An OFAC matter: penalty calculation methodology lessons learned

A mid-sized financial institution receives a written inquiry from OFAC. The question seems narrow: how were penalty amounts calculated across a batch of transactions processed over several years? The compliance team begins pulling records. Within days, it becomes clear that the firm's own calculation methodology has produced inconsistencies – some transactions were assessed against the correct base, others were not, and a handful appear to have been categorised in a way that understated the apparent violation value. The regulator has not yet characterised the matter. Time is short, and the decisions made in the next few weeks will shape every outcome that follows.

OFAC's penalty calculation methodology turns on a defined analytical sequence: the applicable statutory maximum, the base penalty amount, and a series of aggravating and mitigating factors set out in the Enforcement Guidelines. The methodology is not discretionary in the way a court sentencing exercise is – it is a structured formula, and how a firm responds to each element of that formula determines where within the penalty range it lands. Voluntary self-disclosure (a firm's proactive report of its own apparent violation to OFAC before the regulator independently discovers it) is a recognised mitigating factor that can materially alter the outcome.

This case comment follows the timeline of a representative matter – from the first regulator contact through internal triage, the disclosure decision, and the penalty negotiation – and draws out the lessons for any business that may face an analogous situation.

The trigger: a routine inquiry becomes a penalty exposure question

OFAC enforcement inquiries rarely arrive labelled as enforcement actions. They typically open as requests for information – a letter asking a firm to explain a specific set of transactions, provide records, or confirm counterparty details. In the matter we describe here, the initial contact was precisely that: a written request covering a defined period and a defined category of transactions. Nothing in the letter used the word "violation".

The firm's first instinct was to treat the inquiry as an administrative matter and to respond narrowly. That instinct, while understandable, carried a risk that is easy to miss under pressure: the scope of an OFAC inquiry can expand, and the firm's own response – what it says, what it produces, and when – becomes part of the evidentiary record. A response that turns out to be incomplete is treated differently from a response that proactively flags gaps.

Within the first week, the internal review surfaced a complication. The firm had developed its own internal methodology for categorising and valuing the relevant transactions. That methodology had not been validated against OFAC's published guidance. Some transactions had been assessed against the full transaction value; others had been assessed against a net figure. OFAC's Enforcement Guidelines address the base penalty amount calculation, and the two approaches produced meaningfully different numbers. That discrepancy was now visible to the regulator.

In our experience, the point at which a firm realises its internal categorisation does not map onto the regulator's methodology is also the point at which specialist counsel should be involved. The analytical gap is not merely technical; it becomes the foundation of the firm's legal position. How big is the apparent exposure under OFAC's methodology? Does the gap reflect a good-faith interpretive difference or something more? Those questions require clear answers before any further step is taken.

What the OFAC Enforcement Guidelines actually require

OFAC's Enforcement Guidelines set out the framework that governs how a civil penalty is assessed. The framework distinguishes "egregious" from "non-egregious" matters, and within each category applies different base penalty amounts and different caps. The statutory penalty authority rests on IEEPA; penalties are assessed per violation and may be substantial. OFAC civil liability operates on a strict basis – no knowledge or intent is required to establish the violation itself.

The Guidelines identify specific aggravating factors: whether the conduct was wilful or reckless, whether management was aware, whether the firm is a sophisticated actor, whether it has a prior sanctions history, and whether the conduct caused harm to the objectives of the programme. Each factor pushes the assessment toward the higher end of the applicable range.

Mitigating factors run the other way. Voluntary self-disclosure is the most consequential single factor: it shifts the applicable base and, in non-egregious matters, reduces the penalty ceiling significantly. Beyond VSD, the Guidelines also credit: a remedial response that addresses root causes rather than symptoms, a co-operative posture throughout the inquiry, a credible and effective sanctions compliance programme at the time of the violation, and no prior sanctions history. What is not credited is silence. A firm that waits for OFAC to characterise a matter before it engages loses the mitigating value of early disclosure – a value that can be the difference between a warning letter and a substantial monetary penalty.

The firm in this matter had not made a disclosure at the point of the initial inquiry. The internal review now had to determine whether the window for a disclosure that OFAC would treat as "voluntary" had closed. That question – whether the regulator has already independently obtained the relevant information – is a legal judgment, not a factual one. It requires a precise reading of what the inquiry letter disclosed and what OFAC likely already knew.

The disclosure decision: a structured analysis, not a binary choice

The received wisdom in some compliance functions is that staying silent is safer than self-disclosing. The logic runs: disclosure confirms the violation, gives OFAC a roadmap, and cannot be undone. That logic is mistaken, and it is the central myth this matter illustrates.

