A Canadian trading company receives a Government notice. A payment to an overseas supplier has been flagged. The transaction touched an entity that Global Affairs Canada has designated under the Special Economic Measures Act ("SEMA") – Canada's primary legal instrument for autonomous sanctions. The company's compliance team begins to ask the question every enforcement respondent eventually faces: does how we respond, and what we can show about our conduct, actually change the outcome?
Yes – and materially so. Under Canada's sanctions enforcement regime, administered primarily by Global Affairs Canada ("GAC") with referrals to the Royal Canadian Mounted Police and the Public Prosecution Service where criminal liability is engaged, the facts surrounding a potential violation can significantly affect whether a matter is pursued, and at what level. Mitigation factors in enforcement under Canada rules operate through both prosecutorial discretion and through the broader analytical process GAC applies when assessing an apparent breach. As of April 2026, the applicable country regime does not publish a formal mitigation-factor matrix of the kind that OFAC uses in the United States, but the underlying principles – cooperation, self-disclosure, prior compliance record, and the depth of existing controls – carry equivalent practical weight.
This briefing sets out who administers the regime, the legal basis, the categories of mitigation that apply in practice, how Canada's approach compares with those of the United States and the United Kingdom, and the practical steps a business should take from the moment it identifies an apparent violation.
Who administers Canada's sanctions enforcement regime?
Enforcement authority in Canada is distributed across several institutions, and understanding which body holds the file at any given moment is the first step in managing the response. The primary legislative instruments are SEMA, the United Nations Act (which gives domestic effect to mandatory UN Security Council measures), and the Freezing Assets of Corrupt Foreign Officials Act. GAC administers the sanctions lists and provides interpretive guidance. It does not itself prosecute; it refers cases with apparent criminal elements to the RCMP, which can in turn engage the PPSC.
Administrative engagement – outreach, guidance requests, voluntary disclosure – runs through GAC. Criminal prosecution runs through the PPSC after RCMP investigation. The distinction matters enormously for a business assessing its exposure. An administrative resolution, where available, avoids the stigma and resource demands of criminal proceedings. In our experience, the pathway a matter takes is substantially shaped by whether the company engages GAC early and transparently.
For cross-border businesses, this institutional picture has an important corollary. A Canadian-nexus transaction may simultaneously engage OFAC's jurisdiction – particularly where US-dollar clearing, US-origin goods, or US persons are involved – and OFSI in the United Kingdom where a UK financial institution forms part of the payment chain. The applicable country regimes do not coordinate enforcement decisions, but the factual record a business builds for one authority is read by others. A disclosure to GAC that is internally inconsistent with a position taken before OFAC creates its own risks.
Related practices
- Apparent Violation Assessment (EU) – mapping exposure under EU Council regulations before a formal inquiry begins
- Mitigation Factors in Enforcement: OFAC Explained – how OFAC's published guidelines compare with the Canadian approach
What is the legal basis for sanctions and their enforcement in Canada?
SEMA provides GAC with the authority to recommend that the Governor in Council impose prohibitions and asset-freeze obligations by regulation in response to specified international circumstances. Violation of those regulations constitutes a criminal offence under the applicable country regime. The United Nations Act performs the equivalent function for mandatory UN Security Council resolutions; Canada's obligations under Chapter VII of the UN Charter are implemented through regulations made under that Act, and breach carries criminal consequences on the same basis.
Criminal liability under the Canadian sanctions regime is strict in the sense that proof of intent is not always required to establish the underlying act; however, mens rea – the mental element – remains relevant to the degree of prosecution risk and to the sentencing analysis once liability is established. This is one of the features that makes the early factual investigation so important. A business that can demonstrate it acted in good faith on the basis of a credible screening programme, and that the breach resulted from a process failure rather than a deliberate decision, occupies a materially different position before the RCMP and the PPSC than one that cannot.
