A mid-size technology distributor with subsidiaries across three continents receives a subpoena-adjacent request: OFAC has made informal enquiries about a series of transactions that passed through its US parent. The compliance team pulls the files. What they find is not a deliberate act. It is something quieter and, in some ways, harder to explain – a gap between written policy and operational reality that allowed prohibited transactions to clear without triggering a single alert. The internal sanctions investigations process that follows will determine whether this stays a disclosure or becomes an enforcement action.
Internal sanctions investigations under OFAC are the structured internal review a business conducts when it identifies or suspects an apparent violation of US economic sanctions law. The governing authority is OFAC, acting under authority delegated through IEEPA and related statutes. The investigation outcome – its scope, its documentation, and its timing – directly shapes whether the matter results in a voluntary self-disclosure, a no-action outcome, or a formal enforcement proceeding carrying civil or, in serious cases, criminal consequences.
This case comment walks through an anonymised matter: the situation that triggered the review, the legal questions the investigation had to answer, the analysis applied across the OFAC regime and its principal comparators, the route the business chose, and the lessons that translate directly to comparable situations.
The Situation: How the Gap Appeared
The business operated a well-documented sanctions compliance programme. It had screening at onboarding, a transaction-monitoring layer, and annual training. On paper, the architecture was sound. In practice, a legacy product line processed through a subsidiary outside the United States had been routed – for operational convenience – through a payments channel that sat inside the US parent's treasury function. That routing made the transactions subject to US jurisdiction under OFAC's rules, a fact the operational team had not registered when the routing change was made eighteen months earlier.
The payments involved counterparties in a country subject to a comprehensive OFAC programme. The amounts individually were modest. Cumulatively, across the eighteen-month period, they reached a level that placed the matter in a range where OFAC's enforcement posture makes a voluntary self-disclosure (VSD – a formal, proactive report of an apparent violation submitted to OFAC before the agency identifies the conduct independently) a materially different option from silence.
Three questions shaped the investigation from day one. First: did US jurisdiction actually attach? Second: were any of the counterparties themselves designated, or did the exposure arise purely from the country-based prohibitions? Third: had the business discovered the issue before OFAC, and could a VSD be structured in time to change the penalty calculus?
Does US Jurisdiction Attach? The Threshold Legal Question
The jurisdictional question in internal sanctions investigations is the first gate, and it is worth spending real time on it before the investigation widens. OFAC's jurisdiction extends to US persons wherever located, to all persons and transactions within the United States, and – through the extraterritorial reach of certain comprehensive and list-based programmes – to non-US persons in defined circumstances. The routing of transactions through the US parent's treasury function was, on the facts, dispositive: it made a US person the processing entity.
This is a point where the cross-regime comparison matters. Under EU Council regulations, jurisdiction turns primarily on whether the activity occurs within the Union, involves a Union national or entity, or is conducted from Union territory. Under UK OFSI rules, the test looks at whether the conduct was by a UK person or occurred within the United Kingdom. Neither regime would have captured the same conduct on identical facts – the subsidiary's home jurisdiction was outside both the EU and the UK, and the counterparties were not on EU or UK lists.
That divergence had a practical consequence. The business's EU and UK compliance officers, reviewing the same operational facts, had not flagged a concern. They were right under their respective regimes. But they were also not the relevant regimes. In our experience, multi-jurisdictional businesses frequently underweight the significance of US-side routing and treasury functions, treating them as administrative rather than jurisdictional facts. That is the wrong frame.
The investigation confirmed US jurisdiction attached. The analysis then moved to the second question: the nature of the exposure.
Country Prohibitions Versus List-Based Exposure: Why the Distinction Drives the Analysis
OFAC operates two structurally different types of prohibition. Country-based programmes – comprehensive sanctions regimes applicable to defined geographic areas – prohibit a broad range of dealings regardless of whether any specific counterparty is on a list. List-based programmes designate specific persons, entities, and vessels onto the SDN List (OFAC's list of Specially Designated Nationals and blocked persons) or other restricted-party lists, and prohibit dealings with those specific entries.
The distinction matters for several reasons. A country-programme exposure that does not involve a designated person raises different questions about intent, wilfulness, and prior knowledge than a transaction with an SDN. Screening tools are typically calibrated to catch list-based exposure; they do not substitute for jurisdictional analysis of country-programme applicability.
