A compliance officer at a mid-sized trading company receives an enforcement notice. The transaction involved goods routed through three jurisdictions. Two regulators are now asking questions simultaneously. The question is not whether a violation occurred – the question is how much it costs, and whether a criminal referral follows. That answer turns, in very large part, on mitigation factors in enforcement.
Mitigation factors in enforcement are the procedural, substantive, and behavioural indicators that regulators use to calibrate penalties across all major sanctions and export-control regimes. Applied correctly, they can reduce a civil penalty substantially and, in some regimes, eliminate it entirely. Applied poorly – or not applied at all – they expose a business to the maximum penalty base available under the relevant authority.
This guide sets out the cross-border mitigation procedure step by step, compares the approach taken by OFAC, OFSI, the EU, and BIS, and identifies the practical traps that cause businesses to lose credit they had earned.
What are mitigation factors in enforcement, and which authorities apply them?
Mitigation factors are the legally recognised considerations that a sanctions or export-control authority weighs when deciding whether to pursue enforcement, and at what level of penalty to set the outcome. Every major regime has a published or statutory basis for this assessment, though the weight given to individual factors differs sharply.
In the United States, OFAC applies a framework drawn from IEEPA and its own published enforcement guidelines. BIS applies a parallel process under the Export Control Reform Act and the Export Administration Regulations. Both agencies distinguish between egregious and non-egregious violations. Egregious cases attract the statutory maximum penalty base; non-egregious cases open a range in which mitigation is operative.
In the United Kingdom, OFSI's published enforcement guidance identifies factors that the Treasury considers when imposing, increasing, or reducing a civil monetary penalty. The relevant thematic sanctions regulations under SAMLA govern the legal basis. OFSI's enforcement posture has hardened since it gained the power to impose monetary penalties without requiring proof of knowledge in certain circumstances. That shift makes the mitigation record more important, not less.
In the European Union, enforcement remains fragmented across member-state competent authorities. The Council regulations set the prohibition; enforcement is national. Mitigating and aggravating factors are assessed at the member-state level, which means the same underlying violation may be treated very differently depending on the jurisdiction in which the enforcement action is brought. In our experience, businesses that operate across multiple EU member states rarely map this divergence until they face a concurrent inquiry.
As of the first quarter of 2026, the cross-border picture also includes SECO in Switzerland, GAC in Canada, DFAT in Australia, and the relevant national instruments in Singapore, the UAE, and Japan. Each of those regimes has its own mitigation architecture. The connecting thread is that every one of them responds positively to the same core signals: early disclosure, cooperation, and demonstrated remediation.
Step 1: Assess whether you have an apparent violation before a regulator does
The single most valuable mitigation action is an internal assessment that precedes any regulatory contact. Once a regulator identifies a potential violation independently, the credit for voluntary disclosure is lost entirely. The window between discovery and formal inquiry is short and must be used deliberately.
An apparent violation assessment should cover four questions. First, is there a prohibited transaction? Second, which regime or regimes are triggered by the facts? Third, what is the knowledge and intent record – did compliance personnel know, should they have known, and what did they do with that knowledge? Fourth, is the violation isolated or systemic?
The answers to those four questions drive every subsequent mitigation step. A systemic violation disclosed late, with poor compliance records, will attract penalty treatment at the upper end of the non-egregious range. A one-off, promptly disclosed, with a strong compliance programme in evidence, sits at the opposite end. For businesses with a cross-border footprint, the assessment must be run simultaneously across each affected regime. OFAC's analysis and OFSI's analysis of the same transaction are legally independent. Scoring well before one regulator does not automatically carry over to the other.
Our practice includes a structured apparent-violation assessment service for exactly this situation. Businesses that engage counsel at this stage consistently preserve options that are unavailable six weeks later. The EU apparent-violation assessment service page describes the EU-specific procedure in more detail.
Step 2: Decide whether to make a voluntary self-disclosure
A voluntary self-disclosure, or VSD (a proactive report to the relevant authority before that authority independently identifies the violation), is the single most powerful mitigation lever available across OFAC, OFSI, and BIS. All three authorities treat a timely, complete, and accurate VSD as a strong mitigating factor.
At OFAC, a non-egregious case in which a VSD is made is assessed against a base penalty that is substantially reduced from the statutory maximum. The precise mechanics depend on the applicable programme and the agency's current guidance, which should be verified before relying on it. The key variables are completeness – a VSD that omits material facts provides limited mitigation credit – and speed. The disclosure should precede independent regulatory discovery of the same facts.
