A Canadian subsidiary of a European group ships components to a distributor in a third market. Six months later, Global Affairs Canada contacts the compliance team with a notice of apparent violation under SEMA (the Special Economic Measures Act, Canada's principal statutory tool for autonomous sanctions). The clock is running. What does counsel do first?
Penalty defence under Canada's sanctions regime is governed primarily by SEMA and administered by Global Affairs Canada (GAC), the competent authority for Canadian autonomous sanctions. Violations can attract significant civil and, in the most serious cases, criminal consequences. The defence process moves through discrete stages – initial assessment, voluntary disclosure, written representations, and, where applicable, settlement – and the choices made in the first days materially affect the outcome.
This guide walks through each stage in sequence, identifies the risk flags that change the analysis, and explains where the Canadian regime converges with and diverges from its US, UK, and EU counterparts.
Step 1: What governs the penalty process in Canada?
Canada's autonomous sanctions operate under SEMA and, for UN-mandated measures, under the United Nations Act. GAC administers both instruments and issues the underlying regulations – the country-specific and thematic measures that set out which persons and transactions are caught. Enforcement sits within GAC's Trade Controls Bureau, which investigates apparent violations, issues notices, and has discretion to refer the most serious matters to the Royal Canadian Mounted Police or the Public Prosecution Service for criminal consideration.
The penalty regime distinguishes between administrative and criminal tracks. The administrative track is the more common path for companies. It allows GAC to impose monetary penalties without a court proceeding. The criminal track, which requires referral to prosecutors, is reserved for deliberate or repeated conduct. Understanding which track applies is the first analytical task when a notice arrives.
SEMA's extraterritorial scope is more limited than OFAC's secondary-sanctions machinery, but it is not narrow. It applies to Canadian persons and to activities conducted in Canada, capturing subsidiaries and branches operating here. A multinational with a Canadian presence must therefore assess whether a group-wide transaction has a Canadian nexus – even if the transaction was approved at the group's European or US headquarters.
Cross-border implication: where a transaction also has a US or EU dimension, OFAC and the EU Council regulations operate in parallel. The analysis does not stop at the Canadian border. In our cross-border practice, we regularly advise clients who face simultaneous exposure under two or more regimes and need a coordinated defence posture across each.
Step 2: How should you assess the apparent violation immediately after receiving notice?
The moment a GAC notice arrives – or the moment internal monitoring surfaces a potential violation before GAC contacts the business – the first task is to scope the apparent violation accurately. This is not the moment for guesswork or a quick email to the business unit. It is the moment for a structured legal assessment.
The assessment should answer four questions in sequence. First, is there an actual violation of the relevant regulations, or does the conduct fall within an exception or authorisation? Second, what is the nature of the goods, services, or funds involved, and what is the specific prohibition that applies? Third, what is the Canadian nexus – which entity, which transaction, which person? Fourth, has this already been reported to GAC, or is the business considering a voluntary self-disclosure (a proactive report to a regulator before enforcement action is initiated)?
The assessment must be documented carefully. Legal privilege attaches to the work product of counsel instructed to advise on the legal position – but only if the communication is genuinely for legal advice purposes and is kept appropriately confidential. In our experience, clients who run the initial assessment informally, through business emails copied to many people, lose privilege over exactly the analysis they most need to protect.
Time is a material variable. GAC's investigation timeline is not fixed by statute in the same way as some other regimes, but delay in responding to a notice, or in disclosing conduct that the business has already identified, erodes the mitigation credit available at the settlement stage. Act promptly.
Step 3: Should you make a voluntary self-disclosure to GAC?
A voluntary self-disclosure is a proactive report of an apparent violation to GAC before the regulator has independently identified or opened an investigation into that conduct. The decision to disclose is one of the most consequential choices in the defence process, and it must be made on legal advice.
GAC's published enforcement guidance acknowledges that cooperation and proactive disclosure are factors it weighs when determining the appropriate response. A well-prepared disclosure – one that accurately describes the conduct, identifies the persons involved, explains the root cause, and sets out the remediation steps taken – positions the business favourably for a reduced or administrative resolution rather than criminal referral. The benefit is real, but it is not guaranteed and cannot be promised to any client.
What makes a disclosure well-prepared? The document should be factually complete without speculating beyond what the evidence shows. It should demonstrate that the business took the obligation seriously once it identified the issue. It should include concrete remediation: what has changed in the screening programme, the approval process, or the contractual controls. A disclosure that reads as damage-limitation without genuine remediation does not carry the same weight as one that demonstrates systemic improvement.
The question of whether to disclose is not only a Canadian question. If the same transaction carries US or UK exposure, a disclosure to GAC must be considered alongside any parallel obligation or strategic choice to self-report to OFAC or OFSI. The approaches of these regulators differ. OFAC has a structured VSD process with published penalty-reduction guidance. OFSI's enforcement guidance also addresses cooperation. The timing and sequencing of disclosures across regimes requires a coordinated strategy, not three independent decisions made in isolation.
The position above covers the standard case. Your facts – the counterparty, the goods, the route, the regime in play – change the analysis. For an assessment of your exposure under Canada's sanctions regime, contact Calder & Vance at info@caldervance.com.
Step 4: How do you prepare written representations to GAC?
After receiving a notice of apparent violation, a business typically has an opportunity to submit written representations to GAC before any penalty is imposed. The representations are the primary vehicle for the defence. They should be treated as a formal legal submission, not a letter of explanation.