In this matter, the counterparties screened clean against the SDN List and OFAC's other restricted-party lists. The exposure was country-programme based: the counterparties operated in a jurisdiction subject to comprehensive prohibitions, and the US-routed payments constituted a prohibited service. That finding – no SDN involvement, country-programme exposure only – was significant for the penalty analysis. OFAC's enforcement guidelines treat the presence of designated persons in the transaction as an aggravating factor. Their absence does not eliminate liability, but it affects the base penalty calculation.
The investigation also checked for secondary-sanctions exposure. Some OFAC programmes carry consequences for non-US persons who engage in significant transactions in defined sectors, even without a US nexus. The business's non-US subsidiaries had not engaged in the level or type of activity that would independently trigger those provisions, but the analysis had to be run explicitly. Secondary-sanctions risk does not announce itself.
The position above covers the standard architecture of this analysis. Your facts – the counterparty, the goods or services, the payment route, and the programme in question – will change the result at each step. If you are in the middle of a similar review, the earlier you bring in external counsel, the more options remain available.
For an assessment of your exposure under OFAC or a related regime, contact Calder & Vance at info@caldervance.com.
Structuring the Internal Investigation: Scope, Privilege, and Documentation
A well-structured internal sanctions investigation serves two functions at once: it uncovers the facts accurately, and it creates a documentary record capable of supporting a credible VSD or, if needed, a penalty defence. Those two functions are not always in tension, but failing to think about the second from the outset regularly damages the first.
Scope is the first decision. In this matter, the investigation team set the scope to cover all payments processed through the US parent's treasury function over the eighteen-month period the rerouting was in place, plus a ninety-day look-back before that period to establish the baseline position. Wider is not always better: an uncabined scope that drags in unrelated business lines creates volume without adding probative value, delays the VSD window, and can surface additional issues that complicate a clean disclosure narrative.
Legal privilege was managed carefully. The investigation was conducted at the direction of external counsel, with internal teams contributing factual data under a defined protocol. Interview notes, analytical memoranda, and counsel's working papers were maintained as privileged. The factual record – transaction data, payment logs, counterparty documentation – was not privileged and was prepared for potential production.
Timing is a live constraint throughout. OFAC does not publish a statutory window for VSD submission, but the agency's enforcement guidelines treat self-disclosure as a mitigating factor only when it is genuinely voluntary – meaning before OFAC has independently identified the conduct. Once OFAC has opened an inquiry, the window for a VSD in the full sense is closed. In this matter, the informal enquiry from OFAC had been general, touching the business's broader compliance programme rather than the specific transaction stream in question. The investigation confirmed there was time to file. The team moved quickly.
Documentation standards across the investigation were held to the same level the team would apply to a formal regulatory submission. Every factual finding was sourced to a specific record. Every analytical conclusion was traceable to the factual finding. That discipline, applied during the investigation, materially reduced the time needed to prepare the actual VSD submission.
What Does a VSD Filing Actually Involve?
A voluntary self-disclosure to OFAC is a formal written submission describing the apparent violation, the facts underlying it, the business's compliance programme at the time, the remediation steps already taken or committed to, and a request for a mitigated civil penalty. It is not a letter of apology. It is a legal submission that will be reviewed by OFAC's enforcement staff and form the basis of the agency's penalty determination.
The submission in this matter covered seven substantive areas: a factual chronology of the routing change and the payments; a jurisdictional analysis confirming US-person involvement; a counterparty analysis confirming no SDN or other list-based designation; a quantification of the transactions and their aggregate value; an assessment of the business's compliance programme using OFAC's published framework of root-cause, culture, and systemic indicators; a remediation plan with specific, committed actions and timelines; and a statement of co-operation.
The remediation plan was not aspirational. It identified the specific control gap – the absence of a jurisdictional-trigger review when payment routing changed – and committed to a defined set of control improvements with named owners and completion dates. OFAC's enforcement posture rewards concrete remediation over general commitments to "enhance" controls. We regularly advise clients that the remediation section of a VSD is as important as the factual disclosure itself.
The submission also addressed the business's co-operation explicitly. OFAC's published guidelines identify the absence of prior sanctions history, the self-disclosure itself, and active co-operation as mitigating factors. Each was documented in the submission rather than left implicit.
If a transaction has already been flagged, or a filing has been refused or queried by a regulatory authority, an early external review preserves options that narrow with time. Contact us at info@caldervance.com for a confidential review.
The Route Taken and Its Outcome
The business filed a VSD. OFAC acknowledged receipt and opened a review. The matter proceeded through the standard enforcement channel without escalation to a formal administrative proceeding or referral for criminal consideration. OFAC's review confirmed the self-disclosed facts. The agency issued a finding of a violation and imposed a civil monetary penalty at a level materially below the statutory maximum – a reduction attributable, in OFAC's written determination, to the voluntary disclosure, the absence of prior violations, the absence of designated-person involvement, and the quality and specificity of the remediation commitment.