At OFSI, the voluntary disclosure of a breach of financial sanctions is an explicit mitigating factor in the penalty calculation. OFSI's enforcement guidance describes the reporting obligation that attaches to relevant persons who hold information about a designated person or a breach. These are separate obligations: the mitigation credit attaches to the voluntary enforcement disclosure, not merely to the report of suspicion that relevant firms are already required to make. Confusing the two is a common and expensive mistake.
At BIS, a VSD to the Office of Export Enforcement can result in a case being handled at the administrative level rather than referred for criminal prosecution. That distinction matters far more than the civil-penalty differential. A BIS VSD must include a description of the apparent violation, the parties involved, the items, the destinations, and the remediation steps taken. An incomplete VSD can be treated as aggravating rather than mitigating.
Should every potential violation result in a VSD? No. The decision is fact-specific. In our experience, the cases that benefit least from disclosure are those in which the violation was minor, isolated, already remediated, and unlikely to be discovered independently. The cases that benefit most are those involving systemic issues, significant value, or high-profile counterparties. Disclosure of a serious violation before a regulator finds it independently converts a potential enforcement action into a negotiated outcome. That conversion is rarely available once the regulator has already opened a file.
Step 3: Document the compliance programme as evidence, not background
A well-designed compliance programme is a mitigation factor before OFAC, OFSI, BIS, and most other regimes. But the credit is conditional. The programme must have been in place at the time of the violation, must have been genuinely operative, and must address the risk category involved. A programme that exists only on paper provides little protection and can, in some circumstances, aggravate an outcome by suggesting that the violation was the product of wilful ignorance.
OFAC's published framework describes the five components it uses to assess whether a compliance programme is adequate: management commitment, risk assessment, internal controls, testing and auditing, and training. Businesses should treat those five components as the evidentiary framework for the mitigation submission, not merely as an organisational checklist. For each component, the question is not "do we have this?" but "what does the contemporaneous record show?"
Under OFSI's enforcement guidance, demonstrating a strong pre-existing compliance programme is explicitly recognised as a mitigating factor. The same is true under BIS's enforcement policy. In the EU, member-state assessments vary, but the existence and quality of a compliance programme is consistently relevant to the question of whether a violation was negligent or merely administrative.
What does the documentary record look like in practice? Compliance counsel reviewing a penalty submission will look for: board-level sign-off on the compliance programme; dated risk assessments covering the relevant sanctions categories; screening logs that show the programme was operating on the date of the violation; training records for the staff involved in the transaction; and any escalation records showing that the compliance team was engaged before or after the issue arose. Records that exist but cannot be located quickly are nearly as problematic as records that do not exist at all.
How does the cross-border dimension complicate mitigation?
The cross-border dimension creates three distinct complications that do not arise in a purely domestic enforcement matter: concurrent jurisdiction, programme divergence, and the risk of inconsistent representations to multiple authorities.
Concurrent jurisdiction means that a single transaction can trigger enforcement proceedings in more than one regime simultaneously. An export of dual-use goods from the United States to a third-market buyer may engage OFAC (if a sanctions programme covers the destination or the buyer), BIS (if the item requires a licence under the EAR), OFSI (if the exporter or any party has a UK nexus), and the relevant member-state competent authority (if the EU dual-use rules are engaged). Each authority applies its own mitigation criteria. Gaining full credit from one authority does not guarantee the same from another, and in some cases the disclosure made to one regulator can complicate the position before a second.
Programme divergence means that a compliance programme calibrated to OFAC standards may not satisfy the criteria that OFSI or a European competent authority applies. OFAC's five-component model is the US benchmark. OFSI has its own guidance. EU member states have developed their own assessment criteria. A business that assumes its OFAC-facing programme covers all of its regulatory exposure is operating on an incorrect assumption, and that assumption will be visible in the penalty submission.
Inconsistent representations are the most operationally dangerous risk. If counsel is preparing simultaneous VSD submissions to OFAC and OFSI, and the factual narratives differ in material respects, both authorities will notice. Coordinating the factual record across jurisdictions before any submission is filed is not optional. It requires a single point of oversight across all the enforcement workstreams. In our cross-border practice, we routinely act as that point of coordination, ensuring that the factual and procedural submissions across regimes are consistent and complementary rather than contradictory.
For the detailed EU procedure, the EU mitigation factors guide covers the member-state enforcement mechanics and the role of the relevant Council regulations. For the Japan-specific procedure, the Japan mitigation factors guide sets out the applicable national instruments and the relevant authority.
