A compliance officer at a mid-sized trading house receives a letter from OFAC. It references a payment routed through a correspondent bank eighteen months earlier. The counterparty, it turns out, appeared on the SDN List (OFAC's list of Specially Designated Nationals and blocked persons) at the time of the transaction. Two weeks later, the same business receives a separate inquiry from OFSI. The goods also moved through a UK-regulated entity. Now the matter touches two enforcement authorities, two legal systems, and two penalty regimes – simultaneously.
Defending a sanctions penalty across multiple regimes is not simply running two parallel domestic matters. As of early 2026, enforcement authorities in the United States, United Kingdom, and European Union are actively coordinating – formally and informally – and a response designed for one regime can damage the client's position before another. This guide sets out, step by step, how to manage penalty defence and settlement across a cross-border footprint, from the moment a potential violation surfaces to final resolution.
The sections below follow the matter chronologically: scoping the exposure, deciding whether to disclose, preparing the defence record, engaging each authority, managing parallel proceedings, and reaching settlement on the best available terms.
Step 1: Scope the apparent violation before anything else
The first task in any cross-border penalty defence is to draw the precise boundary of the apparent violation – what happened, under which regime's rules, and whether the relevant legal elements are satisfied. Begin there, not with the question of settlement value.
Each regime applies its own jurisdictional test. OFAC asserts authority over US persons, entities organised in the United States, and transactions that involve US-origin goods, technology, or the US financial system. OFSI's jurisdiction covers UK persons and conduct in the United Kingdom. EU Council regulations apply to EU-incorporated entities, EU nationals, and conduct occurring within EU territory. The same underlying transaction can satisfy all three tests at once – and frequently does when a payment clears through New York and the goods ship under a UK freight arrangement.
Map the jurisdictional footprint before contacting any authority. Which entities in the group were involved? Which currencies and banking channels? What was the nationality and listing status of the counterparty at the time? Which goods or services moved, and under which classification? In our experience, businesses that skip this mapping step discover mid-investigation that the exposure is wider than the initial inquiry suggested – and that information surfaces in a context that prejudices the disclosure assessment.
Document the mapping. You will need it for every subsequent step.
Step 2: Assess voluntary self-disclosure – regime by regime
Once the scope is clear, the single most consequential decision is whether – and to whom – to make a voluntary self-disclosure (VSD: a proactive report to a regulator before the authority initiates or becomes aware of the matter). The decision differs by regime, and choosing one path forecloses options on another.
Under the OFAC enforcement guidelines, a timely, complete, and accurate VSD is a general mitigating factor that can reduce a civil monetary penalty substantially. OFAC distinguishes egregious from non-egregious cases; in a non-egregious case with a VSD, the base penalty range is meaningfully lower than without disclosure. The EAR, administered by BIS, operates a parallel VSD mechanism for export-control violations. Both agencies treat the quality of the disclosure – completeness, speed, and remediation steps – as determinative of the credit given.
OFSI's enforcement guidance establishes a similar mitigating framework. Reporting an own-suspected breach promptly, and cooperating fully, are factors that weigh toward a lower penalty or a decision not to impose one. The UK framework also distinguishes between voluntary reports made before and after the authority becomes aware of the matter.
EU member-state competent authorities apply their own national enforcement rules, which vary. There is no single EU-level civil penalty mechanism for most sanctions violations: enforcement sits with member states, and the mitigation credit for voluntary disclosure differs between, for example, a French authority and a Dutch or German one.
What does this mean in practice? A business with exposure in all three regimes must assess the disclosure decision for each authority independently. A disclosure to OFAC does not satisfy an OFSI reporting obligation, and neither constitutes notice to the relevant EU member-state authority. Missing one while addressing another creates the risk of an aggravated enforcement outcome in the regime left unaddressed. In our practice, we build a disclosure matrix for each matter: authority, trigger obligation (if any), voluntary option, timing constraint, and interaction effect with co-regulators.
