A compliance officer at a mid-sized trading house discovers, during a routine internal audit, that the firm processed payments connected to a sanctioned party over a period of several months. The transactions have already settled. The question is no longer whether a violation occurred – it almost certainly did. The question is what to do next, and how quickly.
Voluntary self-disclosure under OFAC – the formal process by which a business or individual proactively reports an apparent violation of US sanctions to the Office of Foreign Assets Control – is one of the most consequential decisions in an enforcement matter. As of April 2026, OFAC's published enforcement guidelines treat a timely, complete, and accurate voluntary self-disclosure (VSD) as a significant mitigating factor that can substantially reduce the base penalty amount. The governing authority is OFAC, operating under the relevant orders issued pursuant to IEEPA and TWEA, and the procedure is set out in OFAC's enforcement guidelines.
This briefing explains who administers the VSD process, what the procedure requires, where the major regimes diverge from OFAC's approach, and which risk factors most frequently compromise a disclosure that started with good intentions.
Who administers voluntary self-disclosure and what is the legal basis?
OFAC administers the VSD process as part of its broader civil enforcement authority under IEEPA, TWEA, and the relevant programme-specific statutes. It is not a court proceeding and not a formal admission of criminal liability. OFAC's enforcement guidelines – a publicly available document, revised periodically – set out the factors that OFAC weighs when calculating a civil monetary penalty, and a timely VSD is among the most heavily weighted.
OFAC's enforcement authority extends to any US person, wherever located, and to foreign persons conducting transactions that touch the US financial system or involve US-origin goods. That extraterritorial reach is not merely theoretical. In our cross-border practice, we regularly advise non-US companies that discover their US-dollar clearing bank processed a payment that triggered OFAC prohibitions – and that company faces a real enforcement exposure even without a US subsidiary or US employees.
The enforcement guidelines distinguish between an egregious case (where systemic failures, management knowledge, or wilful conduct are present) and a non-egregious case. For a non-egregious violation with a timely VSD, OFAC's guidelines indicate that the penalty base is calculated from a reduced range. That is a material difference in financial exposure, and it is the primary incentive that drives the decision to disclose.
The position above covers the standard framework. Your facts – the counterparty, the transaction value, the currency, the route, the programme in play – change the analysis significantly. For an initial assessment of your exposure and whether VSD is the right route, contact Calder & Vance at info@caldervance.com.
What must a voluntary self-disclosure contain?
A VSD to OFAC must be accurate, complete, and timely – those three requirements are not interchangeable, and failing any one of them risks losing the mitigation credit that justifies the disclosure in the first place. OFAC's enforcement guidelines set out the expected content: identification of the transactions, the counterparties, the apparent prohibition triggered, the value and dates, and an explanation of how the issue was discovered and what remedial steps have been taken or are planned.
Timing is measured from the point at which the company has a reasonable basis to believe a violation has occurred. Deliberately delayed disclosure – waiting, for example, until an external inquiry is imminent – is treated not as a mitigant but as an aggravating factor. OFAC's guidelines do not specify a fixed calendar deadline for the initial submission, but practitioners consistently advise that the clock begins running once internal investigation reaches a preliminary conclusion. Sitting on that conclusion is a risk.
The initial submission is typically a short-form report: enough to put OFAC on notice, identify the apparent violation, and assert the intent to disclose fully. A more detailed follow-up, sometimes called a full report, follows within a period that OFAC can specify on a case-by-case basis. The two-stage approach is important because it allows a company to begin the disclosure process before its internal investigation is complete – which matters when the transactions are numerous or the ownership chain is complex.
What should NOT be in the disclosure is equally important. Overstatement, imprecision about dates or values, or the inclusion of transactions that are not in fact apparent violations can all undermine OFAC's confidence in the submission and prolong the inquiry. We have acted for clients whose first-draft disclosures, prepared without specialist counsel, contained exactly these errors.
How does OFAC weigh a voluntary self-disclosure against other mitigating factors?
