A Canadian exporter completes a shipment, then discovers during a quarterly review that the end-user had recently been added to the Consolidated Canadian Autonomous Sanctions List (Canada's list of designated persons under autonomous and UN-derived programmes). The transaction closed. The goods have left the country. What happens next, and is there an obligation to tell the government?
Under Canada's sanctions and export-control regime, voluntary self-disclosure (VSD – the proactive reporting of a potential breach to the relevant authority before that authority initiates proceedings) is not codified in a single statutory duty in the way that some other regimes mandate it. Instead, the obligation to disclose and the incentive to do so flow from a combination of the Special Economic Measures Act ("SEMA"), the Export and Import Permits Act ("EIPA"), the Proceeds of Crime (Money Laundering) and Terrorist Financing Act, and the enforcement posture of Global Affairs Canada ("GAC") – the department that administers Canada's autonomous sanctions and most export-control licensing. Getting this right protects against criminal referral; getting it wrong can accelerate one.
This briefing sets out who administers the regime, what the governing instruments require, how VSD works in practice, where Canada's approach diverges from OFAC, OFSI, and the EU, and when a business or individual should involve counsel before taking any step.
Who administers voluntary self-disclosure in Canada, and what is the legal basis?
GAC is the primary administrative authority for Canada's autonomous sanctions under SEMA and for export controls under EIPA, and it is the first port of call for any VSD relating to either regime. The Royal Canadian Mounted Police (RCMP) and the Canada Border Services Agency (CBSA) hold concurrent investigative and enforcement functions; the Public Prosecution Service of Canada makes charging decisions. Understanding which authority is relevant to your disclosure shapes both the form and the risk profile of the process.
SEMA gives the government of Canada authority to impose economic measures – asset freezes, transaction prohibitions, and restrictions on providing financial or technical services – against designated persons and entities. The regulations made under SEMA for each autonomous programme, together with the United Nations Act ("UNA") regulations implementing Security Council measures, set out the specific prohibitions. EIPA controls the import and export of goods, technology, and services that appear on Canada's Export Control List (ECL) and Import Control List. Violations of either statute can carry criminal penalties.
In our practice, clients are often surprised to learn that Canada has not enacted a single "VSD regime" comparable to OFAC's structured administrative-penalty framework. The absence of a codified VSD pathway does not mean disclosure is optional. It means the mechanics, timing, and risk calculus differ significantly from those of the US or UK regimes – a difference that cross-border businesses working between multiple jurisdictions must understand before they act.
The position above covers the standard architecture. Your facts – the goods, the designated person, the contractual structure, and the presence of any parallel US or EU exposure – change the analysis materially. For a confidential assessment of your specific situation, contact Calder & Vance at info@caldervance.com.
What does Canada prohibit, and what triggers a disclosure obligation?
A disclosure obligation, or a strong incentive to disclose, arises whenever a person or business has reason to believe it has contravened a prohibition under SEMA regulations, UNA regulations, or EIPA – whether by dealing in the property of a designated person, making property available to a designated person, providing financial or related services, or exporting or importing a controlled good without the required permit.
The core SEMA prohibitions cover: dealing in property that is owned, held, or controlled by a designated person; making property available to or for the benefit of a designated person; providing financial or related services to, for the benefit of, or on behalf of a designated person; and acquiring property from a designated person. These prohibitions track the standard asset-freeze architecture seen in OFSI and EU Council regulations, though the precise formulation differs by programme. The "making available" limb is particularly broad: it catches indirect benefit even without a direct transaction.
EIPA prohibitions apply when a person exports, transfers, or permits the export of goods or technology on the ECL without an export permit, or in breach of permit conditions. Goods subject to export controls range from dual-use items to military goods and certain controlled technology. Where the end-user turns out to be a designated person or a restricted destination, both SEMA and EIPA can bite simultaneously.
A critical practical point: the obligation to disclose property held or controlled for a designated person arises under some SEMA regulations as a positive legal requirement, not merely a prudent step. Compliance counsel should check the specific programme regulations – not just the general SEMA architecture – before advising that disclosure is voluntary. The distinction between a positive obligation and a prudential one is not always apparent on the face of the general statute.
How does the VSD process work in practice under GAC and CBSA?
The Canadian VSD process is less formalised than OFAC's structured submission system, but it follows a recognisable sequence of steps. The first is an internal scoping exercise to determine whether a violation has in fact occurred, the extent of the exposure, and whether parallel obligations exist under EIPA or financial-reporting requirements. Acting precipitously – approaching GAC before the internal analysis is complete – can expose the disclosing party to follow-on questions it is not yet in a position to answer accurately.
