A mid-size trading house with operations across North America identifies, during a routine internal audit, that payments processed over the preceding quarter may have touched a party subject to Canadian sanctions. The compliance team freezes the relationship immediately. The question that follows is not whether something went wrong – it clearly did – but what the business does next, and how quickly.
Remediation after a sanctions breach in Canada is governed by the Special Economic Measures Act ("SEMA") and administered by Global Affairs Canada ("GAC"), which holds primary authority over Canada's autonomous sanctions programmes. Where a breach is identified, the firm faces a tight sequence: scope the violation, preserve evidence, assess voluntary disclosure, and execute a remediation plan that satisfies both GAC and, in cross-border matters, the parallel expectations of OFAC and OFSI.
This case comment walks through one anonymised engagement, identifies the risk flags that were missed before the breach, and draws the practical lessons that apply to any business operating across the Canada-US-UK triangle.
The situation: how a compliant business found itself exposed
The business in question – a Canadian-registered commodity trading firm with US-dollar settlement accounts and a UK-incorporated subsidiary – had maintained a sanctions screening programme for several years. On its face, the programme appeared adequate. Counterparties were screened at onboarding, the firm subscribed to a commercial screening database, and internal compliance sign-off was required for transactions above a defined value threshold.
The gap was structural. The firm screened legal entities at onboarding but did not re-screen when ownership information was updated in its KYC files. A target counterparty had been acquired, during the contract period, by a group in which a listed person held a significant stake. The acquisition was a matter of public record. The firm's screening tool had not been configured to trigger a re-screening event on ownership change. Payments continued to flow.
In our experience, this pattern – initial screening that is technically compliant but static – is among the most common sources of post-onboarding exposure. It is particularly acute in commodity trading, where the underlying goods and the counterparty structure can both shift rapidly. The audit that surfaced the issue was, paradoxically, the result of a programme-refresh project that the compliance team had initiated proactively. That timing proved significant.
The legal basis: what SEMA and GAC require
Canada's autonomous sanctions are imposed under SEMA and, separately, under the United Nations Act for UN Security Council measures. SEMA gives the Governor in Council authority to impose asset freezes, dealings prohibitions, and related measures against designated persons and entities. GAC – specifically its Sanctions Bureau – is the administering authority, responsible for both guidance and enforcement referrals.
The core prohibition under the applicable Canadian sanctions regulations is straightforward: a person in Canada, or a Canadian anywhere in the world, must not deal in property of a designated person, provide financial or other services to or for the benefit of a designated person, or facilitate such a dealing or service. The obligation is extraterritorial in its reach. A Canadian entity transacting through a foreign subsidiary or a non-Canadian bank account does not escape the prohibition.
There is no statutory voluntary-disclosure mechanism under SEMA equivalent to OFAC's formal self-disclosure framework. Canada does not operate a published settlement programme with defined mitigation ranges. GAC's enforcement approach is graduated, referrals to the Royal Canadian Mounted Police ("RCMP") are possible for the most serious matters, and the absence of a formal VSD channel means that the manner and quality of engagement with GAC at an early stage carries significant practical weight. That absence is precisely where cross-border counsel earns its value.
For this matter, the UK subsidiary introduced a second layer of obligation under OFSI's financial sanctions regime, administered under the Sanctions and Anti-Money Laundering Act ("SAMLA") and the relevant thematic regulations. OFSI has a mandatory reporting obligation – a firm that knows or has reasonable cause to suspect that it holds frozen assets, or has breached the regulations, must report to OFSI. The reporting window under the applicable UK regulations is short; verify the current deadline before relying on any stated figure.
What happened immediately after the breach was identified?
The firm took three actions in the first 24 hours that, in our view, materially shaped the outcome. First, it appointed external counsel – both Canadian and cross-border – before making any communication to GAC. Second, it preserved all transaction records, communications, and the KYC files relevant to the counterparty without alteration. Third, it suspended all further dealings with the counterparty and the wider group while scope was assessed.
