A US-connected business processes a payment. Post-execution screening flags a potential link to a blocked person. The compliance team faces an immediate question: is this an apparent violation, and if so, what happens next? The answer turns not only on whether a rule was broken, but on how the business responds – and how well it can document everything it did, or failed to do, before the problem surfaced.
Under OFAC's enforcement guidelines, mitigation factors (criteria that reduce the gravity of an apparent violation and can lower the civil penalty base) are assessed across two broad categories: general factors applied in every matter and aggravating factors that can increase the base penalty. OFAC administers these under its statutory authority, primarily IEEPA and TWEA, and publishes enforcement guidelines that set out the criteria in detail. As of March 2026, a voluntary self-disclosure – timely, thorough, and unprompted – remains the single most powerful mitigation lever available to a business that has identified an apparent violation.
This guide walks through the mitigation criteria, the procedure for engaging OFAC, the common errors that convert mitigation into aggravation, and how the OFAC approach compares with OFSI, the EU, and SECO.
Step 1: Understand the governing authority and how OFAC scores a matter
OFAC administers civil economic-sanctions enforcement under its published enforcement guidelines, which apply to apparent violations of the US sanctions programmes it administers. Every enforcement matter is assessed through a two-stage scoring exercise: first, OFAC determines a base penalty figure derived from the transaction value or the applicable statutory maximum; second, it applies general factors that can move the outcome from a no-action letter or a cautionary letter at one end to a finding of a Egregious Case at the other.
The general factors are not a checklist. They are weighted judgments across multiple dimensions. OFAC considers the harm done to sanctions-programme objectives, the sophistication of the business, its sanctions history, and – critically – the quality of its compliance programme at the time of the violation. A business with no compliance programme at all is in a fundamentally different position from one whose programme had a design gap in one screening step. That distinction matters to how mitigation is framed and argued.
One point that surprises clients: OFAC's enforcement reach is extraterritorial. US-dollar clearing through the US financial system, US-person involvement anywhere in a transaction, and export of US-origin goods or technology can each bring a non-US business within OFAC's jurisdiction. The cross-border practitioner therefore needs to ask not only whether OFAC's rules apply, but whether a parallel or overlapping regime – OFSI, the EU, SECO – is also engaged. Each operates its own enforcement and mitigation regime, and a voluntary self-disclosure (VSD) to one authority does not automatically satisfy another.
Step 2: Identify and preserve the evidence base before anything else
The single most consequential action in the first hours after an apparent violation is identified is to stop further exposure and to begin preserving all relevant evidence. OFAC's guidelines explicitly weigh the quality and completeness of a VSD, so the evidentiary record you create now determines the quality of the disclosure you file later.
What does preservation mean in practice? Every communication, transaction record, screening result, override decision, and approval chain document should be placed on legal hold immediately. Do not delete, overwrite, or amend records. Do not send informal emails speculating about what went wrong: those communications are discoverable and can contradict a later, more careful analysis. In our experience, the damage from poor evidence management in the first 72 hours can be harder to remedy than the underlying violation itself.
The scope of the hold should be broader than you initially think is necessary. If the apparent violation involves a payment, hold the entire client-onboarding file, not just the individual payment record. OFAC looks at the systemic picture. A single transaction reviewed in isolation often looks more culpable than the same transaction reviewed in the context of an otherwise well-functioning programme that had one gap.
Record-keeping obligations under the major regimes are non-trivial. OFAC's rules impose a record-keeping requirement for transactions, and businesses should verify the current retention period under the applicable programme before any purge schedule runs. Similar requirements apply under OFSI and the EU regulations. If you are not certain what the current requirement is, err toward retention.
Step 3: Conduct an internal scoping review before deciding on voluntary self-disclosure
A VSD to OFAC is not a routine formality. It is a legal submission that, if done well, is the most effective mitigation tool available, and if done poorly, can create additional liability. Before filing, a business needs a clear-eyed assessment of what happened, who knew what, and when.
The internal scoping review has four objectives. First, establish whether a sanctions rule was actually violated. Not every screening hit is a true match. Not every transaction with a nexus to a restricted country or person is prohibited: general licences, exemptions, and the terms of specific programmes create space that a hasty analysis misses. Second, if there is a violation, characterise its nature and scope – single transaction or pattern, one business unit or systemic, US-only or multi-regime. Third, assess what the compliance programme looked like at the time: was the violation the result of a programme gap, a human error against a sound procedure, or a deliberate override? The answer drives the mitigation argument. Fourth, identify any ongoing risk: is the counterparty relationship still live? Is more exposure accruing while the review runs?
