A US exporter ships dual-use components to a distributor in a third market. Months later, federal agents make contact. The shipment, it emerges, involved a party on the SDN List (OFAC's list of Specially Designated Nationals and blocked persons), and the goods had an ECCN (Export Control Classification Number under the US Commerce Control List) requiring a licence that was never obtained. Two separate statutory regimes are now in play simultaneously. The criminal exposure in export-control cases under OFAC is not theoretical – it is immediate.
Criminal exposure in export-control cases under OFAC arises when a person or company knowingly or wilfully violates sanctions or export-control statutes, including IEEPA and the Export Control Reform Act. The Department of Justice leads criminal prosecution; OFAC retains parallel civil-enforcement authority. Both can proceed at the same time, and the penalties under each are independent. As of April 2026, businesses facing a government inquiry, a voluntary-disclosure decision, or a subpoena need specialist counsel before they respond.
This page explains the legal basis for criminal liability, the procedure from first contact to resolution, the critical divergences between the US position and the UK and EU positions, the risk flags that escalate civil matters into criminal referrals, and how Calder & Vance assists businesses and individuals at each stage.
What is the legal basis for criminal liability in OFAC export-control cases?
Criminal liability in US sanctions and export-control cases flows from two principal statutory sources: IEEPA, which authorises the OFAC sanctions programmes, and the Export Control Reform Act, which governs the Export Administration Regulations administered by BIS. Wilful violations of IEEPA-based sanctions carry criminal penalties. Export-control offences under the EAR similarly attract criminal exposure. Both statutes are extraterritorial in reach: a non-US person who causes a US-nexus transaction can fall within their scope.
The DOJ is the prosecuting authority. OFAC and BIS refer matters to DOJ when the evidence crosses the willfulness threshold. In practice, the agencies co-ordinate early. An OFAC civil investigation can pivot to a joint OFAC-BIS-DOJ inquiry within weeks of a referral, and the investigative file compiled during the civil phase migrates directly into the criminal inquiry. What a company says – or fails to say – during the civil phase therefore carries criminal consequences. That is the single most important structural fact about this area of law.
Extraterritoriality is the feature that surprises cross-border businesses most. A European trading company that routes a US-origin item through a third country, or that processes a US-dollar payment touching a US correspondent bank, can face the same criminal exposure as a US-domiciled exporter. The US-nexus requirement is satisfied by the dollar clearing alone. In our experience, this is the point at which many European and Asian compliance teams underestimate their exposure until a subpoena or a grand-jury notice arrives.
How does the criminal investigation process unfold?
Criminal export-control investigations typically move through five identifiable stages, each with distinct decision points where legal advice changes the trajectory of the matter. Early involvement of experienced sanctions counsel compresses risk at every stage.
- Trigger and initial contact. The trigger may be a subpoena, a knock-and-talk visit by federal agents, a grand-jury notice, a letter from OFAC or BIS, or an internal discovery during a compliance review. At this point the company or individual has no formal obligation to speak – and the strongest practical obligation of all not to do so without counsel present.
- Parallel-track assessment. Once counsel is engaged, the immediate task is mapping the civil and criminal exposure simultaneously. OFAC civil liability, BIS administrative liability, and DOJ criminal liability all have separate legal standards, separate penalties, and separate resolution mechanisms. The map determines the strategy.
- Voluntary self-disclosure decision. A VSD (voluntary self-disclosure to a regulator) is a formal mechanism under both OFAC and BIS guidance. A timely, thorough VSD can qualify as a significant mitigating factor in civil proceedings and can influence how DOJ weighs a criminal referral. The decision to disclose is irreversible. It must be based on a complete internal investigation, a sober assessment of what the disclosure will contain, and a clear-eyed view of whether it consolidates or expands the legal risk.
- Internal investigation and document preservation. Counsel directs a structured review of transaction records, communications, classification decisions, screening logs, and approvals. Legal-professional privilege attaches to the work product of that review when conducted properly. Privilege is the structural protection that separates a managed investigation from an uncontrolled one.
- Resolution. Resolution in a criminal export-control matter can take several forms: a declination by DOJ, a deferred prosecution agreement, a non-prosecution agreement, a guilty plea, or trial. Civil and administrative matters run to separate resolution tracks, potentially simultaneously. The goal is to achieve the best available outcome across all three tracks, not to optimise one at the cost of the others.
The position above covers the standard track. Your facts – the goods, the counterparty, the route, the US nexus, the state of your internal records, and the regime in play – change the analysis significantly. For a confidential assessment of your exposure at any stage of this process, contact Calder & Vance at info@caldervance.com.
