A multinational treasury team processes a wire transfer through a US correspondent bank. Three weeks later, a compliance alert identifies a possible nexus to a listed entity. Legal asks the question that now controls the company's options: was this an apparent violation, how serious is it, and what must the business do next? The answer determines whether the matter ends with a quiet voluntary disclosure or escalates to a formal enforcement action.
An apparent-violation assessment (the structured internal review a business conducts once it identifies a transaction that may have breached OFAC sanctions) sits at the heart of the US enforcement regime. OFAC – the Office of Foreign Assets Control of the US Department of the Treasury – administers the principal economic-sanctions programme in the United States and, through its extraterritorial reach, affects counterparties worldwide. The assessment process determines whether a voluntary self-disclosure (VSD; a proactive report to OFAC of an apparent violation) is warranted, and the quality of that process directly influences how OFAC exercises its enforcement discretion.
This briefing covers who administers the regime, what triggers an apparent-violation review, how OFAC weighs culpability and disclosure, how the assessment compares with parallel obligations under OFSI and the EU, and when to bring in sanctions counsel.
Who administers the OFAC apparent-violation regime?
OFAC is the primary US authority for administering and enforcing economic sanctions, operating under the authority of statutes including IEEPA and TWEA. It maintains the SDN List (OFAC's list of Specially Designated Nationals and blocked persons), sectoral and other targeted lists, and a body of licensing and enforcement guidance that governs how businesses should respond when a potential breach is identified.
OFAC's Enforcement Division handles apparent-violation matters. It has authority to impose civil monetary penalties, to enter into settlement agreements, and – in coordination with the Department of Justice – to refer egregious matters for criminal prosecution. The Division's published enforcement guidelines describe the factors OFAC weighs when evaluating an apparent violation: whether the person voluntarily disclosed; the nature and severity of the conduct; whether it was wilful or reckless; the harm to sanctions programme objectives; and the adequacy of the company's existing compliance programme.
In our cross-border practice, we consistently advise clients that the enforcement guidelines are not merely procedural guidance. They are a decision tree that OFAC's examiners follow in sequence. Understanding that tree – before OFAC does – is what shapes the outcome. Have you mapped the full enforcement matrix against your specific facts, or only the headline prohibition?
What triggers an apparent-violation assessment?
An apparent-violation assessment is triggered whenever a business has reason to believe that a transaction or activity may have contravened OFAC sanctions – regardless of intent and regardless of whether the transaction was completed. The trigger can arise from internal screening, a bank rejection, a compliance-programme audit, an enquiry from a counterparty, or a subpoena or administrative demand from OFAC itself.
The scope of OFAC's prohibitions is broad. They cover the processing of transactions for, or on behalf of, a blocked person; the provision of services, goods, or funds that benefit a designated individual or entity; the evasion – even inadvertent – of a programme's prohibitions; and any transaction involving property in which a blocked person has an interest. That last element is where the 50 percent rule (OFAC's rule treating entities owned 50 percent or more by blocked persons as themselves blocked, directly or through layered intermediaries) generates the most unexpected exposure. A business may not know it has dealt with a blocked entity until the ownership chain is mapped.
Timing matters acutely. As a general principle, OFAC's enforcement guidelines distinguish between apparent violations that are self-reported promptly and those that come to light only after OFAC has begun its own enquiry. The gap between those two states is significant for the resolution outcome. In our experience, the window between discovery and decision is one of the highest-stakes intervals in any enforcement matter.
How does OFAC evaluate culpability and the role of a compliance programme?
OFAC's culpability analysis distinguishes between egregious and non-egregious cases, and between matters disclosed voluntarily and those it uncovers independently. These two axes – severity and disclosure – together determine the penalty base and OFAC's willingness to settle on favourable terms.
For egregious cases, OFAC's guidelines set the base civil penalty at the statutory maximum per transaction, as amended from time to time under the applicable authorising statute. For non-egregious cases resolved with a VSD, the guidelines provide for a substantially reduced base penalty. The reductions available for voluntary disclosure, co-operation, a strong pre-existing compliance programme, and remedial measures are cumulative. That stacking of mitigants is why the internal assessment process has real financial consequence – not just reputational consequence.
