A compliance team at a mid-sized trading house flags an anomaly during a routine screening review. A wire payment routed through a US correspondent bank appears to have touched a counterparty whose beneficial owner was designated under OFAC rules months earlier. The transaction is historical. The bank has already processed it. Legal and compliance are now asking the same question: what happened, how far does the exposure reach, and what do we do next?
An internal sanctions investigation (a structured, legally privileged inquiry into whether a business has breached OFAC prohibitions or transacted with a blocked party) is the essential first step before any decision about voluntary disclosure or enforcement response. As of April 2026, OFAC's enforcement guidelines treat the existence and quality of a compliance programme – including how an organisation responds to a potential violation – as a material factor in determining penalty. Investigations that are thorough, documented, and counsel-directed consistently produce better outcomes than reactive or incomplete ones.
This page explains how an OFAC internal investigation is structured, where it intersects with UK and EU obligations, and how Calder & Vance assists businesses working through that process.
What does an internal sanctions investigation under OFAC actually cover?
An internal sanctions investigation maps every transaction, relationship, or decision that may have violated an OFAC prohibition – and produces a privileged record that supports any subsequent enforcement response. The scope is defined by the triggering facts, not by an initial assumption about outcome.
The governing authority is OFAC itself, operating under the International Emergency Economic Powers Act ("IEEPA") and the Trading with the Enemy Act ("TWEA"), among other statutory bases. OFAC publishes enforcement guidelines that set out how it weighs aggravating and mitigating factors. A well-run internal investigation addresses most of those mitigating factors directly: it demonstrates good faith, supports accurate disclosure, and shows that the compliance function is operational rather than theoretical.
In practice, the investigation has four distinct components. First, a factual reconstruction: gathering transaction records, payment instructions, screening logs, counterparty files, and internal communications that bear on the potential violation. Second, a legal analysis: mapping those facts against the relevant OFAC programme, the SDN List (OFAC's list of Specially Designated Nationals and blocked persons) and sectoral restrictions in force at the time of the conduct. Third, a scope determination: identifying whether the apparent violation is isolated or systemic, and whether it implicates US persons, US-origin goods, or US-dollar clearing. Fourth, a decision as to next steps – which may include a voluntary self-disclosure ("VSD"), a no-action decision, or a corrective-action plan without disclosure.
The scope of OFAC jurisdiction is broad. US-dollar transactions that route through a US correspondent or clearing bank bring US persons into the chain, even where neither party to the underlying deal is American. In our experience, the majority of cross-border investigations we handle for non-US clients involve this correspondent-bank nexus. It is the most common source of OFAC exposure for businesses incorporated entirely outside the United States.
How does OFAC's enforcement framework shape the investigation?
OFAC's enforcement guidelines distinguish between egregious and non-egregious violations, and between cases where the subject voluntarily self-discloses and cases where OFAC discovers the violation independently. The distinction matters enormously for penalty calculation.
A timely and accurate VSD – submitted before OFAC opens its own inquiry – can result in a significantly reduced base penalty. The guidelines also allow OFAC to consider the quality of the compliance programme, the degree of senior-management involvement, and the remedial steps taken after discovery. Each of those factors feeds directly from what the investigation produces. An investigation that is superficial, delayed, or conducted without legal privilege creates its own risk: it may generate a record that undermines the very mitigating arguments the business wants to make.
Does that mean a VSD is always the right route? Not necessarily. The decision to disclose is a legal judgment that depends on the facts of the specific violation, the programme at issue, the business's prior enforcement history, and the likely discovery risk. We regularly advise clients who, after a rigorous investigation, determine that a corrective-action programme is the appropriate response rather than a formal VSD. The investigation has to be thorough enough to support either conclusion.
OFAC's guidelines also treat the existence of a compliance programme as a mitigating factor. A business with a documented, well-tested programme that identified the issue and responded promptly is in a structurally different position from one where no programme existed. The investigation produces the evidence of that programme – or reveals its gaps, which must then be addressed before any disclosure is made.
The position above covers the standard case. Your facts – the counterparty, the goods, the route, the regime in play, and the timeline of events – change the analysis materially. For a confidential review of a potential breach, contact Calder & Vance at info@caldervance.com.
