A mid-sized manufacturing group with operations across three continents ran a routine internal audit. One line item stopped the review cold: a series of payments processed over eighteen months to a distributor whose ultimate beneficial owner had appeared on an OFAC watch-list partway through the relationship. The payments had continued after the designation. The compliance team had not caught it. The question immediately became: how serious is the exposure, and what should the business do next?
Internal sanctions investigations under OFAC follow a defined sequence – scope the apparent violation, preserve evidence, conduct a structured legal-privilege review, and decide whether a voluntary self-disclosure (VSD, a proactive report to OFAC that can reduce a civil penalty by a material amount) is warranted. The governing authority is OFAC under the powers granted by IEEPA. As of early 2026, OFAC's enforcement guidance makes clear that a timely, complete VSD is one of the most significant mitigating factors in any civil penalty determination.
This case comment walks through how a matter of that kind unfolds in practice: the investigation steps, the key decision points, the cross-regime dimensions that a US-focused review can miss, and the lessons that apply to any business that discovers a potential OFAC problem after the fact.
The situation: what the audit uncovered
The compliance team's audit flagged that payments to a regional distributor had continued for a period after one of its indirect shareholders was added to the SDN List (OFAC's list of Specially Designated Nationals and blocked persons). The shareholder held an interest below the threshold that would have automatically blocked the distributor under the 50 percent rule (OFAC's rule treating entities owned 50 percent or more by blocked persons as themselves blocked in the aggregate). The distributor was therefore not itself listed.
That fact did not end the analysis. OFAC's prohibitions are broad. Transacting with a company in which a blocked person holds a significant minority interest can still give rise to liability if the transaction provides a benefit to the blocked person – through dividends, through management fees, or through commercial arrangements that effectively flow value to the listed individual. The compliance team had been screening direct counterparties against the SDN List but had not mapped beneficial ownership beyond the first layer. The gap was structural, not individual.
A second problem compounded the first. Once the audit finding was raised internally, the business's instinct was to document it in a board memorandum distributed to a wide group. In our experience, that instinct – to brief broadly before the legal position is understood – is one of the most common and most damaging errors in the early stages of a sanctions matter. Wide distribution before legal privilege is established can compromise the investigation and limit options.
Step one: scoping the apparent violation and establishing privilege
The first action in any internal sanctions investigation is to define the outer boundary of the potential exposure and to ensure that the investigation itself is conducted under legal privilege. That means external counsel leading the factual review from the outset, with internal communications flowing through that structure rather than through general corporate channels.
Scoping serves two purposes. First, it identifies the period of exposure: the date the designation took effect, the date screening should have caught it, and the date payments stopped. Second, it identifies the jurisdictions whose rules are engaged. OFAC's jurisdiction does not require a US nexus in every case – US-dollar clearing, US financial institutions in the payment chain, and the involvement of US persons anywhere in the transaction can all ground OFAC jurisdiction even for a non-US business. That extraterritorial reach is the dimension that surprises most non-US compliance teams.
In this matter, the payments had been processed in US dollars through a correspondent banking chain. That single fact placed the transactions squarely within OFAC's jurisdiction. Whether the contracting parties were US entities was irrelevant. The USD clearing leg was enough.
The position above covers the standard case. Your facts – the counterparty, the currency, the payment route, the ownership structure, the regime in play – change the analysis significantly.
For an initial assessment of your exposure under OFAC or another regime, contact Calder & Vance at info@caldervance.com.
Step two: the evidence review and the ownership-chain question
Once privilege is established, the investigation turns to the facts. The core questions in an OFAC matter of this kind are consistent across most cases.
- When was the relevant person designated, and what was the effective date of the prohibition?
- What transactions occurred after that date, and what was the total value and number?
- What was the ownership and control structure of the counterparty at each relevant date?
- Did the blocked person receive any economic benefit from the transactions?
- What did the compliance programme require, and was it followed?
- What did senior management know, and when?
The ownership-chain question deserves particular attention. The 50 percent rule operates on an aggregated, look-through basis. Where a designated person holds interests across multiple vehicles that each feed into a common counterparty, the aggregate position can cross the threshold even when no single direct holding does. In this matter, the designated shareholder held interests through two intermediate entities. Neither intermediate entity was listed. Neither alone reached 50 percent. Together, they did not – but the combined economic interest flowing to the designated person was substantial and relevant to the benefit analysis.
The EU and UK positions at this stage of the analysis are worth noting. Under EU Council regulations and under the UK regime administered by OFSI (the Office of Financial Sanctions Implementation), ownership and control (the test for whether a non-listed entity is captured through a listed person's influence over it) operates alongside the ownership threshold. A business managing both a US and a European sanctions dimension in the same matter needs to run both analyses simultaneously. Control, in the EU and UK sense, can catch a relationship that the OFAC 50 percent rule does not.
Step three: assessing the voluntary self-disclosure decision
The VSD decision is the central strategic question in most OFAC internal investigations. A voluntary self-disclosure, made in a timely and complete way, is treated by OFAC as a significant mitigating factor. It does not guarantee a reduced penalty or a no-action outcome – OFAC retains full discretion – but it materially improves the posture of the case. What constitutes "timely" is not defined by a fixed calendar deadline; it is assessed against when the business reasonably could have completed a preliminary review of the facts.
The factors that bear on the VSD decision in practice include the following.
- Voluntariness and timing: disclosure before OFAC becomes aware of the issue through other means carries significantly more weight than disclosure after a regulator inquiry has started.
- The apparent severity of the violation, measured by transaction volume, duration, and the nature of the sanctioned activity.
- Whether the violation was wilful or reckless, or the product of a compliance failure without culpable intent.
