A Canadian trading company receives a routine audit query from its bank. The bank has flagged a payment processed six months earlier – the beneficiary, it turns out, shares an address with an entity listed under Canada's autonomous sanctions regime. The transaction completed. The money moved. Now what?
An apparent-violation assessment (a structured internal review to determine whether a completed or ongoing activity may breach applicable sanctions law) under Canada's regime is governed primarily by the Special Economic Measures Act ("SEMA") and administered by Global Affairs Canada ("GAC"). As of March 2026, Canada's enforcement posture has shifted toward active investigation and referral to the Royal Canadian Mounted Police for criminal matters, making early, structured self-assessment more consequential than it was even two years ago. The window for voluntary disclosure – and its effect on penalty exposure – is not unlimited.
This guide walks through the assessment process step by step, identifies the points where the Canadian approach diverges from the OFAC, OFSI, and EU positions, and sets out the risk flags that should trigger immediate legal review.
Step 1: Understand the governing regime and who enforces it
Canada's primary economic-sanctions instrument is SEMA, supplemented by the United Nations Act ("UNA") for UN Security Council-mandated measures and the Freezing Assets of Corrupt Foreign Officials Act ("FACFOA") for targeted asset-freeze regimes. GAC administers all three. The Royal Canadian Mounted Police and the Public Prosecution Service of Canada handle criminal enforcement referrals.
Unlike OFAC, which combines list maintenance, licensing, and civil enforcement in a single agency, Canada separates the administrative and criminal tracks from the outset. GAC can issue administrative guidance and work with the regulated entity; criminal liability sits with prosecutors and carries custodial risk. Knowing which track your facts engage is the first step of the assessment – and the answer affects everything that follows.
Canada also implements UN Security Council Consolidated List measures through the UNA. For any apparent violation involving a UN-listed party, the dual-track analysis (UNA plus any applicable SEMA designation) is mandatory. Missing this layer is one of the more costly analytical errors we see in cross-border files.
Step 2: Identify and preserve the relevant evidence
Before any analysis begins, a business must freeze the documentary record. This means identifying and securing all contracts, payment instructions, correspondence, screening records, and authorisation approvals related to the potentially offending transaction.
Evidence preservation serves two purposes. First, it prevents inadvertent destruction, which regulators in every major regime treat as an aggravating factor. Second, it defines the factual universe that your legal team will work from. A reconstruction exercise conducted six months after the event – from email memory and partial records – is far weaker than a contemporaneous document set.
In our experience, firms that deal in goods, funds, or services across multiple regimes often discover that the same transaction touches a second sanctions system. A payment that appears in a Canadian bank's records may also have passed through a US correspondent account, engaging OFAC jurisdiction through the dollar-clearing route. Preservation must therefore cover records held by affiliates, banks, freight agents, and any other party in the transaction chain. Scope the evidence before you scope the law.
Step 3: Run the substantive legal analysis – what does Canada's law actually prohibit?
The substantive assessment turns on whether the activity falls within the prohibitions set out in the relevant SEMA regulations or UNA order. Canada's prohibitions typically cover dealings in property, provision of services, and financial transactions involving designated persons or entities. The analysis has three limbs: designation, nexus, and the availability of any permit or authorisation.
On designation, GAC maintains Canada's Consolidated Canadian Autonomous Sanctions List ("CCASL"). The list is distinct from the UN Consolidated List and from the OFAC SDN List. A party may be listed under one regime and not another; a party may be listed under two. The assessment must check all relevant lists, not only the Canadian one.
On nexus, Canada's rules apply to Canadian persons and to activities conducted in Canada. They also apply to Canadian-incorporated entities and, in some circumstances, their foreign subsidiaries. The territorial scope is narrower on the face of the statute than OFAC's extraterritorial reach, but the practical boundary is less clean: a Canadian parent that causes or facilitates a prohibited act by a foreign subsidiary may still face exposure. We regularly advise on exactly this boundary question in cross-border corporate groups.
On authorisation, Canada operates a permit system administered by GAC. A transaction that appears prohibited on its face may be covered by an existing permit, or the business may have grounds to seek one retroactively. However – and this matters for the assessment – a permit application made after a violation has occurred does not undo the violation. It may, though, affect the regulator's assessment of the firm's intent and its approach to enforcement.
Step 4: Assess aggravating and mitigating factors – where Canada's scoring differs
Once the underlying legal question is answered – apparent violation or not – the assessment must turn to the factors that will shape enforcement risk. Canada does not publish a formal penalty matrix in the way OFAC does with its enforcement guidelines, but GAC and prosecutors consider a broadly similar range of factors: the degree of wilfulness or recklessness, the duration and value of the conduct, harm to the sanctions objective, and the quality of the firm's compliance programme at the time.
Voluntary disclosure is a significant mitigating factor under all major regimes, and Canada is no exception. A firm that identifies an apparent violation, preserves evidence, conducts a thorough internal review, and makes a timely, complete disclosure to GAC is in a materially better position than one that waits for enforcement contact. The earlier the disclosure, the more meaningful the mitigation – but "early" must mean before GAC has initiated or substantially advanced its own investigation.
