An export shipment clears customs. Months later, federal agents contact the exporter's logistics director. A grand jury subpoena follows. At that moment, the question is no longer whether a compliance gap existed – it is whether that gap rises to the level of a criminal violation under US export-control and sanctions law, and who in the organisation bears personal liability.
Criminal exposure in export-control cases under OFAC arises when apparent violations of US economic-sanctions law are accompanied by wilful conduct, knowing disregard of legal obligations, or deliberate circumvention of controls. The US Department of Justice prosecutes such matters under IEEPA and the Export Control Reform Act, and penalties can include substantial custodial sentences as well as significant financial penalties. Early involvement of specialist compliance counsel – before a government inquiry crystallises – is the single most important step a business or individual can take.
This page explains how criminal liability attaches under the US regime, where it diverges from the civil enforcement track, how comparable regimes in the United Kingdom and the European Union treat similar conduct, and what a business should do from the moment a risk is identified.
What governs criminal liability for export-control and sanctions violations in the United States?
Criminal exposure in export-control cases under OFAC is governed primarily by IEEPA and, for export-control matters, by the Export Control Reform Act administered by the US Commerce Department's Bureau of Industry and Security. IEEPA provides the statutory authority for most of OFAC's economic-sanctions programmes; wilful violations of its prohibitions are criminal offences carrying significant custodial terms and financial penalties. The Export Control Reform Act similarly criminalises knowing violations of export-control requirements under the Export Administration Regulations.
Two enforcement bodies share jurisdiction over this space. OFAC handles administrative civil enforcement of sanctions violations. The Department of Justice – typically through its National Security Division – handles criminal prosecution. These tracks are not mutually exclusive. A business may face civil and criminal proceedings simultaneously, each governed by different standards of proof and different penalty regimes. In our experience, businesses that treat a DOJ inquiry as a civil compliance matter in disguise are not adequately prepared for what follows.
The criminal standard turns on intent. Wilful violations – those committed with knowledge that conduct is unlawful, or with deliberate indifference to that knowledge – attract criminal exposure. Inadvertent or negligent violations typically remain on the civil track, though OFAC's aggravating factors can push civil penalties to their upper bound even without criminal referral. The line between the two is rarely obvious at the start of an inquiry, which is precisely why characterising the exposure early is essential.
The position above covers the standard case. Your facts – the nature of the goods, the counterparty's location, the documentation trail, the role of each individual in the decision chain – change the analysis significantly. To assess your specific exposure, contact Calder & Vance at info@caldervance.com.
Civil enforcement versus criminal prosecution: where does the distinction matter most?
The civil enforcement track and the criminal prosecution track operate in parallel, but they impose different obligations on a business once an inquiry begins. Understanding the distinction governs every decision about disclosure, cooperation, and document preservation.
On the civil side, OFAC enforces through administrative findings, civil monetary penalties, and – for the most serious cases – referral to DOJ. OFAC's enforcement guidance sets out a matrix of aggravating and mitigating factors. Cooperation, a strong pre-existing compliance programme, and voluntary self-disclosure (VSD) – the act of proactively reporting an apparent violation to OFAC before the agency identifies it independently – can each reduce the civil penalty base materially. OFAC has stated publicly that timely VSD is among the most significant mitigating factors it considers.
On the criminal side, the standard is entirely different. Cooperation with DOJ, including whether a business enters a formal cooperation agreement or a deferred prosecution arrangement, turns on factors that go beyond what OFAC considers: the nature of the conduct, the culpability of individuals, the adequacy of internal controls, and the degree of candour demonstrated from the outset. A VSD to OFAC does not automatically satisfy DOJ; the agencies coordinate but pursue separate analyses.
Individual liability is the most significant divergence. Civil penalties generally fall on the legal entity. Criminal liability attaches to individuals – directors, compliance officers, operations staff, logistics directors – who knowingly participated in a violation. In our practice, the first meeting with a client facing a criminal inquiry always addresses this question: which individuals are exposed, and do they require separate representation?
If a transaction has already been flagged, or if a government inquiry has begun, an early review can preserve options that narrow rapidly with time. Contact Calder & Vance at info@caldervance.com for a confidential assessment.
How does criminal exposure under OFAC compare with the UK and EU enforcement regimes?
Criminal exposure in export-control cases is not limited to the US regime. Businesses operating across borders face parallel criminal exposure under UK and EU rules, and the standards for criminal liability differ in ways that matter operationally.
In the United Kingdom, OFSI enforces financial sanctions under the Sanctions and Anti-Money Laundering Act. The UK also maintains a criminal sanctions-enforcement track under the same statute. OFSI's enforcement guidance distinguishes between civil monetary penalties – which OFSI can impose on an administrative basis – and criminal referrals, which follow the more serious pattern of knowingly or intentionally breaching a financial-sanctions prohibition. The ECJU administers export licensing separately; criminal liability for export-control violations in the UK arises under the Export Control Order, with prosecutions brought in the Crown Court. Custodial sentences are available for the most serious matters.
