A multinational's treasury team processes a payment. Weeks later, OFAC issues a Penalty Notice. The amount is material. The board wants to know: is this figure negotiable, and what happens next? These are the right questions – but they need answers before the response deadline passes, not after.
Penalty defence and settlement under OFAC is a structured process governed by the International Emergency Economic Powers Act and the Office of Foreign Assets Control's enforcement guidelines. The outcome turns on how quickly a business acts, whether it has made a voluntary self-disclosure (a proactive report to OFAC before the agency identifies the apparent violation), and how effectively it builds and presents its penalty mitigants. A well-prepared response can reduce exposure substantially; a poorly prepared one cannot.
This guide takes the matter step by step: from the moment an apparent violation is identified, through the disclosure decision, the investigative phase, the penalty negotiation, and the settlement. It also maps how the OFAC process compares with the approach of OFSI in the United Kingdom and the EU enforcement regime – because most businesses facing OFAC exposure are also subject to one or more of those regimes.
Step 1: Identify the apparent violation and assess the clock
The first obligation when a potential sanctions breach surfaces is to stop, secure, and assess – and that assessment must begin within hours, not days. OFAC's enforcement guidelines distinguish between a voluntary self-disclosure and a situation where OFAC learns of the matter first. That distinction drives the single largest variable in the penalty outcome.
What counts as an apparent violation? Any transaction that a sanctions prohibition may cover: a payment to a blocked person or entity, an export to a destination subject to a comprehensive programme, or a service rendered to an entity that satisfies the 50 percent rule (OFAC's rule treating entities owned 50 percent or more by blocked persons as themselves blocked, regardless of whether the entity itself appears on any list). The 50 percent rule is frequently missed by automated screening tools that match only directly listed names.
The clock starts when the business has reason to know. Delay in opening an internal investigation after that point is itself an aggravating factor under OFAC's enforcement guidelines. In our experience, the businesses that achieve the best outcomes are those that treat the first 48 hours as a critical decision window – not a period for committee approvals.
Practical checklist for this stage:
- Identify every transaction linked to the apparent violation and the relevant counterparty chain.
- Preserve all records: transaction data, screening logs, communications, and approvals.
- Identify any blocked property that must be reported and potentially frozen.
- Map which other regimes – OFSI, EU, SECO – may be triggered by the same facts.
- Involve sanctions counsel before communicating with OFAC or any other regulator.
Step 2: The voluntary self-disclosure decision
A voluntary self-disclosure (VSD) – proactive self-reporting to OFAC before the agency independently discovers the apparent violation – is the most consequential decision in any OFAC penalty matter. OFAC's enforcement guidelines treat a timely, complete, and accurate VSD as a significant mitigating factor and can result in a base penalty that is substantially lower than the non-disclosed equivalent.
The decision is not automatic. It requires an honest assessment of three questions. First, how likely is it that OFAC will discover the matter independently – through a financial institution's Suspicious Activity Report, a counterparty disclosure, or a third-country authority? Second, is the apparent violation egregious or non-egregious? OFAC applies a higher penalty matrix to egregious cases, and a VSD in a genuinely egregious matter, while still beneficial, carries a different risk calculation. Third, is the factual picture sufficiently clear to make a complete and accurate disclosure? An incomplete VSD can be treated as a non-disclosure.
Where a VSD is the right route, it should be submitted promptly and should be followed by a full written response within the period OFAC prescribes. That response sets out the facts, the legal analysis, and the penalty mitigants. It is, in effect, the penalty defence brief.
The position under OFSI in the United Kingdom is structurally similar: OFSI's enforcement guidance also treats voluntary disclosure as a mitigating factor and can affect the penalty calculation. However, OFSI operates a separate mandatory reporting obligation – a financial sanctions target must be reported to OFSI within a defined period of the business becoming aware. That obligation is distinct from, and runs alongside, the decision about voluntary disclosure of a breach. Businesses with UK operations need to manage both obligations in parallel.
The position above covers the standard case. Your facts – the counterparty, the goods, the route, the regime in play – change the analysis. For a confidential review of a potential breach, contact us at info@caldervance.com.
