A multinational trading house completes a series of transactions over eighteen months. An internal audit then surfaces a pattern: certain shipments passed through intermediaries with connections to a listed party. The question is not whether the rule was breached. The question is what to do now, and whether acting first – before a regulator acts – changes the outcome in a meaningful way.
Voluntary self-disclosure (VSD) is the act of proactively reporting an apparent violation to the relevant enforcement authority before the authority discovers it independently. As of April 2026, OFAC, OFSI, BIS, and the EU member-state competent authorities all operate disclosure frameworks that treat a timely, well-prepared VSD as a significant mitigating factor. The practical weight of that mitigation differs sharply between regimes – and in a cross-border matter, a business faces all of them simultaneously.
This guide walks through the VSD process regime by regime, identifies where the approaches converge and where they diverge, and sets out the risk flags that determine whether disclosure saves a business or compounds its exposure.
Why voluntary self-disclosure matters in a cross-border context
A single transaction can trigger disclosure obligations under three or more regimes at once. This is the starting point for any cross-border VSD analysis, and it is the point most internal compliance teams underestimate.
Consider a European company with a US-dollar payment leg, a UK-incorporated holding entity, and an EU-registered operating subsidiary. A transaction that touches a listed counterparty may engage OFAC (because of the US-dollar clearing), OFSI (because of the UK entity), and one or more EU competent authorities (because of the EU entity). Each regime has its own disclosure timetable, its own threshold for what constitutes a reportable apparent violation, and its own penalty calculus. Missing the deadline in one jurisdiction does not excuse non-disclosure in another.
In our cross-border practice, we regularly advise businesses that have correctly identified the primary exposure – say, an OFAC apparent violation – but have not fully mapped the secondary obligations that arise from the same set of facts under OFSI or the relevant EU regulation. By the time the oversight becomes apparent, the mitigation window in a secondary regime may have closed.
The cross-border dimension also affects strategy. A VSD that is carefully timed and scoped for OFAC may need to be filed concurrently or in advance in other jurisdictions to preserve the mitigation benefit in each. Sequencing a multi-regime disclosure requires a coordinated plan, not a series of independent filings.
Step 1: Scope the apparent violation before you disclose
Before a business files anything, it must understand precisely what it is disclosing, to whom, and why. Filing prematurely – before the facts are fully developed – can result in a submission that is both incomplete and inconsistent with later findings, an outcome that regulators treat as aggravating rather than mitigating.
Scoping an apparent violation means answering four questions. First, what happened? This means a factual reconstruction of each relevant transaction – dates, parties, values, the goods or services involved, and the route the transaction took. Second, which rules were engaged? The answer depends on the nature of the nexus: US-dollar clearing engages OFAC; a UK-incorporated party engages OFSI; an EU entity or technology engages the relevant EU regulation. Third, was the conduct wilful, reckless, or non-egregious? Each regime weights this differently, but the distinction between a technical violation and deliberate evasion determines whether disclosure leads to a no-action outcome or a civil penalty. Fourth, is the conduct continuing? An ongoing violation changes the urgency of the disclosure timeline significantly.
In our experience, the scoping phase is where competent counsel adds the most value. An internal investigation conducted without legal oversight can produce documents that become discoverable and that later harm the business's position. The scope of the investigation should be defined carefully, and the investigative steps should be sequenced with disclosure planning in mind.
The position above covers the standard scoping exercise. Your facts – the nature of the nexus, the number of regimes engaged, whether the conduct is continuing – change the analysis materially. For an initial assessment of your apparent violation and whether a VSD is the right route, contact Calder & Vance at info@caldervance.com.
Step 2: Understand the disclosure regime for each authority
Each enforcement authority operates its own disclosure programme, and the conditions for receiving full mitigation credit differ between them. A VSD that meets OFAC's requirements does not automatically satisfy OFSI's – and the EU has no single competent authority, so the disclosure must be directed to the authority in each relevant member state.
OFAC distinguishes between a voluntary self-disclosure that is timely and complete and one that is untimely or incomplete. The mitigation benefit for a genuine, timely VSD is substantial: OFAC's enforcement guidelines treat a timely VSD as a significant mitigating factor that can reduce the base penalty amount by a meaningful proportion. OFAC's guidelines also list the factors that aggravate or mitigate a penalty – including the presence or absence of a compliance programme at the time of the violation, and whether the business acted with awareness of the breach. A well-prepared VSD package addresses each of these factors directly.