In the European Union, sanctions enforcement is decentralised: member states apply criminal sanctions through their national legal systems, implementing the obligations imposed by Council regulations. This means that a single cross-border transaction can generate criminal exposure in multiple member-state jurisdictions simultaneously, each with its own prosecution threshold, penalty range, and procedural regime. The absence of a single EU-level criminal enforcement authority makes multi-jurisdiction coordination essential.
One point of direct divergence is extraterritoriality. US criminal export-control law can apply to non-US persons and non-US entities when the prohibited conduct has a sufficient nexus to the United States – a US-origin item, a US financial institution, or even a US-dollar clearing transaction. UK and EU criminal provisions generally operate within their own territorial scope, though the practical impact for a business with US operations or US banking relationships is that OFAC and DOJ exposure overlaps with UK and EU exposure. Where the conduct is more restrictive under US law, the US prohibition governs for any element touching the US nexus. The stricter prohibition applies, and that is almost always the US position.
What are the main risk flags that indicate criminal rather than civil exposure?
Certain patterns consistently distinguish inquiries that remain on the civil enforcement track from those that attract DOJ attention. Identifying these risk flags early is the first function of specialist compliance counsel in a criminal export-control matter.
The most significant risk flag is evidence of knowledge. Where internal communications – emails, messaging platform records, briefing notes – show that individuals understood the legal prohibition and proceeded regardless, the civil-versus-criminal line shifts sharply. Document-preservation obligations arise immediately once a risk is identified; failure to preserve creates an independent exposure.
A second risk flag is pattern. A single shipment misrouted through an intermediate country without adequate due diligence may be negligent. A series of similar shipments following an internal query about the legal position is a different matter entirely. Pattern evidence suggests that a system existed to circumvent the control rather than comply with it – and that is the paradigm criminal case.
Third, the involvement of a listed person or a sanctioned counterparty – particularly where the business performed a screening check, received a hit, and proceeded without obtaining a licence or a legal opinion – is a strong indicator of wilfulness. The same applies where an ECCN (Export Control Classification Number under the US Commerce Control List) was mis-stated on export documentation in a manner that reduced licensing requirements.
Fourth, prior notice is a significant factor. If OFAC or BIS has previously identified compliance deficiencies – through a warning letter, a prior civil settlement, or a finding of a violation – and the same or similar conduct occurs again, DOJ will treat the repeat conduct as strong evidence of wilfulness. We regularly advise clients reviewing prior enforcement history before a new matter arises, precisely to understand this risk.
Finally, individual concealment – altering documents, instructing logistics providers to mis-describe cargo, removing records from files – transforms what might have been an administrative failing into criminal obstruction. Counsel must assess whether any such acts have occurred before advising on the appropriate response to an inquiry.
What is the procedure once criminal export-control exposure is identified?
Once a business or individual identifies potential criminal exposure in an export-control or sanctions matter, a defined sequence of steps governs the appropriate response. Deviating from that sequence – or acting without specialist advice – can convert a manageable situation into one with materially worse outcomes.
The first step is an immediate internal legal hold. All potentially relevant documents – shipping records, compliance screening logs, internal approvals, communications with counterparties and freight forwarders – must be preserved. Destroying or altering records after an inquiry is reasonably anticipated is a separate criminal offence. The preservation obligation arises before any government contact; it is triggered by internal knowledge of potential exposure.
The second step is a privileged internal investigation. This is conducted by external counsel, not by internal compliance staff, to preserve the attorney-client privilege and work-product protection that apply to the investigation's findings. The investigation scopes the apparent violation, identifies the individuals involved, assesses the intent indicators, and maps the applicable regimes. Its output governs every subsequent decision.
The third step is a voluntary self-disclosure analysis. VSD to OFAC – and, separately, to BIS if EAR issues are present – is a significant mitigating factor in civil enforcement. Its interaction with DOJ's assessment of cooperation is more complex. External counsel must advise on timing, scope, and the implications of disclosure before the decision is made. A premature or incomplete disclosure can be worse than a well-prepared one made slightly later.
The fourth step is individual representation. Where the internal investigation identifies individuals who may bear personal criminal exposure, those individuals require their own legal counsel, separate from the firm's counsel. Conflicts of interest between the entity and its personnel arise early and must be managed from the outset.
The fifth step is engagement with the regulator and, where relevant, the prosecutor. This includes responding to document requests, managing grand jury subpoenas, and – in appropriate cases – approaching DOJ to explore deferred-prosecution or non-prosecution frameworks. The strength of the cooperation case, and the remediation measures the business has already implemented, are the primary determinants of the outcome.
What is the myth about criminal export-control exposure that puts businesses at risk?
One objection we hear often is this: "Our compliance team identified the issue internally and we corrected it, so the legal exposure has been managed." This is a common misconception and a dangerous one.
Internal identification and correction of a compliance gap is genuinely important. It demonstrates that a compliance programme is functioning. But it does not eliminate the underlying legal exposure for the conduct that occurred before correction. OFAC's civil enforcement reach is not suspended by remediation; DOJ's criminal interest is not extinguished by an internal fix. The question of whether a prior apparent violation was wilful, whether it should have been disclosed, and whether the business's response to its own discovery was adequate are all live issues regardless of the correction made.