The regulations made under SEMA and the United Nations Act impose asset-freeze and dealing-prohibition obligations. They do not, in most cases, create a licensing mechanism as broad as the OFAC general-licence or specific-licence architecture. GAC does issue permits in limited circumstances under the applicable country regime, but the permit process is narrower and less systematised than its US equivalent. Businesses accustomed to seeking an OFAC licence to authorise otherwise prohibited activity must adjust their expectations: the Canadian route is often to seek a permit, to rely on a statutory exception, or to restructure the transaction entirely.
The position above covers the standard case. Your facts – the counterparty, the goods, the payment route, the regime in play – change the analysis significantly. For an initial assessment of a potential Canadian sanctions exposure, contact Calder & Vance at info@caldervance.com.
Which mitigation factors carry weight in Canadian enforcement practice?
Canada does not publish a codified list of aggravating and mitigating factors in the way that OFAC's economic sanctions enforcement guidelines do, but the factors that influence prosecutorial discretion and GAC's referral decisions are well understood by practitioners. They fall into four broad categories, each of which a responding business should address in its internal record and in any communication with the relevant authority.
First, voluntary self-disclosure. A voluntary self-disclosure ("VSD") – a proactive report to GAC or to law enforcement before the authority identifies the breach independently – is the most powerful single mitigant available. It signals good faith, demonstrates that the compliance programme is functioning as a detection mechanism, and frames the matter as a failure of process rather than of intent. In our practice we regularly advise clients to treat the VSD decision as time-critical: the window between internal discovery and potential regulatory detection is finite, and a disclosure loses much of its mitigating value once the authority is already aware of the issue. Has your team assessed whether the disclosure window is still open?
Second, the quality of the existing compliance programme. A business that can demonstrate it maintained a genuine, tested compliance programme at the time of the apparent violation is better positioned than one that relied on ad hoc screening. The relevant indicators are: a written compliance policy calibrated to the applicable country regime; documented screening of counterparties and beneficial ownership chains; staff training with records; and senior-level oversight. Programme quality does not excuse the breach, but it speaks directly to the question of whether the breach was systemic or isolated.
Third, cooperation with the investigating authority. Cooperation encompasses timely and complete responses to requests for information, the preservation of relevant records, and a willingness to engage constructively with the scope of the inquiry. It does not mean waiving legal privilege or making admissions that damage the company's legal position. The line between cooperative engagement and prejudicial disclosure requires legal judgment; acting without counsel in the early stages of a GAC or RCMP inquiry is a common source of avoidable exposure.
Fourth, remediation. Steps taken to prevent recurrence – revised screening procedures, counterparty contract terms, changes to payment routing, enhanced ownership-chain due diligence – demonstrate that the business has internalised the lesson of the apparent violation. Remediation is most persuasive when it is documented, when it pre-dates any enforcement demand, and when it is proportionate to the identified root cause. A generic compliance-policy update is less compelling than a targeted fix that addresses the specific control failure.
How does Canada's mitigation approach compare with OFAC and OFSI?
The practical weight that mitigation carries under the Canadian regime is broadly comparable to its weight under OFAC, but the mechanisms differ in three important respects. Under OFAC's published enforcement guidelines, the agency scores each apparent violation against a matrix of aggravating and mitigating factors and produces a base civil penalty that it then adjusts. The Canadian regime has no equivalent public matrix; the outcome is the product of prosecutorial discretion rather than a published formula. That makes the Canadian process less predictable in its arithmetic but does not make the underlying factors less important.
Under OFSI in the United Kingdom, the monetary penalty regime applies a broadly similar set of considerations – voluntary disclosure, cooperation, the existence of a compliance programme, and remediation. OFSI does publish guidance on its enforcement approach, and that guidance references cooperation and disclosure explicitly. One distinction worth noting: OFSI has a statutory power to impose monetary penalties in its own right without criminal prosecution, and its enforcement guidance indicates that voluntary disclosure is a relevant factor in penalty-level decisions. The Canadian regime channels the comparable decision through prosecutorial discretion rather than a civil penalty mechanism, which means that the decision-maker differs even if the factors are analogous.
