A payments firm discovers that a batch of transactions, processed six months ago, may have touched a counterparty that has since appeared on OFAC's SDN List (OFAC's list of Specially Designated Nationals and blocked persons). The compliance head must decide, within hours, whether this is a reporting obligation, a voluntary disclosure opportunity, or a manageable gap in the screening programme. The answer turns on how the investigation is structured from the first moment – and on whether anyone has made a careless decision before counsel is involved.
An internal sanctions investigation under OFAC is the structured process by which a business identifies, scopes, and documents an apparent violation of US economic sanctions administered by the Office of Foreign Assets Control, decides whether to make a voluntary self-disclosure (VSD – a proactive report to OFAC that can significantly reduce civil penalties), and positions itself for the best available outcome under the applicable enforcement guidelines. As of March 2026, OFAC's framework treats a timely, well-documented VSD as a mitigating factor that can reduce the base penalty by a significant proportion.
This guide walks through the investigation in six structured steps, identifies the points where matters go wrong, and explains how the analysis changes when the same transaction also touches UK, EU, or other regimes.
Step 1 – Contain the situation before you analyse it
The first action when a potential OFAC issue surfaces is to stop the activity in question and preserve all records – before a single document is moved, overwritten, or discussed in an unprotected channel. Containment is not an admission; it is the only way to keep options open.
In practice, containment means three things: freezing transaction records and correspondence at the state they are in now; restricting internal discussion to a privileged channel (legal professional privilege attaches to communications for the dominant purpose of obtaining legal advice, but only if that channel is established deliberately); and identifying the custodians who hold relevant data. Do not interview those custodians yet. Premature informal interviews contaminate the witness pool and can create inconsistent accounts that OFAC will later notice.
A common error at this stage is to ask the business line that processed the transaction to produce a summary. That summary will inevitably be self-serving, may lack completeness, and – if produced outside a privileged instruction – becomes a document that OFAC can request. In our experience, the decision to preserve properly at hour one determines the quality of everything that follows.
One practical point deserves emphasis here. OFAC's enforcement guidelines draw a clear distinction between a violation that was voluntarily reported and one that was discovered through an OFAC audit or a referral. The difference affects the penalty range. That distinction is set the moment you decide how to handle the first 24 hours.
Step 2 – Scope the apparent violation and map the applicable regimes
Once records are preserved, the investigation moves to scoping: establishing the factual perimeter of the apparent violation and identifying every sanctions regime that may apply. This is not a single-regime exercise.
Under OFAC, the key questions are whether a US person, a US-nexus transaction, or a US-origin item was involved; whether the counterparty was on the SDN List or was captured by the 50 percent rule (OFAC's rule treating entities owned 50 percent or more by blocked persons as themselves blocked) at the time; and whether any general licence (a standing authorisation that permits a defined category of transactions without a separate application) or specific licence (a case-by-case authorisation to conduct an otherwise prohibited transaction) was in place.
The scoping exercise must run simultaneously across other regimes if the transaction had any non-US dimension. A European subsidiary making a payment through a US correspondent bank triggers OFAC jurisdiction through the US nexus – but the same payment may also be caught by an EU Council regulation or by OFSI under the relevant UK thematic sanctions regulations. We regularly advise on transactions that sit at the intersection of OFAC, OFSI, and EU rules, and the regimes do not always reach the same conclusion on the same facts. Where they diverge, the stricter prohibition governs each jurisdiction's enforcement.
Scoping must produce a written chronology: each transaction, each party, each date, each value (qualitative only unless the figure appears in a contemporaneous record), and each regime that could apply. That chronology is the spine of every subsequent step.
Step 3 – Apply the OFAC enforcement framework to your facts
OFAC assesses apparent violations against a published enforcement framework that distinguishes wilful or reckless conduct from conduct that is merely non-egregious, and that treats prior disclosure, effective compliance programmes, and cooperation as mitigation factors. Understanding where your facts land on that spectrum drives the VSD decision.
The framework identifies factors that increase severity – among them, senior management involvement, harm to sanctions-programme objectives, and a history of violations – and factors that reduce it, including a well-designed compliance programme, prompt remediation, and the absence of prior OFAC action against the entity. A timely VSD is treated as one of the most significant mitigating factors available. OFAC's guidelines indicate that a qualifying VSD can reduce the base penalty calculation substantially, though the outcome in any given matter is not guaranteed and depends on the full set of aggravating and mitigating factors.
