A US-headquartered trading group discovers, during a routine internal review, that a wire transfer processed six months earlier was routed through a counterparty that appeared on the SDN List (OFAC's list of Specially Designated Nationals and blocked persons) at the time of the transaction. The compliance function freezes. The General Counsel asks three questions in quick succession: What must we report? What can we do to limit exposure? And how do we stop this happening again?
Remediation after a sanctions breach under OFAC rules is a structured process governed by the Office of Foreign Assets Control, a bureau of the US Department of the Treasury. The core obligation – where a violation is apparent – is to evaluate whether to file a voluntary self-disclosure (a VSD: a proactive report to OFAC describing the apparent violation before the regulator discovers it independently), then to remediate the underlying weakness. A well-executed VSD and a credible remediation programme are among the most significant mitigating factors in OFAC's penalty calculus.
This briefing sets out the governing authority and legal basis, the obligations that arise after a breach is identified, the VSD procedure and timeline, the remediation programme OFAC expects, how the US position compares with OFSI and the EU, and the risk flags that counsel most frequently identifies in cross-border matters.
Who administers remediation obligations and what is the legal basis?
OFAC administers the US economic-sanctions programmes under authority granted primarily by the International Emergency Economic Powers Act (IEEPA) and the Trading with the Enemy Act (TWEA), together with a series of executive orders and programme-specific regulations that OFAC issues and updates. When an apparent violation occurs, OFAC's enforcement authority activates. The agency determines whether to open an investigation, issue a finding of violation, or – where the facts and remediation warrant it – close the matter with no further action.
OFAC's enforcement methodology is set out in its published enforcement guidelines, which describe the aggravating and mitigating factors the agency weighs. Those guidelines are not a statute and carry no formal binding authority, but in our experience they function as the operative decision standard in every enforcement matter. Any business managing post-breach remediation should treat them as the primary analytical document.
One point that frequently surprises in-house teams: OFAC does not operate a mandatory reporting deadline in the same way that some other regulators do. The decision to file a VSD is voluntary. However, the benefit of filing – a reduction in the base penalty figure of up to half – is contingent on the disclosure being made before OFAC learns of the violation from another source. Timing therefore becomes decisive. What matters is not whether to disclose but how quickly the decision is made and how well the initial submission is prepared.
What triggers the obligation to assess a potential breach?
The obligation to assess arises the moment a business has reason to believe that a transaction it processed, facilitated, or approved may have involved a sanctions-listed party, a blocked asset, or a prohibited activity under any OFAC programme. That trigger is knowledge-based, not conviction-based. You do not need certainty to begin the assessment; a credible reason to suspect is enough.
The assessment phase has two practical stages. First, a rapid fact-gathering exercise: confirm what happened, identify the relevant programme and the listed party involved, and determine the approximate dollar value and volume of transactions at issue. Second, a legal analysis of whether the conduct constitutes an apparent violation – meaning that it appears, on the facts, to violate an OFAC prohibition – versus conduct that falls within a general licence (a standing authorisation that permits a defined category of transactions without a separate application) or that is otherwise authorised.
In our cross-border practice, we find that this triage is where the most consequential errors occur. Businesses either under-scope the review – checking only the transaction that first surfaced – or over-escalate prematurely, alerting counterparties or regulators before the internal facts are clear. Neither approach serves the business well. The correct sequence is to scope carefully, gather completely, and analyse before communicating outward.
How does the OFAC voluntary self-disclosure process work?
A VSD to OFAC is filed in two stages: an initial submission, followed by a full submission once the internal investigation is complete. The initial submission alerts OFAC to the apparent violation, identifies the sanctions programme involved, gives a preliminary description of the conduct, and states that a full submission will follow. OFAC's published guidance contemplates that the full submission follows within 180 days of the initial filing; extensions are available on request but must be justified.
The full submission is the substantive document. It describes the factual background in detail, identifies the root cause of the failure, sets out the remediation steps already taken, and presents the mitigating factors the business wishes OFAC to weigh. Those mitigating factors include: whether the violation was self-discovered, the speed of the self-report, the absence of prior violations, the degree of management involvement (or its absence), and the quality and scope of the remediation programme implemented.
A well-prepared full submission is not merely a factual account. It is also a legal argument. It should address each aggravating factor the agency might identify and provide evidence that it does not apply, or that its weight is reduced by the remediation taken. OFAC will review the submission, may request additional information, and will ultimately issue a response – ranging from a no-action letter through to a civil penalty. The penalty base for egregious violations can be substantial; the base amount for a non-egregious matter where a VSD is filed is lower. Neither figure is stated here as a specific amount, because the applicable maximums depend on the programme involved and are adjusted periodically – verify the current schedule before any submission.
Does the filing of a VSD guarantee a favourable outcome? No. OFAC retains full discretion. But across the matters our practice has managed, the combination of a timely, candid VSD and a credible remediation programme consistently produces a materially better result than waiting to be contacted.
What remediation programme does OFAC expect?
OFAC expects remediation that is proportionate to the root cause and demonstrably implemented, not remediation that is promised but unverified. The agency distinguishes between a business that identified a gap and fixed it before filing, and one that describes planned future actions. Completed steps carry greater mitigating weight.
