Early account and settlement schemes under EU: step by step

A multinational receives a formal inquiry from a competent authority in an EU member state. The allegation: a series of transactions may have breached EU asset-freeze prohibitions. Criminal referral is a real possibility. The compliance team asks: should we engage proactively, or wait? And if we engage, how?

EU sanctions enforcement does not yet operate a single, harmonised early-account or settlement scheme equivalent to OFAC's voluntary self-disclosure pathway or OFSI's tiered settlement model. What exists instead is a patchwork of national procedures, shaped by an EU directive on the criminalisation of sanctions violations that required member-state transposition by 20 May 2025. Proactive engagement – structured correctly – remains a recognised mitigating factor before most competent authorities, and the direction of travel in EU enforcement is clearly toward formal cooperation schemes.

This guide walks through what you need to prepare before you engage, how to structure that engagement regime by regime and authority by authority, and how the EU position compares to the parallel frameworks in the United Kingdom and the United States.

What you need before you start: the readiness checklist

Before any form of proactive engagement with an EU authority, a business must complete a factual investigation that is thorough enough to withstand scrutiny. Submitting an incomplete or inaccurate account is materially worse than waiting: it hands the authority an inconsistency it can use.

Work through the following items in order. Each is a gate; do not advance until the preceding one is closed.

• Scope the apparent violation precisely. Identify each transaction or conduct that may constitute a breach of the relevant Council Regulation. Record the counterparties, the dates, the value, and the nature of the economic resource or funds involved. Do not summarise; the authority will want the underlying records.
• Identify the governing instrument and the specific prohibition. EU asset-freeze prohibitions – the prohibition on making funds or economic resources available, directly or indirectly, to or for the benefit of listed persons – operate under the relevant Council Regulation. Confirm which thematic regulation applies and whether the listed person's designation was in force at the time of each transaction.
• Assess the ownership and control dimension. Even where a counterparty was not directly listed, consider whether it was owned or controlled by a listed person under the EU control test. The EU test looks at ownership exceeding 50 percent and at effective control, as currently applied by the competent authority and the EU General Court. A gap in the ownership-chain analysis can reopen the scope of the violation after you have already filed.
• Identify the competent authority. EU sanctions are enforced at member-state level. Identify which national authority has jurisdiction: the financial regulator, a customs or trade authority, or a public prosecutor. If conduct spans multiple member states, there may be more than one competent authority, and their procedures will differ.
• Preserve all relevant records. Sanctions records retention obligations are a floor, not a ceiling. In an enforcement context, a legal hold should extend to correspondence, screening logs, ownership-chain analysis, compliance-programme documentation, and any prior legal advice that bears on the transactions in question.
• Map the parallel-regime exposure. Conduct with EU-nexus frequently also touches OFAC jurisdiction (because US persons or US-origin goods are involved) or OFSI jurisdiction (because a UK counterparty or UK-incorporated entity is in the chain). The stricter prohibition governs wherever both regimes apply simultaneously; a disclosure to one authority does not discharge obligations to the others.

Only once these items are complete should the business begin to consider the form and timing of engagement. Going to an authority prematurely – before you know the full scope – risks creating a record of understatement that becomes a credibility problem later.

Understanding the EU enforcement architecture

EU sanctions law is made at Union level but enforced by member states, and that split creates a fundamentally different enforcement environment from the centralised models operated by OFAC in the United States and OFSI in the United Kingdom.

The Council Regulation is directly applicable across all member states, so the underlying prohibition is uniform. What varies is everything else: which authority investigates, the procedural rights available to the person under investigation, the penalty regime, and the availability and structure of any cooperation or settlement mechanism.

The EU directive on the criminalisation of sanctions violations – which member states were required to transpose into national law by 20 May 2025 – sets minimum standards. It requires member states to treat serious violations as criminal offences and provides for maximum terms of imprisonment of at least five years for the most serious conduct, as well as corporate fines expressed either as a percentage of worldwide turnover or a fixed maximum. As currently in force, verify the transposed position in the relevant member state before relying on it, since transposition progress varied and infringement proceedings were opened against states that did not meet the deadline.

What this means in practice: the conduct you are assessing may be a regulatory infringement in one member state and a criminal matter in another. The decision about whether to engage proactively, and how, must be made by reference to the specific national regime, not to an assumed EU-wide standard. In our practice, we routinely work with local counsel in the relevant jurisdiction to map those differences before advising a client on the appropriate disclosure posture.

