A mid-sized trading company receives a formal notice of apparent violation from the Office of Foreign Assets Control. The transaction in question cleared over a year ago. The compliance team believes the exposure was minor. Three months later, after a misjudged initial response, the penalty base has grown and settlement terms have hardened. Was there a better path?
Penalty defence and settlement under OFAC is a structured, time-sensitive process governed by IEEPA and OFAC's enforcement guidelines. The agency's guidelines set out a specific framework of aggravating and mitigating factors that determine the base penalty and the settlement multiplier. Early, disciplined engagement – particularly a well-prepared voluntary self-disclosure and a credible remediation plan – consistently produces more favourable outcomes than reactive defence.
This case comment examines an anonymised matter in which a cross-border trading business faced an apparent violation determination, traces the decision points that shaped the outcome, and draws the practical lessons that apply to any business managing OFAC enforcement risk as of early 2026.
The situation: how an apparent violation became a formal enforcement matter
An apparent violation under OFAC does not automatically become a penalty. The agency's published guidelines describe a triage process: a matter may be resolved by a no-action finding, a cautionary letter, a civil monetary penalty, or – in the most serious cases – a referral for criminal prosecution. Where a business sits on that spectrum depends heavily on conduct that precedes the formal notice.
In this matter, the business was a diversified trading company with supply chains touching multiple jurisdictions. Its compliance programme had a screening function, but ownership-and-control analysis was not systematic. A counterparty with a blocked person (a person or entity listed on OFAC's Specially Designated Nationals and Blocked Persons list, or SDN List) in its ownership chain had passed through the firm's standard vendor onboarding. The relevant OFAC-administered sanctions programme applies the 50 percent rule (OFAC's rule treating entities owned 50 percent or more in the aggregate by one or more blocked persons as themselves blocked, regardless of whether the entity is separately listed). The counterparty sat precisely within that rule. Multiple transactions had been processed over an extended period before an internal audit surfaced the issue.
The discovery triggered an immediate question: disclose or wait? The business chose to gather more information first. That decision – understandable under pressure, but ultimately costly – compressed the window for a voluntary self-disclosure (VSD, a proactive disclosure to OFAC of an apparent violation before the agency independently discovers it) and reduced the mitigation credit available under OFAC's guidelines. In our experience, this is the single most common error in OFAC enforcement matters: treating the internal investigation as a prerequisite to disclosure rather than running them concurrently.
What is the difference between a voluntary self-disclosure and a penalty response?
A VSD is a disclosure the business makes to OFAC before the agency opens its own investigation, whereas a penalty response is the submission that follows an agency-initiated notice of apparent violation. The two instruments carry different weight under OFAC's enforcement guidelines.
OFAC's guidelines treat a timely and complete VSD as a significant mitigating factor. In practice, it can reduce the base penalty calculation substantially – by a proportion that the guidelines express qualitatively as a meaningful discount. The guidelines also list a series of additional mitigating factors: whether the violation was voluntary (not wilful or reckless), whether the business had a compliance programme in place at the time, whether it acted promptly to remediate, and whether it had a clean prior history with OFAC. These factors are cumulative. A business that discloses promptly, demonstrates a functioning programme, and remediates credibly can reach a very different outcome from one that discloses late or not at all.
In the matter under review, the delayed internal investigation meant that the VSD arrived after OFAC had already received an indirect indication of the exposure from a third-party financial institution's own reporting. OFAC's guidelines treat a VSD submitted after the agency becomes aware of the conduct through other means differently from a genuinely pre-emptive disclosure. The timing reduced – though did not eliminate – the available mitigation credit. This is a point practitioners must be direct about with clients: the window is short, and it does not pause while the internal review is ongoing.
The position between OFAC and its UK counterpart, OFSI (His Majesty's Treasury's Office of Financial Sanctions Implementation), is worth noting here. OFSI's enforcement guidance similarly treats timely self-reporting as a mitigating factor. However, OFSI operates a distinct penalty regime with different statutory maximums and a different procedural track. For a business with UK operations, a VSD to OFAC does not satisfy any UK reporting obligation that may arise independently. The same transaction may require parallel engagement with OFSI. In our cross-border practice, failure to identify this parallel obligation is a recurring source of additional exposure.
The position between OFAC, OFSI, and their UK and EU counterparts also affects the cross-regime read. Where the EU Council regulations apply – for instance, where a European parent company or bank was involved in the transaction chain – an EU-law apparent violation analysis runs independently. EU financial sanctions sit with national competent authorities, and the remediation steps required under EU law do not mirror the OFAC process. The stricter prohibition governs in any given jurisdiction; a resolution with OFAC does not provide cover in the EU or UK unless the facts and the legal bases are carefully mapped.