Calder & Vance regularly advises businesses at exactly this stage: scoping the apparent violation, tracing the ownership and control chain to confirm whether the 50 percent rule or the EU and UK equivalent tests are engaged, and mapping any parallel-regime exposure before a decision on disclosure is taken. The decision on whether and when to file a VSD is not one to make without experienced sanctions counsel.
Related practices
- Apparent violation assessment – EU – scope EU sanctions exposure and assess parallel enforcement risk
- Mitigation factors under OFSI – how the UK financial-sanctions enforcement approach compares with OFAC
- Mitigation factors under SECO – Switzerland's enforcement posture and the Swiss VSD equivalent
If a transaction has already been flagged, or an internal review has surfaced a potential pattern of violations, an early assessment preserves options that narrow with time. Contact Calder & Vance at info@caldervance.com to discuss a confidential scoping review.
Step 4: File a VSD – and understand what "timely and thorough" means to OFAC
A timely VSD to OFAC's Enforcement Division is the most significant mitigation factor in the agency's guidelines. OFAC treats a VSD that is genuinely voluntary, filed promptly, and substantively complete as a factor that can reduce the base penalty substantially. But "voluntary" means before OFAC knows about it through other channels, and "timely" is measured from the point at which a business knew or should have known of the apparent violation.
The initial VSD is typically a brief notification that puts OFAC on notice of the apparent violation and commits to a full report. It should identify the business, the nature of the apparent violation, and the programmes potentially implicated. It should not speculate about legal conclusions or make admissions beyond what the facts clearly support. A more detailed report, covering the full factual narrative, the compliance context, the remediation steps taken, and any aggravating and mitigating factors, follows after the internal review is complete.
Three errors appear repeatedly in VSD submissions we review. First, the business files the initial notification quickly but then takes many months to produce the full report, eroding the "timely" quality that gives the VSD its mitigating force. Second, the full report is written to minimise rather than to explain, and OFAC's examiners – who see hundreds of submissions – read that framing as a credibility problem. Third, the submission addresses the transaction but does not address the compliance programme gap that allowed the transaction to happen. OFAC will ask. Addressing it proactively, with a concrete remediation plan, converts a potential aggravating factor into an additional mitigating one.
Step 5: Build the compliance-programme argument as a standalone submission element
OFAC weighs the existence and quality of a sanctions compliance programme as a general mitigation factor. A business that can demonstrate it had a sanctions compliance programme (a structured, risk-based set of policies, procedures, screening tools, and training) that was appropriately designed and administered, even if it did not catch this violation, is in a materially better position than one that had no programme at all.
What does OFAC look for? The agency has articulated five components of an effective compliance programme in its published framework: management commitment, risk assessment, internal controls, testing and auditing, and training. A submission that maps the business's programme to each of those components – and explains the gap that the apparent violation exposed – is far more persuasive than a bare assertion that "we take compliance seriously." Have you documented your risk assessment? Are screening-threshold decisions recorded with a rationale? Does your training record show that relevant staff completed sanctions training before the violation occurred?
In a recent matter, a financial-services business faced an apparent violation arising from a gap in its automated screening – a counterparty entity had been added to an OFAC list, but the screening refresh cycle had not yet captured the update at the point of processing. We assisted the business in documenting the programme design, the refresh schedule that was in place, the remediation steps taken to tighten the cycle, and the business's voluntary disclosure. The matter resolved without a finding of an Egregious Case. The outcome reflected the programme's genuine quality, not a narrative constructed after the fact.
Step 6: Recognise aggravating factors and address them directly
OFAC's guidelines specify aggravating factors that can increase the civil penalty base, sometimes substantially. Understanding them is not just a defensive exercise: it shapes how a submission is structured and what remediation evidence is gathered.
The key aggravating factors include: wilful or reckless conduct; concealment; a pattern of violations rather than an isolated incident; senior-management involvement in or awareness of the violation; and harm to US sanctions-programme objectives. Each of these has a corresponding documentary and narrative response.
