A multinational trading group receives a letter from OFAC. It is brief. It requests documents, transaction records, and details of counterparty relationships within a defined window. The compliance team reads it twice. Nobody is quite sure how much to provide, how far back to go, or whether a voluntary self-disclosure has already become unavoidable. The clock is running.
Responding to an OFAC regulator information request requires a calibrated, disciplined approach: scope the apparent violation first, assess privilege and confidentiality before producing anything, and treat every word of the response as a statement to a federal enforcement authority. In our cross-border practice, the businesses that manage these matters well are those that treat the first letter as the start of a legal proceeding – because it is.
This case comment walks through one such matter, following it from the initial request to resolution. It examines the legal context under OFAC, the cross-regime dimensions that arise when a business operates across US, UK, and EU sanctions regimes simultaneously, and the practical lessons that apply to any business that could face a similar information demand.
The situation: an information request from OFAC arrives
OFAC may issue an information request as part of a routine compliance review, a transaction-specific inquiry, or a pre-penalty investigation into an apparent violation. Each category carries different stakes, and the framing of the initial letter does not always make the distinction plain.
In this matter, a mid-size European-headquartered business with a US-incorporated subsidiary received a formal OFAC request for information relating to a series of payments processed through its US accounts over a period of approximately eighteen months. The payments involved counterparties in a jurisdiction subject to a comprehensive OFAC programme. No penalty notice had been issued. No prior contact had occurred. The letter arrived without warning.
The business's first instinct was to compile everything and respond promptly. That instinct, while understandable, is precisely the mistake most likely to convert a manageable inquiry into a formal enforcement action. What you say in the first response – and what you choose not to say – can define the trajectory of the entire matter.
We were engaged within forty-eight hours of the letter arriving. The first task was not to draft a response. It was to scope what had actually happened.
What is OFAC's legal authority to demand information?
OFAC derives its authority to conduct investigations and demand information from statutory powers under IEEPA and, where applicable, TWEA. These instruments give OFAC broad authority to investigate potential violations of US sanctions programmes and to compel the production of records relevant to that investigation.
The practical consequence is significant. Providing false or misleading information to OFAC – including selective omissions – can itself constitute a violation. The response obligation is not simply about producing documents; it is about producing them accurately, within scope, and in a manner that does not create secondary liability.
Privilege is a live issue in virtually every OFAC matter. Attorney-client communications and work product prepared in anticipation of litigation may be withheld from production, but the privilege analysis must be conducted carefully and documented. In our experience, businesses that have not established clear legal privilege over their internal compliance investigations before the letter arrives are in a materially weaker position when the letter does arrive.
There is also a separate question about the scope of the request itself. OFAC requests are frequently drafted broadly. The business has a legitimate interest in understanding whether the scope is proportionate to the stated purpose of the inquiry. Engaging with OFAC on scope – professionally, promptly, and without evasion – is sometimes appropriate. It is a step that requires legal judgment, not a unilateral decision by the compliance team.
How does this differ under OFSI, the EU, and other regimes?
A business that faces an OFAC inquiry but also holds a UK nexus or EU operations will simultaneously be subject to reporting and cooperation obligations under OFSI and under the relevant EU Council regulations. These obligations are not identical, and they can pull in different directions.
Under OFSI, a person who knows or suspects that they hold frozen assets, or that a person has committed an offence under the relevant UK financial-sanctions regulations, is subject to a reporting obligation. The reporting window under OFSI is short – verify the current position before relying on specific timelines – and the obligation arises independently of any US regulatory contact. In our cross-border practice, we regularly advise businesses that receive an OFAC letter to assess their OFSI reporting position on the same day, not as a secondary step.
The EU position adds a further layer. Under the relevant Council regulations, designated persons and their assets are subject to distinct freeze and reporting obligations in each EU member state where assets are located. An EU-based parent of a US entity that receives an OFAC inquiry may have independent notification or reporting obligations to the competent authority in its home member state.
This divergence matters for a practical reason. If the US matter involves an apparent violation of EU sanctions as well – not uncommon where the underlying transaction has a EU nexus – the business faces the question of sequencing: which regulator do you contact first, and what do you say to each, without inadvertently making admissions in one jurisdiction that prejudice the other? There is no universal answer. The sequencing decision depends on the facts of the matter and the relative severity of exposure in each regime. It is, however, a decision that must be made deliberately and with legal oversight.
The position is different again for a business with exposure in Singapore, Japan, or the UAE. Those regimes impose cooperation obligations under their own instruments, but the enforcement posture and the consequence of non-cooperation vary materially. A business with significant operations across these regimes should map the interaction before responding to the lead regulator.
The standard that governs across all of them is the same: when stricter prohibition governs, that prohibition applies, and a licence or permission under one regime does not provide cover under another.
The response strategy: scope, privilege, and sequencing
The response to an OFAC information request is a legal document. It should be prepared by, or at minimum reviewed by, experienced sanctions counsel. Treating it as an administrative task – drafting it internally without privilege protection, producing documents before their scope has been reviewed – is one of the most common and most consequential errors we see in this practice.
In this matter, the response strategy was built in four stages.
The first was to scope the apparent violation independently, before any response was drafted. This meant tracing the payments identified in the OFAC request back through the business's own records, confirming the counterparty relationships, establishing whether any general licence might have applied at the time of the transactions, and assessing whether the conduct fell within the relevant programme's prohibitions.
