A Canadian trading firm completes a series of payments through its correspondent banking network. Months later, an internal audit flags that one beneficiary may have had a connection to a listed entity under the applicable sanctions regime. The payments cleared. The audit report lands on the General Counsel's desk. What happens next – and how quickly the team acts – can determine whether this becomes a managed compliance event or a formal enforcement referral.
A voluntary self-disclosure (VSD) is a proactive, unsolicited report to the competent authority – in Canada's case, Global Affairs Canada (GAC) – informing the regulator of a potential breach before it discovers the matter independently. Under the Special Economic Measures Act (SEMA) and the related thematic sanctions regulations, a well-prepared VSD can reduce or, in certain circumstances, eliminate civil and administrative exposure. It does not guarantee a particular outcome, but in our experience it materially changes the posture of the regulator's response.
This guide sets out the VSD process under Canada's sanctions regime step by step, compares Canada's approach with the positions taken by OFAC, OFSI, and the EU, and identifies the risk flags that should prompt immediate escalation to sanctions counsel.
Step 1 – Recognise the trigger: what makes a potential breach reportable?
The disclosure obligation under Canada's sanctions regime arises when a person or entity has reason to believe it holds, controls, or has dealt with property that is subject to a sanctions prohibition, or has otherwise contravened an applicable prohibition under the relevant thematic regulations made under SEMA. The trigger is broader than many compliance teams expect. It covers not only direct dealings with a designated person (an individual or entity named on a Canadian sanctions list) but also transactions with entities that a designated person owns or controls.
Recognising the trigger correctly is the first practical step. A transaction need not be complete for a reportable situation to arise. The discovery of blocked or restricted property – even property held passively by a financial institution – is itself a potential trigger. In our practice, we regularly see the trigger missed because screening ran only against the counterparty's legal name and not against the broader ownership chain. GAC's expectations under the applicable regulations extend to the entire chain.
The threshold question is: does the information available, taken together, give reasonable grounds to believe a prohibition may have been contravened? If yes, the clock for internal escalation starts. Two things are time-sensitive from that point: preserving all relevant records and initiating the internal factual review that will underpin the VSD submission.
Step 2 – Conduct the internal factual review
Before any disclosure is made to GAC, the business must understand, with as much precision as the evidence allows, what happened, when, and through which entities. This internal review serves two functions: it is the factual foundation of the VSD itself, and it prevents the disclosure from being contradicted by subsequently discovered evidence – a risk that significantly undermines the credibility of a VSD in the regulator's assessment.
The review should document the full transaction history, map the counterparty's ownership and control structure at the time of each relevant transaction, identify the applicable prohibitions under the relevant sanctions regulations, and quantify the value and number of transactions in scope. Where the ownership chain involves intermediate entities, a control analysis is required. Unlike the mechanical fifty-percent ownership threshold used by OFAC, GAC's analysis under SEMA can extend to entities a designated person controls through means other than ownership – including through board influence, contractual rights, or operational direction. The control question is qualitative, not simply numerical.
Crucially, the internal review must be conducted under legal professional privilege where possible. Communications with counsel, and the review memorandum itself, should be structured to maximise the prospect of privilege protection before any decision is made to waive in connection with the VSD. We advise clients to instruct counsel at this stage, not after the disclosure has been drafted.
Step 3 – Assess the disclosure decision and assess cross-regime obligations
The disclosure decision under Canada's regime is not always binary. The relevant question is whether the matter meets the threshold for a formal VSD to GAC, or whether it is better addressed through an internal remediation record without external disclosure. This assessment turns on the nature and gravity of the apparent breach, the likelihood of independent discovery by GAC or a third-party regulator, any ongoing exposure, and whether parallel obligations exist in other jurisdictions.
The cross-regime dimension is where many businesses underestimate the complexity. A Canadian apparent breach frequently involves parties or transactions that also engage OFAC, OFSI, or EU sanctions rules. Each regime has its own disclosure mechanics and its own treatment of cooperation credit. OFAC, for example, operates a well-developed VSD programme under IEEPA and the relevant agency guidance: a qualifying VSD can reduce the base penalty by a significant proportion, and the VSD factor is formally listed in OFAC's enforcement guidelines as a mitigating consideration. OFSI's approach under the UK's Sanctions and Anti-Money Laundering Act (SAMLA) similarly treats proactive reporting as a mitigating factor in monetary penalty assessments, and OFSI guidance sets out specific reporting obligations for financial institutions that hold or become aware of funds belonging to designated persons. The EU Council regulations impose their own reporting obligations on persons who hold funds or economic resources belonging to designated persons, with timelines and authorities differing by member state.