Wilfulness and recklessness are the most serious. OFAC distinguishes between a business that acted with knowledge that it was violating a sanctions rule and one whose conduct was reckless – meaning it disregarded a risk that was obvious. Where the facts are ambiguous, the submission should address the ambiguity directly rather than hope the examiner resolves it favourably. Concealment – including incomplete or misleading disclosures – is itself an aggravating factor. A submission that downplays the scope of a violation and is later found to have been incomplete does not merely fail to achieve mitigation: it creates an additional basis for a more severe outcome.
What about a pre-existing compliance programme deficiency that OFAC had previously identified? If OFAC issued a cautionary letter or a prior finding and the same gap recurs, the aggravating weight is significantly higher. In our cross-border practice, we see businesses treat a cautionary letter as a minor administrative note. That is a serious miscalculation. A cautionary letter is a documented warning: the next apparent violation in the same area will be assessed against the background of a business that was put on notice and did not remedy the problem.
How does OFAC compare with OFSI, the EU, and SECO on mitigation?
The OFAC enforcement model – penalty base, general factors, VSD incentive – is the most extensively documented sanctions-enforcement regime in the world. But a business with US-dollar exposure and European operations is likely to face parallel enforcement risk, and the mitigation architecture differs in ways that matter.
OFSI, the UK's Office of Financial Sanctions Implementation, administers financial-sanctions enforcement under SAMLA and the relevant thematic regulations. OFSI has a formal enforcement guidance that addresses mitigation. Like OFAC, OFSI treats a prompt VSD favourably. Unlike OFAC, OFSI applies a "reasonable excuse" defence in some circumstances, and its licensing and enforcement functions are administered within the same agency. The overlap with OFAC is significant where a transaction has both UK and US connections: a VSD to OFAC does not constitute a disclosure to OFSI, and the timelines may not align. Cross-border businesses should assess both disclosure obligations simultaneously.
The EU does not operate a single centralised enforcement authority for sanctions: enforcement is delegated to member-state competent authorities, whose approaches, timelines, and penalty ranges diverge. A VSD to the French competent authority does not satisfy a parallel disclosure obligation in Germany or the Netherlands. For businesses with EU-wide exposure, mapping the relevant competent authorities and their individual approaches is a prerequisite to any coordinated disclosure strategy. Our apparent-violation assessment work for EU matters is described at caldervance.com/services/enforcement-investigations/apparent-violation-assessment-eu-service/.
SECO, Switzerland's State Secretariat for Economic Affairs, administers Swiss sanctions enforcement under the applicable ordinances. Switzerland maintains its own list and its own mitigation approach, which shares the voluntary-disclosure principle with OFAC and OFSI but has a distinct procedural pathway. For businesses operating Swiss franc payment channels or routing goods through Switzerland, the SECO position should be assessed alongside OFAC and OFSI. A fuller treatment appears at caldervance.com/insights/guides/enforcement-mitigation-factors-seco-guide/.
The common principle across all major regimes is that a business which self-discloses, cooperates, and remediates is consistently treated more favourably than one that waits for the authority to come to it. The divergence is in the mechanics: timelines, the form of the disclosure, the role of counsel, and the weight given to each mitigation factor. Where multiple regimes are engaged simultaneously – which is increasingly the norm for internationally active businesses – a coordinated disclosure strategy is essential.
Common myths about OFAC mitigation
A persistent myth is that a strong compliance programme provides immunity from enforcement. It does not. OFAC's enforcement guidelines treat the compliance programme as a mitigation factor, not as a bar to action. A business with an excellent programme that processes a prohibited transaction is still subject to enforcement. What the programme does is change the penalty calculus and – critically – the framing of the submission. The argument is not "we could not have violated the rules because we have a programme"; it is "the violation reflects a discrete gap in an otherwise sound programme, the gap has been closed, and the business acted promptly and transparently when the gap was identified."
A second myth: size or sophistication of the business is irrelevant to how OFAC scores a matter. OFAC's guidelines expressly consider the size and sophistication of the business as a factor. A large, well-resourced multinational with a mature compliance function is held to a higher standard than a small business encountering a sanctions issue for the first time. That is not a reason for large businesses to treat enforcement more leniently: it is a reason to invest in programme quality proportionate to the level of risk.
A third myth is that OFAC mitigation is purely a US concern. In our experience, the majority of cross-border enforcement matters we handle involve at least two regimes. The OFAC mitigation strategy is the starting point, not the complete picture. A business that achieves a favourable OFAC outcome but has not addressed a parallel OFSI or EU exposure has resolved half the problem.