A wire transfer is flagged by your bank's screening system on a Friday afternoon. The beneficiary's address matches a location associated with a restricted jurisdiction. Your legal team is scrambling: is this an apparent violation? Which regulator – OFAC, OFSI, or the European authority – needs to know? And how long do you have before disclosure becomes compulsory rather than voluntary?
An apparent violation (a transaction or conduct that appears to breach a sanctions or export-control prohibition, pending full legal analysis) requires immediate triage across every regime that touches the facts. As of March 2026, the governing authorities – OFAC in the United States, OFSI in the United Kingdom, and the relevant EU competent authorities – each apply a distinct test, a distinct reporting window, and a distinct set of aggravating or mitigating factors. Where your business has a cross-border footprint, all three sets of rules can engage simultaneously.
This guide walks through the apparent-violation assessment in sequence: establishing which regimes apply, conducting the legal triage, handling voluntary self-disclosure, managing the cross-border reporting mosaic, and reducing recurrence. It is written for General Counsel, Heads of Compliance, and in-house teams advising boards on what to do in the first hours and days after a potential breach surfaces.
Step 1: Establish which regimes are triggered by your facts
The first step in any apparent-violation assessment is jurisdictional mapping – determining which sanctions or export-control regimes apply to the conduct in question, because the answer drives every subsequent decision. A single transaction can simultaneously engage OFAC's rules (through a US-person nexus, a US-dollar clearing leg, or a US-origin item), OFSI's rules (through a UK-incorporated entity or a UK-person's involvement), and EU regulations (through an EU-established entity or goods that touched EU territory).
The US regime has the broadest extraterritorial reach. OFAC's rules apply to US persons anywhere in the world, to any transaction that clears in US dollars through a US correspondent bank, and to transactions involving US-origin goods, software, or technology. That means a non-US company using a dollar-denominated payment rail is a US person for that leg of the transaction. Have you confirmed whether any payment in the chain cleared through a US institution?
The UK and EU regimes apply to persons established or ordinarily resident in those jurisdictions and to conduct occurring within their territories. Where a group has an EU subsidiary and a UK subsidiary both involved in the same flow, both the EU and UK rules may be triggered independently. OFSI and the relevant EU competent authorities operate separate reporting and licensing regimes; satisfying one does not discharge the other.
In our cross-border practice, the single most common error at Step 1 is assuming that because the underlying contract is governed by English law, only OFSI's rules apply. That assumption ignores the dollar-clearing risk, the EU-subsidiary nexus, and – where goods are involved – the export-control dimension under BIS and the relevant EU dual-use rules.
Practical output of Step 1: a written jurisdictional matrix listing each regime, the nexus that triggers it, and the regulator responsible. That matrix becomes the spine of your apparent-violation file.
Step 2: Conduct legal triage – is there a prohibition, and is it engaged?
Once you know which regimes apply, the second step is to determine whether each regime's prohibition is actually engaged by your facts – because an apparent violation is not necessarily a real one. The triage analysis has three layers: the prohibition, the person, and the transaction.
Under OFAC, the core question is whether the counterparty is a Specially Designated National (a person on OFAC's SDN List of blocked parties) or an entity owned 50 percent or more by one or more SDNs. That ownership test – the 50 percent rule – is mechanical. It applies regardless of whether the SDN's name appears in any contract. Under OFSI and the EU, the test adds a control dimension: a non-listed entity may be caught if a designated person can direct or significantly influence its decisions, even without a majority ownership stake.
The prohibition layer then asks what the programme covers. Some regimes impose comprehensive country-wide restrictions; others are targeted, listing specific individuals and entities. Where the apparent violation involves goods, the export-control dimension is separate but parallel: does the item have an Export Control Classification Number (an ECCN, the US Commerce Control List classification) that requires a licence? Does it qualify as dual-use under the EU dual-use regulation?
At this stage, the triage output should address four questions in writing:
- Is the counterparty or a beneficial owner on any list maintained by a triggered regime?
- Does the 50 percent rule or the EU and UK ownership and control test capture an unlisted entity?
- Does the goods or technology involved require a licence or fall under a prohibition?
- Is there any general licence or exemption that permits the transaction notwithstanding the apparent restriction?
A negative answer to all four questions – properly documented – closes the apparent-violation file at this stage. A positive or uncertain answer to any of them moves you to Step 3.
In our experience, the most significant risk at Step 2 is the compressed timeline. Regulators view the speed of internal triage as an indicator of the quality of a compliance programme. A thorough analysis completed promptly carries more weight than an exhaustive one delivered weeks later.