Does this complexity favour silence? It does not. Most competent authorities – whether operating an administrative or a criminal model – treat proactive engagement as a mitigating factor. The question is how to structure it.

How does EU differ from other regimes here?

The most direct comparator for any EU enforcement engagement is the UK's OFSI model, which since 2022 has operated on a strict-liability basis with a published monetary penalty guidance and – as of its revised 2026 guidance – formal early account and settlement schemes carrying defined discounts. The US OFAC model similarly operates a voluntary self-disclosure pathway recognised in its published Enforcement Guidelines, where self-disclosure is a mitigating factor capable of substantially reducing a penalty.

Neither of those features – a codified, regime-wide cooperation scheme with published discount percentages – exists yet at the EU level. What the EU directive does is create a floor: member states must treat cooperation, including voluntary disclosure and the provision of information, as a mitigating factor in sentencing and penalty calculations. Several member states have implemented that floor. Some have gone further and introduced formal cooperation procedures in their national administrative enforcement rules.

The practical divergence between the regimes is sharpest in three areas. First, certainty: an OFSI settlement scheme or an OFAC VSD produces a defined procedural pathway with a known structure; an EU engagement is negotiated through the relevant national procedure. Second, cross-border coordination: a single transaction can engage authorities in two or more member states simultaneously, whereas OFAC and OFSI are each single authorities. Third, criminal exposure: the EU directive introduces minimum criminal-law obligations that some member states have implemented more vigorously than others, so the risk profile of proactive engagement includes criminal-procedure considerations that do not arise in the same way under the OFSI administrative model.

For a business simultaneously exposed under EU and UK regimes, our recommendation is to sequence engagement carefully. An admission made in a UK OFSI context is not automatically protected in a criminal proceeding in a member state. Structure the parallel disclosures with that asymmetry in mind.

The cross-regime point also applies to OFAC. Where the same conduct engages US secondary-sanctions exposure – for instance, because US persons or US-origin items were involved – a VSD to OFAC does not satisfy the EU obligation, and a settlement with an EU authority does not discharge OFAC exposure. We act for multinationals, financial institutions, and exporters on sanctions and export-control matters across the major regimes, and the management of parallel disclosures is one of the most frequently encountered coordination problems in our practice.

See also our parallel step-by-step guides: Early account and settlement under OFAC and Early account and settlement under OFSI, which set out those regimes' procedures in the same format.

The step-by-step engagement procedure

Once the readiness checklist is complete and you have mapped the competent authority and its national procedure, engagement follows a sequence that is broadly consistent across member states, even where the formal rules differ.

1. Obtain specialist advice before first contact. The first communication to an authority sets the tone and the record. If it understates the scope of the violation, correcting it later is costly. If it overstates it, the authority may treat the surplus as additional admissions. Before any written or oral contact, confirm with your sanctions and export-control counsel what you are disclosing, in what form, and to whom. This is not the step to economise on.
2. Establish the applicable national procedure. Ask, through counsel, whether the competent authority operates a formal early-account or settlement mechanism. In jurisdictions that have implemented the EU directive's mitigating-factors provisions in a structured way, there may be a defined submission format, a defined response window, and a defined outcome range. In others, the process is more informal: a meeting, a letter, an undertaking. Knowing which applies before you file changes how you draft the submission.
3. Prepare the disclosure package. The package should cover: (a) a clear factual account of each relevant transaction; (b) an analysis of the legal basis for the apparent breach, referencing the relevant Council Regulation without unnecessary elaboration; (c) the ownership and control position at the time of each transaction; (d) the compliance programme in place and any gap identified; (e) the remedial steps already taken; and (f) any factors bearing on the nature and gravity of the breach. Avoid legal conclusions that you are not prepared to defend; the authority will draw its own conclusions.
4. File in the correct form and forum. EU member states have differing administrative requirements for how disclosures are made. Some require a formal written submission to a designated contact; others accept a meeting at which notes are taken. Confirm the correct channel. A disclosure filed to the wrong authority or in an incorrect format may not attract the mitigating credit it would otherwise deserve.
5. Manage parallel filings. If the conduct also engages OFAC or OFSI jurisdiction, co-ordinate the timing of the parallel submissions. Filing with one authority before another is ready can create inconsistencies in the factual account. Where criminal exposure exists in one or more member states, consider whether any self-incriminatory admission in an administrative context could be used in a criminal proceeding; the rules differ across member states and the interaction with the EU directive's implementation is not uniform.
6. Engage actively with the authority's questions. After the initial submission, the authority will typically ask questions. Answer them fully and promptly. Delays or partial answers are interpreted as a change of posture. In our experience, the willingness to engage transparently after the initial filing is weighted at least as heavily as the initial disclosure itself.
7. Seek confirmation of outcome in writing. Where the authority resolves the matter – by a penalty decision, a no-further-action letter, or a settlement agreement – obtain the outcome in writing. The written record defines what has been settled and prevents a reopening of the same conduct under the same competent authority. It does not prevent another authority from acting on the same facts, so keep that limitation in mind when framing the scope of any settlement.