Under the EU sanctions regime, enforcement is a matter for each Member State, and the degree of formalisation varies considerably across jurisdictions. Some Member States have developed detailed administrative enforcement procedures; others rely primarily on criminal process. For a business with a European footprint, this heterogeneity means that a mitigation strategy must be calibrated to each national enforcement environment, not to the EU level alone.
The cross-border implication for any business with a Canadian-nexus transaction is therefore this: the facts you assemble for GAC will be read against the frameworks of multiple other authorities. A VSD to GAC that is not accompanied by equivalent outreach to OFAC – where OFAC jurisdiction exists – creates an asymmetry that the US authority may later view unfavourably. We regularly advise clients on coordinating multi-jurisdiction disclosures, precisely because the sequencing and content of each disclosure affects the others.
If a transaction has already been flagged, or if internal review has surfaced an apparent violation, early legal review can preserve options that narrow significantly with time. Contact Calder & Vance at info@caldervance.com for a confidential initial discussion.
What are the principal risk flags that elevate enforcement exposure?
Certain facts aggravate an apparent violation under the Canadian regime and materially increase the risk of active enforcement. Practitioners advising on Canadian enforcement matters identify five patterns that consistently attract closer scrutiny.
Actual knowledge of the designation. If internal records – emails, compliance-team notes, flagged screening hits – show that someone within the organisation was aware of the designated status of the counterparty and the transaction proceeded regardless, the mitigating narrative of a good-faith process failure collapses. In our experience, this is the scenario that most commonly converts an administrative matter into a referral for criminal investigation.
Volume and duration of prohibited dealing. A single inadvertent payment is a fundamentally different situation from a recurring series of transactions with a designated entity over an extended period. Repeated dealing suggests either that screening was not functioning or that it was being disregarded. Both readings are unfavourable.
Benefit received. Where the business derived meaningful commercial benefit from the prohibited transaction, the case for a lenient outcome is weakened. This factor interacts with the remediation requirement: returning any benefit received, or offering voluntary disgorgement, is a step some respondents take to reinforce the sincerity of their remediation.
Third-party harm or systemic risk. Where the violation contributed to a broader harm – for example, by allowing value to reach a designated individual whose designation relates to a financial integrity concern – the public-interest considerations that weigh in the prosecution decision point toward action.
Failure to respond promptly to a prior inquiry. A business that received a request from GAC, responded inadequately, and later faces a further inquiry with the same counterparty in view, is in a weaker position on the cooperation factor than one engaging for the first time. Incomplete or evasive responses to prior regulatory outreach are an aggravating feature that is difficult to reverse.
What is the voluntary self-disclosure process under Canada, and when should it be used?
A VSD is a written voluntary report to the relevant Canadian authority – ordinarily GAC for sanctions matters – disclosing the facts of an apparent violation before the authority identifies it through its own channels. It is not a confession to criminal liability; it is a factual account of what occurred, what controls were in place, and what steps have been or will be taken. The decision to make a VSD, and the content of that disclosure, are legal decisions that benefit from careful preparation.
The timing question is the most consequential one. A VSD made promptly after internal discovery – before any regulatory contact, before the counterparty's situation becomes publicly prominent, and before an industry-wide sweep would surface the transaction – carries maximum mitigating value. A disclosure made after GAC has already identified the transaction and is preparing to make contact carries less. A disclosure made in response to a formal request for information is not a VSD in any meaningful sense; it is a response to an inquiry, which is a different and less favourable position.
The content of the VSD should address the factual narrative of the transaction, the state of the compliance programme at the time, the root cause of the failure, and the remediation steps taken or planned. It should not speculate about legal conclusions, should be accurate in all particulars, and should be reviewed by counsel before it is submitted. Factual inaccuracies in a VSD – even inadvertent ones – can undermine the cooperation narrative that makes the VSD valuable in the first place.
