Criminal liability for sanctions breaches under OFAC: a practical guide

A regulator inquiry arrives. The transaction was flagged months ago. Someone on the team knew the counterparty had a problematic shareholder structure, but the deal closed anyway. Now the Department of Justice is asking questions alongside OFAC. Criminal liability for sanctions breaches under OFAC is not a theoretical risk reserved for rogue traders: as of early 2026, enforcement activity has confirmed that wilful and knowing violations can attract prosecution regardless of corporate size or sector.

Under US law, criminal liability for sanctions breaches arises when a person wilfully or knowingly violates a sanctions programme administered by OFAC under IEEPA or TWEA. Civil liability, by contrast, is strict – no knowledge is required. The criminal standard is higher, but it is not a safe harbour: the distinction between the two tracks is often drawn during an investigation, not before it, and a business that has not prepared its position is already at a disadvantage.

This guide works through the criminal-liability question as a practitioner would – from understanding the governing regime, to mapping the exposure, to deciding whether and how to disclose, to managing a live inquiry. It addresses how the OFAC criminal framework compares with the approach taken by UK and EU authorities, so that a cross-border business can calibrate its response across the regimes it faces simultaneously.

What is the governing authority for criminal sanctions liability in the United States?

OFAC administers the US economic-sanctions regime, but criminal prosecution for sanctions violations is the province of the Department of Justice. OFAC identifies the potential violation and makes a referral; DOJ decides whether to charge. That two-authority structure is the first thing a cross-border compliance team must internalise: OFAC and DOJ are separate actors, with separate standards, and they can move independently or in parallel.

The principal statutory bases are IEEPA and TWEA. Both statutes contain criminal-penalty provisions that apply to wilful violations. The statute of limitations for civil and criminal violations of IEEPA and TWEA was extended to ten years as of 2024 – a significant change from the prior five-year period, as currently in force, verify before reliance. That extension means a transaction that looked time-barred may no longer be, and any internal review must reach back accordingly.

For export-control breaches with a sanctions dimension – shipments of controlled items to restricted destinations or end-users – the Export Control Reform Act and the EAR administered by BIS are also relevant. DOJ handles criminal matters arising under both regimes, and joint OFAC/BIS violations are a recognised pattern in export-enforcement matters. We regularly advise clients on fact patterns that touch both agencies, and the procedural dynamics differ materially from a pure-OFAC case.

How does the criminal standard differ from OFAC's civil strict-liability framework?

OFAC's civil-penalty authority operates on a strict-liability basis: a violation can be found even where the respondent had no knowledge of the sanctioned nexus and took all reasonable precautions. That is the mechanism behind the majority of OFAC enforcement actions. Criminal liability applies a different test – the government must prove that the defendant acted wilfully or knowingly.

What does "wilfully" mean in practice? It means the government must show the defendant was aware of the legal duty and deliberately chose to violate it, or was wilfully blind to facts that made the violation apparent. "Knowingly" typically covers conduct where the defendant was aware of the relevant facts, even if not fully aware of their legal consequences. These are prosecutorial tests developed through case law; they require evidence of mental state, which is why internal communications, compliance approvals, and escalation records become central exhibits in a criminal investigation.

There is, however, an important asymmetry. In a civil OFAC matter, a voluntary self-disclosure is a recognised mitigating factor under OFAC's Enforcement Guidelines. It can move a matter from an egregious to a non-egregious classification. In a criminal matter, the same disclosure reaches DOJ and can inform the charging decision – but the interaction between the two tracks is not automatic or predictable. A decision to disclose must be made with both tracks in view. This is where the myth of protective silence is most dangerous.

What is the most common myth about criminal exposure – and why is staying silent riskier than it appears?

The myth runs: "If we disclose, we hand the government a roadmap. Silence gives them nothing." This is one of the most reliable ways to convert a manageable civil matter into a criminal referral. OFAC's Enforcement Guidelines treat voluntary self-disclosure as a significant mitigating factor – it is formally recognised in the framework that classifies a matter as egregious or non-egregious. A business that stays silent loses that mitigation and simultaneously creates a pattern of conduct (continued operations, incomplete records, non-disclosure) that can independently support a wilful-blindness argument.

In our experience, the cases that escalate from OFAC civil inquiry to DOJ criminal referral most frequently involve one or more of the following: evidence that someone in the organisation knew of the red flag and overrode it; a pattern of similar transactions suggesting the violation was not isolated; a voluntary-disclosure opportunity that was deliberately passed over; and a compliance function that was structurally bypassed. None of those features is unique to large businesses. We have acted for financial institutions and mid-sized exporters facing exactly this pattern.

The counterpoint to the myth is not that disclosure is always straightforward – it carries real risks of its own, particularly in a multi-regime environment where a disclosure to OFAC can reach UK or EU counterparts. But the analysis must be made deliberately, with counsel, and not by default through inaction. Silence is itself a choice with legal consequences.

How does the OFAC criminal framework compare with the UK and EU approach?

Cross-border businesses subject to both US and UK sanctions face materially different criminal-liability structures, and the divergence matters at the point of deciding whether to disclose and to whom. Under the UK regime, OFSI administers civil monetary penalties on a strict-liability basis; the maximum penalty is the greater of £1,000,000 or 50 percent of the value of the breach, as currently in force, verify before reliance. Criminal prosecution for UK sanctions offences requires knowledge or intent and is handled by the Crown Prosecution Service, not OFSI. The reporting obligation is distinct: certain categories of relevant firms are under a legal duty to report knowledge or suspicion of a designated person to OFSI.

