A compliance officer at a mid-sized trading house receives an alert: a payment processed six months ago may have touched a counterparty linked to a blocked entity. The transaction is done. The question now is what the business knows, what it must do, and how quickly it must act. Internal sanctions investigations under OFAC define that answer – and the choices made in the first days shape every subsequent option.
When a potential OFAC violation surfaces, a structured internal investigation is the essential first step. It scopes the apparent violation, preserves privilege, and determines whether a voluntary self-disclosure (VSD – a formal report to OFAC disclosing an apparent violation before the regulator identifies it independently) is warranted or required. OFAC treats a timely, thorough VSD as a significant mitigating factor in any enforcement outcome.
This page sets out how Calder & Vance structures and leads internal OFAC investigations, where the process intersects with UK, EU, and other regimes, and what your business should do before a potential breach becomes an enforcement file.
What triggers an internal sanctions investigation under OFAC?
An internal sanctions investigation is triggered whenever a business identifies – or has reason to believe – that a transaction, relationship, or internal process may have violated OFAC-administered prohibitions under IEEPA, TWEA, or the relevant thematic sanctions regulations.
Common triggers include a positive screening hit on a counterparty, a payment returned by a correspondent bank with a sanctions flag, an internal whistleblower report, an M&A due-diligence finding, or a query from a financial-institution counterparty that has declined to process a transaction. Regulators and counterparties surface potential violations from directions a business does not always anticipate.
The trigger matters because it partly determines the investigation's urgency and scope. A hit identified during routine screening of an active relationship requires immediate remediation steps alongside the investigation. A historical transaction identified during an audit may allow a more measured sequence – but the clock on a VSD filing still runs from the point of internal discovery, not the point of the violation itself. Acting quickly and correctly from the outset is the single most important factor in preserving optionality.
In our experience, businesses often delay forming an investigation team while escalating internally. That delay compresses the time available for a thorough factual review before any filing deadline pressure arrives. Involve outside sanctions counsel early.
How does the OFAC investigation process work?
A well-structured OFAC internal investigation follows a disciplined sequence: scope definition, document and data preservation, legal privilege establishment, factual reconstruction, regulatory analysis, and – where required – a disclosure decision.
The first phase is scope definition. The investigation team – led by outside sanctions counsel to preserve attorney-client privilege – identifies the transactions, time periods, counterparties, products, and jurisdictions in question. A narrow scope agreed at the outset prevents scope creep that can extend the investigation unnecessarily and increase cost.
Document and data preservation follows immediately. This includes transaction records, SWIFT messages, email communications, screening logs, and any approval or exception documentation. Destruction or alteration of records after an investigation is opened – even inadvertently – creates a separate and serious legal exposure. Litigation holds should be issued on day one.
Factual reconstruction maps each transaction against the applicable OFAC prohibition. The analysis asks: were any blocked persons involved, directly or indirectly? Did any transaction touch property in which a blocked person has an interest? Was there nexus to the United States through a US-person processor, a US-dollar clearing bank, or US-origin goods? These questions determine whether an apparent violation exists at all and, if so, how many transactions are in scope.
Where apparent violations are confirmed, the investigation team prepares a disclosure decision memorandum. This weighs the aggravating and mitigating factors OFAC applies in enforcement decisions – the egregiousness of the conduct, the existence of a sanctions compliance programme, management awareness, and the degree of cooperation – against the benefits and risks of a VSD filing. OFAC's enforcement guidelines treat a timely VSD as a significant mitigating factor, generally resulting in substantially reduced civil monetary penalties compared to a non-disclosed violation identified by the regulator independently.
What is the cross-border dimension – and why does it change the analysis?
OFAC's reach extends well beyond US persons and US territory. Any transaction cleared in US dollars through a US correspondent bank, any goods of US origin, and any transaction involving a US-person counterparty – including US branches of non-US banks – can create OFAC exposure for a non-US business. This extraterritorial effect means that a European, Asian, or Middle Eastern business may face an OFAC investigation obligation even where it has no US operations.
At the same time, the same transaction that triggers OFAC analysis may independently engage OFSI in the United Kingdom, EU Council sanctions, or the regimes of Canada, Australia, or Singapore. Each regime has its own reporting obligations, its own timelines, and its own enforcement posture. They do not align neatly.
This divergence is consequential in practice. A VSD filed with OFAC does not constitute disclosure to OFSI or the EU competent authorities. Each regime requires separate engagement. OFSI's enforcement guidance, for instance, sets its own reporting obligations and penalty structure. EU competent authorities – spread across member states – have different procedural requirements. Where a matter engages multiple regimes simultaneously, the investigation must be designed from the outset to address each in parallel, not sequentially.
We regularly advise businesses where an OFAC VSD and an OFSI report run concurrently, or where an EU competent authority inquiry opens alongside an OFAC enforcement correspondence. The factual record must be consistent across all regimes; contradictory submissions create risk in each. This is a coordination challenge that requires a single sanctions counsel team with cross-regime visibility.
The position above covers the standard multi-regime case. Your facts – the goods, the financial flows, the nationality of the parties, the currency used, and the jurisdictions of the banks involved – change which regimes engage and in what sequence. Contact Calder & Vance at info@caldervance.com for an early assessment of your multi-regime exposure.
What are the risk flags that escalate an investigation?