Where a transaction touches more than one regime, the VSD strategy must be coordinated. Disclosing in Canada without considering whether parallel filings are required in the US or the UK can create an inconsistent record that complicates, rather than assists, the overall response. We regularly advise clients on multi-regime VSD coordination. The position in each regime should be assessed before the first submission is made to any regulator. For a detailed comparison of the EU parallel process, see our guide at Voluntary self-disclosure: the EU regime, and for cross-border VSD coordination more broadly, see Voluntary self-disclosure: the cross-border guide.
Step 4 – Prepare and submit the VSD to Global Affairs Canada
A well-structured VSD to GAC sets out the facts of the apparent breach clearly, identifies the applicable prohibition under the relevant thematic sanctions regulations, and demonstrates that the submitting entity has taken the matter seriously. It is not a confession; it is a structured, legally framed account of what the evidence shows and what remediation steps have been or are being taken.
The submission should cover: a factual narrative of the transactions or conduct in question; identification of the designated person or sanctioned entity involved; the applicable legal prohibition; the value and number of transactions; the date of internal discovery; the steps taken to cease any ongoing breach; and the remedial measures implemented or planned. GAC will expect the submission to be detailed and to demonstrate genuine engagement with the compliance failure.
Timeliness matters. A VSD submitted promptly after internal discovery carries greater credibility with GAC than one submitted after a lengthy internal review that could not be adequately explained. While SEMA does not prescribe a fixed statutory window for VSD submissions in the same way that some other regimes do, delay weakens the central claim that the disclosure is genuinely voluntary and proactive. In our experience, the period between internal discovery and submission to GAC should be no longer than the time genuinely required to conduct a thorough factual review – typically several weeks for a straightforward matter, longer for complex multi-entity transactions.
The VSD should be submitted in writing to the Sanctions Bureau of Global Affairs Canada. Supporting documentation – transaction records, ownership charts, counterparty due-diligence materials – should accompany the submission or be offered for provision on request. Redact any information protected by privilege that is not being waived, and flag the redactions explicitly.
Step 5 – Manage the post-submission engagement and remediation
Submitting the VSD is the beginning of the regulator engagement, not the end. GAC may request further information, schedule calls or meetings with the compliance team, or ask for access to additional documentation. Each response to a GAC request should be reviewed by counsel before it is sent. The consistency and quality of post-submission engagement is part of the cooperation credit that the VSD is designed to generate.
Remediation should be running in parallel with the post-submission engagement. GAC will assess the seriousness of the remediation steps: whether the business has updated its screening procedures, enhanced its ownership-and-control review process, retrained staff, and addressed the root cause of the apparent breach. A VSD without credible remediation is less persuasive than one accompanied by documented, concrete changes. Think of the VSD and the remediation programme as two components of the same response – one addresses the historical breach, the other demonstrates that the breach will not recur.
The outcome of a GAC VSD review is not guaranteed. GAC retains full discretion to refer a matter for further enforcement action, to issue a warning, or to close the matter administratively. What the VSD does is position the business as a cooperative, good-faith actor – and that positioning carries weight both with GAC and, if the matter is ever referred to a law-enforcement body, with the Crown.
The position above covers the standard case. Your facts – the counterparty, the goods, the route, the regime in play – change the analysis. To discuss a potential apparent breach under Canada's sanctions regime, contact Calder & Vance at info@caldervance.com.
How does Canada's VSD regime compare with OFAC, OFSI, and the EU?
Canada's approach to voluntary disclosure shares the broad principle – cooperation credits matter – with the US, UK, and EU regimes, but the mechanics and the degree of formal codification differ considerably.
Under OFAC, the VSD programme is the most elaborately documented of the four. OFAC's enforcement guidelines set out a structured analysis: a qualifying VSD shifts the apparent violation from the "egregious" to the "non-egregious" category for penalty calculation purposes, and the base penalty range is reduced accordingly. The criteria for a qualifying VSD – unsolicited, before independent discovery, factually complete – are clearly articulated in OFAC guidance. The programme gives US-nexus businesses a relatively predictable, if not guaranteed, path for calculating exposure reduction.
OFSI's approach under SAMLA and the applicable enforcement guidance is less mechanically prescribed but still formally recognises voluntary disclosure as a mitigating factor in monetary penalty decisions. Financial institutions that hold funds belonging to designated persons have a mandatory reporting obligation under OFSI rules – distinct from the voluntary disclosure concept – which runs to a specific reporting window that should be verified against current OFSI guidance before reliance. The interaction between the mandatory reporting obligation and the voluntary self-disclosure process is a nuance that practitioners advising on UK-nexus matters must address carefully.
