derives from the relevant enabling legislation, and OFAC's enforcement guidelines (issued under that authority) set out VSD as a defined procedural step that can reduce a penalty base substantially. Under OFSI, the power to impose monetary penalties derives from the UK Sanctions and Anti-Money Laundering Act ("SAMLA") and the relevant thematic sanctions regulations made under it. OFSI's published enforcement guidance similarly identifies VSD as a mitigating consideration, though it operates within a different penalty-calculation architecture.
The United Nations Security Council framework sits behind both regimes at the international level. Designations that originate at the Security Council level flow through into OFAC's SDN List (OFAC's list of Specially Designated Nationals and blocked persons) and into the UK Consolidated List maintained by OFSI. A VSD relating to a UN-listed person therefore has a jurisdictional dimension that extends beyond the bilateral US-UK picture – and a cross-border business must consider whether the same conduct also engages EU Council regulations, which have their own disclosure and reporting posture.
The position above covers the standard case. Your facts – the counterparty, the goods, the route, the regime in play – change the analysis. To discuss your specific situation with a sanctions lawyer, contact Calder & Vance at info@caldervance.com.
How does the OFAC voluntary self-disclosure procedure work in practice?
OFAC's VSD procedure is formally documented in its enforcement guidelines, which set out the content requirements, the timing expectations, and the evidentiary standard for a disclosure that qualifies for the defined mitigation credit. A qualifying VSD is not simply an informal email acknowledging a problem. It is a structured submission covering the who, what, when, and why of the apparent violation, accompanied by a factual chronology and an account of the remedial steps already taken or planned.
Timing is the threshold question. OFAC expects a business to report as promptly as is practicable once it has identified an apparent violation. In our experience, the window between internal discovery and a submission that OFAC treats as timely is shorter than many compliance teams assume. A protracted internal investigation that delays the submission by several months, without a clear justification for the delay, risks undermining the timeliness element of the mitigation case.
The submission itself is typically structured in two phases. An initial notification alerts OFAC to the existence of an apparent violation while the full investigation is ongoing. A complete report follows, containing the detailed factual account, the legal analysis of the conduct, a description of remedial action, and – where relevant – an assessment of whether the violation was voluntary or non-egregious. OFAC's classification of a violation as voluntary and non-egregious, supported by a complete and timely VSD, can reduce the base penalty substantially. That reduction is not a guarantee; it is a factor in the penalty analysis, and OFAC weighs it alongside the totality of aggravating and mitigating circumstances.
One point that frequently surprises US-based compliance teams is the relevance of the 50 percent rule (OFAC's rule treating entities owned 50 percent or more by blocked persons as themselves blocked, even if not listed) to the VSD narrative. If the apparent violation involved a counterparty that was blocked by operation of the ownership rule rather than by name, OFAC will scrutinise whether the business had adequate screening controls in place to detect indirect exposure. That assessment feeds directly into the "systemic concern" factor in OFAC's penalty matrix – and a weak answer on screening can offset the credit earned by the VSD itself.
How does the OFSI voluntary self-disclosure procedure differ?
OFSI's disclosure procedure rests on two distinct legal obligations that compliance teams must not conflate. First, OFSI has a statutory reporting obligation under SAMLA: a "relevant firm" (a category that includes financial institutions and certain other regulated entities) that knows or suspects that a person is a designated person, or that it holds funds or economic resources belonging to a designated person, must report that knowledge or suspicion to OFSI. This is not a VSD in the discretionary sense; it is a mandatory duty. Second, separately from that mandatory obligation, OFSI encourages voluntary disclosure of apparent breaches as a mitigating factor in enforcement proceedings.
Understanding the difference between these two tracks is essential. A business that conflates the mandatory reporting duty with the discretionary VSD may delay a mandatory report while preparing a polished voluntary submission – and that delay is itself a breach. In our cross-border practice, we see this confusion arise most often in multinational groups where the compliance function is centralised in a US-based team that applies OFAC procedures across the group without adapting them to the UK statutory reporting architecture.