The EU approach adds a third layer. An EU directive on the criminalisation of sanctions violations requires Member States to provide for criminal penalties for serious violations, with maximum terms of imprisonment of at least five years for individuals and corporate fines expressed as a percentage of worldwide turnover or a fixed maximum, as currently in force, verify before reliance. Transposition proceeded through 2025 and 2026 across Member States. For a business with EU-incorporated entities or EU-nexus transactions, the local criminal exposure depends on which jurisdiction's transposing legislation applies.

The practical implication: where two regimes both apply, the stricter prohibition governs. A transaction that is permissible under UK rules may still be prohibited under OFAC's broader secondary-sanctions reach or under an EU Council Regulation. Disclosure decisions must map across all applicable regimes. A disclosure to OFAC that reveals a UK-nexus element may need to be accompanied by or followed by engagement with OFSI. In our cross-border practice, we construct the disclosure strategy across all relevant jurisdictions before any approach is made.

What are the risk flags that elevate a civil matter toward criminal territory?

Not every OFAC violation becomes a criminal matter. Most do not. The risk of criminal escalation is materially higher where specific aggravating patterns are present, and identifying those patterns early is the purpose of a triage review in the first hours after a potential violation is discovered.

The indicators that elevate risk include: evidence of actual knowledge by a senior person – emails, approval records, escalation notes that show someone understood the sanctioned nexus; override of a compliance function – where a screening alert was closed without adequate justification; wilful blindness – where due-diligence steps that would have revealed the nexus were not taken, and a court could infer that they were deliberately avoided; a repeated pattern of similar transactions with the same counterparty or destination; prior OFAC cautions or informal engagement that put the business on notice; and attempts – however informal – to disguise the transaction's routing or the counterparty's identity.

Are all of these present in every referral? No. But a matter presenting several of them simultaneously is a criminal-liability matter for practical purposes, regardless of what label OFAC initially attaches. The triage review must assess each of these indicators systematically and document the assessment. An undocumented review is nearly as damaging as no review at all, because it cannot serve its purpose if the matter later proceeds.

What is a step-by-step approach to assessing criminal liability exposure under OFAC?

A structured assessment of criminal-liability exposure under OFAC follows a defined sequence. The goal is to produce a defensible, documented evaluation of where the matter sits on the civil-to-criminal spectrum, before the government makes that assessment for you. Each step informs the next, and the sequence matters: steps taken out of order can inadvertently waive privilege or crystallise a disclosure obligation at the wrong moment.

Step 1: Preserve records and assert privilege. Before any substantive review begins, all relevant records must be preserved. Legal privilege should be asserted over the investigation from the outset. Communications that flow outside the privilege perimeter – to commercial teams, to the board outside counsel's structure, to counterparties – can become discoverable. This is a structural step, not an optional one.

Step 2: Establish the transaction facts independently. Reconstruct what happened, when, and who knew what. The question of mental state – the element that distinguishes civil from criminal – turns entirely on the evidence of knowledge. The internal reconstruction must be honest and complete; a selective account that later proves partial is more damaging than the underlying facts.

Step 3: Assess the sanctions nexus. Map the transaction against the applicable OFAC programme. Is a blocked person involved directly? Does the 50 percent rule – treating entities owned 50 percent or more by blocked persons as themselves blocked – apply to any entity in the chain? Does the transaction involve a comprehensive territorial programme rather than a list-based prohibition? The legal analysis determines which prohibitions were engaged.

Step 4: Assess the mental-state evidence. Review the compliance records, screening outputs, escalation emails, approval notes, and any internal communications touching the transaction. Is there evidence of actual knowledge, wilful blindness, or override? This is the step that separates a strict-liability civil matter from a potential criminal referral. It must be conducted by counsel, not by the compliance function acting alone.

Step 5: Evaluate the disclosure question. With the facts and the mental-state analysis in hand, assess whether a voluntary self-disclosure to OFAC is appropriate. OFAC's Enforcement Guidelines recognise voluntary self-disclosure as a mitigating factor. The disclosure assessment must simultaneously address any UK, EU, or other jurisdiction reporting obligations. Coordinating timing and content across regimes is not procedural formality: it is risk management. Sanctions records must be kept for five years, as currently in force, verify before reliance, and the disclosure file becomes part of that record.

Step 6: Manage the inquiry if one is already running. If OFAC has already made contact – a subpoena, an administrative inquiry, a request for information – the business is past the disclosure decision. The focus shifts to managing the government's investigation, producing documents within the required timelines, and co-ordinating with DOJ if it has joined the matter. Blocked-property and rejected-transaction reports are due to OFAC within 10 business days of the blocking or rejection, as currently in force, verify before reliance: any overdue reporting must be identified and addressed immediately.

When should a business involve sanctions counsel, and what does effective counsel do?

Sanctions counsel should be involved at the point a potential violation is first identified, not after an internal review has already produced written assessments, made disclosure decisions, or produced documents to regulators. The sequence in which legal advice is obtained affects what can be protected under privilege and what cannot. A business that runs an internal investigation without legal oversight, then engages counsel to "review" the completed file, has likely forfeited the privilege over most of the work product.

What does effective counsel do in a criminal-liability matter? The action library for this kind of matter covers: scoping the apparent violation against the applicable OFAC programme and the cross-regime exposure; advising on voluntary self-disclosure, including timing, content, and co-ordination with UK and EU counterparts; preparing the penalty defence or the submission to OFAC; managing DOJ engagement if a criminal inquiry is running in parallel; and advising the board or audit committee on remediation and programme improvements that reduce the risk of recurrence.

In our experience, the clients who manage these matters most effectively are those who involve counsel early, preserve privilege rigorously, and make disclosure decisions deliberately rather than reactively. A business that receives an OFAC inquiry and asks "what do we do now?" is already behind. The compliance checklist for criminal-liability exposure starts before the transaction closes, not after the inquiry lands.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.