The position above covers the standard read. Your facts – the counterparty's ownership chain, the goods or services involved, the payment routes, the regimes in play – will alter the analysis materially. For an initial review of your exposure across the relevant regimes, contact Calder & Vance at info@caldervance.com.
How OFAC's penalty calculation works in practice
OFAC calculates the maximum civil penalty on a per-transaction basis, applying a statutory ceiling that varies by the underlying programme and by whether the violation was wilful or reckless. Because the registry of verified figures used for this page does not carry the current programme-specific penalty caps, these are described qualitatively: penalties can be substantial relative to the transaction value and, in aggregate across multiple transactions, can reach figures that are existential for smaller businesses. Verify the current caps against OFAC's published guidelines before relying on any figure.
The guidelines then apply a matrix of aggravating and mitigating factors to derive the settlement amount. Aggravating factors relevant to the matter under review included: the extended duration of the conduct (multiple transactions over more than twelve months); the fact that the counterparty's partially blocked ownership structure was not complex and should have been identified by a diligent screen; and the position of the business as a reasonably sophisticated commercial actor. Mitigating factors included: the absence of any evidence that senior management were aware of the transactions; the genuine – if delayed – co-operation with OFAC's investigation; and the remediation steps taken after discovery.
The business ultimately settled for a civil monetary penalty below the transaction-value-based maximum but above what a timely VSD would likely have produced. The difference – expressed in the settlement record as the gap between the mitigating factors achieved and those that were available – was directly attributable to the delayed disclosure. That gap is the operational lesson.
A second calculation point matters for businesses with parallel BIS exposure. Where the same transaction involves a controlled item under the EAR (the Export Administration Regulations administered by BIS, the Bureau of Industry and Security), the apparent violation may generate a separate BIS referral. BIS and OFAC have different penalty bases, different mitigating frameworks, and different timelines. A coordinated, multi-agency disclosure strategy is more effective than sequential, reactive responses to each authority. We regularly advise businesses on this coordination question, and it is consistently underweighted in the early stages of a matter.
Risk flags: what made this matter harder than it needed to be
Several specific factors compounded the difficulty in this matter. Each is common in cross-border trading businesses and worth examining as a checklist against your own programme.
First, the screening tool covered direct SDN matches but did not systematically apply the 50 percent rule to indirect ownership. A counterparty owned 50 percent or more by a blocked person is treated as blocked under OFAC's rules even if the counterparty is not separately listed. Screening tools vary in how they handle this; many do not aggregate indirect holdings automatically. The result is a gap that looks like a functioning compliance programme from the outside but leaves a material exposure undetected.
Second, the business had no documented process for handling a potential match escalation. When the internal audit raised the counterparty flag, there was no defined owner, no defined timeline, and no defined criterion for when to escalate to legal counsel. The internal investigation proceeded informally and slowly. In a matter where OFAC's guidelines treat promptness as a mitigating factor, an undisciplined internal process costs money directly.
Third, the business's initial response to OFAC – prepared without external sanctions counsel – acknowledged the factual position but framed the compliance programme in terms that were difficult to sustain under scrutiny. OFAC's guidelines look for a genuine, functioning programme. A response that overstates the programme's pre-existing effectiveness tends to undermine the credibility of the remediation narrative, which is often the strongest mitigation lever available at the penalty stage.
Fourth, the business had not considered whether any general licence (a standing authorisation that permits a defined category of transactions without a separate application) might have authorised part of the conduct. General licences under the relevant programme permitted certain narrow categories of transactions. A thorough general-licence review at the time of discovery can sometimes reclassify apparent violations as authorised conduct – reducing the transaction count that forms the penalty base. This review was not conducted until late in the matter, after OFAC had already framed its penalty calculation.
If a transaction has already been flagged, or an internal audit has surfaced a potential apparent violation, early external review can preserve options that narrow with each passing week. Contact us at info@caldervance.com for a confidential assessment.
The route to settlement: what the process looked like and where counsel made a difference
OFAC's settlement process begins with the agency issuing a pre-penalty notice or opening a formal civil enforcement investigation. The business then has an opportunity to submit a written response. That response is not merely a factual record; it is a structured advocacy document that presents the mitigating factors, the remediation steps, and – where appropriate – the general-licence analysis in the form most likely to move the agency toward a lower settlement figure.
In the matter under review, external counsel was engaged after the initial response had already been submitted. That placed the defence at a disadvantage: the initial submission had created a factual record that could not be easily retracted, and the tone of the initial submission had signalled a degree of uncertainty about the compliance programme that coloured OFAC's early assessment.
