A payments business processes a wire transfer. Weeks later, its bank flags the transaction as potentially involving a sanctioned party. OFAC opens an investigation. The compliance team has never faced a US enforcement action. What happens next, and does the response in the first days shape the outcome for months to come?
Penalty defence and settlement under OFAC rules is governed by the Office of Foreign Assets Control within the US Treasury. OFAC has authority under IEEPA and related statutes to impose civil monetary penalties for apparent violations of the sanctions programmes it administers. The outcome of an enforcement matter – whether it closes with no action, a cautionary letter, or a significant penalty – turns substantially on how the subject responds, how quickly, and how completely.
As of April 2026, OFAC's enforcement posture remains active across financial services, technology, and commodities sectors. This briefing covers the governing authority and legal basis, the enforcement sequence, the factors OFAC weighs in setting penalties, the role of voluntary self-disclosure, the settlement mechanics, the cross-border dimension, and the risk flags that signal when specialist counsel is essential.
Who administers OFAC enforcement, and what is the legal basis?
OFAC administers US sanctions enforcement under the authority of IEEPA, the Trading with the Enemy Act, and a series of country- and thematic-specific executive orders and statutory sanctions programmes. It sits within the Office of Terrorism and Financial Intelligence at the US Treasury and operates with a civil enforcement function distinct from criminal prosecution, which falls to the Department of Justice.
OFAC issues civil penalties against US persons and, under the extraterritorial reach of certain programmes, against non-US persons who cause or facilitate transactions that would be prohibited if undertaken directly by a US person. The distinction matters: a European bank routing a dollar-denominated payment through a US correspondent can find itself within OFAC's enforcement reach even though neither party to the underlying transaction is American.
OFAC's enforcement process begins when it identifies an apparent violation – either through its own monitoring, through a report by a financial institution, or through a voluntary self-disclosure (VSD – a formal, proactive disclosure to OFAC of a potential violation before the regulator identifies it independently). A VSD can reduce the base penalty by a substantial proportion; the precise reduction depends on the totality of the OFAC guidelines, but the benefit of early disclosure is consistently reflected across enforcement outcomes. Failure to self-disclose when counsel advises it is one of the more consequential early decisions in an OFAC matter.
In our cross-border practice, we regularly advise clients whose first awareness of an OFAC exposure comes not from their own screening but from a correspondent bank query, a blocked-funds notice, or a disclosure from a transaction counterparty. Speed of response from that moment is a variable the subject can control. Almost nothing else is.
What is the OFAC enforcement sequence?
OFAC enforcement follows a defined sequence: identification of an apparent violation, pre-penalty notice, the subject's response, and final determination. Understanding each stage determines the strategy.
When OFAC identifies an apparent violation it may issue a pre-penalty notice (PPN), which sets out the alleged conduct, the proposed civil penalty, and the statutory maximum penalty that could apply. The subject then has a limited period – historically around 30 days, though the subject should verify the current position – to respond in writing, submit additional evidence, request a hearing, and argue for a reduction. That response is the primary opportunity to shape the penalty the subject ultimately faces.
The response to a PPN should address several things at once: the accuracy of OFAC's factual account; any evidence that the violation was not wilful; the existence and quality of the compliance programme at the time; remedial steps taken since discovery; and any cooperation extended to OFAC during the investigation. These are not merely points of mitigation in a general sense – they map directly onto the factors in OFAC's published enforcement guidelines, which OFAC applies in a structured way.
After considering the response, OFAC issues a final penalty notice or closes the matter. Matters may also close at an earlier stage with a no-action letter, a cautionary letter, or a finding of violation without penalty. In our experience, the difference between a cautionary letter and a seven-figure penalty is often the quality of the compliance evidence presented, not simply the severity of the underlying transaction.
How does OFAC calculate the penalty, and what factors reduce it?
OFAC calculates civil penalties by reference to the statutory maximum per-transaction penalty – which differs across programmes and is periodically adjusted for inflation – and then applies a set of aggravating and mitigating factors from its enforcement guidelines to arrive at a proposed figure.
The statutory maximum is the ceiling, not the starting point. OFAC's guidelines identify two broad categories of factor. Aggravating factors include: the harm caused to sanctions objectives; the subject's awareness of the conduct; a pattern of violations rather than an isolated incident; senior-management involvement; and obstruction or failure to cooperate. Mitigating factors include: the absence of prior violations; a comprehensive sanctions compliance programme; self-initiated remedial action; cooperation with OFAC; and the fact that the violation was isolated, non-egregious, and self-disclosed.