Not all apparent violations carry the same enforcement risk. OFAC's enforcement guidelines distinguish between egregious and non-egregious cases, and that distinction determines the penalty range and the likelihood of a formal enforcement action.
The following factors escalate risk materially:
- Wilful or reckless conduct – evidence that the business knew, or disregarded clear evidence, that a transaction involved a sanctioned party substantially increases the likelihood of a referral for civil or criminal enforcement.
- Senior management involvement or awareness – where compliance concerns were raised and overridden at senior level, OFAC treats this as an aggravating factor.
- Harm to US foreign policy objectives – conduct that OFAC determines undermined the stated purpose of a sanctions programme is treated as more serious.
- Volume and value of transactions – a single inadvertent payment by a compliant business occupies a very different risk tier than a sustained pattern of transactions over months or years.
- Prior sanctions history – a business with a prior OFAC settlement or enforcement action faces heightened scrutiny and a less favourable starting position in any subsequent matter.
- No compliance programme – the absence of a sanctions compliance programme at the time of the violation is treated as an aggravating factor under OFAC's five-element compliance framework.
Conversely, the mitigating factors that can substantially reduce exposure include: an effective pre-existing compliance programme, immediate self-initiated remediation, a timely VSD, and active cooperation with OFAC throughout the investigation. These factors do not guarantee a specific outcome, but they shape the range within which OFAC exercises its enforcement discretion.
One myth our clients arrive with is the belief that a VSD automatically results in a penalty reduction, whatever the underlying conduct. In our practice, the mitigating value of a VSD depends heavily on its quality – the completeness of the disclosure, the accuracy of the facts stated, and the credibility of the remediation steps described. A partial or inaccurate VSD can make the position worse, not better.
If a transaction has already been flagged, or a filing has been refused, an early review can preserve options that narrow with time. Contact our team at info@caldervance.com to discuss.
How does Calder & Vance structure and lead the investigation?
We scope the apparent violation, advise on voluntary self-disclosure, and prepare the penalty defence – leading the investigation under attorney-client privilege from day one through to resolution.
Our approach runs in four parallel workstreams:
- Privilege and preservation. We establish the investigation under attorney-client and work-product privilege at the outset. We issue document-preservation instructions and ensure that the investigation record is protected from production in any parallel proceeding.
- Factual reconstruction. We map the transactions, the financial flows, the screening records, and the counterparty ownership chains. Where the ownership structure of a counterparty is in question, we apply the 50 percent rule (OFAC's rule treating entities owned 50 percent or more by blocked persons as themselves blocked) and the indirect-ownership analysis that the rule requires.
- Regulatory analysis and disclosure decision. We assess each apparent violation against OFAC's enforcement guidelines and produce a decision memorandum setting out the options, their respective risk profiles, and our recommended course of action. Where a VSD is warranted, we draft the submission.
- Multi-regime coordination. Where the matter also engages OFSI, EU competent authorities, or the sanctions regimes of Canada, Australia, Singapore, or other jurisdictions, we coordinate the multi-regime response to ensure consistency and to meet each regime's separate reporting obligations.
In a recent matter, a financial-services business identified a cluster of historical transactions that had passed through a US-dollar correspondent bank and involved a counterparty with an indirect ownership link to a blocked person. We led the internal investigation, mapped the ownership chain to confirm which transactions were in scope, prepared and filed a VSD with OFAC, and coordinated simultaneous notifications to the relevant UK authority. The matter reached resolution without a formal enforcement action. We do not guarantee outcomes; each matter turns on its own facts.
What distinguishes effective investigation counsel at the OFAC stage is not only knowledge of the enforcement guidelines but the ability to present a factual record that is accurate, consistent, and complete. OFAC's examiners are experienced readers of VSD submissions; a credible document record and a well-reasoned remediation plan carry more weight than volume of material.
Common errors that increase enforcement risk
The most damaging mistakes in an OFAC investigation are procedural, not substantive – they arise from how the investigation is run, not from the original transaction.
Delay in forming an investigation team is the most common. Businesses that escalate internally for several weeks before retaining outside counsel lose time that cannot be recovered. The investigation timeline compresses, document-preservation obligations may be missed, and any VSD filing is later in the day – reducing, though not eliminating, its mitigating value.
Running the investigation without privilege is the second major error. An internal review led by the compliance department, without outside counsel direction, may not attract attorney-client privilege. The factual findings can then be producible in a subsequent enforcement proceeding or in civil litigation, removing control over the narrative.
A third common error is scoping the investigation too narrowly to avoid escalation. Where a business identifies one problematic transaction and closes the investigation without examining whether a broader pattern exists, OFAC – if it later identifies the full picture – will treat the incomplete VSD as a material misrepresentation. That position is considerably more serious than the original violation.
Finally, businesses sometimes assume that because OFAC is a US authority, a non-US business has limited exposure. The US-dollar clearing system, US-origin goods, and the extraterritorial reach of IEEPA create OFAC exposure that does not depend on a US physical presence. This assumption has caused significant regulatory difficulty for European and Asian businesses that did not include OFAC analysis in their initial review. Always scope for OFAC nexus regardless of where the business is incorporated.
Related practices
- Apparent violation assessment – EU – scoping and advising on apparent violations under EU Council sanctions regulations
- Internal sanctions investigations – OFSI – leading internal investigations and disclosure decisions under UK financial sanctions
- Penalty defence and settlement – EU – contesting and negotiating EU sanctions enforcement actions and penalty decisions