Early account and settlement schemes under OFAC: a practical guide

A compliance officer receives an OFAC inquiry letter on a Monday morning. The underlying transaction happened eighteen months ago. The exposure is real, the record-keeping is incomplete, and someone in senior management is already asking whether criminal counsel should be on the call. What happens next – and specifically, what the firm chooses to say, when, and how – will shape the outcome more than anything that occurred at the time of the original transaction.

Early account and settlement schemes under OFAC are the formal mechanisms through which a person under investigation – or one that has identified its own apparent violation – can engage the agency proactively, present the facts on its own terms, and achieve a resolved outcome at a lower penalty level than contested enforcement. The governing authority is OFAC's Enforcement Guidelines, issued under IEEPA (the International Emergency Economic Powers Act), which treat voluntary self-disclosure (VSD – a proactive, timely report of an apparent violation before OFAC becomes aware of it) and cooperative engagement as recognised mitigating factors that reduce the base penalty calculation. As of early 2026, this pathway remains the primary route for negotiated resolution of civil sanctions exposure in the United States.

This guide walks through the engagement from the moment the apparent violation is identified to the point of final resolution, covering every decision point along the way, cross-regime comparisons with the UK and EU, and the risk flags that most frequently cause matters to go wrong.

How does an apparent violation first come to light – and why that moment matters?

The starting point for every OFAC settlement matter is the triggering event: the moment a firm – or a regulator – first identifies that a transaction may have violated OFAC's rules. That moment starts the clock on a series of decisions, the most consequential of which is whether to disclose voluntarily before OFAC makes contact.

The distinction between a VSD and a response to an agency inquiry is not cosmetic. OFAC's Enforcement Guidelines explicitly identify voluntary self-disclosure as a mitigating factor in the penalty calculation. In practice, a well-structured VSD filed before OFAC has identified the conduct positions the matter differently from day one – not only on the penalty arithmetic, but on the tone and pace of the engagement that follows.

In our experience, the triggering event is rarely a dramatic discovery. More commonly, it is a routine transaction-monitoring alert, a screening-tool upgrade that retrospectively flags a counterparty, an internal audit finding, or a departing employee's handover note. Each of these presents the same initial question: is this an apparent violation, and if so, who needs to know?

The first internal step is to scope the exposure quickly. How many transactions are potentially in scope? Over what period? Which OFAC programme? Are the amounts material? Is there any indication that OFAC, another regulator, or a law-enforcement agency already knows? The answers shape whether a VSD is strategically appropriate and how it should be structured.

What does a voluntary self-disclosure to OFAC actually contain?

A VSD is a structured written submission to OFAC that presents the facts of the apparent violation, the firm's assessment of the relevant prohibition, and the steps taken or being taken to remediate. It is not an admission of intent and it does not waive legal privilege over the investigation materials that underlie it, provided those materials are handled carefully from the outset.

The standard components of a VSD submission are these. First, a factual narrative of the apparent violation: what happened, when, which counterparty or destination was involved, and how the transaction came to be processed. Second, a description of the regulatory context – which OFAC programme applied, why the transaction was prohibited, and whether any licence or authorisation was available. Third, a root-cause analysis: what broke down in the compliance programme that allowed this to occur? Fourth, a remediation section: what has already been fixed, and what is the roadmap for the remainder?

The root-cause analysis is the section that separates a well-constructed VSD from a superficial one. OFAC's reviewers are experienced; they will assess whether the root-cause account is genuine and complete, or whether it is a defensive narrative designed to minimise. A VSD that attributes the violation to a "systems error" without explaining why the systems did not catch it, and without addressing the human-decision layer, is likely to generate follow-on questions that could have been pre-empted.

One practical point that we regularly advise on: the VSD must be sent to the right OFAC programme office. OFAC administers multiple list-based and comprehensive programmes, and the relevant office depends on which programme the violation falls under. Misdirecting a submission, or filing with the wrong team, costs time that the statutory filing window does not always allow.

How does OFAC assess the base penalty – and how is it mitigated?

OFAC's civil-penalty authority under IEEPA allows penalties to be assessed per violation, and the base amount can be substantial depending on the programme and the transaction values involved. The Enforcement Guidelines set out a structured framework for moving from a base figure to a final civil penalty through the application of aggravating and mitigating factors.

Voluntary self-disclosure is one of the most powerful mitigating factors available. Under the Enforcement Guidelines, a qualifying VSD in a non-egregious case can reduce the base penalty significantly relative to what the agency would otherwise assess. The contrast with a contested enforcement posture – where aggravating factors can be applied, and where the matter may take considerably longer to resolve – is material.