What are the risk flags that destroy mitigation credit?
Several patterns consistently reduce or eliminate mitigation credit across regimes. Recognising them in advance is more valuable than discovering them during a penalty proceeding.
The first risk flag is delay. Every major regime treats prompt action positively and delay negatively. A business that discovers a potential violation and waits while it hopes the issue resolves itself loses the VSD window, may breach any reporting obligation that attaches to relevant firms, and provides the regulator with a longer record of inaction to consider when assessing wilfulness.
The second risk flag is incomplete disclosure. A VSD that covers three transactions from a pattern of twelve does not attract the same mitigation credit as a comprehensive disclosure. Regulators conducting a review of the disclosed transactions will frequently identify the undisclosed ones. When they do, the incomplete VSD becomes evidence of an attempt to manage the disclosure rather than make it fully. In some cases that shifts the classification from non-egregious to egregious.
The third risk flag is a compliance programme that does not cover the risk category involved. If the violation arose from the use of a payment intermediary and the compliance programme has no counterparty-screening provision for payment intermediaries, the programme provides minimal mitigation value for that violation. The gap is noted and treated as evidence that the programme was designed around lower-risk categories.
The fourth risk flag is senior management involvement in the violation, or evidence that senior management was aware and did not act. All major regimes treat wilful, senior-level involvement as an aggravating factor. Where the evidence record shows that a compliance officer escalated a concern and was overruled, the mitigation position of the business deteriorates and the personal exposure of the senior individual increases. Have you reviewed the escalation record before any external filing is made?
The fifth risk flag is a pattern of prior violations or prior regulatory contact on the same issue. OFAC, OFSI, and BIS all treat prior history as an aggravating factor. A business that received a cautionary letter from one authority and then committed the same type of violation again will find that the prior contact is cited in the penalty proceedings, regardless of whether formal enforcement followed from the first contact.
When should a cross-border business involve sanctions counsel?
The instinct to handle an apparent violation internally is understandable. Most compliance teams are capable professionals. But in our experience, the cases that result in the worst outcomes are almost never those in which the violation was large. They are the cases in which a capable internal team made a procedural error during the early mitigation phase – a disclosure that was filed too quickly and incompletely, a factual narrative that was inconsistent across regimes, or a compliance programme review that was conducted after the submission rather than before it.
There are four moments at which external counsel adds the most value. The first is immediately after internal discovery of an apparent violation, before any external contact. The second is when a regulator makes initial contact, before a formal response is filed. The third is when a multi-regime exposure is identified – any situation in which more than one authority might have jurisdiction. The fourth is when a penalty submission is being prepared and the factual and compliance record needs to be reviewed for consistency and completeness before it is filed.
The position above covers the standard case. Your facts – the goods, the counterparty, the jurisdictions involved, and the compliance record at the time – change the analysis significantly. For a confidential review of a potential breach, contact us at info@caldervance.com.
A common myth: the compliance programme alone protects you
A persistent misconception in cross-border enforcement is that demonstrating a good-faith compliance programme is sufficient to avoid meaningful penalty exposure. It is not. The compliance programme is one factor among several. Its weight depends on whether it was operative, proportionate to the risk, and genuinely applied at the time of the violation.
Regulators reviewing a penalty submission assess not only whether the programme existed but whether it would have, if properly applied, caught the transaction in question. If the answer is yes and the transaction was not caught, the mitigation credit for the programme is reduced. If the answer is no – if the programme was not designed to catch this category of risk – the programme is largely irrelevant to the mitigation analysis for that violation.
The practical implication is that a compliance programme must be calibrated to the actual risk profile of the business, reviewed and updated when that profile changes, and tested to confirm that it operates as designed. A programme that was adequate five years ago and has not been reviewed since may not be adequate now. We regularly advise businesses on stress-testing their screening and compliance programmes against their current transaction footprint, precisely because the gap between the programme on paper and the programme in operation is the most common source of enforcement exposure in cross-regime matters.
If a transaction has already been flagged, or a regulatory inquiry has been received, an early review preserves options that narrow with time. To discuss the mitigation position on a specific matter, contact Calder & Vance at info@caldervance.com.
Related practices
- EU apparent-violation assessment – structured review of potential violations under EU Council regulations and national competent authorities
- EU mitigation factors guide – detailed procedural analysis of EU member-state enforcement and mitigation mechanics