The distinction between an egregious and a non-egregious violation is particularly consequential. For non-egregious cases without a VSD, OFAC typically proposes a penalty at or below half the statutory maximum transaction value. For non-egregious cases with a VSD, the base penalty is reduced further. For egregious cases the analysis shifts substantially, and the statutory maximum becomes a live threat rather than a theoretical one. OFAC's own guidance frames egregious cases as those involving wilful or reckless conduct, a high degree of management awareness, or conduct that causes significant harm to sanctions objectives.
What constitutes a "comprehensive" compliance programme in OFAC's assessment? OFAC's own compliance guidance describes five essential elements: management commitment, risk assessment, internal controls, testing and auditing, and training. A programme that was designed on paper but never tested, or that had significant gaps in its ownership-and-control screening, is unlikely to carry significant mitigating weight. Have you stress-tested your programme against the standard OFAC applies, not merely the standard your internal audit team applies?
The position above covers the standard analytical path. Your facts – the specific programme involved, the nature of the transaction, the subject's prior enforcement history, and the quality of the compliance evidence – change the analysis materially. For an early assessment of your exposure under the OFAC enforcement regime, contact Calder & Vance at info@caldervance.com.
What is a voluntary self-disclosure, and when should it be made?
A VSD is a formal, timely, and complete disclosure to OFAC of a potential violation before OFAC has independently identified it. Under OFAC's enforcement guidelines, a VSD is a significant mitigating factor that typically results in a reduction of the base penalty amount. The reduction is not automatic; the VSD must meet OFAC's standards for completeness and timeliness.
A VSD that is incomplete – one that omits transactions, understates the scope of the conduct, or presents the facts selectively – can be worse than no VSD at all. OFAC has, in past enforcement practice, treated an incomplete disclosure as an aggravating factor when the full picture later emerged. The practical implication: before submitting a VSD, the subject needs a thorough internal investigation that maps the full population of potentially violative transactions, the responsible business lines, and the compliance failures that permitted them.
Timing interacts with completeness. A rapid preliminary VSD followed by a detailed submission is generally the better approach when there is a genuine risk that OFAC is already aware of the conduct. Waiting to investigate fully before filing the initial VSD can forfeit the "timeliness" element. This sequencing decision is one we regularly advise on in the early days of an OFAC matter.
VSD is also not the only decision point. Concurrent considerations include: whether a Suspicious Activity Report has already been filed by a financial institution involved in the transaction; whether there are parallel disclosures required to other regulators (OFSI, the relevant EU competent authority, or BIS for export-control matters); and whether the conduct may attract criminal referral to DOJ. We have acted for clients where the OFAC civil matter was the straightforward part, and the criminal dimension – which OFAC can refer to DOJ – required separate and carefully sequenced management.
How does OFAC settlement work, and what does it involve?
OFAC settlement – a negotiated resolution of an apparent violation – is the mechanism by which the majority of significant OFAC enforcement matters close. It does not require an admission of the conduct as a matter of strict law, but the settlement agreement will typically describe the facts as OFAC understands them, and that description becomes public.
The settlement process involves negotiation between the subject (or its counsel) and OFAC's enforcement staff. The subject presents its factual account, its mitigation evidence, and its compliance remediation. OFAC responds with its proposed penalty figure. Several rounds of exchange are common before a figure is agreed. A critical element of the settlement is the remediation commitment: OFAC typically requires the subject to agree to specified compliance enhancements, sometimes including an enhanced compliance commitment or a compliance programme undertaking that is monitored for a defined period.
Settlement has several advantages over litigating a PPN to a final penalty determination. It provides certainty, limits public exposure to the maximum statutory figure, and often secures a result faster. The disadvantage is that the agreed facts become public, and the entity's name appears in an OFAC enforcement release. For publicly-listed entities and regulated financial institutions, the reputational and regulatory knock-on effects of that release can be significant.
One element that is sometimes underestimated: the compliance programme undertaking in a settlement agreement can itself be a significant operational commitment. Agreeing to enhanced transaction monitoring, expanded ownership-chain screening, quarterly reporting to OFAC, or an independent compliance review are not abstract formalities. They have operational cost and absorb compliance resource for years after the settlement closes. We advise clients to negotiate the scope of compliance commitments with the same rigour applied to the penalty figure.
