A Canadian trading company receives a formal letter from Global Affairs Canada. The letter requests documents, transaction records, and correspondence relating to a series of export transactions. The compliance team has not dealt with this before. What must they produce? How quickly? What rights do they have? Getting this wrong – producing too little, too late, or in the wrong form – can convert a routine inquiry into a formal enforcement proceeding.
Responding to regulator information requests under Canada's sanctions and export-control regime means engaging with Global Affairs Canada (GAC, the department that administers the Special Economic Measures Act and related instruments) under a legal obligation to provide accurate and timely information. The obligation arises under SEMA (the Special Economic Measures Act) and the associated regulations, which together form the primary legal basis for Canada's autonomous sanctions programme. Failure to respond fully and accurately can result in civil or criminal liability under the applicable country regime.
This guide sets out the step-by-step procedure for responding to a GAC information request, explains the key legal tests, flags the most common errors, and identifies when to bring in external sanctions counsel. It also draws comparisons with the equivalent processes under OFAC (US), OFSI (UK), and the EU, because many businesses receiving a Canadian request have simultaneous exposure under one or more of those regimes.
Step 1: Understand the legal basis and who is asking
Before drafting a single word of your response, identify the precise legal instrument under which the request is made, the authority that issued it, and whether it is a voluntary inquiry or a mandatory demand. Those three facts determine every subsequent step.
GAC administers Canada's autonomous sanctions under SEMA and the Export and Import Permits Act (EIPA). Requests may come from different units within GAC – the Sanctions Policy and Operations Bureau, the Trade Controls Bureau for export-related matters, or, in criminal cases, the Royal Canadian Mounted Police or the Public Prosecution Service. Some requests are styled as voluntary inquiries asking a business to explain a transaction. Others are statutory demands that carry an obligation to respond. The label on the letter is not always conclusive. Read the cited legal authority carefully; if the request references statutory powers, it is mandatory in nature even if the language is polite.
In our cross-border practice, we regularly see businesses treat an apparently informal letter from GAC as a routine correspondence matter. That misreading costs valuable preparation time and can result in an uncoordinated initial response that the regulator later relies upon in escalating the matter. Identify the legal nature of the request first. Everything else follows from that.
The position above covers the standard case. Your facts – the goods involved, the counterparty, the applicable country regime, and the transactions in scope – will change the analysis. For a confidential review of a potential breach, contact us at info@caldervance.com.
Step 2: Preserve documents and establish a response team
The moment a request is received, a formal document-preservation hold must be issued to all custodians of potentially relevant materials. Any destruction of documents after receipt of a regulatory request can itself constitute an offence under the applicable country regime, independent of the underlying conduct under review.
Document categories typically relevant to a GAC information request include export permits, shipping and logistics records, end-use certificates, payment records, communications with the counterparty, and any internal compliance notes or screening records relating to the transaction. The scope of preservation should be wider than the scope of the request itself. It is easier to narrow production later than to explain a gap in records.
A response team should be constituted immediately. At minimum, it should include the most senior compliance officer with knowledge of the relevant transactions, a legal or regulatory affairs lead, and, where the matter has any complexity, external sanctions counsel. Do not assign the response to a junior team member without direct senior oversight. The response will form part of the permanent record of the matter.
Consider whether a voluntary self-disclosure (VSD – a proactive report to the regulator disclosing an apparent violation before the regulator raises it) is appropriate. In our experience, businesses that receive a GAC request and simultaneously identify an underlying compliance issue are better served by taking early legal advice on whether to make a VSD. A VSD made at this stage can be a meaningful mitigating factor; one made after the regulator has already developed its case carries far less weight.
Step 3: Analyse the request scope and the applicable sanctions obligations
Map the request against the substantive provisions of the Canadian regime before you begin collecting documents. The request scope often signals what the regulator suspects; understanding that signal lets you assess your exposure and structure your response accordingly.
Canada's autonomous sanctions under SEMA prohibit dealings with designated persons and with entities owned or controlled by them. The ownership and control test under the Canadian regime is functionally similar to the EU and UK tests: an entity that a designated person owns, controls, or directs – directly or indirectly – is generally treated as caught. This is distinct from OFAC's purely mechanical 50 percent rule (OFAC's rule treating entities owned 50 percent or more by blocked persons as themselves blocked), which does not require a separate control analysis. If your business also has US nexus, a GAC request about a counterparty may simultaneously raise OFAC questions about the same counterparty under a different legal test. The two analyses must run in parallel.
Identify every transaction mentioned or implied by the request. For each, ask: was the counterparty a designated person at the time of the transaction? Was any intermediate party designated? Did the goods or services fall within a sector-specific restriction under the applicable country regime? Were applicable export permits obtained and relied upon in good faith? These questions frame the substantive analysis that should underpin your response.
If a transaction has already been flagged, or a filing has been refused, an early review can preserve options that narrow with time. Write to info@caldervance.com for a confidential assessment.
How does Canada's regime compare with OFAC, OFSI, and the EU on information requests?