OFSI operates within the framework established by the Sanctions and Anti-Money Laundering Act and OFSI's published enforcement guidance. OFSI differentiates between cases it refers for criminal prosecution and civil penalty matters it handles directly. A timely disclosure to OFSI, accompanied by evidence of a credible compliance programme and remedial steps, is treated as a factor that can reduce or eliminate a civil penalty. Critically, OFSI also has a mandatory reporting obligation that runs in parallel with the VSD framework: certain persons – including financial institutions – must report knowledge or suspicion that a person is a designated person or that funds are owned or controlled by a designated person. The mandatory reporting duty and the strategic VSD are legally distinct, and conflating them can expose a business to liability for failing to satisfy the former.
BIS and the EAR govern US export-control violations. BIS operates its own VSD programme separately from OFAC. An export-control VSD goes to BIS, not to OFAC, and the standards for a well-prepared submission differ from those in the sanctions context. For a business facing both sanctions and export-control exposure from the same conduct – for example, a shipment of controlled goods to a sanctioned end-user – the business may need to file disclosures with both agencies simultaneously. Coordinating the scope and the factual narrative across both submissions requires careful planning.
EU member-state authorities vary. The EU does not have a single sanctions enforcement authority. Each member state designates its own competent authority, and disclosure standards, timelines, and penalty structures differ across jurisdictions. A business with entities in multiple EU member states facing apparent violations under the same Council regulation must assess each jurisdiction separately. Some member states have formal VSD-equivalent programmes; others address the matter through general administrative-penalty principles.
Step 3: Assess the timing obligations and the deadline risk
Timing is the critical variable in VSD planning. File too late and the mitigation credit evaporates. File too early – before the facts are fully established – and the submission may be materially inaccurate, undermining the good-faith signal that the VSD is designed to send.
OFSI's enforcement guidance sets out a reporting obligation with a defined window for certain categories of person. The obligation to report knowledge or suspicion of a designated person is not discretionary for those within its scope. A business that delays a required mandatory report while it investigates the matter internally runs the risk of breaching the reporting obligation independently of the underlying apparent violation.
OFAC does not publish a fixed calendar deadline for VSDs, but its enforcement guidelines make clear that the timeliness of a disclosure is assessed against the moment the business knew or had reason to know of the apparent violation. A business that discovers an apparent violation, conducts an internal investigation over several months, and files only when facing a subpoena will not receive the same mitigation credit as one that discloses promptly and cooperates with the subsequent inquiry.
BIS applies a similar principle: a VSD is treated as timely if it is filed before BIS has opened an investigation or the Department of Justice has initiated criminal proceedings relating to the same conduct. Once either of those events occurs, the mitigation benefit of a VSD is substantially reduced.
In practice, the timing question requires a business to make a decision under uncertainty. The facts will not be fully known at the point when the disclosure must be made. A well-drafted initial VSD can acknowledge the preliminary nature of the investigation and commit to supplementing the disclosure as the facts develop. This approach – a holding disclosure followed by a full submission – is widely used in OFAC practice and is recognised by BIS, but it must be executed correctly to preserve the timeliness argument.
If a transaction has already been flagged internally, or if a regulator has made contact, an early legal review can preserve mitigation options that narrow with time. Contact Calder & Vance at info@caldervance.com for a confidential review.
Step 4: Prepare the disclosure package
A VSD package is not simply a letter acknowledging a breach. A well-prepared package addresses the factual record, the legal analysis, the compliance context, and the remedial measures – and it does so in a format that the receiving authority can process efficiently.
The core elements of a VSD package for OFAC include: a chronological factual narrative of each apparent violation; identification of the specific sanctions programme or programmes engaged; an analysis of whether the violation was wilful, reckless, or non-egregious; a description of the compliance programme in place at the time; an account of how the violation was discovered; and a description of the remedial steps taken or planned. OFAC also expects the business to identify the total value of the apparent violations and the number of transactions involved.