On the penalty side, OFSI's enforcement guidance treats VSD as a factor that can significantly reduce the amount of a monetary penalty. OFSI has published details of its penalty decisions, which gives practitioners a clearer public record of how the regulator has treated VSD in assessed cases than OFAC's record provides – though neither regulator offers a fixed formula. OFSI also operates a "report and pay" mechanism for lower-value breaches, which has no direct analogue in the OFAC system. The monetary penalty cap under OFSI is set by statute (the greater of a percentage of the value of the breach or a fixed maximum), whereas OFAC's civil monetary penalties are determined by statutory per-transaction caps as adjusted from time to time and subject to OFAC's penalty matrix.
If a transaction has already been flagged by OFSI, or a filing has been refused, an early legal review can preserve options that narrow with time. Contact Calder & Vance at info@caldervance.com to discuss the position.
Where do the two regimes diverge most sharply?
The divergence is most acute in four areas: the mandatory versus discretionary character of disclosure, the sequencing of disclosures in a parallel-regime situation, the weight assigned to VSD in the penalty calculation, and the treatment of privileged materials during the investigation phase.
On the mandatory versus discretionary point, OFAC does not impose a general statutory duty on non-financial-institution businesses to report apparent violations; disclosure is discretionary (though strongly incentivised). OFSI, by contrast, imposes a mandatory reporting duty on relevant firms under SAMLA. A multinational group that triggers both regimes must therefore navigate a situation in which disclosure to OFSI may be legally required before the internal investigation is complete enough to support a well-structured OFAC submission. Sequencing the two disclosures without either delaying the mandatory OFSI report or prejudicing the OFAC submission requires careful coordination.
On the weight given to VSD, OFAC's guidelines expressly provide that a timely, complete, accurate VSD for a non-egregious, non-wilful violation can reduce the base penalty calculation by a defined proportion relative to the applicable statutory maximum. OFSI's guidance is less formulaic but has demonstrated in published cases that a well-structured disclosure results in materially lower penalties. Practitioners note that the OFAC credit is more arithmetically predictable; OFSI's approach is more holistic and therefore less easy to model in advance.
On privilege, both regimes present tensions. OFAC will accept submissions that withhold attorney-client privileged materials, but the completeness requirement means that a business cannot use privilege to shield exculpatory facts from the submission narrative. OFSI similarly expects a frank account. Where the investigation has been conducted under legal professional privilege – for example, through an external counsel-led internal investigation – decisions about what materials to include and what to withhold require advice from UK counsel familiar with both OFSI's expectations and the scope of privilege under English law.
The EU position adds a further dimension. Where the same conduct implicates EU Council sanctions regulations, the relevant EU member state authority (competent national authority) handles enforcement, and the EU regime does not have a single pan-European VSD procedure equivalent to OFAC's or OFSI's. Disclosure strategy must therefore address the national competent authority of any affected EU member state alongside the OFAC and OFSI tracks. In our cross-border practice, coordinating three parallel disclosure tracks – US, UK, and one or more EU jurisdictions – is an increasing feature of enforcement matters for European multinationals with US-dollar payment flows.
What are the principal risk flags in a cross-border voluntary self-disclosure?
Four risk flags consistently arise in the cross-border VSD matters we advise on, and each can undermine the mitigation credit that the disclosure is designed to generate.
Delay without documented justification. Both OFAC and OFSI assess the timeliness of a VSD as part of the mitigation analysis. An internal investigation that runs for several months before any notification is made – without a contemporaneous record showing why the complexity of the matter required that time – reads to both regulators as delay, not diligence. The practical implication is that an initial notification (even a brief one, acknowledging the existence of an apparent violation and committing to a full report) should be made at the earliest practicable point. The full report follows; the initial notification preserves the timeliness argument.
Incomplete disclosure. A VSD that omits facts material to the analysis – whether because they were not yet known or because a decision was made to characterise the conduct favourably – risks a worse outcome than no disclosure at all. OFAC and OFSI both treat incomplete or misleading submissions as aggravating factors. In a parallel-regime situation, a submission to one regulator that is inconsistent with submissions to another creates a cross-border credibility problem that is very difficult to manage after the fact.
Failure to remediate before the submission. Both regulators look for evidence that the business has taken concrete steps to prevent a recurrence. A VSD accompanied by a detailed remediation plan – enhanced screening, revised ownership-mapping procedures, amended counterparty-approval processes – is treated more favourably than a disclosure that presents the violation without a forward-looking response. Remediation that is still "under consideration" at the time of the full report is weaker than remediation that is already implemented.