Step 3: Decide on voluntary self-disclosure – the OFAC, OFSI, and EU calculus
A voluntary self-disclosure (VSD – a proactive report to the regulator identifying an apparent violation before the authority learns of it independently) can be the single most consequential decision in the apparent-violation process. The three major regimes treat it very differently, and understanding that difference is essential to making the right call.
OFAC treats a timely VSD as a significant mitigating factor in its enforcement calculus. Regulators assess the totality of circumstances – including whether the VSD was submitted promptly and with full information – when setting a civil monetary penalty. A VSD does not guarantee a reduced penalty, and it does not prevent a referral for criminal prosecution where egregious conduct is involved, but in our experience it reliably moves a matter from the higher end of the penalty range toward the lower.
OFSI operates a mandatory reporting obligation. A relevant firm – broadly, a financial institution and certain other regulated businesses – that knows or has reasonable cause to suspect that a customer or counterparty is a designated person, or holds frozen assets, must report that fact to OFSI. The reporting window is short; verify the current requirement before relying on any specific figure, as the obligation bites promptly after knowledge or suspicion arises. Failure to report is itself an offence. For non-mandatory reporters, voluntary disclosure is a mitigating factor in OFSI's penalty guidance.
EU member states each have their own competent authorities and their own enforcement postures, but the underlying EU regulation creates uniform prohibitions. Voluntary disclosure is not harmonised at the EU level; the incentive structure and the procedural requirements vary by member state. A business with subsidiaries in multiple EU countries may therefore face different reporting calculi in each jurisdiction simultaneously.
Does that complexity justify delaying a disclosure decision? Almost never. The moment a regulator learns of a potential violation through any channel other than the company's own report, the VSD option closes. Speed and completeness are the two variables a compliance team can control.
The VSD submission itself should include: a factual narrative of the transaction, the identification of the apparent prohibition, the steps taken to stop further exposure, and the corrective measures already in place or planned. Attaching evidence of those corrective steps at the time of submission – rather than promising future action – is a material factor in how OFAC and OFSI assess the quality of the disclosure.
The position above covers the standard case. Your facts – the counterparty, the goods, the payment rail, the regimes in play, and the timing – change the analysis materially. To discuss the VSD calculus for your specific situation, contact Calder & Vance at info@caldervance.com.
Step 4: Manage the cross-regime reporting mosaic – sequencing and confidentiality
Where multiple regimes are engaged, the question is not simply whether to disclose but how to sequence disclosures across jurisdictions without inadvertently prejudicing one proceeding through statements made in another. This is one of the most technically demanding aspects of cross-border apparent-violation management.
A VSD to OFAC is a legal submission; everything in it can be shared with other US agencies, including DOJ where criminal export-control exposure exists. A report to OFSI is subject to UK legal and procedural rules that are separate from the US framework. An EU member-state disclosure is subject to that state's procedural law, which may include confidentiality rules that differ from both the US and UK positions.
In practice, this creates three sequencing risks. First, a disclosure made to one regulator may include factual admissions that a second regulator then uses in a parallel investigation. Second, a disclosure in one jurisdiction may trigger a mandatory notification requirement in another – for instance, where a bank operating in the UK and the EU has an obligation to notify OFSI and, separately, the relevant EU competent authority. Third, internal communications prepared before legal counsel is engaged may not carry privilege in every jurisdiction.
The practical answer is to engage counsel before any external disclosure is made, to prepare a single master factual narrative with counsel, and to adapt that narrative for each jurisdiction's specific submission requirements. The master narrative controls the factual record; the jurisdictional adaptations address each regulator's specific format and emphasis requirements.
Record-keeping is equally important. The obligation to maintain records of sanctions-related transactions and communications runs across all major regimes; verify the current period for each regime before relying on any specific figure. Where there is doubt, keep the records for longer than you believe is required.
If a transaction has already been flagged by a counterparty or regulator, or a filing has already been refused, an early review of the sequencing options can preserve positions that narrow with time. Contact Calder & Vance at info@caldervance.com to discuss a cross-regime disclosure strategy.
What are the principal risk flags in a cross-border apparent-violation assessment?
Certain patterns consistently appear in cross-border apparent-violation matters and indicate elevated enforcement risk. Identifying them early determines whether a matter is handled as a compliance issue or escalates into a full enforcement proceeding.