The EU position varies by member state because enforcement of the Council's sanctions regulations is decentralised. Each member state designates its own competent authority and determines its own enforcement posture. Some member states have well-developed VSD analogues; others address cooperation informally. EU law does impose mandatory reporting obligations on persons holding funds or economic resources belonging to designated persons, and the timelines and authorities for that reporting differ by jurisdiction. For apparent violations in the EU, see our analysis at Apparent violation assessment: EU regime.
Canada's GAC sits between OFSI and OFAC in terms of formalisation. The VSD pathway is recognised and used, but less prescriptively documented than OFAC's. That places greater weight on the quality of the submission and the conduct of the post-submission engagement. Where a matter has US, UK, or EU dimensions alongside its Canadian dimension, the most formally structured regime – typically OFAC – often provides the analytical template for the overall VSD strategy, with adjustments for each additional regime.
One convergence point across all four regimes: the principle that the stricter prohibition governs where multiple regimes apply to the same conduct. A transaction that would be prohibited under OFAC but not under SEMA must still be treated as prohibited if the US nexus is engaged. Designing a VSD strategy that addresses only the most lenient applicable regime is a structural error.
Risk flags and when to instruct sanctions counsel
Not every compliance issue requires a VSD. But certain risk factors move a matter from internal remediation territory into formal disclosure territory, and missing those flags can turn a manageable situation into a significant enforcement problem.
The risk flags that should prompt immediate escalation to sanctions counsel include the following. First, the apparent breach involves a transaction with a designated person or a directly listed entity – not merely a screening hit that was cleared on investigation. Second, the breach is ongoing: property is still held, payments are still being processed, or a continuing contractual relationship has not been suspended. Third, the apparent breach involves goods or technology that may also engage export-control regulations, such as those administered by the Export and Import Permits Act (EIPA) in Canada or the EAR in the United States – because the VSD obligations for sanctions and for export controls are separate and must be managed in parallel. Fourth, there is a reasonable prospect that GAC or another regulator will discover the matter independently, through a third-party report, a correspondent bank's own compliance process, or a parallel regulatory inquiry. Fifth, the transaction has a multi-regime dimension involving OFAC, OFSI, or EU sanctions exposure alongside the Canadian position.
A myth we encounter regularly from compliance teams at this stage: "We only need to disclose to GAC because the contract is governed by Canadian law." Contract law and sanctions law are different things. The governing law of a contract does not determine which sanctions regimes apply. OFAC's jurisdiction extends to any transaction involving a US person, US-origin goods, or US dollar clearing – regardless of the governing law of the underlying contract. OFSI's reach covers UK persons and entities incorporated in the United Kingdom regardless of where they are operating. A business that structures its VSD strategy around the governing law of its contracts, rather than around the jurisdictional reach of the applicable sanctions regimes, will routinely miss its disclosure obligations.
If a transaction has already been flagged by a correspondent bank or a payment processor, or if a filing has been refused, an early review can preserve options that narrow with time. Contact Calder & Vance for a confidential review of a potential apparent breach at info@caldervance.com.
Documentation and record-keeping
Record-keeping is both a precondition for a credible VSD and an independent obligation under Canada's sanctions regime. The applicable regulations under SEMA impose record-keeping requirements on persons engaged in activities that may be subject to a sanctions prohibition. Maintaining complete, accurate, and accessible transaction records is not a post-breach response; it is an ongoing compliance obligation.
For VSD purposes, the documentation that GAC will expect to see – or that the business should be prepared to produce on request – includes: all transactional records for the period in scope; ownership and corporate structure charts for relevant counterparties; due-diligence records showing what screening was conducted and when; communications with the counterparty at the relevant time; and internal compliance records showing the screening procedures that were in place. Gaps in this documentation weaken the VSD and invite further inquiry.
Privilege management is a related point. Where legal counsel has been involved in the internal review, the status of counsel's communications and memoranda should be assessed before any material is produced to GAC. A blanket waiver of privilege in a VSD submission is rarely necessary and may produce unintended consequences if the matter is later reviewed by a different authority. The decision on what to produce and what to protect should be made deliberately, not by default.
Related practices
- Apparent violation assessment: EU – assess and manage apparent violations under EU Council regulations
- Voluntary self-disclosure: cross-border guide – coordinate VSD filings across multiple regimes simultaneously
- Voluntary self-disclosure: the EU regime – navigate EU sanctions disclosure obligations across member states