These steps matter because they are reversible in a way that early disclosure to the regulator is not. Once a voluntary approach is made, the firm has defined the narrative. Doing so without a full picture of the scope, the chain of payments, the jurisdictions touched, and the applicable concurrent obligations across Canada, the UK, and the United States is a significant risk.
The scope exercise revealed a more complex picture than the initial audit had suggested. A total of several payment cycles had touched the affected counterparty. The US-dollar settlement account ran through a US correspondent bank, raising the question – which we regularly advise on – of whether OFAC jurisdiction was engaged on top of SEMA exposure. The answer turned on the nature of the US nexus, the identity of the US persons involved, and whether the underlying goods had any US-origin content triggering the Export Administration Regulations.
Had the firm approached GAC without working through those questions, it risked making disclosures that were accurate for Canada but incomplete or inconsistent relative to what OFAC might later request. That inconsistency, in an enforcement context, is a material aggravating factor.
Cross-border exposure: where Canada, the UK, and OFAC diverge
The three-regime overlay in this matter illustrates a divergence that practitioners see repeatedly in Canada-connected transactions. Each regime has a different threshold test, a different reporting obligation, and a different enforcement culture.
Under SEMA, the prohibition reaches Canadian persons globally and persons in Canada. The ownership-and-control test under Canada's sanctions regulations looks at whether a designated person owns or controls the counterparty; the analysis is contextual and not strictly mechanical in the way OFAC's 50 percent rule (OFAC's rule treating entities owned 50 percent or more by blocked persons as themselves blocked, regardless of control) operates. In this matter, the designated person's stake was below fifty percent but the firm's counsel assessed that control indicators – board composition, contractual rights, economic substance – meant the EU and UK approach to ownership and control would likely capture the entity. The Canadian position was less certain on the same facts.
OFSI, operating under SAMLA, applies an ownership and control test (the UK and EU standard for whether a non-listed entity is caught through a listed person) that encompasses both direct and indirect ownership and a separate control limb. Where the UK subsidiary had transacted with the same counterparty, OFSI's test was the operative one for those flows. The OFSI reporting obligation had a deadline that ran from the point the firm knew or had reasonable cause to suspect. Identifying that trigger date precisely was a critical task, because the clock for the UK obligation did not align with the Canadian audit timeline.
The US nexus added OFAC's secondary-sanctions dimension. Payments settled in US dollars through a US correspondent bank give OFAC jurisdiction even where neither party to the underlying transaction is a US person. That is a point many compliance teams in Canada underestimate. In our cross-border practice, we frequently find that Canadian firms treat their US-dollar payment infrastructure as operationally neutral when, for sanctions purposes, it is anything but.
For a comparative view of how apparent violations are assessed under EU Council regulations, see our discussion of the apparent violation assessment process under EU sanctions. For US-dimension matters involving BIS information requests, the approach we describe in our BIS EAR regulator information request matter is instructive on the documentation expectations that parallel those GAC would apply. The OFAC-specific parallel appears in our OFAC regulator information request matter.
The remediation plan: what was built and why
Once scope was established – a process that took approximately three weeks – the firm's cross-border counsel produced a remediation plan that addressed all three active regimes concurrently. The structure of that plan is worth describing, because it illustrates a sequencing discipline that the firm had not applied before.
The plan had five components. First, a factual record – a chronological account of every transaction, the state of knowledge at each point, and the KYC information available to the compliance team – constructed from contemporaneous documents only, with no reconstructed narrative. Second, a legal analysis memo covering the Canadian, UK, and US positions separately, with a comparison of where they diverged on the ownership question. Third, a disclosure strategy: the decision was made to approach GAC first, because the primary obligation was Canadian, then to address OFSI's reporting obligation within the applicable window, and then – given the US correspondent bank nexus – to assess whether a voluntary self-disclosure to OFAC was warranted on the OFAC-jurisdiction flows.