Once the internal review establishes the basic facts, the typical sequence runs as follows.
- Document the apparent violation: identify the transaction, the designated person or ECL item involved, the date, value, and any parties in the chain.
- Assess the mandatory reporting angle: determine whether the specific SEMA programme imposes a positive disclosure obligation and whether the Proceeds of Crime (Money Laundering) and Terrorist Financing Act triggers a suspicious transaction report to FINTRAC independently of any GAC disclosure.
- Prepare the written disclosure: address it to GAC's Trade Controls Bureau (for EIPA matters) or to the Sanctions Bureau (for SEMA matters) as appropriate. The disclosure should describe the facts accurately, explain the circumstances, and set out the remedial steps already taken or proposed.
- Coordinate with CBSA if goods are in transit or at the border: CBSA has its own disclosure procedures for goods that have been detained or are the subject of a border query.
- Manage any parallel US, UK, or EU exposure: see the cross-regime section below.
Timing matters. In our experience, a well-structured early disclosure – made before any regulatory enquiry has commenced – is treated more favourably than a disclosure made in response to a government request or an investigation. This mirrors the approach under OFAC and OFSI, where proactive disclosure is a mitigating factor. Under Canada's enforcement posture, the same principle applies, even if it is not codified in a penalty table.
If a transaction has already been flagged, or a filing has been refused, an early review can preserve options that narrow with time. Our team can assess the disclosure quickly and advise on the most defensible approach. Contact us at info@caldervance.com.
How is voluntary self-disclosure enforced under Canada, and what are the consequences of non-disclosure?
Enforcement of SEMA and EIPA violations in Canada is primarily criminal in character, which is a meaningful structural distinction from the largely civil-penalty frameworks administered by OFAC in the United States and OFSI in the United Kingdom. A person who knowingly contravenes SEMA regulations is liable to criminal prosecution; the same applies to wilful or reckless contraventions of EIPA. There is no equivalent of OFAC's administrative settlement process that resolves matters short of criminal referral through a civil monetary penalty assessed by the sanctions authority itself.
This structural feature has two important practical consequences. First, voluntary self-disclosure is even more consequential in Canada than in some other regimes: a well-timed, candid disclosure can support an argument against criminal referral and in favour of compliance-focused engagement with GAC. Second, the decision to disclose – and how to frame that disclosure – requires the kind of legally privileged advice that only counsel can provide. A disclosure that is incomplete, ambiguous, or poorly timed can itself create risk.
GAC's enforcement posture has evolved. The department has signalled a willingness to engage with businesses that come forward proactively, provided the disclosure is genuine, complete, and accompanied by credible remediation steps. That engagement does not guarantee any particular outcome – criminal referral decisions rest ultimately with the RCMP and the Public Prosecution Service – but it distinguishes the disclosing party from one that did not come forward at all. Is there a formal commitment to leniency in writing? No. Is early disclosure consistently a mitigating factor? In our cross-border practice, the answer is yes.
How does Canada's approach compare with OFAC, OFSI, and the EU?
Canada's approach to voluntary self-disclosure sits in a distinct position among the major regimes, with important points of both convergence and divergence. Understanding the differences matters acutely for any business with simultaneous exposure under more than one regime.
OFAC (US): OFAC operates a well-documented administrative penalty framework under IEEPA and other authorities. VSD to OFAC is a defined, codified process. A voluntary self-disclosure submitted to OFAC before it has reason to believe a violation occurred is treated as a significant mitigating factor in the penalty calculation; it can reduce the base penalty substantially. OFAC publishes enforcement guidelines setting out the mechanics. The result is more predictable than under Canada's regime, but the scrutiny of the OFAC process is also more formalised. See our briefing on OFAC voluntary self-disclosure for the full analysis.
OFSI (UK): OFSI under the Sanctions and Anti-Money Laundering Act requires certain persons to report a known or suspected breach to OFSI as soon as practicable. This is a positive statutory reporting obligation, not merely a mitigating option. OFSI's enforcement guidance treats voluntary reporting as a factor reducing the monetary penalty. The UK approach is closer to a mandated disclosure than Canada's, though the civil-penalty regime means the consequences short of criminal referral are more readily quantifiable. Henry Ashworth's related briefing on EU voluntary self-disclosure addresses parallel obligations under the EU Council regulations.
EU: The EU does not have a single, harmonised VSD process. Disclosure obligations and their consequences depend on the member state's national implementing legislation and enforcement authority. In some member states, the obligation to report blocked assets is explicit and time-bound. EU Council regulations require designated persons and those holding blocked assets to notify the competent national authority. Enforcement through national authorities means that the practical experience of disclosure varies considerably across the single market.