The outcome cannot be promised in advance. OFAC retains full discretion in its penalty determinations. Identical facts in a different business context, with a different compliance history or a different quality of disclosure, can produce a different result. What the outcome illustrates is the structured pathway: investigate accurately, disclose credibly, remediate concretely, co-operate consistently. That pathway does not eliminate liability. It meaningfully shapes how OFAC exercises its discretion.
The business also notified its banking counterparties of the matter, as required under the terms of its principal credit facility. That notification, managed carefully, did not result in a facility acceleration. It was handled as a disclosure of a resolved compliance matter with documented remediation – not as an admission of systemic failure. The framing was accurate and the documentation supported it.
Risk Flags: When Does an Internal Review Become Urgent?
Not every compliance gap warrants the full architecture of an internal investigation and a VSD. The question practitioners face is where on the spectrum a given issue sits. Several factors push a matter toward the urgent end.
First, the involvement of designated persons. A transaction with an SDN – even an inadvertent one – sits in a different enforcement category from a country-programme exposure without a listed counterparty. The investigation should treat any potential SDN involvement as urgent from the moment it is identified.
Second, the volume and duration of the exposure. A single transaction over a short period with a prompt identification and cessation looks different to eighteen months of recurring payments. The latter raises questions about systemic control failure that OFAC will ask explicitly.
Third, the presence of aggravating factors in OFAC's published guidelines. Wilfulness, knowledge, senior management involvement, concealment, and obstruction are the headline aggravators. Any fact pattern that touches one of these requires immediate external counsel involvement.
Fourth, criminal exposure. OFAC's civil enforcement is the most common pathway, but wilful violations can be referred for criminal prosecution under the relevant statutes. The threshold for criminal referral is not published as a mechanical rule, but a pattern of wilful conduct – particularly involving high-value transactions or designated persons – creates real exposure. External counsel must assess this question independently of the civil-penalty analysis.
Fifth, and often overlooked, is the counterparty's own exposure. If the business's counterparty is itself a US-regulated entity, it may have independent reporting obligations. The business's VSD and that counterparty's potential disclosures may intersect in ways that affect the sequence and content of the disclosure strategy.
A myth we encounter regularly in this work is the belief that a compliance programme's existence – its written policies, its training records, its governance structure – means the business will receive OFAC's best-case treatment in enforcement. It does not. OFAC looks at whether the programme was effective in practice, not merely whether it existed on paper. The gap between a documented programme and actual operational controls is exactly what this matter illustrated. Do not assume documentation is protection.
For a confidential review of a potential breach or to stress-test your screening and compliance programme, reach our team at info@caldervance.com.
Lessons for Comparable Businesses
The lesson this matter produces is not exotic. It is operational. Payment routing changes – treasury restructuring, banking relationship shifts, correspondent-bank changes – carry jurisdictional consequences that the operational team making the change is typically not positioned to assess. The compliance function needs to be in the loop before the routing change is made, not after it has been in place for eighteen months.
A second lesson concerns the extraterritorial architecture of US sanctions. The reach of OFAC's programmes extends well beyond the obvious case of a US company doing business in a sanctioned jurisdiction. A non-US subsidiary that routes payments through a US parent, clears through a US correspondent bank, or denominated transactions in US dollars has, in most programme contexts, brought that activity within OFAC's jurisdiction. That connection is not academic. It is the jurisdictional hook that OFAC enforcement relies on.
A third lesson is the value of the investigation-first discipline. The instinct, when a compliance issue surfaces, is sometimes to move quickly to disclosure or remediation before the full picture is understood. That instinct, however well-intentioned, regularly produces disclosures that are incomplete, inconsistent, or framed in ways that complicate the enforcement outcome. The investigation needs to be thorough before the disclosure is filed. Rushed disclosures rarely produce better outcomes than careful ones.
We have acted for businesses in structurally similar situations across multiple OFAC-regulated sectors. The common thread is not the type of business or the type of goods or services. It is the gap between written compliance architecture and operational reality – and the question of how that gap is discovered, investigated, and addressed.
Related practices
- Apparent Violation Assessment (EU) – structured review of potential EU-regime violations and disclosure options
- OFAC matter: a second internal investigation – further case comment on internal review methodology and VSD strategy
- Penalty defence and settlement: an OFAC matter – case comment on managing the civil penalty process through to settlement