The decision to disclose is not a binary choice between admission and silence. It is a structured analysis that turns on several specific questions. First: does OFAC already know, or is it materially likely to know, the core facts of the violation from its own inquiry? If yes, the mitigating value of disclosure is reduced but not eliminated – a disclosure that supplements what the regulator already has can still demonstrate co-operation. Second: how does the violation score on the egregious / non-egregious spectrum? In non-egregious matters, VSD is by far the most powerful lever available to a respondent. Third: what remediation is the firm willing and able to commit to alongside the disclosure? A bare admission with no remedial steps is treated differently from a disclosure packaged with a credible account of root-cause analysis and programme improvements.

In the matter described here, counsel assessed that the regulator had identified the existence of the transactions but had not yet characterised the methodology discrepancy. A supplemental submission was prepared: it acknowledged the categorisation inconsistency, recalculated the apparent violation value using OFAC's published methodology, and set out the remedial steps already underway. The submission was framed as co-operative and factually complete. It did not minimise the apparent violation, because minimisation is read as non-co-operation.

This is a decision the firm could not have made well without external counsel. The line between what OFAC knows and what it has not yet connected is a judgement call that requires experience of how the Enforcement Guidelines are applied in practice, not only how they read on the page.

Aggravating and mitigating factors: how the record is built

Once the disclosure was made, the focus shifted to the penalty range. OFAC's methodology gives the respondent a role in constructing the factual record that the Guidelines are applied to. That record is built through the submissions the firm makes: the account of how the violation occurred, the evidence of the compliance programme at the relevant time, the explanation of root cause, and the documentation of remedial steps.

The key mitigating factors were addressed in sequence. The firm had no prior OFAC sanctions history – that was documented clearly. The compliance programme in place at the time of the transactions was imperfect but genuine; the firm could demonstrate that it had screening in place, that the methodology gap arose from a specific interpretive decision rather than a wholesale absence of controls, and that the decision had been made at an operational rather than a senior-management level. The absence of management awareness, while it did not remove the violation, bore on the assessment of wilfulness.

Records must be kept for five years under OFAC's rules. The firm had its records. That sounds straightforward, but in practice the record-keeping obligation is what makes a detailed factual submission possible at all. Firms that have not maintained complete transaction records are in a materially weaker position: they cannot demonstrate what the programme looked like, cannot reconstruct the decision trail, and cannot build the remedial narrative that the Guidelines reward.

The aggravating side of the analysis was also considered carefully. The firm was a financial institution – a sophisticated actor under the Guidelines – and the transactions fell within a period of heightened regulatory attention to the relevant instrument. Both factors pulled toward the higher end of the range. Counsel did not argue against those characterisations; instead, the submission concentrated on the factors that the firm could actually control: the quality of the remediation, the completeness of the co-operation, and the strength of the programme improvements committed to.

Blocked-property and rejected-transaction reports are due to OFAC within 10 business days of the relevant event. In this matter, not all required reports had been filed within that window. Counsel addressed the reporting gaps directly in the submission rather than waiting for OFAC to raise them. Proactive acknowledgment of a subsidiary deficiency, framed with an explanation and a remedial commitment, lands differently than a gap that the regulator identifies and the firm then has to account for reactively.

Cross-border dimensions: how OFSI and EU enforcement differ

The firm in this matter operated across the UK and the EU as well as the US. That cross-border reach raised a question that is now almost inevitable in enforcement matters involving a major financial institution: does a US OFAC enforcement action carry implications for the firm's UK and EU regulatory position?

The answer is not automatic, but it is not remote either. OFSI, the UK's Office of Financial Sanctions Implementation, has its own enforcement posture and its own penalty methodology. Since 2022, OFSI has had the power to impose monetary penalties on a strict-liability basis. Under the current rules, the maximum OFSI monetary penalty is the greater of £1,000,000 or 50 percent of the value of the breach, as currently in force – verify before reliance. A firm resolving an OFAC matter without considering its UK position may find itself disclosing to one regulator information that should have been assessed against UK reporting obligations simultaneously.

OFSI also has a reporting obligation: relevant firms that know or have reasonable cause to suspect that a person is a designated person, or has committed an offence under the financial sanctions regime, are under a legal duty to report to OFSI. That obligation runs independently of any US reporting requirement. In our practice, firms that manage OFAC matters in isolation – without a parallel assessment of their UK and EU obligations – frequently discover a secondary exposure they had not anticipated.