A credible remediation programme typically addresses five areas. First, the immediate containment: blocking or reversing any transaction that remains open, freezing assets where required, and preventing further prohibited activity. Second, the root-cause analysis: identifying precisely why the screening, approval, or oversight process failed to catch the violation. Third, the control redesign: amending the specific control – whether that is a screening-list subscription, an approval workflow, an ownership-mapping procedure, or staff-training content – that the root cause identifies. Fourth, testing: confirming that the redesigned control functions as intended under realistic conditions, not just in a controlled demonstration. Fifth, governance: ensuring that senior management and the board have visibility of the violation, the root cause, and the remediation, and have formally approved the new controls.
In a recent matter, a financial services business discovered that its screening tool was not applying consolidated-list updates in real time; a batch-update delay had allowed a transaction to process on a day when the counterparty's listing had already taken effect. The root cause was a technical configuration issue, not a deliberate failure. We assisted the business in scoping the full transaction history affected, preparing both stages of the VSD, redesigning the update protocol, and demonstrating to OFAC that the redesigned control had been tested and validated. The matter closed without a civil penalty.
That example illustrates a broader principle: the quality of the remediation narrative matters as much as the remediation itself. OFAC reviewers are assessing whether the business genuinely understands what went wrong and whether it has the institutional will to prevent recurrence.
How does the OFAC approach compare with OFSI and the EU?
Cross-border businesses face a layered compliance environment. A transaction that triggers an OFAC apparent-violation analysis will often also engage OFSI – the UK's Office of Financial Sanctions Implementation – or an EU competent authority, depending on the currencies, counterparties, and jurisdictions involved. The three regimes share a common objective but diverge on procedure in ways that matter operationally.
Under OFSI, the reporting obligation is mandatory and time-bound. A firm that knows or has reasonable cause to suspect that a person is a designated person – or that it holds frozen funds – must report to OFSI as soon as practicable. There is no voluntary element: the obligation to report is imposed by statute under the Sanctions and Anti-Money Laundering Act (SAMLA) and the relevant thematic regulations. OFSI's enforcement guidance sets out a penalty regime with a separate methodology from OFAC's. Critically, OFSI has the power to impose monetary penalties and to refer matters for criminal prosecution.
The EU operates through national competent authorities designated under the relevant Council Regulations. Those authorities vary in their enforcement posture and in their published guidance on self-reporting. Some member states operate a voluntary-disclosure mechanism with explicit mitigation; others do not. A cross-border matter involving both an OFAC programme and EU sanctions will therefore require coordinated reporting strategy across at least two – and potentially more – national authorities.
The practical implication: the VSD or initial report to OFAC should never be prepared in isolation if the transaction also has a UK or EU dimension. The sequence of filings, the content of each, and the treatment of privilege across jurisdictions must all be considered before the first submission goes out. In our experience, the greatest risk in multi-regime breach situations is that the OFAC submission inadvertently contains admissions that then complicate the UK or EU defence. See our briefing on post-breach remediation under OFSI for the UK-specific procedure, and our analysis of regulator information requests under EU sanctions for the EU dimension.
One further divergence worth noting: OFAC's 50 percent rule – treating entities owned 50 percent or more in the aggregate by blocked persons as themselves blocked – is a US-specific construct. OFSI and the EU apply an ownership and control test (the test for whether a non-listed entity is caught through a listed person) that looks not only at ownership percentages but also at control through contractual, structural, or other means. A remediation analysis that maps ownership under the OFAC standard may therefore miss entities that the OFSI or EU test would capture – and vice versa.
What are the common risk flags in post-breach remediation?
Several patterns recur in post-breach situations, and identifying them early shapes the remediation strategy. The first is scope creep in the wrong direction: an initial review reveals one transaction, but the root cause – once properly understood – indicates that the same failure affected dozens of prior transactions. A VSD that discloses only the initially identified transaction and then is later shown to have omitted others is far more damaging than a comprehensive initial disclosure. Scope the review to the root cause, not just to the transaction that surfaced first.
The second is record-keeping gaps. OFAC's expectations on record retention are clear: records of transactions subject to OFAC programmes must be maintained for a substantial period. If those records cannot be produced during the investigation phase, both the factual reconstruction and the credibility of the full submission are compromised. Businesses should verify their record-retention architecture at the outset of the review.
The third is counterparty notification risk. In some fact patterns, the business that processed the transaction is a financial intermediary, not the originating party. Its customer may also have OFAC exposure. Managing what the intermediary communicates to its customer – and when – requires care, because premature disclosure can alert the customer to a regulator's interest before the intermediary has completed its own assessment.
The fourth is the interaction with AML/CFT reporting obligations. A sanctions apparent violation that involves a counterparty who may be engaged in money laundering will frequently trigger suspicious-activity reporting obligations under the Bank Secrecy Act in the US, or equivalent obligations under UK or EU financial-crime regimes. The relationship between a VSD to OFAC and a suspicious-activity report is not straightforward, and the sequencing and content of each requires careful analysis.
