A payments firm operating between New York and a third-market correspondent bank processes a batch of transactions. A post-settlement review flags one counterparty as potentially connected to a designated entity. The funds have moved. The question now is not whether a violation occurred – it is what the firm does next, and how quickly.
Under OFAC's enforcement regime, a company that identifies an apparent violation and reports it to OFAC before the agency discovers it independently may qualify for voluntary self-disclosure (VSD – a proactive report to OFAC describing the facts of an apparent violation, submitted before the agency opens an inquiry). A VSD, properly constructed and timed, is treated by OFAC as a significant mitigating factor and can reduce the base civil monetary penalty by a substantial amount. The governing authority is OFAC itself, acting under powers granted by statutes including IEEPA and TWEA.
This briefing sets out how the VSD process works under OFAC, where the US approach diverges from the UK and EU equivalents, what the risk flags are, and when a business should involve sanctions counsel.
What authority governs OFAC voluntary self-disclosure?
OFAC administers the US economic-sanctions programme and is the sole authority that receives and evaluates voluntary self-disclosures for apparent sanctions violations. Its enforcement powers derive from statutes including IEEPA and TWEA, implemented through programme-specific regulations for each active regime. OFAC's enforcement guidelines set out the factors the agency weighs when deciding whether to pursue a civil penalty, issue a cautionary letter, or close a matter with no action.
The guidelines distinguish between egregious and non-egregious cases. That distinction drives the penalty calculation. In an egregious case, a VSD reduces the base penalty by a meaningful proportion but the penalty itself can still be substantial. In a non-egregious case, a timely VSD – combined with other mitigating factors – can result in a penalty at the lower end of the applicable range, or in no penalty at all.
It is worth being precise about what OFAC can and cannot do. OFAC imposes civil penalties and issues cautionary letters. Criminal exposure for wilful violations sits with the Department of Justice, which operates a separate and parallel enforcement track. A VSD to OFAC does not automatically resolve criminal exposure, and where DOJ interest is possible, the two tracks must be managed concurrently by counsel.
The position above covers the formal regime. Your facts – the programme involved, the value of the transactions, the counterparty, the compliance culture of your organisation – change the analysis significantly.
To discuss whether a potential disclosure should be made, and how to structure it, contact Calder & Vance at info@caldervance.com.
What does OFAC's enforcement framework prohibit, and when does an apparent violation arise?
An apparent violation arises whenever a US person, or a non-US person with a sufficient US nexus, engages in a transaction that is prohibited under an OFAC programme – whether or not the party knew the transaction was prohibited at the time. OFAC's programmes prohibit a range of conduct: dealing in blocked property, providing services to designated parties, importing or exporting in breach of a country or sectoral programme, and processing financial transactions that benefit blocked persons.
The prohibited conduct is defined by the specific programme regulations. Those regulations cover: asset-blocking of parties on the SDN List (OFAC's Specially Designated Nationals and Blocked Persons List) and on certain sectoral and country-specific lists; broad country-wide embargoes that restrict virtually all transactions with a target country; and narrower sectoral restrictions that target specific industries or transaction types without a full asset freeze.
The key point for a VSD analysis is that strict liability applies. OFAC can pursue a civil penalty even where the apparent violation resulted from negligence, a screening failure, or a misidentification in an automated system – rather than from deliberate intent. Intent is a factor in the penalty calculation, but it is not a defence to liability. That is why the post-incident response – including the timing and quality of a VSD – matters so much.
A further complication is the 50 percent rule (OFAC's rule treating any entity owned 50 percent or more in the aggregate by one or more blocked persons as itself blocked, even if the entity is not separately named on any list). Dealing with such an entity constitutes an apparent violation, even if the counterparty passed automated screening. In our experience, the 50 percent rule is the single most common source of undetected apparent violations for firms that screen against named lists but do not map ownership chains.
How does the VSD procedure work in practice?
A VSD to OFAC is a written submission that describes the facts of the apparent violation in sufficient detail for the agency to evaluate the matter without conducting its own investigation. OFAC's guidelines identify the information it expects: the name and contact details of the reporting entity, a description of each apparent violation, the relevant OFAC programme, the parties involved, the dates and values of the transactions, the relevant nexus to the United States, and the steps taken to remediate the issue.