What should a business do in the period between internal discovery and the submission of a VSD? That window is not dead time. It is when records should be preserved, relevant personnel identified, root-cause analysis begun, and the decision on whether to disclose to multiple authorities made. It is also when legal privilege should be established over the internal investigation so that communications are protected from subsequent compelled disclosure.
For guidance on preparing and submitting a voluntary self-disclosure under the Canadian regime, or on managing a multi-jurisdiction disclosure where OFAC or OFSI jurisdiction also applies, contact Calder & Vance at info@caldervance.com.
A common misconception: the myth that Canada's enforcement posture is less demanding than its allies'
A persistent view among some international compliance teams is that Canada's sanctions enforcement is less active than OFAC's and that the consequences of an apparent Canadian-nexus violation are therefore less severe. This is a misconception that our practice encounters with some regularity, and it leads businesses to underweight their Canadian exposure in risk assessments and compliance-programme design.
The Canadian criminal penalties available under SEMA are significant. The absence of a published civil-penalty matrix does not indicate a less serious regime; it reflects a different institutional architecture, one in which criminal prosecution is the primary enforcement mechanism rather than the civil-penalty process that OFAC and OFSI operate alongside their criminal referral powers. A criminal conviction under the applicable country regime carries consequences – including reputational damage, potential debarment from government contracts, and the practical effects of a conviction record – that no well-advised business should treat as a secondary risk.
Moreover, Canada's designation lists have expanded considerably in recent years, and GAC's engagement with the business community on compliance expectations has increased. The relative infrequency of high-profile Canadian prosecutions compared with US enforcement actions does not mean the risk is lower; it means that the enforcement environment is changing, and that businesses that calibrated their programmes to historical enforcement levels may find those programmes insufficient as GAC's activity increases.
The cross-border consideration reinforces this point. Where OFAC jurisdiction also exists – which is common for Canadian businesses that use US-dollar accounts, deal in US-origin goods, or work with US-person counterparties – a matter that begins as a Canadian enforcement concern can rapidly become a US matter as well. In that scenario, the stakes attached to how the Canadian response is handled are multiplied.
See also our analysis of how internal investigations are conducted in the EU regime, which addresses many of the same procedural questions in a different enforcement environment.
When should a business involve sanctions counsel?
The answer, in every case, is earlier than feels necessary. The practical reason is that the decisions made in the first days after internal discovery of an apparent violation – what records to preserve, what to say to whom, whether and when to make voluntary disclosure, how to communicate with GAC – shape every subsequent step in the enforcement response. Reversing an early decision that turned out to be wrong is significantly harder than making the right decision initially.
The threshold for involvement is low. If internal screening has produced a hit that cannot be immediately and confidently cleared; if a counterparty's beneficial ownership chain includes an entity or individual that may be connected to a designated person; if a government inquiry has arrived, however informally framed; or if a transaction has been completed and subsequent information has raised doubts about the status of a party to it – in any of these situations, the appropriate step is to engage counsel before taking further operational action.
In a recent matter, a mid-sized manufacturing exporter identified, through a routine internal review, a series of payments made to a distributor whose indirect shareholder had been added to the applicable country regime's designation list. The company had no actual knowledge of the designation at the time of payment. We scoped the apparent violation, advised on the voluntary self-disclosure decision, prepared the disclosure documentation, and managed GAC's subsequent information requests. The matter was resolved without criminal referral. No outcome of that kind can be promised; the facts of each matter determine the result. What can be said is that early involvement allowed the company to present a coherent, documented, and credible account of its conduct and its compliance programme from the outset.
Our sanctions counsel can assess eligibility for voluntary self-disclosure, prepare and submit the disclosure, and manage the regulator's queries in Canada and, where required, in parallel proceedings before OFAC or OFSI. We regularly advise on the sequencing of multi-jurisdiction disclosures where both GAC and a foreign authority have potential jurisdiction over the same set of facts.