Fourth, a remediation-of-process report: what had failed in the screening programme and what changes were being implemented. This component is often underweighted by firms in crisis mode, but regulators – including GAC in its informal engagement – consistently signal that demonstrated commitment to systemic fix, not just to explaining the past event, is a significant factor in how they approach a matter. Fifth, a written engagement with the counterparty terminating all business relationships and preserving the firm's position on the enforceability of the underlying contract.
The proactive nature of the discovery – the firm had found this itself, not as a result of regulatory inquiry – was presented to GAC as part of the first engagement. That fact, combined with the quality of the factual record, shaped the tone of the subsequent dialogue. We do not guarantee outcomes, and the outcome of any GAC engagement depends on facts specific to the matter. What we can say, from our practice, is that early, organised, and candid engagement materially differs from reactive engagement prompted by a regulator's own inquiry.
Risk flags: what this matter reveals about systemic gaps
Three risk flags in this matter are common across the businesses we advise. Identifying them before a breach is the purpose of an effective compliance programme; identifying them after is the starting point for a credible remediation.
The first is static screening. The firm screened at onboarding and at certain transaction-value thresholds, but not on ownership-change triggers. In a period when corporate ownership across sanctioned-country exposure has shifted frequently, a programme that does not re-screen on material change events is structurally deficient. What event in your counterparty data model would trigger a re-screening today?
The second is currency-nexus blindness. The use of US-dollar settlement accounts as a matter of commercial convenience, without any analysis of the OFAC jurisdiction that US-dollar clearing engages, is a persistent gap. A Canadian firm that believes it is operating solely under SEMA may in practice be operating under OFAC as well. That is not a point of academic interest; it is an enforcement-risk multiplier.
The third is the absence of a multi-jurisdiction disclosure playbook. This firm had no pre-prepared framework for how to sequence regulatory contacts across three regimes. Building that playbook under pressure – while the clock for the OFSI reporting obligation was running – added cost and created risk. The playbook does not need to be long; it needs to be precise about who contacts which regulator, in what order, and with what initial framing.
A common myth among businesses in this position is that voluntary disclosure will automatically result in a more severe outcome by drawing attention that might otherwise have been avoided. That concern is understandable but usually misplaced. GAC, OFSI, and OFAC all operate graduated enforcement approaches in which the quality and timing of voluntary engagement is an explicit factor. A well-structured disclosure is not a confession that invites maximised penalty; it is a data point about the firm's culture and systemic reliability that regulators weigh accordingly.
When to involve cross-border sanctions counsel
The firm in this matter instructed external counsel within 24 hours of the internal finding. That timing proved to be the most consequential single decision in the entire matter. The alternative – completing an internal investigation first and then approaching counsel – is common and regularly leads to two problems: an internal record that is partially reconstructed rather than wholly contemporaneous, and disclosure decisions made before the full cross-border picture is understood.
There are specific points at which external sanctions counsel adds clear value that internal teams typically cannot replicate. First, at the scoping stage: mapping which regimes are engaged, on what facts, and where the jurisdictional tests diverge requires a cross-border view that most in-house teams do not carry simultaneously. Second, at the disclosure strategy stage: the sequencing and framing of regulatory contacts is a legal judgment, not an administrative task. Third, in producing the factual record and the process-remediation report in a form that satisfies regulatory expectations – which differ between GAC, OFSI, and OFAC.
A fourth point – often missed – is the interaction between sanctions remediation and the firm's trade-finance and banking relationships. Where a firm is in active disclosure to GAC, its correspondent banks may receive separate regulatory inquiries, or may exercise their own de-risking judgments. Coordinating the narrative across the regulatory and commercial relationships simultaneously is work that requires early legal oversight.
Related practices
- Apparent violation assessment – EU sanctions – structured review of potential EU sanctions exposure and enforcement posture
- BIS EAR regulator information request matter – how a US export-control information request was managed and resolved