Timing is critical. A VSD filed before OFAC has opened an inquiry – or before the agency has become aware of the potential violation through another channel – qualifies as a full VSD and receives the maximum mitigating credit available for self-reporting. A submission made after OFAC has already contacted the company, or after a third party (a correspondent bank, for example) has reported the transaction to OFAC, is treated as a partial disclosure at best. The difference in credit can be significant.
After the initial VSD, OFAC typically sends a written acknowledgement and may request further information. The agency then evaluates the submission against its published penalty guidelines. Factors weighed include: the apparent violation's harm to US foreign-policy objectives, whether the party had adequate compliance controls, whether senior management was involved or aware, whether the company has a history of prior violations, and what remediation steps have been taken. A general licence (a standing authorisation that permits a defined category of transactions without a separate application) may be relevant if the transaction in question falls within a licensed category – but that analysis must happen before the disclosure is structured.
From submission to resolution, OFAC enforcement matters take time. The agency's workload means that straightforward non-egregious matters may take months to close; complex or egregious matters can extend substantially longer. Interim steps – such as preserving records, continuing remediation, and managing regulatory relationships – require ongoing attention throughout that period.
If your organisation has already identified an apparent violation and is deciding whether to disclose, early engagement with counsel can preserve options that narrow with every passing day. Contact Calder & Vance at info@caldervance.com for a confidential review.
How does the OFAC approach compare with UK and EU equivalents?
The OFAC VSD regime operates on a broadly similar principle to the UK and EU equivalents – proactive disclosure is rewarded – but the procedural detail and institutional context differ in ways that matter for cross-border businesses managing simultaneous exposure.
Under the UK regime, OFSI (the Office of Financial Sanctions Implementation) administers financial-sanctions enforcement in the United Kingdom. UK financial institutions and other regulated entities are subject to a legal obligation to report knowledge or reasonable suspicion of a financial-sanctions breach to OFSI under SAMLA (the Sanctions and Anti-Money Laundering Act). That obligation is a mandatory reporting duty, not a voluntary election. Going beyond mandatory reporting – by proactively providing a full factual account before OFSI opens an inquiry – can still attract mitigating credit in OFSI's penalty calculation, but the conceptual starting point is different from OFAC's purely voluntary regime.
In the EU, the picture is more fragmented. Enforcement of EU sanctions sits primarily with member-state competent authorities rather than with a single EU-level agency. The treatment of voluntary reporting varies by member state. A business that has exposure in France, Germany, and the Netherlands may face three different processes, three different institutional cultures, and three different timelines – even where the underlying EU Council regulation is the same. There is no EU-level equivalent of OFAC's single enforcement docket.
The practical cross-border implication is this: where an apparent violation engages both US and UK (or EU) obligations simultaneously – as is common for internationally active banks, payment firms, and trading businesses – each regime must be assessed independently, on its own timetable and under its own procedural rules. Filing a VSD with OFAC does not satisfy the OFSI reporting obligation, and vice versa. The sequencing of multi-regime disclosures, and the risk that one disclosure triggers an inquiry by another authority, requires careful management.
OFAC's extraterritorial reach adds a further dimension. Transactions processed in US dollars through US correspondent banks are within OFAC's jurisdiction, even when the underlying parties are not themselves US persons. That nexus is why a European bank or trading house may face OFAC exposure – and why a VSD to OFAC is a live question for non-US entities in a way that surprises many compliance officers encountering it for the first time.
What are the risk flags that should prompt immediate disclosure analysis?
Not every sanctions screening alert rises to the level of an apparent violation, and not every apparent violation requires an immediate VSD. The decision requires a structured analysis of the facts. Certain patterns, however, should trigger immediate escalation and a disclosure-readiness review.
First: any transaction that has cleared but subsequently triggers a positive match on the SDN List, or reveals a counterparty that may meet the 50 percent rule threshold, requires urgent assessment. The clock for a timely VSD starts when the firm has – or should have had – awareness of the potential issue. Delay in escalating an internal alert can undermine the "timely" characterisation of a later submission.