In our experience, businesses that self-correct without external legal advice – and without assessing their VSD obligations or the criminal-exposure indicators – sometimes learn months or years later that an apparent violation they thought was resolved has generated a government inquiry. By that point, the options available at the time of discovery have largely expired. The time to involve specialist counsel is when the gap is identified, not when the subpoena arrives.
How does Calder & Vance support clients facing criminal export-control exposure under OFAC?
Calder & Vance acts for businesses and individuals at every stage of a criminal export-control matter, from initial risk identification through resolution of government inquiries. Our work is limited to lawful compliance, enforcement defence, licensing, and due diligence. We do not advise on circumventing or evading sanctions.
In a recent matter, a technology distributor identified a pattern of shipments that may have reached a sanctioned destination through an intermediate distribution chain. We scoped the apparent violation, assessed the intent indicators across the relevant documentation, and advised on voluntary self-disclosure timing and scope under both OFAC and BIS. The matter was managed through the administrative civil track; the criminal-exposure indicators were addressed in the disclosure presentation. No guarantee of outcome is implied or offered – each matter turns on its specific facts.
Our action library for criminal export-control matters includes:
- Scoping the apparent violation across the applicable US and non-US regimes and identifying the criminal-exposure indicators
- Conducting a privileged internal investigation and advising on individual representation conflicts
- Advising on voluntary self-disclosure – timing, scope, and interaction with DOJ
- Preparing the penalty defence and the remediation evidence package
- Managing regulator and DOJ engagement, including document requests and cooperation frameworks
- Reviewing and redesigning the compliance programme to address the root cause identified
We advise across OFAC, BIS, OFSI, the ECJU, the EU Council regulations, and the criminal enforcement regimes of the major trading jurisdictions. For cross-border matters where a single transaction touches multiple regimes simultaneously, we coordinate with local counsel in the relevant jurisdiction.
Related practices
- Apparent violation assessment – EU – assessing apparent violations under EU Council regulations and advising on disclosure
- Enforcement mitigation – BIS / EAR – building the mitigation case under the Export Administration Regulations
- Enforcement mitigation – EU – managing the mitigation and remediation case before EU national enforcement authorities
Frequently asked questions: criminal exposure in export-control cases under OFAC
How long does assessing criminal export-control exposure take under OFAC?
The timeline depends on the volume and complexity of the underlying conduct. An initial scoping review – establishing whether criminal-exposure indicators are present and what regulatory obligations are immediately triggered – typically takes a matter of days once counsel has access to the relevant documentation. A full privileged internal investigation, covering the entire scope of apparent violations and individual liability, takes longer and is calibrated to the facts. Where a government inquiry has already begun, counsel must respond to external timelines set by the regulator or prosecutor. Speed of engagement is critical; preserving options requires early action.
What are the main risks in criminal exposure in export-control cases under OFAC?
The primary risks are individual custodial sentences for executives and compliance personnel who knowingly participated in a violation, significant financial penalties at the entity level, and reputational damage that affects counterparty relationships and banking access. Secondary risks include parallel civil enforcement by OFAC alongside DOJ criminal proceedings, multi-jurisdiction exposure where the same transaction touches UK, EU, or other sanctions regimes, and obstruction liability arising from inadequate document preservation once exposure is identified. Each of these risks is manageable if counsel is involved early; each becomes harder to address once a formal inquiry is under way.
Do we need specialist counsel for criminal exposure in export-control cases?
Yes. Criminal export-control matters sit at the intersection of sanctions law, criminal procedure, privilege, and individual employment law. General counsel familiar with civil compliance matters may not be equipped to manage the privilege issues, the conflict analysis between entity and individual, or the interaction between OFAC's civil track and DOJ's criminal track. Specialist sanctions and enforcement counsel is required from the moment criminal-exposure indicators are identified. Engaging general commercial lawyers at this stage – or relying solely on internal compliance resource – risks decisions that narrow the options available at every subsequent step.
About the author
J. M. Aldridge advises multinationals and financial institutions on US sanctions and export controls, with a focus on OFAC licensing, secondary-sanctions risk, and BIS classification. J. M. Aldridge has acted for businesses and individuals across a range of criminal and civil enforcement matters involving OFAC, the Department of Justice, and BIS, covering both voluntary self-disclosure and formal enforcement proceedings. Calder & Vance – International Sanctions & Export Control Counsel.
About Calder & Vance
Calder & Vance is an independent international sanctions and export-control boutique. We advise multinationals, financial institutions, exporters, and individuals on the major regimes – OFAC and BIS in the United States, OFSI and ECJU in the United Kingdom, the EU Council regulations and the EU General Court, the United Nations Consolidated List, and the regimes of Switzerland, Canada, Australia, the UAE, Singapore, and Japan. Our work is limited to lawful compliance, licensing, delisting, enforcement defence, and due diligence. To discuss a matter, contact info@caldervance.com.
Disclaimer: This material is general information, not legal advice, and is not a substitute for advice on your specific facts. Sanctions and export-control rules change frequently and differ by regime; verify the current position before relying on anything stated here. Calder & Vance does not advise on circumventing or evading sanctions. For advice on your situation, contact info@caldervance.com.