The fifth – and in our experience the most underestimated – is the secondary-sanctions dimension. Even where the primary transaction involves a US-dollar clearing bank with OFAC exposure, the underlying trade may also have involved goods, technology, or services subject to US export controls administered by BIS under the Export Administration Regulations (the EAR). A transaction that violates OFAC sanctions may simultaneously involve an export-control violation. The two investigations are separate, with separate disclosure and mitigation tracks. Failing to identify the EAR dimension at the outset of the OFAC remediation can produce a second enforcement track that the business was not expecting. For export-control and dual-use aspects of related matters, our apparent violation assessment practice provides a structured entry point.
When should a business involve external sanctions counsel?
The answer is: as early as possible after the apparent violation is identified, and certainly before any communication is made to OFAC or to any other regulator. The reason is not procedural formality. It is that every decision made in the first hours after identification – who is told, what is documented, how the transaction is described internally – affects the legal position in ways that are difficult or impossible to undo.
Privilege is the most immediate concern. Internal communications about an apparent violation should be channelled through counsel from the outset, so that the work-product and legal-advice privileges attach where possible. Communications that precede counsel's involvement may not be protected, and OFAC has the authority to request production of documents in the course of an investigation.
A common myth is that engaging external counsel signals guilt or escalates a matter unnecessarily. That view is incorrect, and in our practice it is one of the beliefs most likely to worsen the outcome. OFAC's published guidance explicitly recognises the engagement of experienced compliance counsel as a mitigating indicator of good-faith remediation. Early counsel engagement does not escalate; it structures.
The position above covers the standard case. Your facts – the counterparty, the transaction type, the regime, the currencies and routing banks involved, the number of transactions at issue, and the presence or absence of prior notices from OFAC – all change the analysis materially. For an assessment of your exposure and the appropriate remediation route, contact Calder & Vance at info@caldervance.com.
If a transaction has already been flagged internally, or if OFAC has made contact, an early structured review can preserve options – including the ability to file a complete and credible VSD – that narrow with every passing day. Contact us at info@caldervance.com to discuss next steps on a confidential basis.
Related practices
- Apparent Violation Assessment – structured triage for businesses assessing OFAC or EU apparent violations
- Post-Breach Remediation under OFSI – the UK mandatory-reporting procedure and penalty regime compared
- Regulator Information Requests under EU Sanctions – responding to competent-authority enquiries across member states
Frequently asked questions: remediation after a sanctions breach under OFAC
Who administers remediation after a sanctions breach under OFAC?
OFAC – the Office of Foreign Assets Control, a bureau of the US Department of the Treasury – administers enforcement of the US economic-sanctions programmes and oversees post-breach remediation. OFAC receives voluntary self-disclosures, investigates apparent violations, and determines the appropriate enforcement response. For matters with a UK or EU dimension, OFSI and the relevant EU national competent authorities may also be engaged, and each operates under its own distinct statutory framework. Multi-regime matters require coordinated disclosure strategy across all involved regulators.
What does OFAC prohibit in relation to remediation after a sanctions breach?
OFAC's prohibitions – which vary by programme – apply to transactions involving blocked persons, blocked property, or designated countries or regions. After an apparent violation, the prohibition continues: OFAC requires that any assets or funds that remain in a blocked position be reported and maintained as frozen. OFAC does not prohibit the act of remediation itself; it requires that remediation be genuine, proportionate, and verifiable. A remediation that conceals or minimises the true scope of a violation is treated as an aggravating factor, not a mitigating one.
How is remediation after a sanctions breach enforced under OFAC?
OFAC enforces through civil penalties, findings of violation, and referrals to the Department of Justice for criminal prosecution in the most serious cases. The agency applies a published set of aggravating and mitigating factors. A timely and complete voluntary self-disclosure, combined with a demonstrably implemented remediation programme, is one of the strongest mitigating factors available. Conversely, an incomplete disclosure, a delayed report, or a remediation that proves superficial on scrutiny are treated as aggravating. The outcome spectrum runs from a no-action letter through to a substantial civil penalty; no specific outcome is guaranteed by any particular course of action.
About the author
J. M. Aldridge advises multinationals and financial institutions on US sanctions and export controls, with a focus on OFAC licensing, secondary-sanctions risk, and BIS classification. Calder & Vance – International Sanctions & Export Control Counsel.
About Calder & Vance
Calder & Vance is an independent international sanctions and export-control boutique. We advise multinationals, financial institutions, exporters, and individuals on the major regimes – OFAC and BIS in the United States, OFSI and ECJU in the United Kingdom, the EU Council regulations and the EU General Court, the United Nations Consolidated List, and the regimes of Switzerland, Canada, Australia, the UAE, Singapore, and Japan. Our work is limited to lawful compliance, licensing, delisting, enforcement defence, and due diligence. To discuss a matter, contact info@caldervance.com.
Disclaimer: This material is general information, not legal advice, and is not a substitute for advice on your specific facts. Sanctions and export-control rules change frequently and differ by regime; verify the current position before relying on anything stated here. Calder & Vance does not advise on circumventing or evading sanctions. For advice on your situation, contact info@caldervance.com.