The second was to conduct a privilege review. All internal communications touching the transactions in question were assessed for privilege. Those that qualified were identified, documented, and withheld from production. A privilege log was prepared.
The third was to consider whether the facts identified in the scoping exercise pointed toward a voluntary self-disclosure (a proactive disclosure to OFAC of an apparent violation, made before OFAC has opened a formal investigation). Where VSD is appropriate, it is among the most significant mitigants available under OFAC's enforcement guidelines. The timing matters: once OFAC has contacted the business, the window for a pre-investigation VSD may have closed or narrowed, but the analysis remains relevant to the posture of the response.
The fourth was to draft the substantive response. This addressed each element of OFAC's request precisely, neither under-producing (which invites follow-up and implies concealment) nor over-producing (which volunteers information outside the scope of the request and can expand the inquiry). Every factual statement in the response was verified against the underlying documents before it was submitted.
Risk flags: what escalates an OFAC inquiry into a penalty action?
Not every OFAC information request results in a penalty notice. Many are resolved by a thorough, accurate, and timely response that demonstrates good-faith compliance. But certain patterns escalate the matter, and understanding them is the heart of an effective defence strategy.
The first is delay. OFAC sets response deadlines, and failure to meet them – without having sought and obtained an extension – is itself an aggravating factor. In our experience, extensions are usually available if requested promptly and with a substantive explanation. A business that misses a deadline without explanation has handed OFAC an additional issue.
The second is inaccuracy. A response that contains errors – whether because the business's records are poor, because the response was drafted without adequate document review, or because someone on the team made an optimistic factual judgment – becomes a problem that compounds. OFAC can and does treat inaccuracies in responses as evidence of a broader failure of compliance culture.
The third is scope-creep in the production. Businesses that produce documents outside the scope of the request, or include internal commentary that was not privileged and not reviewed, routinely give OFAC more to investigate. The initial inquiry, which might have closed at the response stage, reopens around the newly disclosed material.
The fourth is the absence of a compliance story. OFAC's enforcement posture responds positively to evidence of a genuine compliance programme: trained staff, documented screening procedures, risk-based controls, and a management culture that takes sanctions obligations seriously. A business that cannot point to any of these elements – or that can point to them on paper but cannot demonstrate they were working in practice – is in a different position from one that can show the apparent violation was an isolated breakdown in an otherwise effective programme.
Has your business conducted a table-top exercise against an OFAC information request? If not, the first time you test the process should not be when a real letter arrives.
How the matter resolved
In this matter, the scoping exercise confirmed that a small number of the transactions in OFAC's identified window did constitute apparent violations of the applicable comprehensive programme. The majority of the transactions in the request were permissible under an applicable general licence that had been in force at the relevant time and which the business had not documented correctly at the point of transaction.
The response package submitted to OFAC addressed the full scope of the request. It identified the apparent violations clearly and provided context: the transactions were isolated, the business had no prior enforcement history, remediation had been implemented, and the compliance programme had been redesigned and retested since the period in question. A VSD analysis was included as part of the cover letter.
OFAC's response, received several months after the initial letter, did not result in a civil monetary penalty. The matter was resolved through a no-action outcome. No guarantee of that outcome existed at the outset, and the same facts presented differently – or without legal preparation – could have produced a different result. What the outcome reflected was a documented good-faith engagement with the regulator's concerns, accurate and complete disclosure, and a credible remediation narrative.
The position above covers the standard trajectory of an OFAC information-request matter. Your facts – the transactions involved, the programme in question, the business's history, the cross-regime exposure – will change the analysis materially.
If a transaction has already been flagged, or a filing has been refused, an early review can preserve options that narrow with time. Contact Calder & Vance at info@caldervance.com for a confidential assessment.
The lesson: what similar businesses should do now
An OFAC information request is not the beginning of the problem. It is the moment at which an existing problem becomes visible to the regulator. The businesses that manage these matters best are those that have invested before the letter arrives: in documented screening procedures, in privilege-aware compliance investigations, and in a legal relationship with experienced sanctions counsel who can be reached quickly.
The specific lesson from this matter is about documentation. The majority of the transactions in the OFAC request were permissible – but the business could not demonstrate that at the point they occurred, because the general licence analysis had never been written down. In enforcement terms, a transaction that was lawful but undocumented is materially more difficult to defend than one that was lawful and recorded. Documentation is not bureaucracy. It is the difference between a no-action letter and a penalty.
A second lesson concerns the cross-regime dimension. In our experience, businesses that focus narrowly on the US regulatory exposure and fail to assess the OFSI or EU position concurrently create sequencing risks. Responding fully to OFAC before assessing whether doing so is consistent with obligations under another regime is a mistake that cannot easily be reversed once the production has been made.
A myth worth correcting at this stage: some businesses believe that because OFAC has not issued a penalty notice, the matter is not serious. In practice, an information request from OFAC is a significant enforcement signal. The absence of a penalty notice at the outset means only that OFAC has not yet decided whether to issue one. The decision will be shaped, in meaningful part, by the quality of the response.
We have acted for businesses at every stage of an OFAC inquiry – from the first letter through to a settlement or no-action outcome. The consistent pattern is that earlier engagement with specialist sanctions counsel produces better outcomes.
Related practices
- EU apparent violation assessment – assessing the strength of an EU sanctions enforcement position before formal proceedings
- Voluntary self-disclosure: an Australia matter – how a proactive disclosure shaped the outcome in a cross-border enforcement context