How does US criminal exposure compare with EU and UK enforcement?
Cross-border businesses operating under both US and European sanctions regimes face a structural divergence in enforcement posture that is material to legal strategy. Under the US system, criminal prosecution is an explicit and regularly used tool. DOJ brings criminal cases in export-control matters with meaningful frequency. The UK and EU regimes do not carry the same depth of criminal enforcement infrastructure, though that is changing.
In the UK, OFSI administers financial-sanctions enforcement under SAMLA. OFSI holds civil monetary-penalty authority and refers serious matters to law-enforcement agencies for criminal investigation. The criminal standard under UK law requires proof of knowledge or reasonable cause to suspect. ECJU administers export-licensing enforcement; criminal prosecution for unlicensed exports is available under the Export Control Order. The UK regime is therefore criminal-capable, but the enforcement posture has historically been more heavily weighted toward civil penalties and licence refusals.
The EU operates through Member State authorities. Council regulations impose the prohibitions; national authorities prosecute. The result is divergence across Member States in both enforcement frequency and criminal-penalty levels. An EU-based group with US-origin goods in its supply chain may face simultaneous exposure under the EAR, US sanctions, and one or more EU Member State regimes. Where those regimes diverge – particularly on the treatment of dual-use items with no equivalent EU classification – the stricter prohibition governs each jurisdiction independently.
The practical consequence for a multinational is this: a decision taken to manage US exposure – including a VSD or a cooperation agreement with DOJ – can have direct evidentiary consequences in EU or UK proceedings if those authorities have access to the same transaction record. Co-ordinated cross-regime strategy is not a luxury; it is a structural requirement. We regularly advise clients navigating simultaneous US and EU exposure, and the management of that interaction is one of the most technically demanding aspects of this work.
What risk flags escalate a civil matter into a criminal referral?
Not every sanctions or export-control violation becomes a criminal case. The escalation from civil to criminal turns on a cluster of factors that OFAC, BIS, and DOJ assess in combination. Understanding those factors early shapes both the internal investigation and any disclosure decision.
The primary escalation indicators are:
- Willfulness evidence. Internal communications that demonstrate the company knew it was dealing with a blocked party, or knew the goods required a licence and shipped without one, satisfy the criminal intent element. Even a single internal email advising caution that was overridden by a commercial decision can constitute willfulness evidence.
- Volume and duration. A pattern of repeated transactions over an extended period, particularly where each transaction was individually approved, suggests a systemic rather than inadvertent failure. Systemic failures attract criminal referral; isolated inadvertent errors tend to remain civil.
- Concealment or obstruction. Any effort to obscure the nature of a transaction, alter records, or mislead the investigating authority after an inquiry begins carries independent criminal exposure for obstruction. This is distinct from the underlying export-control violation and may be treated as the more serious offence.
- Sensitive goods or end-users. Where the goods involve items with weapons or proliferation potential, or where the ultimate end-user is a military or government entity in a country subject to comprehensive sanctions measures, the political and investigative priority is higher. These cases move faster toward criminal referral.
- Prior notice or warnings. A company that received a prior warning, a prior civil penalty, or an internal compliance finding and continued the conduct is in a materially worse position than one facing a first-time exposure.
A common misconception worth addressing directly: some compliance teams believe that an absence of intent – because the classification error was made in good faith or the screening system was inadequate – provides a complete defence to criminal liability. It does not. Willful blindness, meaning deliberate ignorance of a risk that the company was on notice to investigate, can satisfy the criminal intent standard. A company that never classified its products properly, or that deployed a screening tool it knew was incomplete, may be found to have been wilfully blind. The distinction between negligence and wilful blindness is one of the most consequential analytical questions in this area of practice.
If a transaction has already been flagged, or if an internal review has surfaced potential violations, early legal advice preserves options that narrow with time. Contact Calder & Vance at info@caldervance.com for a confidential review.
What does voluntary self-disclosure actually involve, and when is it the right route?
A VSD is a formal submission to OFAC, BIS, or both, in which a company proactively discloses apparent violations before a government inquiry has identified them independently. Both OFAC and BIS treat a timely, complete, and accurate VSD as a significant mitigating factor in calculating the civil penalty base. The mitigation is real and substantial – but it is conditional on the disclosure being complete.
The VSD decision is not a procedural formality. It is a strategic legal judgment that requires a completed internal investigation before the submission is made. A VSD filed before the internal investigation is finished, or one that omits material facts because the internal review was inadequate, is worse than no VSD at all. OFAC's enforcement guidance makes clear that incomplete or misleading disclosures are treated as aggravating factors. Filing a VSD is therefore a two-stage commitment: complete the investigation first; then disclose fully.