The subsequent strategy had three components. First, a full ownership-chain analysis was conducted to map precisely which transactions were captured by the 50 percent rule and which, on closer analysis, were not – because the blocked person's aggregated indirect ownership fell below the threshold on certain transaction dates. This reduced the transaction count. Second, a comprehensive remediation plan was documented and submitted, demonstrating specific programme enhancements: a revised screening protocol that aggregated indirect ownership, a defined escalation procedure, and a training record. Third, the settlement submission presented a clear narrative on the absence of wilfulness: the compliance programme had a genuine – if incomplete – design, and there was no evidence that any individual knowingly facilitated a prohibited transaction.
The matter settled. The settlement figure reflected partial mitigation. The experience confirmed a pattern we have seen consistently: the value of experienced sanctions counsel is highest in the period between discovery and the first submission to OFAC, not after the initial response has already been filed.
Cross-border enforcement risk: how OFSI and EU regulators interact with an OFAC settlement
An OFAC settlement does not release a business from obligations under other regimes. Where the same facts engage UK financial sanctions under the Sanctions and Anti-Money Laundering Act (SAMLA, the UK's framework statute for sanctions designations and regulations), the business may have a separate reporting obligation to OFSI. OFSI's enforcement guidance makes clear that a settlement with a foreign regulator is not a mitigating factor in itself – what matters to OFSI is whether the business reported to OFSI promptly, co-operated with OFSI's own review, and remediated within the UK entity.
In the matter under review, the UK parent entity had routed payments through a correspondent bank. The correspondent bank had its own OFSI reporting obligations. Where the correspondent bank's own compliance team identified the exposure and reported to OFSI independently, the UK parent's failure to self-report became an aggravating factor in the UK analysis rather than a neutral one. This interaction – where the bank's obligation runs ahead of the client's awareness – is a risk that cross-border businesses often underweight. We advise clients to assume that any bank in the payment chain is independently screening the same counterparties and may report independently. Plan accordingly.
Under EU Council regulations, the position differs again. The EU operates through national competent authorities rather than a single federal regulator. Where a European subsidiary processed any of the transactions, the relevant national authority in that member state had jurisdiction over the EU-law apparent violation. A co-ordinated cross-border response – covering OFAC, OFSI, and the relevant EU national authority – requires a mapped strategy, not three separate reactive submissions.
For businesses with operations in Singapore, Japan, or the UAE, parallel obligations under those regimes' applicable country frameworks may also be engaged. In our practice, the most effective cross-border enforcement responses treat the multi-regime mapping exercise as the first step, completed before any submission is made to any single authority.
What this means for a business facing a similar situation today
The operational lessons from this matter reduce to a short decision sequence. The sequence applies whether a business has just discovered an apparent violation or has already received an OFAC notice.
Step one: preserve and secure all records relating to the transaction or transactions in question. Do not delete, overwrite, or modify records. This step is not discretionary; it is a legal obligation once litigation or regulatory review is foreseeable.
Step two: map the ownership chain of the counterparty as at the date of each transaction. The 50 percent rule applies at the time of each transaction, not at the time of discovery. If ownership changed over the transaction period, the analysis differs by date.
Step three: identify all potentially applicable regimes – OFAC, OFSI, the relevant EU national authority, and any other jurisdiction whose sanctions rules were engaged by the payment route, the parties, or the goods. Do this before making any submission to any authority.
Step four: assess whether any general licence authorised any part of the conduct. A general-licence review can reduce the transaction count that forms the penalty base. This step is frequently skipped under time pressure and frequently produces a material result.
Step five: decide the disclosure strategy on a fully informed basis. A VSD to OFAC, if the window is still open and the facts support it, is almost always the better path. The decision must be made with legal advice, not deferred while the internal review concludes.
Step six: if any external submission has already been made, ensure that all subsequent submissions are consistent with the factual record already created. Inconsistency between an initial response and a subsequent remediation submission is one of the factors that erodes credibility with OFAC.
A common misconception at this stage is that the penalty outcome is already determined once an apparent violation notice has been received. It is not. The enforcement guidelines leave substantial room for mitigating factors to move the settlement figure. What matters is whether those factors are presented clearly, documented, and credible. That is the function of a well-prepared enforcement response.
Related practices
- Apparent violation assessment – EU – assessing EU apparent violations and structuring the response to national competent authorities
- Penalty defence and settlement – OFSI matter – how a comparable OFSI enforcement matter was handled and what it revealed about UK regime differences
- Post-breach enforcement risk – BIS/EAR matter – managing parallel BIS exposure where the same transaction engages US export controls