Other mitigating factors include: the apparent violation was not wilful or reckless; the firm has not previously received a penalty or cautionary letter; the firm identified and remediated the violation through a genuine compliance programme; the firm cooperated fully with OFAC's subsequent review; and the harm to the sanctions programme's objectives was limited. Aggravating factors run in the opposite direction: management involvement, deliberate concealment, a pattern of violations, or obstruction.

A word on the egregious classification. OFAC's Enforcement Guidelines distinguish between egregious and non-egregious cases. An egregious case – one involving wilful or reckless conduct, senior management knowledge, or a pattern of behaviour – attracts a higher base penalty, and voluntary self-disclosure produces a smaller proportionate reduction. Whether a matter is characterised as egregious is therefore one of the most important early analytical questions, and it should inform the decision about how and when to engage.

It is worth asking at this stage: have you considered what OFAC will find if it looks at the broader compliance programme, not just the specific transactions in scope? The agency's review does not stay narrowly focused on what was disclosed; it will assess whether the underlying programme is adequate.

Step by step: how does the settlement process run from first contact to resolution?

The settlement process follows a recognisable sequence, though the pace and complexity vary with the size of the matter and the responsiveness of both parties. Walking through the representative stages helps a firm understand what it is committing to when it chooses the VSD route.

Stage one: internal scoping and privilege mapping. Before any external engagement, the firm should establish what is known, instruct counsel to preserve privilege over the investigative work product, and make a preliminary assessment of whether the conduct is a civil or also a potential criminal matter. The criminal dimension – which involves DOJ rather than OFAC – changes the posture significantly and requires separate advice.

Stage two: the VSD submission. This is filed with the relevant OFAC programme office. The submission presents the initial factual narrative and requests that OFAC treat the disclosure as a VSD for purposes of the Enforcement Guidelines. A preliminary VSD can be filed quickly, followed by a more comprehensive submission once the investigation is complete, but the initial filing should be made promptly – OFAC's rules require that a report of blocked property or a rejected transaction be made within 10 business days of the triggering event, and delay beyond the voluntary-disclosure window undermines the VSD characterisation.

Stage three: OFAC's acknowledgement and information requests. OFAC will acknowledge the VSD and, in most cases, issue a request for additional information. This is a formal part of the process, not a sign that the initial submission was deficient. The responses to these requests must be accurate, complete, and consistent with the original submission. Inconsistency – even unintentional – is an aggravating factor.

Stage four: negotiation of the settlement amount. Once OFAC has completed its review of the submitted materials, it will typically make an opening settlement proposal. The firm, through counsel, responds with its own analysis of the applicable mitigating factors and the appropriate penalty range. Several exchanges may follow. In our cross-border practice, matters where the VSD was well-structured and the remediation was credible tend to reach agreement in fewer rounds.

Stage five: settlement agreement and public release. OFAC settlement agreements are published on the agency's website. The release includes a description of the apparent violations, the factors OFAC considered, and the agreed penalty. The public nature of this release is a fact that firms sometimes underestimate at the outset: the settlement record is permanent and searchable.

Stage six: remediation delivery and follow-on compliance commitments. The settlement agreement will typically require the firm to complete its remediation programme and may impose specific compliance commitments – testing schedules, reporting obligations, or personnel changes. These are not optional; failure to deliver on agreed commitments re-opens the exposure.

How does OFAC's approach compare with OFSI, the EU, and other regimes?

For a business operating across multiple jurisdictions, the OFAC settlement process is rarely the only enforcement engagement in play. The same underlying conduct may give rise to parallel exposure under OFSI in the United Kingdom, the relevant EU Council regulations, or other national regimes. Understanding how these regimes compare – and where they diverge – is essential for managing the overall position.

The UK regime under OFSI has its own enforcement and monetary penalty guidance, published most recently in early 2026, which introduced a formal early account scheme and a settlement scheme with a specific percentage discount for eligible cases. OFSI's strict-liability basis – which does not require proof of knowledge for a monetary penalty to be imposed – mirrors OFAC's approach in one important respect: a firm can face a penalty even where it did not know it was dealing with a designated person. The UK maximum monetary penalty, as currently in force (verify before reliance), is the greater of £1,000,000 or 50 percent of the breach value. The interaction between an OFAC VSD and an OFSI disclosure is an area of active practice: the timing and sequencing of the two submissions can affect both outcomes.