Two factors are worth flagging for firms with cross-regime exposure. OFAC's published enforcement guidelines identify voluntary self-disclosure (a "VSD" – the formal notification to a regulator before it learns of the issue through other means) as a factor capable of reducing a notional penalty base by a significant proportion. OFSI in the United Kingdom operates a similar framework. Canada's regime does not codify the reduction in the same explicit terms, but the practice consistently reflects the same logic. The cross-regime lesson: disclose early and completely, document the disclosure decision, and engage counsel before filing anything.
Step 5: Decide on disclosure – comparing the Canadian, OFAC, and OFSI routes
The disclosure decision is the most consequential step in the assessment. Three regimes – Canada, the United States, and the United Kingdom – each offer a voluntary-disclosure route, but the mechanics and consequences differ in ways that matter for a multi-regime file.
Under Canada's regime, disclosure is made to GAC. There is no codified "minor" versus "major" violation classification akin to OFAC's egregious / non-egregious distinction, though the practical outcome of the analysis follows similar logic. GAC's response can range from no further action, to a compliance undertaking, to criminal referral. The absence of a published civil-penalty schedule creates uncertainty – but it also creates space for well-prepared, well-presented disclosures to resolve without formal enforcement action.
Under OFAC, a VSD for a non-egregious matter typically results in a "no-action" letter or a substantially reduced penalty. The process is administratively structured and the timelines are broadly predictable once the VSD is filed. For a business with both a Canadian and a US nexus in the same transaction – a common fact pattern in North American supply chains – the two disclosures must be coordinated. Inconsistent representations across two regulatory submissions create their own risk.
Under OFSI in the United Kingdom, a similar voluntary-disclosure framework operates with its own procedural requirements and timelines. Where a transaction touches all three regimes – Canadian person, US-dollar clearing, UK-connected counterparty – a coordinated, sequenced disclosure strategy across all three authorities is the minimum standard. Our practice handles exactly these multi-regime disclosure questions; improvised single-jurisdiction disclosures on facts with cross-border elements are a recurrent source of difficulty in files that come to us after disclosure has already been filed.
Step 6: Identify the risk flags that require immediate counsel involvement
Not every apparent-violation assessment requires immediate external legal support – but several fact patterns elevate risk sharply and should trigger counsel involvement without delay.
- Criminal conduct indicators: any evidence that a designated party was knowingly transacted with, or that internal screening results were overridden without documented justification, moves the file toward the criminal track. This is not a matter for internal compliance to manage alone.
- Repeat transactions: a pattern of dealings, rather than an isolated event, signals systemic compliance failure and attracts a qualitatively different enforcement response in every major regime.
- Regulatory contact already made: if GAC, a bank, or another counterparty has already raised the transaction with the business, the window for voluntary disclosure – and the mitigation it carries – may be closing or already closed.
- Dual-use goods or technology: where the apparent violation involves goods or technology that may also engage Canada's export-control rules under the Export and Import Permits Act, the assessment must encompass both the sanctions and the export-control dimension. These are separate regimes with separate enforcement tracks.
- US-dollar nexus or US-person involvement: either feature can bring OFAC into the picture independently of the Canadian facts. A Canadian firm that processes a US-dollar payment – even through a non-US bank – may trigger OFAC jurisdiction through the correspondent-clearing chain.
- Ownership and control ambiguity: where the designated person is a shareholder rather than the direct counterparty, the assessment must map the ownership structure to determine whether the entity itself is caught. Canada's ownership-and-control analysis broadly tracks the approach under EU and UK sanctions, but the specific test should be confirmed against the applicable SEMA regulation rather than assumed.
A single flag from this list is enough to warrant legal review before any further steps are taken. Two or more flags in the same file should be treated as an urgent matter.
Step 7: Common misconceptions – what businesses get wrong in the Canadian assessment
The most persistent myth we encounter is that Canada's sanctions enforcement is less rigorous than OFAC or OFSI enforcement, and that a Canadian-only file therefore carries lower priority. This is not accurate as a description of the current enforcement environment. GAC has expanded its outreach and investigative capacity, and criminal referrals under SEMA are a real feature of the enforcement landscape. A business that treats a Canadian apparent violation as a lower-stakes matter relative to a US or UK equivalent risks a significant misallocation of response effort.
A second common error is treating the CCASL as the only relevant list. Many compliance teams run a transaction against the Canadian list and stop. The UN Consolidated List, applicable through the UNA, is a separate legal obligation. A counterparty not on the CCASL may nonetheless be on the UN list, and the Canadian obligation to comply with UN Security Council measures is directly enforceable. A complete Canadian apparent-violation assessment checks both.
Third: the assumption that a retroactive permit application resolves the apparent violation. It does not. A permit issued after the event authorises future conduct; it does not provide retrospective legal cover for a completed transaction. The permit application may assist the enforcement conversation, but it must not be confused with a legal cure.
What is the practical upshot? An apparent violation under Canada requires the same structured, evidence-anchored, multi-regime analysis as an apparent violation under OFAC or OFSI. The standards of care, and the consequences of getting the assessment wrong, are comparable.
Related practices
- Apparent-violation assessment – EU – enforcement and investigation counsel for EU sanctions apparent violations, including disclosure strategy and penalty defence
- Apparent-violation assessment – cross-border guide – coordinating apparent-violation reviews across OFAC, OFSI, and EU when one transaction touches multiple regimes
- Apparent-violation assessment – EU guide – step-by-step guide to the EU apparent-violation process, including ownership-and-control analysis and disclosure mechanics