- The quality and completeness of the disclosure itself: a partial or misleading VSD is worse than none.
- The remediation steps taken: has the business closed the gap in its programme, or is it simply reporting and waiting?
In this matter, the analysis pointed toward disclosure. The violation had a defined duration. The compliance gap was structural but not wilful. The business had no prior OFAC history. Remediation was already under way. A well-prepared, complete VSD, accompanied by a detailed remediation account, was assessed as the route most likely to produce a favourable outcome – though no outcome was assured.
If a transaction has already been flagged, or if an internal audit has surfaced a potential OFAC issue, the time available to shape the response narrows quickly. An early review by external counsel preserves the options that become harder to exercise as the matter ages.
Contact Calder & Vance at info@caldervance.com to discuss an apparent violation in confidence.
The cross-border dimension: what OFAC investigations routinely miss
OFAC is one regime. In most cross-border matters, it is not the only one engaged. In our cross-border practice, we regularly advise clients who have identified an OFAC issue and then discover, midway through their internal investigation, that the same underlying facts also engage OFSI, the relevant EU Council regulation, or the sanctions programme of the jurisdiction in which the counterparty operates.
The practical consequences of a multi-regime issue are significant in two respects.
First, reporting timelines may differ. OFSI operates a statutory reporting obligation requiring a compliance counsel-reviewed report within a defined window once a firm knows or has reasonable cause to suspect that it holds frozen funds or has dealt with a designated person. The OFAC VSD process does not carry the same statutory form, but the timing expectations are similar in practice. Running both in parallel requires co-ordination; missing the UK reporting window while focused on the US process is a real risk.
Second, the ownership-and-control analysis under EU and UK rules can produce a different conclusion from the OFAC 50 percent rule. A counterparty that is not blocked under OFAC because the designated person's aggregate ownership is below 50 percent may nonetheless be caught under the EU or UK control test. Conversely, a counterparty that is blocked under OFAC because the 50 percent threshold is reached may not be treated as a prohibited entity under the EU regime if the economic interest structure does not meet the EU criteria. Divergence in conclusions between regimes is the norm rather than the exception.
In this matter, a parallel EU analysis confirmed that the relevant EU Council regulation did not independently block the distributor, because the designated shareholder's indirect interest, while economically significant, did not give rise to the control indicators that the EU test requires. That conclusion had to be reached separately and documented separately. It could not be assumed from the OFAC analysis.
Related to this multi-regime dynamic, businesses managing an OFAC-facing matter with a European counterparty dimension should also consider the position under the apparent-violation assessment process for EU sanctions matters, which sets out the comparable EU enforcement pathway.
How the matter concluded: outcome and remediation
A VSD was filed. The disclosure package included a complete factual chronology, a summary of the ownership analysis, a quantification of the payments at issue, and a remediation plan. The remediation plan addressed three structural gaps: the beneficial-ownership look-through in the screening process, the periodic re-screening cadence for existing relationships (which had not been re-screened after the designation took effect), and the escalation procedure for screening alerts.
OFAC acknowledged receipt of the VSD. The matter remained under review for an extended period – as is typical – before being closed. No penalty was imposed. That outcome is not a guaranteed result of a VSD, and we do not present it as one. What the outcome reflected was a combination of the mitigating factors present in this particular matter: no prior history, no wilful conduct, complete and timely disclosure, and credible remediation.
We have acted in a number of enforcement matters with comparable fact patterns, and the variation in outcomes is real. The strength of the mitigating package, the quality of the remediation evidence, and the completeness of the disclosure each influence the result. None of them removes OFAC's discretion.
For context on how a comparable matter resolved in a UK OFSI context, see the OFSI penalty defence and settlement matter on this site, which illustrates the parallel UK enforcement pathway and the differences in how mitigating factors are assessed.
The lesson for similar businesses: risk flags and when to act
Several risk patterns appear consistently in OFAC matters of this kind. Businesses that identify any of the following in their own operations should treat it as a signal that an internal review is warranted.
- Re-screening gaps: counterparties screened at onboarding but not re-screened periodically. Designations happen throughout the year. A relationship that was clean at the start can become prohibited without the business noticing.
- Beneficial-ownership data that stops at the first layer. The 50 percent rule looks through the entire chain. Screening only direct counterparties systematically misses the pattern.
- USD-denominated payments to any counterparty with sanctioned-country nexus. USD clearing creates OFAC jurisdiction regardless of where the contracting parties are incorporated.
- Screening programmes that flag only exact name matches. Transliteration variants, aliases, and corporate name changes are standard features of SDN List entries; fuzzy-match logic is not optional.
- Escalation procedures that route screening alerts to business-line managers rather than compliance. Conflicts of interest in alert handling are a recognised enforcement red flag.
One myth worth correcting directly: a number of businesses we advise have proceeded on the assumption that OFAC's enforcement posture is primarily directed at large financial institutions, and that a commercial company with no US operations sits below the enforcement threshold. That view is incorrect. OFAC's civil jurisdiction reaches any person or entity that engages a US jurisdictional nexus – dollar clearing, a US financial institution in the payment chain, a US-person involved anywhere in the transaction. The enforcement record confirms that non-financial companies are regularly the subject of OFAC action.
For guidance on the full range of penalties and the enforcement process in an OFAC context, the OFAC penalty defence and settlement matter on this site provides a practical account of how that process operates from the first regulatory contact through to resolution.
Related practices
- EU apparent-violation assessment – scoping and presenting an EU sanctions enforcement matter, including the VSD equivalent and the General Court route
- OFAC penalty defence and settlement – a practitioner account of managing an OFAC civil penalty process from first contact to resolution