A compliance officer at a mid-size trading house receives an OFAC pre-penalty notice on a Tuesday morning. The notice runs to forty pages. The dollar figure cited is material. The team has ten business days to decide whether to contest, settle, or escalate. What happens next – and what was done in the months before that notice arrived – will determine whether the matter ends with a reduced settlement or a final penalty that generates a public enforcement release.
Penalty defence and settlement under OFAC rules operate through a structured administrative process governed by IEEPA and the relevant programme regulations. OFAC issues a pre-penalty notice (a preliminary finding of an apparent violation), the respondent responds in writing, and OFAC either issues a final penalty, converts the matter to a cautionary letter, or – in most settled cases – agrees a reduced civil monetary penalty. The outcome turns on the strength of the factual and legal record assembled before and during that process, including whether a voluntary self-disclosure (VSD – a proactive report to OFAC before the agency identifies the violation independently) was filed.
This briefing covers the authority and legal basis, the enforcement sequence step by step, the factors OFAC weighs in setting penalties, the role of VSD and cooperation, the cross-regime dimension for businesses facing parallel proceedings, common risk points, and when to involve sanctions counsel.
Who administers OFAC enforcement, and what is the legal authority?
OFAC – the Office of Foreign Assets Control, a bureau of the US Treasury Department – administers all civil enforcement of US economic sanctions. Its authority derives principally from IEEPA and, for the oldest programmes, TWEA. Each sanctions programme is implemented through programme-specific regulations that sit under those parent statutes.
OFAC's enforcement framework is also shaped by its published guidelines on the economic factors that determine penalty amounts. Those guidelines are publicly available and form the backbone of any penalty defence. They set out two tracks: egregious cases, where OFAC calculates a penalty closer to the statutory maximum per transaction, and non-egregious cases, where the base penalty is substantially lower. Understanding which track applies to your facts is the first decision in any defence.
OFAC has jurisdiction over US persons, US-incorporated entities and their foreign branches, and – critically – any transaction that touches the US financial system or US persons, regardless of where the transacting parties are domiciled. That extraterritorial reach is what makes OFAC enforcement a concern for European, Asian, and Middle Eastern businesses with any dollar-denominated activity.
What is the OFAC enforcement sequence?
The enforcement sequence begins before OFAC contacts you: it begins when a potential violation occurs or is discovered. The sequence in outline is as follows.
- Potential violation identified. A business discovers, through its own screening, an internal audit, or a bank's transaction-monitoring alert, that a payment or transfer may have involved a sanctioned party or destination.
- Voluntary self-disclosure decision. If the business elects to file a VSD, it must do so promptly – before OFAC independently identifies the conduct. A VSD, if accepted, halves the base penalty calculation in non-egregious cases under OFAC's published guidelines.
- OFAC review. OFAC reviews the submission (or initiates its own inquiry). It may request additional information. This phase can last months or, in complex matters, longer.
- Pre-penalty notice. If OFAC concludes that a civil monetary penalty is warranted, it issues a pre-penalty notice setting out the apparent violation, the proposed penalty amount, and the factual basis. The respondent has 30 days (or 60 days in egregious matters, verify before reliance) to respond in writing or to request a meeting.
- Response and negotiation. The respondent submits a written response contesting the facts, the legal basis, the penalty calculation, or all three. In practice, most matters that do not convert to a cautionary letter result in a negotiated settlement at this stage.
- Final penalty or settlement. OFAC issues a final penalty notice or enters into a settlement agreement. Settled matters are routinely published as enforcement releases. Cautionary letters are not published.
In our experience, the response to the pre-penalty notice is the single most consequential document in the process. It is the opportunity to put the full mitigation record before the agency. A poorly framed response – one that is legally defensive but factually thin – rarely produces the best outcome.
How does OFAC calculate the penalty, and what factors does it weigh?
OFAC's penalty calculation is not arbitrary. The agency applies published guidelines that assess aggravating factors and mitigating factors to arrive at an appropriate civil monetary penalty. Understanding these factors is the core task of any penalty defence.
Aggravating factors that can push a penalty toward the statutory maximum include: wilful or reckless conduct; management awareness of or involvement in the violation; harm to US sanctions programme objectives; the sophistication of the respondent; and a pattern of prior violations.
Mitigating factors – those that press the penalty downward – include: a timely and complete VSD; cooperation with the investigation; the existence and quality of a compliance programme at the time of the violation; a remediation programme put in place after discovery; and the respondent's absence of prior violations. OFAC has indicated that a qualitatively strong compliance programme is itself a mitigating factor, even if it did not prevent the violation in question.