OFAC explicitly evaluates the quality of a company's compliance programme at the time of the violation. A programme that meets the five-element standard OFAC has articulated – senior management commitment, risk assessment, internal controls, testing and auditing, and training – is a mitigating factor. A company that had no programme, or one that was nominally in place but untested, loses access to that mitigation. We regularly advise clients that a compliance programme is not a background document; it is an asset that either works for you in enforcement or does not.
The mid-matter question that general counsel should ask is whether the programme at the time of the violation can be evidenced and credibly described to OFAC. If the answer is uncertain, remediation before a disclosure is filed can itself be a mitigating factor – but it must be genuine and documented.
The position above covers the standard analytical framework. Your facts – the counterparty, the transaction type, the jurisdiction, the state of your programme – change the assessment significantly. For an initial review of apparent-violation exposure under OFAC, contact Calder & Vance at info@caldervance.com.
The voluntary self-disclosure decision: when and how to report
A VSD – a proactive disclosure to OFAC of an apparent violation before OFAC has initiated a formal investigation – is not legally mandated under most OFAC programmes, but the practical incentive to file one is strong. OFAC's enforcement guidelines treat a timely VSD as a significant mitigating factor, capable of substantially reducing the base penalty that would otherwise apply to a non-egregious apparent violation.
The disclosure must be timely, complete, and accurate to attract full credit. Partial or delayed disclosures, or disclosures that omit material transactions, can be treated by OFAC as aggravating rather than mitigating factors. This is one of the reasons the internal apparent-violation assessment must precede the disclosure: a poorly scoped review produces a poorly scoped report, which produces a problem rather than a solution.
A VSD typically includes a factual narrative of the transactions at issue, an analysis of the applicable prohibition, an account of how the violation came to light, and a description of the compliance programme and any remedial steps already taken. OFAC expects the submission to be organised, attorney-reviewed, and complete. It is not a routine compliance filing.
Co-operation after the VSD is filed also matters. OFAC's guidelines treat prompt responses to supplemental requests, proactive sharing of relevant information, and transparency about the scope of the matter as additional mitigants. Conversely, delays or incomplete responses to OFAC queries during the review period are treated as aggravating factors. The matter does not end at filing; it continues until OFAC issues its determination.
Cross-border comparison: how OFSI and the EU approach the same moment
For businesses with operations or counterparties in the United Kingdom or the European Union, an apparent violation under OFAC may simultaneously trigger reporting obligations under OFSI and the relevant EU Council regulations. The regimes do not operate in perfect parallel, and the divergence can catch a cross-border business unprepared.
Under the UK regime, OFSI – His Majesty's Treasury's Office of Financial Sanctions Implementation – administers financial sanctions under the Sanctions and Anti-Money Laundering Act ("SAMLA") and the relevant thematic regulations. Certain persons, including financial institutions, face a mandatory reporting obligation when they know or have reasonable cause to suspect that a person is a designated person or that a breach has occurred. This is a statutory duty, not a discretionary choice. The threshold for triggering it is lower than the OFAC VSD decision – it does not require a completed transaction, only reasonable cause to suspect.
Under the EU regime, the relevant Council regulations similarly impose reporting and freezing obligations on persons who hold or control funds or economic resources of designated persons. The EU ownership and control test (the test for whether a non-listed entity is caught through a listed person) incorporates both a quantitative ownership element and a broader control limb – meaning an entity may be caught in the EU even where the OFAC 50 percent threshold is not crossed.
The practical consequence for a business operating across these regimes is that a single transaction may need to be assessed, disclosed, and remediated under three separate authorities, on potentially different timelines, with different evidence standards. We have acted for businesses where the OFAC VSD timeline and the OFSI reporting window created genuine sequencing decisions that required co-ordinated advice. That is not a problem one should encounter for the first time when an alert has already fired.