Understanding where the Canadian process diverges from those of the major allied regimes matters because many businesses operating in Canada also hold licences, permissions, or authorisations from OFAC, OFSI, or EU member-state competent authorities – and a GAC inquiry can trigger parallel obligations or parallel risks under each.
Under OFAC, the US regime, requests for information typically arise in the context of a Cautionary Letter, a Finding of Violation, or a formal civil-penalty process. OFAC has broad subpoena power, but it also has an active voluntary self-disclosure programme in which a VSD, made promptly and fully, can reduce the base penalty by a significant amount as a matter of published policy. OFAC's process is more explicitly penalty-calibrated than GAC's, and the published framework for calculating civil penalties is more granular. The timeline for responding to an OFAC administrative subpoena is set by the instrument and is typically short; verify the current position before relying on it.
Under OFSI (the UK's Office of Financial Sanctions Implementation), information-gathering powers arise under SAMLA (the Sanctions and Anti-Money Laundering Act). OFSI may issue a formal information notice requiring production of documents or information. OFSI operates a monetary penalty regime and has a published enforcement guidance document. A business that receives an OFSI information notice has rights to representation and, ultimately, to appeal a penalty decision to the Upper Tribunal. The UK regime is unusual in that OFSI also requires financial-sector firms to report knowledge or reasonable suspicion of a sanctions breach; that reporting obligation runs concurrently with, and independently of, any response to a formal information notice.
Under the EU regime, enforcement of financial-sanctions obligations is primarily the responsibility of national competent authorities in each member state, operating under the relevant Council Regulation. There is no single EU-level information-request procedure. The competent authority in the relevant member state issues requests under national procedural law. Challenges to a designation – rather than to an enforcement action – proceed before the EU General Court by way of an annulment action. Response timelines under EU member-state procedures vary; a business responding to a GAC request who also has a Dutch, French, or German exposure must check the applicable national rules.
The common thread across all four regimes is that early engagement, full document preservation, and a coherent initial response are uniformly treated as mitigating factors. Delayed, incomplete, or internally inconsistent responses are uniformly treated as aggravating ones.
What are the most common risk flags and errors in a Canadian response?
The most common and most damaging error is producing documents without first conducting a legal privilege review. Documents that are legally privileged – communications with lawyers providing legal advice – are generally protected from disclosure. Producing them voluntarily and without reservation waives that protection permanently. Run a privilege screen before any document leaves the organisation.
A second common error is allowing multiple individuals to communicate with GAC separately and without coordination. In a request involving several departments – trade, finance, logistics, compliance – different staff members may receive different parts of the request or be contacted by the regulator directly. Inconsistencies between their responses, even innocent ones, create the appearance of either confusion or concealment. Designate a single point of contact for all regulator communications and route everything through that person.
A third risk flag is the assumption that because Canada is an allied jurisdiction, the regulator will be lenient. GAC has demonstrated an increasing willingness to escalate matters to the Public Prosecution Service and to refer cases involving apparent evasion of the applicable country regime to the RCMP. The regime is not a soft touch. Treat every GAC information request as you would an equivalent request from OFAC or OFSI.
A fourth error is failing to check whether the transactions in scope also trigger reporting obligations under Canada's anti-money-laundering regime administered by FINTRAC. Sanctions violations frequently have an AML dimension; the two regimes should be reviewed together, not in separate silos.
Have you stress-tested your internal records against the scope of the request before you produce them? In our experience, the answer is frequently no – and that is when gaps surface at the worst possible moment.
When should you involve external sanctions counsel?
External counsel should be instructed before the first substantive response is sent to GAC. That is the practical rule. There is no moment in the process where the involvement of experienced sanctions lawyers makes the situation worse; there are many moments where their absence does.
Instruction at the outset preserves attorney-client privilege over the most sensitive communications and analysis. It enables a coordinated review of the transactions in scope before the response is drafted. It allows an experienced practitioner to assess whether a VSD is appropriate and, if so, to prepare one that will carry maximum mitigating weight. It also ensures that any parallel OFAC, OFSI, or EU exposure is identified and managed from the start, rather than discovered after a response has already committed the business to a particular factual position under the Canadian regime.
We have acted for businesses across the manufacturing, financial-services, and energy sectors in responding to GAC inquiries and, where appropriate, in making coordinated voluntary disclosures across multiple regimes simultaneously. In a recent matter, a logistics firm received a GAC information request that on its face concerned a narrow set of shipments. Our review identified that the same counterparty raised questions under the applicable US regime. We coordinated the response and the disclosure strategy across both jurisdictions. The matter resolved without formal penalty proceedings being initiated under either regime – though we do not suggest that outcome is guaranteed in any given case.
The myth that a business can manage a GAC information request internally, without legal input, until the situation becomes serious is one we encounter regularly. By the time it becomes serious, the internal response has already been sent, the factual record is set, and the options for managing exposure have narrowed materially. There is no advantage to waiting.
Related practices
- EU apparent violation assessment – assessing and responding to apparent breaches under EU sanctions.
- Cross-border regulator information request guide – managing simultaneous information requests across multiple regimes.
- EU regulator information request guide – procedure and risk flags for EU competent-authority requests.