The most powerful mitigation tool, in most non-egregious matters, is a VSD filed before OFAC has independently identified the conduct. The published guidelines provide for a 50 percent reduction to the base penalty in non-egregious VSD cases. That differential – between a base penalty on a self-disclosed matter and the same matter discovered independently – is the central financial argument for proactive disclosure.
Does your compliance programme produce a documented record of the steps taken when a potential violation is identified? That record – the investigation notes, the escalation trail, the legal advice log, the VSD or the reasons for not filing one – is what OFAC will scrutinise. Building that record prospectively is the compliance task; marshalling it for the defence is the legal one.
What is voluntary self-disclosure, and when should a business file one?
A voluntary self-disclosure is a proactive report filed with OFAC before the agency identifies the apparent violation through its own investigation or through information from a third party such as a bank or a foreign counterpart regulator. Timing is the defining criterion: once OFAC is already investigating, the window for a VSD has closed.
The VSD decision is one of the most consequential calls in the post-violation period. Filing a VSD that is incomplete or legally framed in a way that characterises the conduct more seriously than the facts support can create problems. Not filing a VSD on a matter that OFAC subsequently discovers independently removes the most significant mitigation available. The analysis requires legal input, usually under privilege.
In practice, the VSD submission itself is a substantial document. It sets out the facts, the legal characterisation of the apparent violation, the compliance programme in place at the time, the steps taken since discovery, and the remediation measures implemented or planned. OFAC may ask follow-up questions. We regularly advise clients on how to structure a VSD submission to provide full transparency without inadvertently characterising the matter in terms that escalate rather than mitigate OFAC's assessment.
There is a related point on cooperation credit. Even where a VSD is not filed – because the violation was identified by the bank or another party first – OFAC's guidelines allow for cooperation credit based on the responsiveness and completeness of the respondent's engagement during the investigation. Providing requested records promptly, making personnel available, and not requiring multiple follow-up requests are the practical markers of the cooperation that earns credit.
How does the OFAC enforcement process interact with other regimes?
For cross-border businesses, an apparent OFAC violation rarely exists in isolation. The same transaction that triggers OFAC scrutiny may also fall within the jurisdiction of OFSI (the UK's Office of Financial Sanctions Implementation), an EU member state's national competent authority, or, for goods in transit, BIS and the US Export Administration Regulations.
The position above covers the standard OFAC track. Your specific facts – the counterparty, the goods, the correspondent bank, the route of the payment, and the domicile of the entities involved – change the analysis materially.
Under OFSI, the UK equivalent, the enforcement posture has become notably more active since SAMLA (the Sanctions and Anti-Money Laundering Act) came into force. OFSI operates a civil monetary penalty regime with a separate threshold structure and a separate licence and reporting process. A disclosure to OFAC does not substitute for an OFSI report; the two obligations run in parallel. Similarly, EU member states' national competent authorities retain jurisdiction over EU-nexus conduct, and EU Council regulations impose obligations that are legally independent of, and in some respects structurally different from, the US rules.
The BIS dimension arises where the apparent violation involves goods or technology on the Commerce Control List. BIS has its own enforcement process and its own VSD mechanism. A joint OFAC-BIS matter – common in export-control-adjacent cases – requires coordinated disclosure strategy. Filing a VSD with one agency that contradicts the position taken with another creates serious problems. In our cross-border practice, the first task in any multi-regime situation is mapping all potentially applicable jurisdictions before any disclosure is filed.
One practical divergence that often surprises clients: OFAC's 50 percent rule (the test under which an entity owned 50 percent or more by one or more blocked persons is itself treated as blocked) operates differently from the OFSI and EU ownership and control test. OFAC's rule is mechanical – percentage ownership is the trigger. OFSI and the EU also apply a control test that can catch entities below the 50 percent ownership line. That divergence means a counterparty that passed the OFAC ownership screen may still be caught under OFSI or EU rules. Have you applied both tests? For a business active in both markets, applying only one creates a gap.
If a transaction has already been flagged – by your bank, by a correspondent, or by a preliminary agency inquiry – an early review of the full multi-regime picture can preserve options that narrow quickly with time.
For an assessment of your exposure under OFAC and parallel regimes, contact Calder & Vance at info@caldervance.com.
What are the most common risk points in OFAC penalty defence?
Across the matters we advise on, certain failure modes recur. Identifying them in advance – before a pre-penalty notice arrives – is the practical value of reviewing your compliance posture now.