What is the cross-border dimension, and when do UK and EU obligations also apply?
An OFAC-triggered investigation rarely operates in isolation. Where the business has UK operations, EU-nexus transactions, or counterparties subject to OFSI or EU Council regulation designations, the investigation must address those regimes simultaneously.
Consider the practical pattern: a European business makes a payment in US dollars through a US correspondent bank and the counterparty is designated on both the OFAC SDN List and the UK OFSI consolidated list. The OFAC exposure arises through the dollar-clearing nexus. The OFSI exposure arises independently under the UK Sanctions and Anti-Money Laundering Act ("SAMLA") and the relevant thematic regulations, because the UK business dealt with a designated person regardless of currency or routing. The EU position may add a third layer if any EU-person or EU-nexus element exists.
The obligations on discovery differ. OFSI requires that a person who knows or has reasonable cause to suspect that they have dealt with a designated person or that a designated person holds funds they control must report that to OFSI. The reporting window is short, and the ownership and control test (the UK and EU test for whether a non-listed entity is caught through a listed person) is distinct from OFAC's mechanical 50 percent rule (OFAC's rule treating entities owned 50 percent or more by blocked persons as themselves blocked). Getting those tests wrong – in either direction – creates compounding exposure.
In our cross-border practice, we routinely handle investigations that sit across two or three regimes at once. The sequencing of internal findings, the timing of any disclosures, and the interaction between OFAC's VSD framework and OFSI's reporting obligation require careful co-ordination. Mis-timing a voluntary disclosure in one regime can undermine the privilege position or the mitigation argument in another.
Where local counsel in the relevant jurisdiction is needed for ancillary corporate or procedural questions, we co-ordinate that engagement. The sanctions analysis – across OFAC, OFSI, and the EU – sits with our team throughout.
What are the common risk flags that expand an investigation's scope?
Investigations frequently begin with a narrow trigger and expand when document review reveals a wider pattern. The most common risk flags we encounter are set out below.
- Correspondent-bank clearing: any historical payment in US dollars that routed through a US bank creates OFAC exposure, even if the parties and goods had no US connection. The volume of such payments in a typical multinational's history is large.
- Aggregated ownership: the 50 percent rule captures entities owned by multiple blocked persons whose stakes aggregate to the threshold, even if no single person holds a majority. Screening tools that check only direct single-holder records miss this pattern entirely.
- Expired designations and re-listings: the SDN List changes frequently. A counterparty that was clean at onboarding may have been listed since. Investigating the current designation status is not the same as investigating the status at the time of the transaction – and OFAC's analysis focuses on the latter.
- Intermediary and transit exposure: a transaction may have passed through a third-party financial institution or freight intermediary that itself had SDN exposure. The investigation must trace the full transaction chain.
- Dual-use goods and the interaction with BIS: where goods or technology are involved, the investigation must consider whether BIS and the Export Administration Regulations ("EAR") also apply. An Export Control Classification Number ("ECCN" – a classification under the US Commerce Control List) determination and licence-exception analysis may sit alongside the OFAC work.
- Virtual-asset exposure: OFAC has designated virtual-asset addresses and exchanges. Businesses with cryptocurrency activity must screen wallet addresses, not only legal-entity names. This is a growing source of new investigations.
If a transaction has already been flagged, or a filing has been refused, an early review can preserve options that narrow with time. Contact Calder & Vance at info@caldervance.com to discuss the position before it develops further.
How is legal privilege protected during an internal investigation?
Legal professional privilege is the single most important structural feature of an effective internal sanctions investigation. Without it, the documents produced during the investigation – interview notes, chronologies, analysis memoranda – are potentially disclosable to OFAC or to civil claimants. Structuring the investigation to maintain privilege from the outset is not optional.
Privilege attaches when the primary purpose of the communication or document is to obtain or provide legal advice, and when the work is directed by counsel. This means that the engagement structure matters from day one. Investigators working under the supervision of external legal counsel, producing work product for the purpose of advising on legal exposure and disclosure obligations, operate within a privileged perimeter. Internal compliance teams running the investigation themselves, with external lawyers retained only to review the output, create a more uncertain privilege position.