Systemic versus isolated conduct. A single transaction error in an otherwise well-controlled environment is treated differently from a pattern of conduct that suggests a systemic screening failure. OFAC's enforcement guidelines explicitly identify the presence or absence of systemic concerns as a factor in the penalty matrix. OFSI's enforcement guidance similarly weighs the systemic character of the breach. Where screening data shows multiple missed hits over an extended period, a business should expect both regulators to press hard on whether the VSD represents the full extent of the exposure.
How should a cross-border business sequence a dual-regime voluntary self-disclosure?
A cross-border business facing apparent violations under both OFAC and OFSI should treat the sequencing question as a strategic decision that shapes every downstream element of the enforcement response. There is no single correct sequence; the right approach depends on the specific facts, the relative severity of the apparent violation under each regime, the applicable mandatory reporting obligations, and the state of the internal investigation.
A common starting point is to map, at the earliest stage, which obligations are mandatory (OFSI's statutory reporting duty for relevant firms) and which are discretionary but strongly incentivised (OFAC VSD). The mandatory obligations set the earliest filing deadlines and constrain how long the internal investigation can run before a notification must be made. Within that constraint, the business can work toward a coordinated set of submissions that are consistent in their factual account and appropriately timed.
In a recent matter, a financial services firm with operations in London and New York identified a payment that had been processed to a counterparty with a complex ownership structure. The counterparty was not named on any list, but an ownership analysis revealed that a blocked person held a significant minority stake in combination with a second listed party, together exceeding the relevant ownership threshold. The firm faced mandatory reporting obligations to OFSI and a strong incentive to submit a VSD to OFAC. We advised on the sequencing of the two submissions, coordinated the factual narrative across both jurisdictions, and prepared the remediation evidence package. The matter concluded with both regulators treating the disclosure as timely and complete. No penalty outcome is guaranteed; this account is illustrative of the process, not of the result.
One structural point deserves emphasis: a decision to disclose to OFAC without a contemporaneous plan for the OFSI position, or vice versa, creates an asymmetry that later submission to the second regulator cannot fully repair. Regulators communicate with each other, formally and informally, at the international level. A business that has filed a VSD with OFAC and is identified by OFSI through separate means before the OFSI disclosure has been made is in a materially weaker position on the mitigation point than a business that managed both tracks in parallel.
A common misconception: does voluntary self-disclosure guarantee a reduced penalty?
A persistent myth in corporate compliance circles is that a well-drafted VSD effectively caps the penalty at a nominal level. The reality is more nuanced. Neither OFAC nor OFSI treats VSD as a guarantee. The disclosure is one factor among several in each regulator's penalty assessment.
OFAC's enforcement guidelines set out a list of aggravating factors – wilfulness, concealment, harm to sanctions objectives, recidivism, pattern of conduct – any one of which can erode or eliminate the credit available for a timely VSD. A business that disclosed promptly but is found to have had a systemic screening failure over several years will not receive the same treatment as one that disclosed an isolated processing error. OFSI's published enforcement decisions tell a similar story: the penalty outcome reflects the totality of the conduct, not the disclosure alone.
What VSD does reliably achieve, when properly executed, is to preserve the maximum available mitigation credit and to demonstrate good faith to the regulator. That matters because it shapes not only the penalty quantum but also the regulator's assessment of whether the business requires ongoing monitoring, additional undertakings, or a referral to another authority. A well-managed VSD, in our experience, changes the character of the enforcement relationship – from an adversarial investigation to a cooperative resolution – and that shift in itself has practical value beyond the arithmetic of the penalty calculation.
The ownership and control dimension (the UK and EU test for whether a non-listed entity is caught through a listed person) is relevant here too. Where the apparent violation involved a counterparty caught through ownership rather than by name, both OFAC and OFSI will scrutinise the adequacy of the business's de-risking (a financial institution exiting a relationship to avoid sanctions exposure) and screening procedures. If those procedures were inadequate, the VSD credit is at risk of being offset by the systemic-concern factor.
Related practices
- Apparent violation assessment – EU – structuring your EU enforcement response before it becomes a formal investigation
- OFAC vs OFSI: voluntary self-disclosure compared (part II) – deeper procedural comparison and case-study analysis
- OFSI vs EU: voluntary self-disclosure compared – how UK and EU disclosure procedures diverge for cross-border groups