The critical cross-border point: where a transaction touches both a Canadian-designated person and a US-designated person – which is common given the overlap between GAC's list and the OFAC SDN List – a business may need to disclose to both GAC and OFAC, on different timelines, under different legal frameworks, with different confidentiality implications. Coordinating parallel disclosures is one of the most technically demanding tasks in this area of practice. We regularly advise on exactly this coordination challenge for clients with multi-regime exposure.
An important asymmetry: because SEMA violations carry criminal exposure by default, whereas an OFAC settlement is typically a civil administrative matter, the Canadian leg of a parallel disclosure requires special care. Statements made to GAC are not automatically shielded from use in a Canadian criminal proceeding in the way that an OFAC submission operates in a purely civil context. Counsel should address this before the disclosure letter is drafted.
What are the principal risk flags and common mistakes?
Several patterns recur in the matters we handle. Each represents a point where a business that acted without advice compounded its original exposure.
Delayed internal escalation. The most common mistake is not the original violation itself but the gap between when the compliance team first identifies the issue and when it reaches legal counsel or senior management. During that gap, further dealings with the same counterparty may continue, the record may be disturbed, and the window for a genuinely proactive disclosure narrows. Early escalation protocols are not bureaucratic formality. They are a direct risk-management tool.
Partial disclosures. A disclosure that addresses one transaction but omits related transactions involving the same designated person creates a worse position than a complete disclosure. GAC and, if the matter escalates, the RCMP will conduct their own review. A partial disclosure that is later overtaken by a regulatory investigation is treated as evidence of bad faith, not good compliance.
Failing to identify the FINTRAC angle. Where a violation involves a financial institution, a money-services business, or any entity subject to the Proceeds of Crime (Money Laundering) and Terrorist Financing Act, a parallel suspicious transaction report to FINTRAC may be required independently of any disclosure to GAC. Missing this creates a separate and distinct compliance gap. The two disclosure streams are not substitutes for each other.
Treating the Canadian leg as secondary. Businesses with strong US compliance programmes sometimes treat the Canadian disclosure as a formality once the OFAC leg has been resolved. In our experience, this is a material error. The criminal character of SEMA enforcement, and the independent role of the RCMP and the Public Prosecution Service, means that the Canadian process demands its own strategic attention.
Underestimating the "making available" limb. A business that believes it has not "transferred" anything to a designated person because title never passed may still have made property available to that person under a SEMA prohibition. This is not a technicality. It is a structural feature of the prohibition that compliance counsel must test against the specific facts before advising that no violation occurred.
Related practices
- Apparent Violation Assessment (EU) – structured review of EU sanctions exposure and disclosure strategy
- Voluntary self-disclosure under the EU regime – how EU member-state obligations compare with the Canadian approach
When should a business or individual involve sanctions counsel?
The answer is: before drafting or submitting anything to GAC, CBSA, FINTRAC, or any other authority. This is not a formulaic recommendation. It reflects the specific legal risk created by Canada's criminal-default enforcement architecture.
Counsel's role in a Canadian VSD matter covers several distinct tasks. First, scoping the apparent violation: determining whether a prohibition was in fact contravened, under which programme, and by whom. Second, assessing the mandatory versus discretionary disclosure question for the specific SEMA programme and EIPA position. Third, advising on privilege: ensuring that internal investigation materials generated for the purpose of legal advice attract solicitor-client privilege and are managed accordingly. Fourth, drafting the disclosure in terms that are accurate, complete, and appropriately framed. Fifth, coordinating any parallel OFAC, OFSI, or EU disclosure to manage timing, consistency, and the differing confidentiality positions of each regime.
A common objection is that the matter is too small to justify specialist counsel. In our experience, this objection conflates transaction value with legal risk. The criminal character of SEMA enforcement means that the legal consequence of a misstep does not scale proportionately with the size of the underlying transaction. A modest shipment to a designated person carries the same criminal exposure as a large one. The cost of early advice is almost always smaller than the cost of managing a criminal referral or a protracted regulatory engagement without it.
Another misconception worth addressing directly: some compliance officers believe that because Canada's sanctions list overlaps substantially with the OFAC SDN List, a business with a clean OFAC record will automatically be in good standing with GAC. This is not correct. The two lists are maintained independently. GAC designates persons on the basis of Canadian foreign-policy considerations under SEMA; those designations can differ from OFAC's both in scope and in timing. Screening solely against the SDN List is not a substitute for screening against the Consolidated Canadian Autonomous Sanctions List.