In our experience, the most reliable structure is for counsel to be retained at the outset, to direct the document-collection protocol, and to commission any specialist forensic or financial analysis as counsel-supervised work product. Internal teams contribute knowledge and access; the legal analysis and record-making sit with counsel. That structure holds up if OFAC later asks how the investigation was conducted.
The privilege question is not unique to OFAC matters, but it is particularly acute because OFAC's framework actively credits the quality of the internal investigation. A business that can demonstrate a thorough, counsel-directed inquiry is better placed than one whose investigation is patchy, undocumented, or legally unprotected.
A common misconception: "we are not a US person, so OFAC does not apply to us"
One of the most persistent myths in cross-border sanctions compliance is that OFAC's rules only bind US persons – companies incorporated or resident in the United States, US citizens, and US green-card holders. That reading is wrong in two material respects, and acting on it is a significant source of unaddressed exposure.
First, OFAC's rules apply to any transaction that involves US jurisdiction. Transactions cleared in US dollars through a US correspondent bank involve a US person (the clearing bank) and fall within OFAC's remit, regardless of where the counterparties are located. A Dutch logistics company and a Singaporean buyer can both be entirely non-US, and their US-dollar invoice payment can still constitute a violation if the underlying goods or beneficiary are OFAC-sanctioned.
Second, secondary-sanctions risk – the risk that a non-US person engages in conduct that exposes them to US measures even absent a primary-sanctions nexus – is a distinct and expanding category. Non-US businesses that engage in significant transactions with parties subject to certain OFAC programmes face exposure to US countermeasures, even where no US-person or US-currency link exists. The scope and application of secondary sanctions varies by programme; the analysis is fact-specific.
We regularly advise non-US clients – European manufacturers, Asian trading houses, Middle Eastern financial institutions – who face OFAC exposure through one or both of these routes. The internal-investigation process for a non-US client is substantively the same as for a US business: map the facts, identify the OFAC nexus, assess the violation, determine the disclosure obligation, and document the remedial steps.
How Calder & Vance conducts an internal sanctions investigation under OFAC
Our enforcement and investigations practice is built around a defined investigation protocol, adapted to the specific facts and the regime or regimes in play. We do not operate through generic checklists.
The engagement begins with a privileged scoping call, typically within 24 hours of instruction, at which we assess the apparent trigger, the business's US nexus, and the urgency of any reporting obligation. From that call we produce a scoping memorandum that sets the investigation's parameters, the document-collection priorities, and the timeline. That memorandum is itself privileged.
The investigation then proceeds in stages:
- Document preservation and collection: we advise on a legal-hold instruction to prevent destruction of relevant records, and work with the business's IT and compliance teams to collect transaction data, screening logs, and communications.
- Factual reconstruction: we build a transaction chronology, map counterparty ownership and designation history, and identify every US-person or US-nexus element in the chain.
- Legal analysis: we assess the apparent violation against the OFAC programme in force at the time of the conduct, consider whether any licence or authorisation applied, and evaluate the aggravating and mitigating factors under OFAC's enforcement guidelines.
- Cross-regime review: where OFSI, EU, or other regime obligations are engaged, we bring those into the analysis at this stage, co-ordinating with local counsel where procedurally required.
- Disclosure recommendation: we advise on whether a VSD is warranted, the content and timing of any submission, and the corrective-action steps that should accompany it.
- Remediation: we assess eligibility, prepare and submit any licence application if one is needed to resolve a blocking issue, and redesign the relevant compliance controls to the standard that mitigates future exposure.
In a recent matter, a financial-services business discovered that its payments-processing unit had processed transactions for a corporate client whose controlling shareholder had been designated partway through a multi-year banking relationship. We scoped the investigation, directed the document review, and assessed the full population of transactions against the relevant OFAC programme. The matter was resolved through a VSD supported by a comprehensive corrective-action package that addressed the screening gap. No guarantee of any specific outcome can be given; the process is the product.
Related practices
- Apparent violation assessment under EU sanctions – assessing potential EU sanctions violations and advising on disclosure obligations
- OFAC internal investigations: advanced enforcement response – structured enforcement defence and penalty mitigation strategy
- Internal sanctions investigations under OFSI – UK financial sanctions breach assessment, reporting, and enforcement defence