OFAC's penalty calculation methodology gives VSD its own weight, but it operates alongside a set of general mitigating and aggravating factors that together determine the final civil penalty, if any is imposed at all. Understanding how these factors interact is essential for a business trying to estimate its realistic exposure before deciding whether to disclose.
Key mitigants beyond VSD include: a compliance programme that existed and was operating at the time of the violation (even an imperfect one), cooperation with OFAC's investigation, remedial action taken promptly after discovery, and the absence of a prior sanctions history. Each of these can reduce the penalty further. Conversely, aggravating factors – management involvement, a pattern of violations, harm to the integrity of a sanctions programme, or obstruction – can override even a timely VSD and push the penalty into the egregious range.
OFAC also considers the economic benefit derived from the violation. A transaction that generated a significant margin is treated differently from one that produced nominal value. Does your internal investigation quantify the economic benefit? If not, OFAC will – and their calculation may be less favourable.
The interaction between VSD and OFAC's five-element compliance commitment framework matters here too. OFAC's published guidance on an effective compliance programme identifies five elements: management commitment, risk assessment, internal controls, testing and auditing, and training. A business that can demonstrate that a programme meeting those five elements was in place – and that the violation was an isolated failure, not a systemic one – is positioned to argue for the lowest penalty tier or, in some cases, a no-action outcome.
Cross-border considerations: how other regimes treat voluntary disclosure
A disclosure to OFAC does not automatically satisfy disclosure obligations under other regimes, and in our experience this is the most consequential planning error that cross-border businesses make. The same set of transactions can trigger parallel obligations under OFSI in the United Kingdom, the European Union's relevant sanctions regulations, and the laws of the counterparty's home jurisdiction.
Under OFSI – the UK's Office of Financial Sanctions Implementation – there is a separate reporting obligation. OFSI's enforcement guidance requires that a person who knows or suspects they have breached UK financial sanctions, or that another person has done so, must report that suspicion without delay. This is a mandatory reporting obligation, not a discretionary one. It runs in parallel with OFAC's regime, not as an alternative to it. OFSI and OFAC are distinct authorities with distinct enforcement powers, and a disclosure that satisfies OFAC does not bind OFSI's assessment of the same underlying conduct.
The EU regime adds another layer. EU sanctions regulations impose reporting obligations on persons who hold or control funds or economic resources belonging to designated persons. There is no single EU-wide VSD mechanism equivalent to OFAC's; obligations and enforcement fall to the competent authority of each Member State, and the approach varies. A cross-border group with operations in multiple EU Member States may face parallel reporting obligations in each of those jurisdictions.
The UN Security Council's sanctions regime is administered through Member States' national implementation. A violation of UN-derived sanctions is therefore reported under the national regime of the relevant jurisdiction, not directly to the Security Council.
For businesses operating between the US, the UK, and the EU simultaneously – which describes most of the cross-border corporate clients we advise – the sequencing of disclosures across jurisdictions is a strategic decision. Disclosure to one authority at the wrong time can prejudice the position in another. This is not a process to manage without experienced cross-border sanctions counsel.
If a transaction has already been flagged, or a disclosure to one authority has already been made, an early multi-regime review can preserve options that narrow quickly. Write to info@caldervance.com for a confidential assessment.
Risk flags that compromise a voluntary self-disclosure
The most damaging VSD errors are not legal errors – they are process and timing errors that a compliance team makes in the hours and days after a violation is discovered. Understanding the most common failure modes protects a disclosure that would otherwise succeed.
Incomplete transaction identification is the most frequent problem. An apparent violation discovered in one business line may reflect a systemic issue across others. If the VSD covers only the transactions that triggered the audit finding, and OFAC's own review identifies additional apparent violations that were not disclosed, the company is in a materially worse position than if it had disclosed nothing. OFAC views an incomplete disclosure as evidence of a lack of genuine cooperation.