A well-structured submission addresses the following in order. First, the factual record: set out the transaction accurately, identify the persons and goods involved, and describe what the business knew and when. Second, the legal analysis: explain how the conduct relates to the prohibition at issue, identify any exceptions or authorisations that may apply, and address the question of intent (which bears on culpability, even on the administrative track). Third, the mitigating factors: cooperation, disclosure, remediation, the business's compliance record prior to the incident, and the role of the business in the broader transaction chain. Fourth, the proposed resolution: if settlement is the objective, the representations can frame the appropriate outcome.
Intent matters even when it is not a formal element of the offence. GAC, like most sanctions regulators, treats deliberate conduct differently from negligent or inadvertent conduct. A business that can demonstrate it had a genuine compliance programme, that the violation resulted from a failure in process rather than a wilful decision, and that it has corrected the process, is in a materially different position from one that cannot.
Documentation is the foundation of the representations. Transaction records, screening logs, approval records, communications with the counterparty, and the compliance team's contemporaneous notes all contribute to the factual narrative. Gaps in documentation are themselves a risk factor. If records are missing, the representations must address why.
Step 5: What does the settlement process look like, and what are the risk flags?
Settlement with GAC on an apparent sanctions violation is a negotiated outcome. There is no fixed formula, and GAC retains discretion. The factors that bear on settlement include the seriousness of the conduct, the value of the transaction, the business's cooperation, the strength of its compliance programme, and the remediation steps taken.
Several risk flags change the trajectory of a matter significantly. First, multiple violations or a pattern of conduct over time signals systemic failure rather than an isolated incident. GAC is less likely to accept an administrative resolution where the records show repeated exposure to the same counterparty or the same category of goods after the first incident was identified. Second, the involvement of listed persons or entities – particularly where the business had a plausible basis for knowing the counterparty was a designated party – raises culpability. Third, the value of the transaction is relevant. Higher-value conduct attracts greater scrutiny and a less favourable settlement position.
A separate risk flag is the multi-regime dimension. Where the conduct also constitutes an apparent violation under OFAC or EU Council regulations, the Canadian settlement cannot be evaluated in isolation. A settlement with GAC that involves an admission of fact may be used in parallel proceedings in another jurisdiction. Counsel managing a Canadian enforcement matter should assess the evidentiary implications for every other regime that is potentially engaged.
If a transaction has already been flagged, or a filing has been refused, an early review can preserve options that narrow with time. Contact Calder & Vance at info@caldervance.com for a confidential review of your position.
How does Canada's enforcement posture compare with OFAC, OFSI, and the EU?
Canada's regime is often described as less aggressive in its enforcement volume than OFAC's. That characterisation is broadly accurate in terms of publicly announced penalty cases, but it does not mean the risk is low. GAC has increased its enforcement activity in recent years, and the criminal track under SEMA carries serious consequences including custodial sentences for individuals.
Three points of divergence matter for a cross-border business. First, the ownership and control test: OFAC's mechanical 50 percent ownership threshold captures entities owned in aggregate at or above that level, regardless of control. The Canadian regime follows a different formulation, placing emphasis on whether a person is acting on behalf of, or at the direction of, a designated individual or entity. This is closer to the EU control test than to OFAC's bright-line rule, and it requires a qualitative assessment rather than a simple aggregation of shareholdings. Second, secondary sanctions: OFAC's secondary-sanctions programme can reach non-US persons conducting transactions entirely outside the United States. Canada does not operate an equivalent secondary-sanctions mechanism. A business with no Canadian nexus is not directly exposed to SEMA, even if it deals with a SEMA-designated party. Third, the licensing and authorisation regime: under SEMA, permits can be issued to authorise otherwise prohibited transactions. The permit process is administered by GAC and operates differently from OFAC's specific-licence procedure or OFSI's licensing casework. The documentary requirements and timelines vary, and counsel familiar with one regime should not assume the practice transfers.
The practical consequence of these divergences: a group that is simultaneously managing a Canadian matter and a parallel US or UK matter cannot apply a single analytical template. The assessments must run in parallel, informed by the rules of each regime and the specific facts of the transaction in each jurisdiction.
Common objection: "Our compliance programme is strong – the violation was a one-off"
This is one of the most frequently voiced positions we encounter when a business first contacts us after a GAC notice. The instinct is understandable. A compliance team that has invested in screening technology, trained its staff, and maintained records will naturally frame the incident as an outlier. Sometimes that framing is accurate. Often it is not.
GAC – and any sanctions regulator evaluating a penalty defence – looks at the programme not as the business describes it, but as the evidence shows it operated. Were the screening logs actually reviewed? Did the compliance officer have authority to stop the transaction? Was the red flag that appeared on the counterparty's profile before the transaction completed investigated, or noted and set aside? The gap between a written compliance policy and the daily practice of the business is exactly what enforcement proceedings expose. We regularly advise clients who are surprised to discover that their documented programme does not match their operational reality.
A strong compliance programme genuinely reduces enforcement risk and supports a mitigating-factors argument in penalty defence. An overstated one does neither. The honest pre-submission assessment of the programme's actual operation is one of the most valuable pieces of work counsel can do at the outset of a defence matter.
Related practices
- Apparent violation assessment (EU) – structured legal review of potential EU sanctions violations before enforcement contact
- Penalty defence and settlement: cross-border guide – managing coordinated enforcement exposure across multiple regimes simultaneously
- Penalty defence and settlement under the EU – EU Council regulation enforcement procedure, mitigation, and settlement