Do not disclose without having first scoped the full violation. An incomplete VSD – one that understates the population of affected transactions or omits a related product line – is treated as a failure to cooperate in most regimes, and can eliminate the credit that motivated the disclosure in the first place.
The position above covers the standard case. Your facts – the counterparty, the goods, the channel, the timing, and the entities involved – change the analysis materially. For an assessment of your disclosure options, contact Calder & Vance at info@caldervance.com.
Step 3: Build the defence record – what to gather and why
The defence record is the evidentiary foundation of every subsequent step, whether the matter resolves through a VSD, a settlement, a penalty challenge, or a combination of all three. Start building it immediately, in parallel with the scoping exercise.
Across all major regimes, the authorities look for the same categories of evidence: the state of the firm's compliance programme at the time of the violation, the due diligence actually conducted, the steps taken to remediate after discovery, and the cooperation the firm has provided since. Each regime weighs these factors differently, but all of them are relevant.
Compile the following categories of material:
- Transaction records: payment instructions, shipping documents, contracts, and bank confirmations covering the period in question. Retention obligations under most regimes run for a minimum of five years from the date of the transaction – retrieve records now, before any litigation hold lapse creates an additional problem.
- Screening records: logs showing what screening was run, against which lists, on what date, and with what result. If the screening system generated a hit that was cleared, retrieve the disposition record and the analyst's rationale.
- Compliance programme documentation: the written procedures, training records, and any internal audit results that were in place at the time of the transaction. Authorities treat a well-documented programme as a genuine mitigating factor, not mere paperwork.
- Communications: internal escalation chains, emails to and from compliance, and any external advice sought. Privilege considerations apply; take advice on what to retrieve and what to withhold before the collection begins.
- Remediation steps: what has the firm done since discovering the violation? Updated screening logic, exited relationships, retraining programmes, and management-level oversight changes all count as concrete evidence of cooperation and good faith.
In a cross-border matter, gather documents from all relevant jurisdictions before the first formal authority contact. Once a regulator opens a formal inquiry, document-production obligations and privilege rules diverge sharply across the US, UK, and EU. What is privileged in London may not be protected in Washington. Collect, then assess protection jurisdiction by jurisdiction.
Step 4: Engage the authorities – sequencing and tone
With the scope confirmed, the disclosure decision made, and the defence record assembled, the next step is formal engagement. Sequencing matters here, and getting it wrong is one of the most common sources of avoidable prejudice in cross-border enforcement matters.
Where a VSD is the chosen route, OFAC and BIS generally expect a preliminary notice filing within a short period of discovering the apparent violation – followed by a full submission within a defined extension period. OFSI also expects prompt voluntary reporting; delay after discovery is treated as reducing the mitigation credit available. In both systems, "prompt" is measured from the date the business reasonably concluded that a violation had or may have occurred, not from the date a lawyer was instructed.
Consider the sequencing between authorities. A disclosure to OFAC may trigger coordination between OFAC and DOJ – the criminal export-control and sanctions enforcement division. A filing with OFSI may be shared with the relevant UK law-enforcement body if the facts suggest criminal conduct. The authorities do talk to each other. A submission drafted for one audience that contains statements inconsistent with your position before another creates serious credibility problems.
Draft every submission as if it will be read by all relevant authorities. Factually, it probably will be.
Tone is a substantive issue. Submissions that over-assert the adequacy of the compliance programme before the authority has reviewed the evidence tend to backfire. Submissions that acknowledge the failure, describe the root cause accurately, and set out concrete remediation steps consistently receive more favourable treatment. This is not a concession of maximum liability; it is a calibrated presentation of the facts most likely to support a mitigated outcome.
If a transaction has already been flagged, or a filing has been refused, an early review can preserve options that narrow with time. To discuss an existing enforcement matter, write to Calder & Vance at info@caldervance.com.
Step 5: Managing parallel proceedings – what diverges between regimes
Parallel enforcement proceedings across OFAC, OFSI, and EU member-state authorities require active management of the overlap. The legal standards diverge, the timelines differ, and a concession in one forum can be used against you in another.