If a transaction has already been flagged, or an internal review is underway, an early legal review can preserve options that narrow with time. Contact Calder & Vance at info@caldervance.com to discuss the cross-regime position.
Risk flags: what escalates an apparent violation to an egregious case?
OFAC's egregious-case determination turns on a cluster of factors that the enforcement guidelines treat as aggravating. Understanding them in advance is the difference between a matter that closes with a reduced penalty and one that results in the maximum civil penalty and a public enforcement action.
The principal escalating factors are: wilful or reckless conduct (where the business knew, or had reason to know, that the transaction involved a sanctioned party and proceeded regardless); senior management awareness of or involvement in the violation; harm to sanctions-programme objectives; a pattern of violations rather than an isolated incident; concealment or obstruction; and a compliance programme that was non-existent, inadequate, or knowingly ignored.
Recklessness is the most frequently contested characterisation in our practice. OFAC treats a failure to conduct adequate due diligence – where the risk indicators were present and a reasonable compliance programme would have identified them – as capable of supporting a recklessness finding, even where the business did not subjectively intend to transact with a sanctioned party. That is the area where incomplete screening, shallow ownership-chain analysis, and untested compliance controls cause the most damage.
A myth that appears regularly in cross-border enforcement matters is the belief that, because a transaction was in a non-US currency between two non-US parties, OFAC cannot assert jurisdiction. In practice, the use of US-origin goods, US technology, US-person involvement, or a US correspondent-bank clearing step can each independently ground OFAC jurisdiction. Secondary-sanctions risk – the risk of OFAC designating a non-US party for dealing with a programme target – adds a further dimension. Neither category of exposure disappears simply because the transaction appears, at first view, to have no US element. The ownership-chain and route analysis must be conducted with that jurisdictional perimeter in mind.
What steps should a business take when an apparent violation is identified?
The first priority when a potential violation is identified is to preserve optionality. That means neither confirming nor denying the violation externally, securing the relevant records, and taking no further steps on the transaction in question until the legal position is assessed. A rushed internal response – especially one that results in an incomplete disclosure or a premature communication to OFAC – can convert a manageable situation into a more serious one.
The internal apparent-violation assessment should address at minimum: the factual record of the transaction; the precise prohibition engaged; the applicable programme and any general or specific licences in force; the ownership and control analysis for all counterparties; the state of the compliance programme at the time; and an early view on whether the conduct is egregious, non-egregious, or potentially not a violation at all.
That last category matters. Not every compliance alert represents an apparent violation. OFAC's prohibitions do not apply where a transaction falls within a valid licence, a general authorisation, or a statutory exception. A transaction that initially appears problematic may, on full analysis, be authorised. Running to a VSD before that analysis is complete wastes the benefit of the VSD mechanism and may file a disclosure that was unnecessary – which itself creates a record with OFAC.
The assessment phase is also the moment to evaluate remedial measures. OFAC's guidelines treat prompt, genuine remediation – fixing the control that failed, retraining staff, enhancing the screening logic – as a mitigant. Remediation that begins during the assessment phase and is completed before the disclosure is filed carries more weight than remediation promised in the disclosure but not yet done.
For organisations that discover a pattern of apparent violations rather than a single event, the assessment becomes more complex. OFAC's view of a pattern affects both the egregious-case analysis and the penalty calculation. Scoping a multi-transaction review, sequencing the internal investigation, and deciding whether and how to present a pattern to OFAC are judgment calls that require experienced sanctions counsel.
Related practices
- EU apparent-violation assessment service – counsel on apparent-violation reviews under the EU sanctions regime, including Council-regulation analysis and EU General Court considerations.
- Apparent-violation assessment under OFAC: advanced issues – deeper analysis of egregious-case methodology, multi-transaction patterns, and penalty settlement negotiation.
- Compliance monitorship under the EU sanctions regime – how EU enforcement outcomes interact with monitorship and remediation obligations.