At the EU level, an EU directive on the criminalisation of sanctions violations has set minimum penalty standards, with maximum terms of imprisonment of at least five years for serious offences and corporate fines expressed as a percentage of worldwide turnover, as currently in force. The EU's approach to enforcement continues to develop, and divergence from the US methodology – particularly on the treatment of intent and on remediation credit – means that a submission calibrated for OFAC may not be optimal for a parallel EU proceeding. The principle that applies across all three regimes is consistent: where two or more regimes both apply, the stricter prohibition governs, and a firm subject to all three must manage each track on its own terms.

For counsel assisting on this matter, the cross-border analysis required a co-ordinated approach: the OFAC submission was prepared first, given the tighter response timeline, but the UK and EU positions were assessed in parallel and the submissions were sequenced to avoid any representation to one regulator that created a difficulty before another. Businesses managing multi-regime enforcement matters benefit from a view across all relevant regimes from the outset, not from working through them sequentially.

The lesson for similar businesses: what this timeline reveals

The lesson from this matter is not that the firm made an unusual or egregious error. The lesson is that a specific category of internal methodology decisions – ones that involve a mapping between the firm's own analytical approach and a regulator's defined framework – carries enforcement risk that is easy to underestimate until a regulator asks about it directly.

Penalty calculation methodology is not a back-office function that sits outside compliance. It is a legal analysis. The choices a firm makes about how to value an apparent violation, how to categorise a transaction, and how to define the universe of relevant events all produce numbers. When those numbers are visible to a regulator, they are also statements. A number that reflects an interpretive choice that OFAC does not share is a statement that the firm must either defend or correct.

The remediation steps that produced the best outcome in this matter were not complicated. They were: early involvement of qualified external counsel, a structured assessment of the VSD question before any further response was provided, a submission that engaged honestly with both sides of the aggravating / mitigating analysis, complete record production, and a programme-improvement commitment that was specific and credible. None of those steps required extraordinary resources. All of them required the firm to resist the instinct to manage the inquiry narrowly.

A practical diagnostic for any compliance function is to ask, before a regulator asks: if OFAC reviewed our methodology for calculating apparent violation values, would our internal categorisation produce the same number that the Enforcement Guidelines would produce applied to the same facts? If the honest answer is uncertain, the time to resolve the uncertainty is now – not during a live inquiry. We regularly advise clients on exactly this kind of proactive methodology review, and in our experience the gap between internal practice and the regulatory standard is more common than most firms expect.

The secondary lesson concerns the cross-regime dimension. A firm that operates under OFAC, OFSI, and EU sanctions simultaneously cannot treat an OFAC inquiry as a US-only event. Reporting obligations, disclosure timing, and penalty methodology differ across the three regimes. Managing them in sequence, rather than in parallel, compounds rather than reduces the exposure. The time to build a multi-regime response plan is before the first inquiry letter arrives.

When to involve counsel: the decision points that cannot be reversed

Not every OFAC inquiry requires immediate external counsel involvement – but several specific decision points do, because they cannot be reversed once passed.

The first is the characterisation of the initial inquiry. Is this an informational request or the opening of an enforcement proceeding? The distinction affects privilege, tone, and the scope of any response. Misjudging it early narrows options that would otherwise remain open.

The second is the VSD window assessment. As discussed above, whether a disclosure still qualifies as "voluntary" under OFAC's Enforcement Guidelines is a legal question that depends on what the regulator has already obtained independently. A firm cannot make that assessment reliably without external advice; the question is too fact-specific and too consequential to resolve internally.

The third is the factual record of the remedial steps. Remediation that is genuine but poorly documented does not earn the mitigation credit it deserves. Counsel can assist in structuring the remediation narrative so that each step – root-cause analysis, programme improvement, retraining, revised procedures – is documented in a form that maps onto the factor the Enforcement Guidelines are assessing.

The fourth, and in cross-border matters the most frequently missed, is the parallel assessment of non-US obligations. OFSI's reporting obligation, the EU transposition of the criminalisation directive, and the timing of disclosures to multiple regulators are all questions that require legal judgment applied to the specific facts. A representation made to OFAC that is inconsistent with what OFSI is told creates a problem that is very difficult to correct after the fact.

The statute of limitations for civil and criminal violations of IEEPA was extended to ten years in 2024 – verify the current scope and effective date before reliance. That extension materially alters the risk horizon for firms conducting historical transaction reviews. A transaction processed six or seven years ago is not beyond the reach of the current rules in the way it would once have been. Any historical review of transactions touching a sanctions-sensitive counterparty or instrument should be scoped with this longer window in mind.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.