A mid-sized financial institution operating across multiple jurisdictions discovers, during a routine internal audit, that a small number of transactions over a prior period may have touched a blocked party's account. The amounts are not large. The underlying relationship was not flagged at the time. Nobody acted with obvious intent. Yet the institution's legal team knows the question that now matters most: does OFAC need to hear about this before it finds out another way?
A voluntary self-disclosure (VSD) – a proactive report to the Office of Foreign Assets Control disclosing an apparent violation before the regulator identifies it independently – is one of the most consequential decisions a sanctioned-party matter can produce. As of early 2026, OFAC continues to treat timely, accurate, and complete VSD as a significant mitigating factor in penalty determinations, with the potential to reduce a civil penalty base substantially. The decision to disclose, and how the disclosure is structured, can be the difference between a no-action letter and a formal enforcement outcome.
This case comment walks through an anonymised engagement involving a cross-border financial institution, the VSD analysis it faced under OFAC's rules, the steps taken, and the lessons that apply to any business that finds itself in the same position.
The situation: what the internal review uncovered
An internal compliance review identified a pattern of transactions, processed over a multi-month window, that had not been flagged by the institution's automated screening system at the time they were executed. Post-review analysis suggested that a beneficial owner of one counterparty account appeared on OFAC's SDN List (the Specially Designated Nationals and Blocked Persons List – OFAC's primary list of individuals and entities whose property must be blocked and with whom transactions are generally prohibited). The transactions had been processed because the listed name appeared in a transliterated form that the firm's screening tool did not match against the List.
The institution faced a set of questions that, in our experience, arise in almost every VSD engagement: Were the transactions actually prohibited? Was the beneficial-owner link sufficient to trigger the 50 percent rule (OFAC's rule treating entities owned 50 percent or more, in aggregate, by blocked persons as themselves blocked)? Had the institution dealt with a blocked party or merely with a counterparty that had some connection to one? And how quickly did a decision on disclosure need to be made?
None of these questions had clean answers at the point of discovery. That ambiguity is normal. It does not suspend the clock.
The legal question: is this an apparent violation, and must it be disclosed?
OFAC does not impose a general statutory obligation to self-disclose every potential compliance failure. The decision to disclose is, in that formal sense, voluntary. However, OFAC's enforcement guidelines make the incentive structure explicit: a timely and complete VSD is treated as a significant mitigating factor, and its absence – particularly where OFAC learns of the violation through another channel – can be treated as an aggravating factor.
The first analytical step in the engagement was to determine whether an apparent violation existed at all – that is, a transaction or conduct that, on the available facts, appears to have violated OFAC's prohibitions, even if intent or knowledge is not established. OFAC's penalty framework applies to apparent violations; culpability is assessed separately and affects the penalty calculation, not the threshold question of whether a violation occurred.
In this matter, we assessed the beneficial-owner structure against the 50 percent rule. The blocked individual held a stake in the counterparty below the 50 percent threshold on a direct basis. But a second related entity, also associated with the same individual, held an additional interest. Aggregated, the combined stake crossed the threshold. The counterparty was therefore itself a blocked person under OFAC's rules, regardless of whether it appeared on any list by name. The transactions were apparent violations.
That conclusion resolved the disclosure question. A business that has identified an apparent violation and then chooses not to disclose does not thereby avoid OFAC's jurisdiction. It simply loses the mitigating credit that VSD provides – and, if the matter surfaces later, the absence of disclosure becomes part of the record.
How the voluntary self-disclosure was structured
A VSD to OFAC is not a notification letter. It is a carefully structured submission that serves several purposes simultaneously: it demonstrates the institution's good faith; it provides OFAC with a factual basis for its penalty assessment; and it sets out the remediation the institution has already taken or is committed to taking. The quality of the submission directly affects the outcome.
For this institution, the submission process involved four distinct phases.
First, a complete transaction review covering the relevant period. The institution needed to identify every payment that touched the blocked beneficial ownership chain – not only the transactions already identified in the audit, but any that a thorough review might surface. Submitting a VSD and having OFAC identify additional transactions not included in the submission creates a substantially worse position than including them from the outset.
Second, a root-cause analysis. OFAC's guidelines assess whether a violation reflects a systemic failure or an isolated gap. The institution's screening tool had a documented limitation in handling transliterated names. That limitation needed to be described accurately, with an explanation of why it existed and how it had been addressed. Minimising or omitting the root cause is a significant tactical error in VSD submissions.
Third, a remediation plan. The institution had already updated its screening logic and was implementing enhanced beneficial-ownership due diligence. These steps were documented and included in the submission. Remediation that is completed before or at the time of the submission carries more weight than remediation described as planned.
Fourth, a careful presentation of the mitigating factors under OFAC's enforcement guidelines – including the voluntary nature of the disclosure, the absence of intentional conduct, the institution's prior compliance history, and the cooperation offered. These factors are not simply listed; they are demonstrated by the quality and completeness of the submission itself.
The position above covers the standard case. Your facts – the counterparty structure, the goods or services involved, the jurisdictions in play, and the size and duration of the apparent violation – change the analysis significantly. For an assessment of your exposure under OFAC's enforcement regime, contact Calder & Vance at info@caldervance.com.