Risk flags: what makes the position materially worse

Not every enforcement inquiry ends badly for a well-prepared business. What consistently worsens the position is a predictable set of conduct failures that an authority treats as evidence of bad faith or systemic control failure.

The first is delay. Once a potential violation is identified internally, the clock is running in every relevant jurisdiction. An EU authority that discovers the matter through its own intelligence, before you have engaged, loses the option to treat your engagement as voluntary. The mitigating value of proactive cooperation depends on its being genuinely proactive.

The second is an incomplete initial disclosure. Filing an account that excludes transactions that are later identified – through the authority's own investigation – is treated as a credibility problem, not an oversight. Scope the violation fully before you file, not after.

The third is inconsistency across parallel regimes. A factual account submitted to an EU authority that differs in material respects from an account submitted to OFAC or OFSI gives every authority a reason to distrust both. Coordinate the accounts so that any differences are justified by the genuinely different legal questions at stake, not by a desire to minimise in each forum separately.

The fourth is destruction or failure to preserve records. Where an authority later identifies a gap in the documentary record that corresponds to the period under inquiry, it will draw an adverse inference. Legal holds must be implemented immediately and comprehensively.

The fifth is underestimating criminal exposure. The EU directive has changed the calculus. In member states that have implemented it vigorously, a decision about proactive engagement is also a decision about criminal-procedure rights. The procedural rules governing self-incrimination, legal privilege, and the use of evidence gathered in administrative proceedings vary. Missing that dimension at the outset can narrow options that do not reopen.

What about the myth that silence is safer than disclosure? In our experience, this view is wrong in almost every case. An authority with intelligence about a potential violation that then identifies a failure to cooperate treats the silence as an aggravating factor, not a neutral one. The EU directive reinforces this: cooperation is a defined mitigating factor. Silence forfeits it. The question is not whether to engage but how and when.

When to involve sanctions counsel

Involve counsel before the first communication to any authority. That is the single most important timing point, and it is the point most frequently missed by businesses that handle the initial stages internally and engage outside advisers only once the inquiry has developed.

There are three earlier triggers that should prompt immediate specialist advice. First, when a transaction-monitoring system or a screening platform generates an alert that a counterparty may have been listed at the time of a transaction: this is the moment to assess scope, not to begin disclosure. Second, when a business receives any formal or informal communication from a competent authority – an information request, a supervisory letter, a site inspection notice – even one that does not yet use the word "breach". Third, when a business discovers, through its own due diligence, that a past transaction involved a counterparty that is now listed or that was owned or controlled by a listed person at the time.

In a recent matter, a financial institution active in cross-border payments identified, through a retrospective screening review, a series of historical transactions that appeared to involve counterparties owned by designated persons. We assessed the scope of the exposure under the relevant EU Council Regulation, mapped the parallel OFSI jurisdiction, and advised on the sequencing and form of engagement with the relevant competent authorities. The matter was managed through coordinated proactive engagement, with the institution in a position to present a complete factual account at the outset. We will not characterise the outcome beyond saying that early, well-structured engagement substantially preserved the options available to the client.

For businesses that have not yet faced an inquiry, now is the time to test whether the compliance programme would detect and correctly escalate a potential violation before the authority does. Screening logic that flags only directly listed parties and misses the ownership chain is a structural gap. See our related service on corporate liability and attribution for the framework we use to stress-test that logic.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.