The EU regime operates through Council Regulations and is enforced at the member-state level, so there is no single "EU settlement scheme" equivalent to the OFAC process. An EU directive on the criminalisation of sanctions violations sets minimum standards, including maximum terms of imprisonment of at least five years for serious offences and corporate fines expressed as a percentage of worldwide turnover. Member states were required to transpose that directive by May 2025, and transposition continued through 2026, with infringement proceedings opened against those that had not yet acted. The practical result is that the criminal dimension of an EU sanctions violation may be assessed by a national prosecutor under newly enacted criminal provisions, adding a further layer to any multi-regime matter.

Switzerland, Canada, and Australia each maintain their own sanctions regimes with varying degrees of voluntary-disclosure incentive. In our experience of cross-border matters, the key question at the multi-regime coordination stage is whether a disclosure in one jurisdiction can create adverse consequences in another – for example, by providing a factual record that a foreign prosecutor uses against the firm in a criminal context. This is a material risk that requires regime-by-regime analysis before any submission is filed.

Does the OFAC VSD protect you in every jurisdiction? It does not. It protects only the civil penalty calculation under OFAC's own Enforcement Guidelines. Everything else requires separate legal analysis.

For a deeper look at how the UK early account and settlement scheme operates in parallel, see our guide to the OFSI early account and settlement process. For the EU procedural context, see our guide on EU fixed-penalty and procedural sanctions.

What are the risk flags that cause matters to go wrong?

A VSD that is poorly handled can produce a worse outcome than a well-managed response to an agency inquiry. Several patterns recur in matters where the initial disclosure created problems rather than resolving them.

First, incomplete scope. The VSD presents a subset of the transactions that are actually in scope, whether because the internal investigation was not thorough enough or because someone made a judgment that certain transactions were different in kind. OFAC's reviewers will frequently identify inconsistencies between the disclosed transactions and the firm's broader transaction history. A disclosure that appears to have cherry-picked the facts is treated as an aggravating factor, not a mitigating one.

Second, delayed filing. The reporting obligation for blocked property runs within 10 business days of the blocking event. A firm that sits on a potential VSD for weeks while it conducts an internal investigation may find that it has already missed the window for treating the report as a timely voluntary disclosure. Speed and thoroughness are in tension here, and managing that tension is one of the core early-stage tasks for counsel.

Third, inconsistency across submissions. Where a firm files a preliminary VSD and then a comprehensive follow-on submission, the two must be consistent. Inconsistency – even where it reflects the normal process of learning more during an investigation – needs to be carefully explained. Unexplained inconsistency reads as concealment.

Fourth, inadequate remediation. OFAC expects that remediation is under way, not merely planned. A VSD filed with a promise to fix the problem "over the next twelve months" is less compelling than one accompanied by evidence that the screening system has already been upgraded, the relevant personnel have been trained, and the governance structure has been strengthened.

Fifth, failure to coordinate with other regulators. Where a bank's primary prudential regulator also has visibility into the transactions, or where a foreign regulator has already made contact, the OFAC disclosure needs to be coordinated with those other regulatory relationships. A firm that tells OFAC one thing and its prudential supervisor another is in a materially worse position than one that presents a consistent account across all regulators.

Addressing the myth: is staying silent really safer than self-disclosing?

A common instinct, particularly in firms without prior enforcement experience, is that silence is protective. The reasoning runs: if OFAC does not know about the violation, disclosing it can only make things worse. This is not how the regime works in practice, and acting on that instinct is one of the most consequential mistakes a firm can make.

OFAC's investigative reach is broader than most firms appreciate. Financial institution data, transaction reporting, correspondent-bank records, export documentation, and information shared between regulators all create pathways through which apparent violations surface. Blocking and rejection reports (the mandatory reports that counterparty financial institutions file when they encounter sanctioned parties) mean that even a single transaction may generate multiple data points in OFAC's systems before the firm has decided what to do.

The consequence of silence, if OFAC subsequently identifies the violation through its own means, is that the mitigating effect of voluntary self-disclosure is lost entirely. The firm moves from the non-egregious, cooperative track to the contested track, with all the aggravating potential that involves. The criminal referral risk also increases: OFAC's civil enforcement team can refer matters to DOJ, and the combination of a known violation and apparent non-disclosure is precisely the pattern that attracts criminal attention.

In our experience advising firms on OFAC matters across multiple sectors, the early instinct toward silence almost always gives way once the full legal position is explained. The question is whether that explanation comes early enough to preserve the VSD option.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.