Liability standards differ in their strictness. OFAC applies a strict-liability standard to civil violations: the question is whether the prohibited transaction occurred, not whether the firm knew or intended to violate the rules. Intent and wilfulness are relevant only to aggravation or to the criminal referral question. OFSI's civil enforcement standard similarly does not require knowledge of the designation for a monetary penalty to be imposed, though knowledge and intent are relevant to penalty level. EU member-state standards vary: some apply strict liability, others require fault. Where the same conduct is assessed under different standards, you can have a defensible position before one authority and an admitted violation before another. Manage that openly.
Penalty calculation diverges sharply. OFAC bases civil penalties on the transaction value, the statutory maximum per violation, or a base penalty amount – the applicable figure depends on the egregious/non-egregious classification and VSD status. OFSI moved to a turnover-based penalty cap: fines can reach a defined percentage of annual turnover, meaning that for a large financial institution the theoretical maximum is substantial. EU member-state penalties are capped by national law, and the maximums differ across jurisdictions.
What is the practical consequence? A business settling with OFAC on agreed facts must ensure that those facts, as stated in the OFAC settlement agreement, do not admit elements that trigger an aggravated finding under OFSI's separate assessment. In our experience, the most problematic cross-regime interactions arise when OFAC settlement language describes the compliance failure in terms – "systematic," "willful disregard," "repeated" – that map directly onto aggravating factors under OFSI guidance. Review every settlement document through the lens of the other open proceedings before signing.
Where criminal exposure is possible – typically where intentional evasion or wilful conduct is alleged – the management of parallel civil and criminal proceedings requires a different posture entirely. The privilege against self-incrimination operates differently across the US, UK, and EU. Coordinate the strategy across all three before any formal statement is made in any forum.
Step 6: Common risk flags and when to involve counsel
Certain patterns reliably signal that a matter will be treated more seriously by enforcement authorities – and that the window for a favourable resolution is shorter than it appears.
First, any involvement of a financial institution in the transaction chain. Banks and payment firms that process a sanctions-prohibited payment face their own exposure, and they will typically be cooperating with the relevant authority before the underlying corporate even knows an inquiry is open. If your transaction moved through a regulated financial institution and that institution has already been in contact with a regulator, you are likely a known subject rather than a voluntary discloser. The distinction matters to the credit available.
Second, a pattern of transactions rather than an isolated event. Authorities treat a single anomalous transaction differently from a series of transactions involving the same counterparty over a period of months. The screening logs, the clearing histories, and the contract files together will reveal whether the apparent violation is isolated or systemic. If the answer is systemic, the remediation evidence and the compliance programme documentation become the most important part of the defence.
Third, any export-control element. Where the goods involved are dual-use items with a relevant export control classification, the BIS dimension of the matter opens in parallel with OFAC. BIS and OFAC often coordinate in these matters, and a transaction that looks like a pure sanctions violation on first review may also constitute an unlicensed export of a controlled item.
Fourth, the myth – which we regularly encounter – that a small transactional value means a small penalty. Penalty bases in most regimes are not simply proportional to transaction value. OFAC's civil monetary penalty structure ties the per-violation maximum to statutory figures that bear no necessary relationship to the commercial value of the blocked payment. A business that settles quickly on the assumption that a low-value transaction produces a low penalty can be surprised by the statutory arithmetic.
Involve counsel at the moment you identify a potential violation, not after internal investigation is complete. In our cross-border practice, the decisions that most constrain a favourable outcome – what to retain, what to communicate, whether and how to disclose – are all made in the first two to four weeks. Waiting for internal legal to finish the review before briefing external counsel means those decisions are made without the benefit of cross-regime disclosure strategy.
Related practices
- Apparent violation assessment – EU – scoping exposure and voluntary-disclosure options under EU sanctions enforcement
- Penalty defence and settlement – EU guide – step-by-step analysis of the EU member-state enforcement process
- Penalty defence and settlement – Japan guide – how the Japanese sanctions enforcement regime handles violations and settlement