- Delayed internal discovery. A violation that occurred several years before the compliance team identified it is harder to defend. The trail of escalation decisions, the compliance-programme documentation, and the personnel involved may all be harder to reconstruct. Early detection systems – whether automated screening, periodic audits, or transactional red-flag reporting – shorten the discovery gap.
- Incomplete ownership mapping. The 50 percent rule aggregates indirect holdings. A screening system that checks only direct counterparty names against the SDN List (OFAC's list of Specially Designated Nationals and blocked persons) misses indirect ownership. Many enforcement cases turn on exactly this gap. Mapping the full ownership chain, not just the contracting party, is the minimum standard.
- The compliance programme gap. OFAC's guidelines treat the quality of a compliance programme at the time of the violation as a mitigating factor. A programme that exists on paper but is not operationally embedded – no documented training, no transaction-level screening logs, no senior ownership – provides limited mitigation. The test is whether the programme was genuinely functioning, not whether a policy document existed.
- Poorly managed VSD decisions. The VSD timing window closes fast. A business that waits while internally debating whether to disclose may find the window shut before a decision is reached. The analysis should happen promptly, under legal advice and, where appropriate, under privilege.
- Uncoordinated multi-party communications. In transactions involving multiple parties – a borrower, a bank, a guarantor, a trader – each party may have its own counsel and its own disclosure calculus. Uncoordinated disclosures, or disclosures that characterise the same transaction differently across parties, compound the problem for everyone.
- Remediation without legal input. Businesses that terminate the offending relationship, overwrite the screening record, or restructure the relevant contracts immediately after discovery may inadvertently destroy the evidence trail that the defence requires, and may trigger separate concerns about obstruction.
A common misconception: "our compliance programme is a complete defence"
A persistent myth in OFAC enforcement is that a well-documented compliance programme operates as a complete defence to a violation. It does not. OFAC's published guidelines treat the existence and quality of a compliance programme as a significant mitigating factor – not a bar to enforcement.
The distinction matters in practice. A business that genuinely invested in a functioning compliance programme – with documented training, senior accountability, screening that covered indirect ownership, and a clear escalation process – will receive meaningful mitigation credit. But credit against the penalty calculation is not immunity from a finding of apparent violation. OFAC can and does issue final penalties and cautionary letters against respondents with established programmes. The programme's role is to reduce the penalty amount and demonstrate good faith, not to preclude the enforcement process entirely.
What this means operationally: the time to build the compliance record is before the violation, not after the pre-penalty notice. Retrofitting a compliance programme after discovery is visible to OFAC and, while it shows remediation intent, it carries less weight than a programme that was genuinely operational at the time the apparent violation occurred. In a recent matter, a financial-services business with a partial screening programme received meaningful mitigation credit for the documented controls that were operational, alongside remediation credit for the rapid implementation of the remaining programme components after discovery. The outcome turned on the contemporaneous documentation, not the programme's theoretical scope.
When should a business involve sanctions counsel?
The honest answer is: earlier than most businesses do. The four points at which counsel adds the clearest value are: (1) immediately on discovery of a potential violation, before any internal or external communication characterises the conduct; (2) before filing a VSD, to ensure the disclosure is complete, accurate, and framed in a way that supports the available mitigating analysis; (3) on receipt of any OFAC inquiry, whether a formal administrative subpoena or an informal information request; and (4) on receipt of the pre-penalty notice, to prepare the written response.
Counsel is also of clear value before any of these moments: in the design and testing of compliance programmes, in screening-logic reviews, and in the ownership-mapping exercise for high-risk counterparties. That preventive work is less visible than crisis management, but it is where the enforcement risk is genuinely managed rather than managed after the fact.
We have acted for businesses at every stage of the OFAC enforcement cycle. The matters that resolve most favourably – at the cautionary-letter end of the spectrum, or with a substantially reduced civil monetary penalty – tend to share three characteristics: early discovery, complete and well-framed disclosure (VSD or otherwise), and a contemporaneous compliance record that stands up to scrutiny. Counsel cannot manufacture any of those after the fact, but counsel can help preserve and present the record that already exists.
To discuss a pre-penalty notice, a VSD decision, or a compliance programme review, contact Calder & Vance at info@caldervance.com.
Related practices
- Apparent violation assessment (EU) – assessing apparent violations and enforcement risk under EU sanctions regulations
- Post-breach enforcement risk under BIS / EAR – the parallel enforcement process for US export-control apparent violations
- Post-breach enforcement risk under OFAC – a deeper treatment of the risk factors that shape OFAC enforcement outcomes