What does "timely" mean in this context? OFAC does not publish a fixed statutory window for voluntary disclosure in the same way that some other regimes do. The expectation, drawn from enforcement practice, is that disclosure should be made as soon as the business has enough information to provide a meaningful account – not after years of internal review. Sitting on an identified issue while the limitation period runs is itself treated as an aggravating indicator.
The investigation must therefore produce, at this stage, a preliminary assessment of the egregiousness of the conduct and a recommendation on timing. That assessment is privileged and should remain so. Have you established the conditions under which privilege will attach to your team's conclusions?
What is the difference between a VSD and a mandatory report – and when does it matter?
A voluntary self-disclosure to OFAC is distinct from mandatory reporting obligations that arise in parallel under other regimes, and conflating the two is one of the most consequential mistakes in a multi-regime investigation.
Under OFAC, a VSD is voluntary in the strict sense: no general statutory deadline requires a business to disclose an apparent violation it has discovered internally. The incentive is mitigation, not compliance with a mandatory window. That is the US position.
The UK position is materially different. Under OFSI's enforcement approach, a financial institution that knows or suspects it is holding frozen assets, or that has facilitated a prohibited transaction, faces a mandatory reporting obligation with a reporting window. The same transaction that triggers a voluntary OFAC disclosure may simultaneously trigger a mandatory OFSI report. Missing that OFSI window is itself a separate breach – independent of the underlying transaction. Under EU rules, similar obligations apply under the relevant Council regulation, with member-state competent authorities as the reporting destination.
In a cross-border investigation, the mandatory obligations under OFSI and the EU must be identified and calendared before the team finalises the OFAC VSD timeline. We have acted for businesses where the OFAC voluntary disclosure was well-prepared but the OFSI mandatory report was filed late because the two workstreams were not coordinated. That sequencing failure produced a separate OFSI compliance issue on top of the underlying transaction matter.
The practical discipline is to prepare a multi-regime reporting matrix at the scoping stage: regime | authority | mandatory or voluntary | applicable window | status. That matrix drives the investigation calendar.
Step 4 – Conduct the investigation and build the evidence package
The investigation itself – the structured collection, review, and analysis of documents and accounts – follows the chronology and the scoping output from Steps 2 and 3. It has three components: document review, witness accounts, and technical or data analysis.
Document review should be systematic and recorded. Every document reviewed, every gap identified, and every privilege determination should be logged. Gaps matter as much as documents: OFAC will ask whether records are complete, and an unexplained gap in the transaction record looks worse than a disclosed limitation in the data systems.
Witness accounts in an internal investigation are not informal conversations. They are structured, privileged interviews conducted by or under the direction of legal counsel, with a written record of what was put to each witness and what was said. The interviewer should not share one witness's account with another before that second witness has given their own account. This is basic investigative hygiene, but it is regularly neglected in compliance-led (rather than legally-directed) investigations.
Technical and data analysis is increasingly the substantive core of a sanctions investigation. Payments data, system logs, screening results, and override records are the contemporaneous evidence that an OFAC reviewer will scrutinise. In our experience, the most persuasive VSD submissions are those that can show the screening logic in operation at the time of the transaction – including any false-negative results – and demonstrate what has been changed since.
The output of this step is the evidence package: a privileged memorandum setting out the factual findings, the legal analysis, the egregiousness assessment, and the remediation steps taken or planned. That memorandum is the VSD submission's foundation.
Step 5 – The VSD decision and submission
The decision whether to make a VSD to OFAC is a legal and commercial judgment that belongs to senior management, informed by counsel's assessment of the egregiousness of the conduct, the strength of the mitigating factors, and the risk that OFAC will discover the apparent violation independently.
A well-constructed VSD submission to OFAC contains: a factual narrative of the apparent violation; an account of how it was discovered; the business's preliminary legal analysis of the applicable prohibitions; the mitigating factors, including the compliance programme in place at the time; the remediation steps already taken; and a request for a specific penalty determination or a no-action finding. The submission must be accurate. Inaccuracies or omissions in a VSD are themselves aggravating factors and can convert a civil matter into one with criminal dimensions.
Should you always disclose? The honest answer is that the analysis is fact-specific and the decision is consequential in either direction. A VSD that is premature, incomplete, or poorly framed can create more exposure than a well-timed, comprehensive one. A decision not to disclose, where the apparent violation is credibly discoverable by OFAC through its own processes or through a third-party referral, is a substantial risk. Counsel's role at this stage is to set out the realistic range of outcomes for each path, not to guarantee a result.