For OFSI, the package should address the equivalent elements under OFSI's enforcement guidance framework, with particular attention to: the nature and duration of the conduct; the role of the reporting entity and its proximity to the violation; evidence of a compliance programme; and the steps taken to remediate. OFSI places significant weight on the quality and credibility of the compliance programme. A business that can demonstrate that the violation was an isolated failure in an otherwise well-designed programme is in a materially better position than one with no programme at all.
For BIS, export-control VSDs follow a distinct format that addresses the classification of the goods or technology involved, the jurisdictions to which they were exported, the end-users, and the end-use controls (or lack thereof) in place at the time.
Where a business is disclosing to multiple authorities simultaneously, the factual narrative must be consistent across all submissions. Inconsistencies between a simultaneous OFAC VSD and a BIS VSD, or between an OFSI disclosure and an EU competent-authority notification, will be identified and will raise questions about the completeness and accuracy of each submission.
What are the most common mistakes in a voluntary self-disclosure?
The most common mistake is disclosure without adequate factual preparation. A business that files a VSD before completing a thorough internal investigation commits to a factual narrative that may need to be retracted or substantially revised as further information emerges. Each revision erodes the credibility of the submission and can trigger regulatory scrutiny of the business's internal-investigation methodology.
The second most common mistake is single-regime tunnel vision. A business that files an OFAC VSD but fails to assess whether the same conduct triggers an OFSI reporting obligation, or a BIS export-control disclosure requirement, is resolving one problem while creating another. In our practice, we have seen businesses receive OFAC no-action letters on the basis of a VSD, only to face an OFSI enforcement inquiry into the same underlying transactions because the OFSI reporting obligation was not separately addressed.
A third recurring mistake is the treatment of a mandatory reporting obligation as synonymous with a VSD. These are legally distinct. The mandatory reporting duty – which applies to certain regulated persons under OFSI's regime and under equivalent obligations in certain EU member states – is a compliance obligation that arises independently of any decision to pursue VSD treatment. Treating the mandatory report as the VSD, or substituting one for the other, misunderstands both regimes and can leave the business exposed on both.
Finally, businesses frequently underinvest in the remediation narrative. Enforcement authorities weigh the steps a business has taken since discovery as heavily as the steps it took before. A VSD that describes no remedial measures, or that describes steps not yet implemented, signals that the business has not treated the matter with appropriate seriousness. The remediation plan should be credible, specific, and – where possible – already partially executed at the time of filing.
How does the cross-border dimension change the VSD calculus?
The cross-border dimension changes the VSD calculus in three specific ways that do not arise in a purely domestic enforcement matter. Understanding each is essential for any business with a multi-jurisdictional footprint.
First, the penalty bases and calculation methods differ. OFAC calculates civil penalties by reference to the greater of a statutory maximum per transaction or the transaction value; BIS uses a separate statutory maximum under the Export Control Reform Act; OFSI operates its own penalty calculation regime under SAMLA. The EU member-state authorities apply national penalty structures that vary considerably. A cross-border VSD strategy must assess the penalty exposure in each jurisdiction and weigh the relative cost of disclosure against the risk of independent discovery in each.
Second, cooperation with one authority may affect the position in another. Information provided to OFAC in a VSD is not automatically shared with OFSI or EU authorities, but regulatory bodies in allied jurisdictions do exchange information. A business that discloses fully to OFAC but provides a narrower account to OFSI faces a serious credibility problem if OFSI subsequently obtains the OFAC submission through information-sharing channels.
Third, the timing of parallel disclosures requires a coordinated plan. Where a business is filing simultaneously with OFAC and OFSI, for example, the disclosures should ideally be filed on the same day or within a short window. A significant gap between the two filings – particularly if the first filing becomes known to the second authority before the second filing is made – undermines the claim that both disclosures were timely and voluntary.
Does your business have the capacity to coordinate a simultaneous multi-regime disclosure, manage the follow-on regulatory engagement in each jurisdiction, and maintain a consistent factual record across all submissions? This is the operational question that drives the decision to instruct specialist cross-border counsel early.
Related practices
- Apparent Violation Assessment (EU) – assessing EU sanctions apparent violations before disclosure or enforcement
- Voluntary Self-Disclosure: EU Guide – step-by-step guide to the EU VSD process and member-state authorities
- Voluntary Self-Disclosure: Japan Guide – disclosure obligations and mitigation routes under the applicable Japanese regime