Premature remediation can also create problems. Taking corrective action before the scope of the violation is fully understood – for example, terminating a counterparty relationship before its ownership chain has been fully mapped – may destroy records or foreclose avenues of inquiry that OFAC will want to examine. Remediation is important, but it should follow an internal scoping exercise, not precede it.
Disclosure by the wrong person within the organisation creates its own risks. A VSD is a legal submission to a federal authority. It should not be prepared or submitted by a person who is not authorised to bind the entity, and it should not be submitted without legal review. Errors in the submission are difficult to correct after filing without drawing attention to the error itself.
Parallel criminal exposure is a risk that a civil VSD does not remove. OFAC operates on the civil side. DOJ, which handles criminal export-control and sanctions enforcement, is a separate authority. A VSD to OFAC does not immunise a company or its employees from criminal prosecution, and the content of a civil VSD can in principle be used in a criminal proceeding. Whether to disclose, and what to say, requires advice on both civil and criminal exposure simultaneously.
When is voluntary self-disclosure not the right route?
VSD is not always the correct decision, and advising a client to disclose without first assessing whether a violation actually occurred is a failure of counsel. Not every apparent hit on a screening system reflects an actual prohibition. Not every transaction involving a party with a similar name to a listed entity is a violation. Due diligence and internal investigation come before disclosure, not after.
There are situations where disclosure could be counterproductive. If the apparent violation is, on proper legal analysis, not a violation at all – because the activity fell within a general licence, the counterparty is not in fact the listed entity, or a relevant exemption applies – then submitting a VSD unnecessarily opens an inquiry into conduct that OFAC would never have investigated. A thorough analysis before disclosure, not after, is the correct sequence.
There is also the question of whether OFAC is already aware. If the apparent violation has come to light because of an external inquiry, a correspondent bank's suspicious transaction report, or a government contact, the calculus changes. Disclosure at that point may still carry some mitigation credit, but it will not carry the full weight of a genuinely voluntary and unprompted disclosure. This is a fact-specific judgment.
A common assumption – and one we address directly in our practice – is that VSD is always the safe option, the conservative choice. It is not. It is the right choice in many cases, possibly most. But it is a choice that requires a legal assessment of the underlying facts, the applicable programme, the ownership structure, and the parallel-regime implications before the submission button is pressed.
How Calder & Vance supports a voluntary self-disclosure
We advise businesses and individuals at every stage of a VSD matter: from the initial internal triage, through the scoping exercise, through the drafting and submission of both the initial notice and the full report, through OFAC's follow-up queries, and through the final resolution. Our role is to assess the exposure, structure the disclosure to maximise the available mitigation, and manage the parallel obligations under OFSI, the EU regime, and any other relevant jurisdiction.
In a recent matter, a financial services firm identified a series of payment transactions that appeared to involve a counterparty with links to a designated entity. We scoped the apparent violations, mapped the ownership structure, assessed the cross-regime implications across the US and UK, and prepared a two-stage VSD submission to OFAC while simultaneously advising on the parallel OFSI reporting obligation. The matter resolved within the timeframes that a well-managed disclosure process typically produces, and the client's compliance programme was restructured to address the control gaps that had allowed the transactions to proceed.
We also advise on the companion question of whether VSD is appropriate in the first instance: classifying the apparent violation, identifying applicable general licences and exemptions, and assessing the realism of a no-violation conclusion before any submission is made. For enforcement matters that are already under way, we prepare penalty defences, manage OFAC's information requests, and advise on settlement negotiations.
Cross-regime coverage – OFAC, OFSI, EU, and the other regimes in scope for your business – is handled under one engagement, not through a collection of separate referrals. That is the practical advantage of a specialist cross-border sanctions practice.
Related practices
- Apparent Violation Assessment – EU – assessing apparent violations under EU sanctions regulations and structuring a response
- Voluntary self-disclosure under OFAC: advanced issues – detailed treatment of egregious cases, parallel criminal exposure, and multi-regime coordination
- Apparent Violation Assessment – EU (II) – enforcement defence and penalty mitigation under EU and Member State sanctions regimes