Step 3: The internal investigation – scope, documents, and privilege
Once the VSD decision is made, the internal investigation must be scoped and completed with care. OFAC will expect a complete factual account; the quality of that account shapes both the agency's view of the business's co-operation and the accuracy of the penalty mitigants that can be advanced.
The investigation should cover: the full transaction history (not only the identified payment), the screening process at the time and any gaps in it, the chain of approvals, the relevant sanctions compliance programme and any deficiencies in it, and the corporate structure and ownership chain for each relevant counterparty. The 50 percent rule means that a counterparty analysis cannot stop at the directly listed name – the ownership chain above it matters.
Privilege is a practical concern from the outset. Communications between a business and its external sanctions counsel are protected by legal professional privilege. Internal investigation reports prepared in anticipation of litigation or regulatory proceedings attract work-product protection under US law. But that protection is not automatic: it depends on how the investigation is structured and who directs it. We regularly advise clients to structure the investigation under external counsel from the first day, precisely because that structure preserves the protection.
A note on document preservation: OFAC's guidelines treat the destruction or alteration of relevant records after an apparent violation is identified as an egregious aggravating factor. Preservation should be formalised in a litigation hold notice issued as soon as the matter surfaces – and that hold should extend to all jurisdictions where records are held. For a business with EU operations, the EU data-protection rules interact with the hold obligations; for a business with UK operations, OFSI record-keeping requirements apply independently.
Step 4: Building the penalty mitigants
OFAC's enforcement guidelines set out a specific list of general and specific factors that can reduce a civil penalty from the statutory maximum. Understanding and building each applicable mitigant is the core of the penalty defence brief.
The general mitigating factors include: a demonstrated commitment to compliance (an established sanctions compliance programme); the business acting promptly to remediate the violation; co-operation with OFAC's investigation; and the voluntary self-disclosure discussed in Step 2. The specific factors include: the harm caused by the violation and its broader impact; whether the violation was isolated or part of a pattern; the sophistication of the business; its sanctions compliance history with OFAC; and whether the transaction had any commercial nexus with a blocked person's actual benefit.
In a recent matter, a financial-sector business identified a pattern of payments that had transited through a correspondent whose ultimate beneficial ownership included a blocked person captured by the 50 percent rule. The entity had not appeared on any list. We scoped the apparent violation, analysed the ownership chain against OFAC's guidance, prepared the voluntary self-disclosure, and assembled the penalty mitigant package – demonstrating that the screening programme was well-tested at the time, the violation was self-identified, and remediation had been completed before the submission. The matter resolved without proceedings.
One mitigant that is often undervalued is the quality of the post-discovery remediation. OFAC looks not only at what happened but at what the business has done since. A documented, completed remediation programme – new screening logic, revised ownership-chain controls, updated training, and a revised escalation procedure – is a concrete and persuasive mitigant. Businesses that present a remediation plan rather than a completed programme are in a weaker position.
Step 5: The penalty negotiation and settlement process
Once OFAC has reviewed the submission, the agency may issue a Proposed Penalty Notice, a Finding of Violation without penalty, or a No Action Letter. The Proposed Penalty Notice is the opening of the negotiation; it is not the final figure. A business has the right to respond to the Proposed Penalty Notice with a written submission contesting the amount, presenting additional mitigants, or challenging the legal basis of the proposed penalty. That response is a further opportunity to advance the defence.
How does the settlement figure move? It moves on the strength of the mitigant package, the quality of the co-operation throughout the process, and the accuracy of the factual record presented. It can also move on a challenge to the legal analysis – whether the transaction was in fact prohibited, whether an applicable general licence authorised it, or whether the counterparty was in fact captured by the 50 percent rule. These are legal arguments, not commercial ones, and they require counsel with OFAC practice.
What happens if a business disagrees with the Final Penalty Notice? OFAC's administrative process does not offer a formal appeal within the agency. A business may seek judicial review in the US federal courts, though this is a high-cost and long-cycle route. In our practice, the more effective route is to advance every available argument during the administrative process, before the Final Penalty Notice issues. The judicial review option exists, but it is a backstop, not a primary strategy.