On the criminal track, a VSD to OFAC or BIS does not constitute a disclosure to DOJ, and it does not bind DOJ's decision on whether to prosecute. However, a well-documented, co-operative posture – combined with a completed internal investigation, evidence of programme remediation, and prompt notification to all relevant authorities – is a significant factor in DOJ's declination analysis. In our practice, the coordination between the civil VSD, the criminal-track approach, and the internal investigation timeline is the most operationally intensive part of an early-stage enforcement matter. Getting that sequencing right matters.
Not every matter warrants a VSD. Where the internal review concludes that no violation occurred, or that the apparent violation was caused by a third party without the company's knowledge, a VSD may not be appropriate. The analysis is always fact-specific. We assess eligibility, structure the internal investigation, prepare and submit the disclosure, and manage the regulator's queries throughout the process.
How do businesses address the common misconception that export-control violations are "customs issues"?
One of the most persistent misunderstandings we encounter is the belief that export-control violations are, at bottom, customs or regulatory infractions – the kind of technical breach that attracts a fine and some paperwork. This is the myth. The reality is that US export-control violations under the EAR and OFAC sanctions violations under IEEPA are federal criminal statutes. They are prosecuted by the Department of Justice in federal courts. They carry the prospect of custodial sentences for individuals, criminal fines for companies, and debarment from future government contracting.
The customs framing also obscures the jurisdictional reach. A customs violation is, by definition, a matter for the country of export. US export-control and sanctions violations follow the goods, the dollar, and the US person wherever they go. A transaction that never physically crossed US territory may still constitute a US federal offence if it involved a US-origin item, a US-dollar payment, or a US person at any point in the chain.
In a recent matter, a manufacturing business in the EMEA region discovered during an internal systems review that a series of sales to a regional distributor had involved a party whose ownership chain, when traced through three intermediate holding companies, included a blocked person at the 50 percent or more ownership level. The items sold had ECCN classifications that required a licence for export to the relevant destination. No licence had been sought. We scoped the apparent violation, conducted the internal investigation under privilege, advised on the VSD decision, and prepared the submission to the relevant US authorities. The matter was resolved on the civil track without a criminal referral, and the company implemented a redesigned classification and screening programme.
Could this have been managed as a customs matter? No. The governing statutes, the investigating authorities, the resolution mechanisms, and the potential consequences were all federal criminal law instruments from the outset.
How Calder & Vance assists with criminal export-control exposure under OFAC
Our enforcement practice handles criminal export-control exposure under OFAC and BIS at every stage of the matter: from the first indication of a potential problem through to resolution and programme remediation. We work with both companies and individuals, and we operate across the US, UK, and EU regimes simultaneously where a cross-border exposure requires it.
Our action library in this area covers the full investigation and enforcement cycle:
- Scoping the apparent violation and mapping the civil, administrative, and criminal exposure across all relevant regimes from the first engagement.
- Directing the internal investigation under legal-professional privilege, ensuring the evidentiary record is controlled and the investigation is completed before any disclosure decision is made.
- Advising on the VSD decision and, where a VSD is the correct route, preparing and submitting a complete, accurate disclosure to OFAC and BIS.
- Managing the criminal-track parallel to the civil investigation, including co-ordinating the posture toward DOJ with the civil-disclosure strategy.
- Preparing the penalty defence in civil proceedings, applying the full range of OFAC and BIS mitigating factors including co-operation, remediation, and voluntary disclosure.
- Advising on export-classification reviews and screening-programme redesign following resolution, to prevent recurrence and to demonstrate to the authorities that the systemic cause has been addressed.
- Coordinating with local counsel in the relevant jurisdiction where EU or UK enforcement proceedings run in parallel.
Our practice covers the US, UK, and EU regimes under one roof. We do not hand off the cross-border analysis to a separate team; the multi-regime view is integrated from the first engagement. We have acted for multinationals, mid-market exporters, financial intermediaries, and individuals facing personal criminal exposure in export-control and sanctions enforcement matters.
Related practices
- Apparent violation assessment – EU sanctions – scoping EU apparent violations and advising on the disclosure and remediation route.
- Criminal export-control exposure under OFAC – related matters – connected enforcement and investigation support for complex multi-party OFAC cases.
- Enforcement mitigation factors under BIS and the EAR – maximising mitigating factors in BIS administrative and criminal penalty proceedings.