Second: a transaction value that is large relative to the firm's normal business, or a counterparty relationship with a pattern of flagged transactions, raises the egregious-case risk. In an egregious case, OFAC treats the harm to US foreign-policy objectives as a primary weighting factor, and the base penalty is calculated differently from the non-egregious path.
Third: where senior management or board members were directly involved in approving the relevant transactions, the management-culpability factor – one of the aggravating considerations in OFAC's penalty guidelines – comes into play. That factor can convert a mid-range non-egregious matter into a more serious proceeding.
Fourth: prior OFAC contact. If the firm has previously received a cautionary letter, a finding of violation, or a no-action determination, OFAC treats a subsequent apparent violation more seriously. Prior history is an aggravating factor and should be disclosed transparently in any VSD.
Fifth: parallel regulatory exposure. A VSD to OFAC may run alongside a separate Suspicious Activity Report to FinCEN, a mandatory OFSI report in the UK, or notifications to EU member-state competent authorities. Managing the interaction between these parallel tracks – including privilege considerations, information-sharing risks, and the risk of inconsistent statements across disclosures – is one of the most technically demanding aspects of cross-border enforcement response.
A common misconception is that a VSD is always the right answer. That is not so. In a small number of cases – where the apparent violation is isolated, the compliance controls in place were strong, and the OFAC nexus is genuinely uncertain – a voluntary disclosure may not offer more protection than maintaining a robust contemporaneous record and waiting. That analysis must be done on the specific facts. In our practice, we work through the penalty-calculation arithmetic for each scenario before recommending a course of action.
What remediation does OFAC expect alongside a VSD?
A VSD filed without accompanying remediation carries less mitigating weight than one paired with concrete compliance improvements. OFAC evaluates the quality and credibility of remedial steps as part of the mitigating-factor analysis. Remediation that is cosmetic, delayed, or not fully implemented by the time the matter resolves will not attract the same credit as action that demonstrably reduces the risk of recurrence.
OFAC's guidelines identify the elements of an effective compliance programme. These include: management commitment to sanctions compliance, a designated compliance function with adequate resource, risk-based controls calibrated to the business's geographic reach and counterparty profile, transaction screening against current and comprehensive lists, and regular testing and audit. A VSD submission that can point to changes in each of these areas – made promptly after the apparent violation was identified – is substantively stronger than one that relies on pre-existing controls that did not prevent the violation.
Record-keeping is integral to both remediation and the VSD itself. OFAC's rules require records relating to sanctions compliance to be maintained for a defined period. Gaps in records – missing payment instructions, incomplete counterparty data, absent ownership-chain documentation – are both a compliance failure in themselves and an obstacle to constructing a coherent VSD narrative. In our experience, firms that invest in transactional record-keeping as a routine matter find the disclosure and remediation process materially more manageable when an incident does occur.
What does a credible remediation plan actually look like? It is specific, time-bound, and tied directly to the root cause of the apparent violation. If the violation arose from a failure to screen beneficial owners against the SDN List, the remediation plan addresses beneficial-owner identification at the point of onboarding and periodically thereafter, not merely the front-end screening of named counterparties. If it arose from a gap in transaction monitoring for US-dollar legs, the plan addresses the monitoring logic for correspondent and intermediate accounts, not just the primary accounts.
When should a business involve sanctions counsel, and what will counsel do?
The answer is: earlier than most businesses instinctively think. The window between identifying a potential apparent violation and losing the "timely" characterisation of a VSD is not defined by a hard statutory deadline in every case, but it is real and it closes. Counsel needs time to assess the facts, evaluate whether a VSD is the right course, structure the submission, and manage the parallel-regime considerations before any disclosure is made.
The decision to disclose involves legal judgment, not just factual description. Counsel will assess the strength of the US nexus, evaluate the programme-specific regulations, apply OFAC's published penalty-calculation methodology to the specific facts, identify any available general-licence defences, and consider whether the matter also triggers mandatory reporting obligations under another regime. Those are not assessments that an in-house compliance team should make alone, particularly where criminal exposure cannot be excluded.