If a transaction has already been flagged, or a filing has been refused, an early review can preserve options that narrow quickly. Contact Calder & Vance at info@caldervance.com to discuss your position.
How does the cross-border dimension affect OFAC enforcement strategy?
An OFAC enforcement matter rarely sits in isolation. For non-US businesses caught by OFAC's extraterritorial reach, the same conduct that grounds an OFAC enforcement action may simultaneously engage OFSI in the United Kingdom, the relevant EU competent authority, or BIS where goods or technology are involved. Managing a multi-regulator exposure requires coordinating the disclosure strategy across those regimes, because what is said to one regulator can affect the position with another.
Consider a multinational with subsidiaries in both the United States and the European Union. A transaction that violates OFAC – perhaps because a US-person subsidiary was involved or because the payment cleared through a US correspondent – may also constitute an infringement of EU Council regulations if an EU subsidiary was party. OFSI, for UK-connected transactions, operates its own penalty regime under the Sanctions and Anti-Money Laundering Act, with its own licensing and enforcement guidance. The three regimes share some features – the ownership-and-control test, the blocking of assets, the licensing mechanism – but their penalty calculations, their disclosure timelines, and their settlement mechanics differ.
Secondary sanctions exposure adds a further layer. OFAC's secondary-sanctions programmes can affect non-US entities that have no direct US nexus but transact with parties targeted by those programmes. A non-US trading house that continues to deal with a designated counterparty risks being designated itself or losing access to the US financial system. This is the secondary sanctions risk – a consequence that flows not from a direct prohibition but from the US's stated policy of penalising non-US actors who undermine designated-party restrictions.
For businesses with BIS exposure alongside OFAC, the interaction between export-control violations and sanctions violations requires careful sequencing. BIS and OFAC can both be engaged by the same transaction; a VSD to OFAC does not constitute a VSD to BIS, and BIS has its own disclosure and penalty framework under the Export Administration Regulations. We have acted for clients managing simultaneous OFAC, OFSI, and BIS exposure, and the coordination requirement in those matters is substantial. For guidance on the export-control dimension, see our briefing on post-breach enforcement risk under BIS and the EAR.
What are the key risk flags that warrant immediate specialist involvement?
Several indicators signal that an OFAC enforcement matter has moved beyond the in-house team's independent management capacity and requires external sanctions counsel immediately.
The first is a criminal dimension. Where OFAC's investigation involves conduct that could constitute wilful violation of the International Emergency Economic Powers Act – wilful violations carry criminal penalties including imprisonment – DOJ involvement becomes a real possibility. Criminal and civil OFAC matters require separate and coordinated management from the outset.
The second is a parallel regulator inquiry. Where OFSI, the EU competent authority, or a prudential regulator (such as a banking supervisor) is simultaneously inquiring into the same conduct, the disclosure and response strategy must be coordinated. Statements made in one proceeding can affect the position in another.
The third is egregious-case classification. If the conduct was wilful, senior-management-sanctioned, or involved deliberate circumvention of controls – as opposed to a screening miss or a compliance programme gap – the probability of an egregious classification is high. Egregious cases attract the statutory maximum as the base point, and the penalty figure can be material.
The fourth is a pattern of violations. A subject with prior OFAC enforcement history faces a compounded aggravating-factor analysis. Prior violations, even those closed by cautionary letter, are taken into account. Do you know your entity's full OFAC enforcement history before you respond?
The fifth is an inadequate compliance programme. If the compliance programme that was in place at the time of the apparent violation was weak, undocumented, or untested, the mitigation available from the compliance factor is limited. In that situation, rapid post-discovery remediation – documented, evidenced, and framed correctly – is the best available mitigation lever. Acting quickly matters.
A common objection we encounter is that a small or mid-sized business lacks the profile to attract OFAC attention. In our experience, this underestimates OFAC's enforcement reach. OFAC has issued enforcement actions against entities of all sizes, including small financial institutions, fintech businesses, and non-US companies. Transaction size and entity profile are factors in penalty calculation, but they are not gates to enforcement jurisdiction.
Related practices
- Apparent violation assessment – EU – EU enforcement exposure assessment for cross-border apparent violations
- Penalty defence and settlement under OFAC – further analysis – deeper review of penalty calculation and settlement mechanics
- Post-breach enforcement risk under BIS and the EAR – export-control enforcement risk and BIS disclosure strategy