The first flag is repeated conduct. An isolated transaction, promptly stopped and disclosed, is treated very differently from a pattern of transactions over months or years. Regulators examining the apparent violation will pull transaction history; if the same counterparty or the same payment route appears repeatedly, the narrative of inadvertence becomes difficult to sustain.
The second flag is a prior notice. If the business received any communication – a bank query, a screening alert, a compliance team warning – before the transaction completed, and nevertheless proceeded, that prior notice is a significant aggravating factor. OFAC's enforcement guidance explicitly identifies prior notice as relevant to the egregious-versus-non-egregious determination. OFSI's enforcement guidance treats prior notification similarly.
The third flag is concealment. This is distinct from evasion: it includes any internal action taken after the apparent violation was identified that reduced the documentary record – deleting communications, amending booking records, or failing to preserve transaction data. Regulators treat concealment as among the most serious aggravating factors in any enforcement action.
The fourth flag is senior-management involvement. Where the transaction was approved at a senior level, the business faces both institutional and personal enforcement exposure. In our experience, this is the flag that most often causes a matter to migrate from a civil to a criminal referral trajectory.
The fifth flag is a cross-border goods component. Where goods with a potential dual-use character were involved, the BIS and relevant EU dual-use rules create a parallel exposure that must be assessed simultaneously. A matter that is clean under the financial sanctions regime may carry a separate export-control liability.
Identifying which of these flags are present shapes the entire response strategy: the speed of disclosure, the scope of the internal investigation, and the degree of remediation documented before the VSD submission.
Step 5: Remediate and reduce recurrence – building the audit trail regulators expect
Remediation is not a post-enforcement formality. It is a substantive part of the apparent-violation response that regulators evaluate when assessing both the penalty and the level of ongoing supervisory engagement. A business that can demonstrate, at the time of its VSD, that it has already implemented corrective measures is in a materially stronger position than one that promises to do so later.
The remediation package for a cross-border apparent-violation matter typically addresses four areas. First, the immediate containment: stopping the transaction or payment leg, freezing any funds subject to the prohibition, and notifying the relevant financial institutions. Second, the root-cause analysis: identifying precisely why the screening system or the compliance process failed to catch the issue before the transaction completed. Third, the structural fix: amending the screening logic, updating the counterparty data, retraining staff, or revising the approval workflow. Fourth, the documentation: creating a contemporaneous record of each remediation step, dated and signed, so that the regulator receives evidence rather than assertions.
The root-cause analysis is the step most often underinvested. Regulators are experienced in distinguishing genuine process failures from post hoc narratives. A credible root-cause analysis identifies the specific gap in the five-element compliance programme – leadership, risk assessment, internal controls, testing, and training – that allowed the apparent violation to occur. In our experience, the quality of that analysis is often the single most persuasive element of the VSD package.
Where the apparent violation involved goods or technology, the remediation must also address the export-control dimension: reviewing the item classification, confirming the applicable licence exception or requirement for future transactions, and updating the end-use certification process. A financial-sanctions remediation that does not also address the export-control root cause leaves a residual exposure.
A common misconception: one disclosure covers all regimes
A persistent myth in cross-border compliance is that a disclosure to one regulator satisfies the reporting obligations under all regimes engaged by the same conduct. It does not.
OFAC operates under US law. OFSI operates under UK law. The EU competent authorities operate under the law of each member state. These are parallel systems with independent legal bases. A disclosure to OFAC does not notify OFSI; OFSI's mandatory reporting obligation is not discharged by a US filing. Similarly, a UK report to OFSI does not satisfy the notification requirements of any EU member state.
The practical implication is that a compliance team handling a cross-border apparent violation must track the reporting obligation and the disclosure status for each regime separately. In our practice, we maintain a regime-by-regime tracker for each cross-border matter, updated as submissions are made and responses received. The tracker also records the confidentiality constraints applicable to each submission, which affect what can be shared in parallel proceedings.
We regularly advise businesses that have made a disclosure to one regulator and then been contacted by a second, discovering only at that point that a parallel obligation existed. The later the second disclosure, the harder it is to sustain the position that it is voluntary rather than reactive. The lesson is to build the full jurisdictional picture before making any disclosure, not after.
Related practices
- EU Apparent-Violation Assessment Service – specialist advice on apparent violations under EU Council regulations and EU enforcement posture
- Apparent-Violation Assessment: EU Guide – step-by-step guide to the EU apparent-violation process and competent-authority reporting
- Apparent-Violation Assessment: Japan Guide – the Japan regime's approach to apparent violations, licensing, and cross-border interaction