We regularly advise on OFAC voluntary self-disclosure decisions at the pre-submission stage – scoping the apparent violation, advising on the penalty arithmetic, preparing and submitting the VSD, and managing OFAC's subsequent questions. We also advise on the parallel UK and EU reporting obligations where a cross-regime matter requires coordinated disclosure.
In a recent matter, a financial-services business in the payments sector identified a series of transactions that may have involved a counterparty connected to a designated entity. We were instructed before any VSD had been prepared. We scoped the apparent violation, assessed the applicable OFAC programme, identified that the counterparty did not meet the 50 percent threshold on the facts as reconstructed, and advised the client on a records-preservation and monitoring programme rather than disclosure. That outcome depended entirely on the quality of the preliminary analysis. Had the client submitted a VSD before the ownership analysis was complete, the disclosure itself would have created a record that could not be withdrawn.
Related practices
- EU apparent violation assessment – structured analysis of potential EU sanctions breaches and disclosure options
- EU enforcement defence and investigation support – managing member-state competent authority inquiries following apparent violations
- OFAC apparent violation assessment – pre-VSD scoping, penalty-range analysis, and disclosure strategy for US-nexus matters
Frequently asked questions: voluntary self-disclosure under OFAC
Who administers voluntary self-disclosure under OFAC?
OFAC – the Office of Foreign Assets Control within the US Department of the Treasury – administers the voluntary self-disclosure process for apparent sanctions violations. OFAC receives the written VSD submission, acknowledges it, and evaluates it against the agency's published enforcement guidelines. Separate criminal exposure for wilful violations is handled by the Department of Justice on a parallel track; a VSD to OFAC does not automatically resolve DOJ exposure. Businesses with genuine criminal-risk indicators should take advice on both tracks concurrently.
What does OFAC prohibit in relation to voluntary self-disclosure?
OFAC does not prohibit voluntary self-disclosure – it actively encourages it through penalty-mitigation credit. What the underlying OFAC programmes prohibit is the original sanctioned conduct: dealing in blocked property, providing services to designated parties, processing transactions that benefit SDN-listed persons or entities, and engaging in transactions covered by programme-specific restrictions. A VSD describes that prohibited conduct to OFAC after the fact. The quality and timing of the VSD then affect the penalty outcome, but do not undo the apparent violation itself.
How is voluntary self-disclosure enforced under OFAC?
OFAC does not enforce VSD submissions directly; rather, it rewards them. A timely, complete, and accurate VSD is a significant mitigating factor in OFAC's civil-penalty calculation. Where the VSD is paired with strong remediation and no aggravating factors, OFAC may close the matter with a cautionary letter or a reduced penalty. Where a business that was aware of an apparent violation fails to disclose and OFAC discovers the matter independently, the absence of a VSD becomes an aggravating factor – and the penalty range can increase substantially as a result.
About the author
J. M. Aldridge advises multinationals and financial institutions on US sanctions and export controls, with a focus on OFAC licensing, secondary-sanctions risk, and BIS classification. J. M. Aldridge brings particular experience in voluntary self-disclosure decisions, enforcement defence, and cross-border compliance-programme design for businesses operating across the major sanctions regimes. Calder & Vance – International Sanctions & Export Control Counsel.
About Calder & Vance
Calder & Vance is an independent international sanctions and export-control boutique. We advise multinationals, financial institutions, exporters, and individuals on the major regimes – OFAC and BIS in the United States, OFSI and ECJU in the United Kingdom, the EU Council regulations and the EU General Court, the United Nations Consolidated List, and the regimes of Switzerland, Canada, Australia, the UAE, Singapore, and Japan. Our work is limited to lawful compliance, licensing, delisting, enforcement defence, and due diligence. To discuss a matter, contact info@caldervance.com.
Disclaimer: This material is general information, not legal advice, and is not a substitute for advice on your specific facts. Sanctions and export-control rules change frequently and differ by regime; verify the current position before relying on anything stated here. Calder & Vance does not advise on circumventing or evading sanctions. For advice on your situation, contact info@caldervance.com.