The EU position is materially different. A listed person or entity challenging a Council designation has access to the EU General Court via an annulment action – a direct judicial route that OFAC's administrative regime does not replicate. For a business that is simultaneously addressing an EU designation and an OFAC enforcement matter, those two parallel processes require separate, coordinated strategies.
If a transaction has already been flagged, or a filing has been refused, an early review can preserve options that narrow with time. Contact Calder & Vance at info@caldervance.com to discuss the position.
Step 6: Parallel regime obligations – OFSI, EU, and SECO
An OFAC enforcement matter rarely exists in isolation. A business with European operations, a UK banking relationship, or a Swiss holding company will almost always face parallel obligations under OFSI, the relevant EU Council regulation, or the SECO regime in Switzerland. The factual record developed for the OFAC response will be seen by those regulators too – and inconsistencies between submissions to different regulators are a serious and avoidable problem.
Under OFSI, the civil penalty regime operates on a different legal basis from OFAC's. OFSI is required to publish details of monetary penalties, though it has a discretion not to do so in defined circumstances. The OFSI licensing and enforcement regime is set by the Sanctions and Anti-Money Laundering Act (SAMLA), which establishes the legal architecture for the UK's autonomous sanctions programmes following the UK's departure from the EU. The ownership-and-control test under OFSI is not purely mechanical: alongside the 50 percent ownership threshold, OFSI applies a control test that can catch entities not captured by a numerical ownership analysis alone. That divergence from OFAC's purely mechanical rule means that a counterparty cleared by an OFAC ownership analysis may still be caught under OFSI.
The EU enforcement regime varies by member state: there is no single EU civil penalty authority equivalent to OFAC or OFSI. Enforcement actions are brought by national competent authorities under the applicable EU Council regulation. However, the prohibition on dealing with a designated person is uniform across the EU, and the legal question of whether a transaction was prohibited is determined by EU law. An annulment action before the EU General Court is the route to challenge a designation itself; it is not a penalty appeal mechanism.
SECO, the State Secretariat for Economic Affairs in Switzerland, administers the Swiss sanctions regime. Switzerland maintains its own sanctions list, and while it regularly aligns with EU designations, it does not do so automatically or simultaneously. A transaction involving a Swiss entity or a Swiss financial institution must be checked against the SECO list as well as OFAC's SDN List and the EU Consolidated List. We regularly advise clients whose supply chains pass through Switzerland on the interaction between these three regimes.
Step 7: Remediation and the post-settlement compliance programme
Settlement is not the end of the matter. OFAC frequently requires, as part of a settlement, that the business implement a specific compliance programme or remediation measure. Even where that is not formally required, a documented and demonstrably effective post-settlement programme significantly reduces the risk of a future violation being treated as a repeat offence – which is itself an aggravating factor under the enforcement guidelines.
What does an effective post-settlement programme look like? OFAC's published framework for a sanctions compliance programme identifies five core elements: senior management commitment; a risk assessment; internal controls (including screening); testing and auditing; and training. A post-settlement programme that can demonstrate all five elements, with documentary evidence, is the appropriate standard.
One myth worth addressing directly: many businesses assume that once OFAC has issued a Final Penalty Notice and the settlement is paid, OFAC's attention moves elsewhere. In our experience, that assumption underestimates the degree to which OFAC monitors businesses that have previously resolved enforcement matters. A documented compliance programme, maintained and tested after settlement, is not a box-ticking exercise. It is the evidence that a future apparent violation – if one occurs – is treated as isolated rather than systemic.
Compliance counsel also has a role in the post-settlement period in relation to other regimes. The OFAC settlement will typically be public, at least in summary form. OFSI, EU national competent authorities, and other regulators may review it. A business that has resolved an OFAC enforcement matter should consider whether it needs to make any voluntary report or notification to its regulators in other jurisdictions, and what that disclosure should say.
Related practices
- Apparent violation assessment – EU – scoping and advising on apparent violations under the EU sanctions regime.
- Penalty defence and settlement under OFSI – step-by-step guide to the UK enforcement process.
- Penalty defence and settlement under SECO – managing Swiss sanctions enforcement alongside OFAC and OFSI matters.