The cross-regime point applies here too. An OFAC VSD does not satisfy a parallel OFSI reporting obligation or an EU notification requirement. Each must be addressed separately, in the right form, to the right authority, within the applicable window.
Step 6 – Remediation and the compliance programme review
OFAC's enforcement guidelines place substantial weight on remediation: the steps a business takes, after identifying an apparent violation, to prevent recurrence. Remediation is not a narrative add-on to the VSD submission; it is a substantive factor in the penalty calculation.
Effective remediation typically includes a root-cause analysis of the compliance failure; targeted changes to screening logic, ownership-and-control mapping, or transaction-monitoring rules; documented retraining of relevant personnel; and a testing cycle that verifies the changes work. Remediation that addresses the symptom – the specific transaction that was missed – without addressing the systemic cause is unlikely to satisfy OFAC that future violations are prevented.
Record-keeping through this process matters. OFAC may request documentation of the remediation steps as part of a post-VSD review. Records should be retained for at least the period required under the applicable regime; the general expectation under US sanctions rules is a retention period of several years from the date of the transaction. Verify the current requirement before designing the retention protocol.
The compliance programme review that follows a sanctions investigation is also an opportunity to address adjacent risks: the ownership-and-control mapping that feeds the screening system, the escalation procedures for screening alerts, and the coordination protocols between the US compliance function and its UK, EU, and other counterparts. An investigation that produces only a narrow fix misses the broader systemic lesson.
Common pitfalls and risk flags
Several patterns recur in internal sanctions investigations that go badly. Recognising them early is the difference between a matter that resolves through a well-managed VSD and one that escalates to a formal enforcement action.
Delayed legal involvement. The most consistent risk factor is allowing the compliance function or the business line to run the investigation without legally-qualified counsel directing it from the outset. Privilege does not attach retroactively. Documents produced before counsel is engaged can be requested by OFAC and may contain internal assessments that are more harmful than the underlying facts.
Premature or incomplete disclosure. A VSD filed before the factual investigation is complete, or that omits transactions the business could have identified with reasonable diligence, is worse than no VSD at all. OFAC will view a materially incomplete submission as an indication of inadequate cooperation.
Treating the matter as US-only. Any cross-border business must run the parallel regime analysis from day one. We regularly advise companies that have filed with OFAC but have not assessed their OFSI or EU position – and that have, as a result, missed mandatory reporting windows in those regimes.
Inadequate remediation narrative. Enforcement outcomes turn not only on whether a violation occurred but on what the business did about it. A remediation account that reads as pro-forma – a list of training sessions and a policy update – carries less weight than one that demonstrates a genuine root-cause analysis and a tested fix.
One common myth deserves direct correction: that a business with a strong prior compliance programme can rely on that programme to avoid any significant OFAC consequence. The compliance programme is a mitigating factor, not a defence. If the underlying transaction was prohibited and no licence applied, the apparent violation exists regardless of the programme's quality. The programme's quality affects the penalty range, not the legal analysis of whether a violation occurred.
When to involve external counsel – and what to ask for
External counsel should be involved as early as possible – ideally before any internal communication about the potential issue has been produced outside a privileged setting. The question is not whether you need counsel for a "serious" matter; it is whether the investigation will be conducted in a way that preserves your options. That requires legal direction from the start.
When you engage external counsel for an OFAC investigation, the initial scope of work should cover: a privilege protocol for all investigation communications; a preliminary scoping review to identify the applicable regimes and mandatory reporting obligations; a timeline for the investigative steps and the disclosure decision; and a point of contact structure that keeps the investigation separate from the ongoing business operations.
The position above covers the standard case. Your facts – the specific transactions, the counterparties, the regimes in play, and the compliance history – change the analysis substantially. For a confidential review of a potential breach, contact Calder & Vance at info@caldervance.com.
For businesses already engaged with OFAC on an apparent violation – or managing a simultaneous OFSI or EU review – early external coordination is not optional. Different authorities move at different speeds and have different information expectations. A submission that satisfies one authority may inadvertently prejudice the position before another if the multi-regime strategy has not been designed from the outset.
Related practices
- EU apparent violation assessment – structured legal review of apparent breaches under EU Council regulations, with cross-regime coordination
- Internal sanctions investigations under OFSI – step-by-step guide to OFSI investigations and mandatory reporting obligations
- Internal sanctions investigations under SECO – guide to investigation procedure under the Swiss sanctions regime