The cross-border dimension: OFSI and the EU
A question that arose early in this engagement, and that arises in virtually every matter of this kind, was whether the VSD to OFAC was the only disclosure required. The institution had operations in the United Kingdom and in an EU member state. Were there parallel obligations to OFSI or to the competent authority in the relevant EU jurisdiction?
The answer turned on two separate analyses.
Under the UK regime administered by OFSI (the Office of Financial Sanctions Implementation), there is a statutory reporting obligation that applies to certain regulated entities when they have knowledge or reasonable cause to suspect that a person is a designated person or has committed an offence under the financial-sanctions rules. This is not a voluntary regime in the same sense as OFAC's VSD framework. It is a mandatory reporting obligation with its own trigger, scope, and timeline. Whether the obligation was engaged in this matter depended on whether the institution held relevant information and whether it met the threshold for the statutory trigger.
Under the EU regime, the position varies by member state, because enforcement of EU financial sanctions is handled at the national level. The relevant national competent authority's reporting rules applied. In our cross-border practice, we find that clients frequently underestimate this divergence. An institution that resolves its OFAC position carefully may still face unresolved obligations in London or Brussels if the multi-jurisdiction picture is not mapped from the outset.
There is also a secondary-sanctions dimension. Where a non-US institution is involved in an apparent OFAC violation, the US may have jurisdiction by virtue of the US-dollar denomination of the transactions, the use of US correspondent banking, or other US-nexus factors. That jurisdictional question must be assessed before the disclosure strategy is fixed. Disclosing to the wrong regulator, or disclosing to one regulator without assessing whether another has jurisdiction, can produce an incomplete resolution.
If a transaction has already been flagged, or a filing has been refused, an early review can preserve options that narrow with time. To discuss a disclosure strategy across multiple regimes, contact us at info@caldervance.com.
What the resolution produced – and what it did not guarantee
The institution received a response from OFAC acknowledging the VSD and, following review, issued a no-action outcome on the apparent violations disclosed. That outcome reflected the combination of factors present: the voluntary and timely nature of the disclosure, the absence of intentional conduct, the strength of the remediation, and the completeness of the submission itself.
We state this without reservation: a no-action outcome is not guaranteed by a well-prepared VSD. OFAC retains full discretion over its enforcement decisions. The penalty guidelines set out the factors that bear on the assessment; they do not constrain the outcome. A VSD can, in other matters on different facts, still result in a civil penalty, a cautionary letter, or a finding of violation. What VSD does is place the institution in the best available position to receive credit for its conduct.
In our experience, the most significant variable is not the quality of the prose in the submission. It is the completeness of the underlying factual investigation. Institutions that submit before they have finished their transaction review, or that revise the disclosed scope upward after the initial submission, face a materially harder path. OFAC's guidelines treat the completeness and accuracy of the initial disclosure as independent indicators of good faith.
Risk flags: what goes wrong in voluntary self-disclosure matters
Across the VSD matters we have handled, a small set of failure points recurs with enough consistency to deserve direct treatment.
The first is delay in beginning the legal analysis. A business that discovers a potential apparent violation and spends the next several weeks trying to resolve the factual picture internally – without legal analysis running in parallel – compresses the time available to structure the disclosure carefully. The factual investigation and the legal framework need to proceed together, not sequentially.
The second is incomplete ownership and control mapping. The 50 percent rule catches aggregated indirect holdings, not only direct named-entity hits. A business that maps only the first layer of ownership – checking whether the counterparty itself appears on the SDN List – will miss exactly the pattern that was present in this matter. Screening tools are not a substitute for a legal ownership analysis on the facts.
The third is treating the VSD as the end of the matter. Once a VSD is submitted, OFAC may have follow-up questions, may request additional documentation, or may take time to respond. The institution needs to remain in a position to respond accurately and promptly throughout the process. Internal communications about the apparent violation, created after the VSD is filed, can be significant. They should be produced under legal-privilege considerations from the outset.
The fourth is failing to address parallel obligations. A VSD to OFAC does not discharge obligations under OFSI's mandatory reporting regime, under EU competent-authority rules, or under anti-money-laundering requirements that may have been separately triggered by the same underlying facts. Each obligation runs on its own clock and has its own scope.
What about the myth that a small apparent violation is not worth disclosing? This is one of the most persistent misconceptions we encounter. OFAC's penalty guidelines assess the harm of the violation, but the decision to disclose is not made after calculating the expected penalty. It is made in the face of uncertainty about whether OFAC will ever learn of the matter and, if it does, what position the institution will then be in. A small violation disclosed promptly is a contained compliance event. The same violation discovered by OFAC through a correspondent bank's report, a regulatory examination, or a counterparty's own disclosure, becomes something else entirely.
Related practices
- Apparent Violation Assessment – EU – assessing apparent violations under EU sanctions and advising on disclosure obligations to national competent authorities.
- Apparent Violation Assessment – Australia Guide – a step-by-step overview of how apparent violations are handled under Australia's autonomous sanctions regime.
- Apparent Violation Assessment – BIS / EAR Guide – guidance on assessing and disclosing apparent violations under the US Export Administration Regulations.