Penalty calculation methodology under OFAC: compliance counsel

Your firm has received an OFAC subpoena, a cautionary call from a correspondent bank, or an internal transaction review that has surfaced a potential violation. The immediate question is not whether you are liable – it is how much that liability could be, and what your team can do right now to influence the outcome. Penalty calculation methodology under OFAC is not a mechanical formula. It is a structured discretionary analysis, and every variable in that analysis is one your counsel can work with. As of January 2026, OFAC administers civil enforcement under Enforcement Guidelines (the published framework that sets out how the agency scores violations and weights aggravating and mitigating factors) and retains significant discretion at every stage.

OFAC's civil penalty calculation for a given apparent violation begins with a statutory maximum base penalty under IEEPA, then adjusts that figure up or down through a formal scoring of aggravating and mitigating factors – including culpability, harm, sophistication, sanctions history, and whether the subject made a voluntary self-disclosure (a proactive report to OFAC before the agency had independent notice). A well-prepared penalty defence, built on accurate characterisation of the violation and systematic presentation of mitigating evidence, can move the final figure materially. The difference between an egregious and a non-egregious classification, or between a disclosed and an undisclosed case, is not marginal – it can be the difference between a public monetary penalty and a cautionary letter.

This page sets out how OFAC's penalty calculation methodology works, which variables matter most, where the cross-regime picture (particularly UK OFSI and EU enforcement) creates additional pressure, and how Calder & Vance supports businesses working through an active enforcement matter.

What does OFAC's penalty calculation methodology actually measure?

OFAC's civil enforcement process evaluates an apparent violation across two primary dimensions: whether the case is egregious, and whether the subject disclosed voluntarily. These two determinations interact to produce the range within which a final penalty is set. Neither determination is automatic. Both depend on facts that experienced counsel can develop, document, and present.

The egregiousness determination turns on the subject's culpability. OFAC considers whether the apparent violation resulted from wilful or reckless conduct, whether senior management was aware, whether the subject has a pattern of violations, and whether the conduct caused harm to sanctions programme objectives. A transaction that a compliance officer could have caught but missed through a screening gap sits very differently from conduct where management knew about the exposure and proceeded regardless. In our experience, the initial characterisation OFAC places on a matter often reflects the information available to the agency at the start – not the full picture. Early intervention matters.

The voluntary self-disclosure determination is equally consequential. Voluntary self-disclosure is a recognised mitigating factor under OFAC's Enforcement Guidelines. Where a subject discloses before OFAC has independent notice of the apparent violation, that disclosure can substantially reduce the penalty range that applies. Disclosure is not a concession of guilt. It is a procedural step with a specific legal effect. The decision whether to disclose, when, and in what form, is among the most consequential choices an enforcement matter presents – and it must be made quickly, on accurate legal advice.

Liability under OFAC's civil enforcement regime is generally strict. That means the agency does not need to prove that the subject knew the counterparty was sanctioned. The violation occurs when a prohibited transaction takes place. What knowledge and intent affect is the egregiousness score and the applicable penalty range – not the threshold question of whether a violation occurred.

How are the base penalty and the final figure calculated?

The starting point for any OFAC civil penalty calculation is the applicable statutory maximum, set by IEEPA per violation. OFAC then applies its Enforcement Guidelines to produce a penalty figure within the range that corresponds to the violation's egregiousness classification and disclosure status.

For a non-egregious violation with voluntary self-disclosure, OFAC applies a significantly reduced calculation – the agency's published methodology produces a figure that, in that category, is a fraction of the statutory maximum. For an egregious violation without voluntary self-disclosure, the calculation produces the highest figures. The two poles are not adjacent. In our practice, we consistently find that clients who wait too long before seeking counsel forfeit the ability to control which category applies, because the disclosure window narrows and evidence degrades.

Beyond the egregiousness and disclosure variables, OFAC's Enforcement Guidelines set out additional factors that affect the final figure within a category. These include the actual harm caused, the subject's financial condition, the extent of remediation, the degree of cooperation with the investigation, and whether the subject had an effective compliance programme at the time of the violation. A strong compliance programme does not prevent a penalty – but it is a documented mitigating factor, and OFAC treats it as evidence that the violation was an isolated failure rather than a systemic one.

Records are critical. OFAC requires sanctions records to be kept for five years, and an enforcement investigation will typically span that full period. Gaps in transaction records, screening logs, or approval documentation are themselves aggravating indicators. A business that can produce complete records of its screening methodology, the decisions made at the time, and the steps taken after the apparent violation is in a materially stronger position than one that cannot.

When does the situation become criminal, and why does that change everything?

OFAC's civil enforcement process is distinct from criminal prosecution, but the two can run in parallel. The Department of Justice has jurisdiction over wilful sanctions violations under IEEPA and related statutes. Where DOJ becomes involved – or where the conduct suggests the kind of intentional or knowing behaviour that could attract criminal referral – the entire case strategy changes. This is the background exposure that a regulator inquiry often carries, and it is not a theoretical risk for matters involving wilful circumvention, senior management direction, or repeated conduct.

The statute of limitations for civil and criminal violations of IEEPA and TWEA was extended to 10 years in 2024, as currently in force – verify the current position before relying on it. This has material implications for how far back an OFAC investigation can reach, and for how long after a transaction a business remains exposed. It also affects the scope of the record review that a competent enforcement defence must conduct.

In a matter where criminal exposure is a possibility, civil disclosure decisions interact with Fifth Amendment considerations, attorney-client privilege strategy, and parallel proceedings planning. This is not territory for a compliance team operating alone. Do you know yet whether your matter is being reviewed by DOJ as well as OFAC? That question must be answered early, because the answer determines how the civil response is structured.

How does OFAC's methodology compare with OFSI and EU enforcement?

For businesses operating across more than one jurisdiction, OFAC's penalty calculation is not the only calculation on the table. Where a business has a UK entity or a UK nexus, OFSI enforcement runs on a parallel track. Where EU entities are involved, EU sanctions-violation proceedings under the relevant Council regulations apply.

OFSI operates a strict-liability civil penalty regime, as currently in force. The maximum OFSI monetary penalty is the greater of £1,000,000 or 50 percent of the value of the breach. The UK regime issued revised enforcement guidance that introduced a settlement scheme and an early account scheme; these provide procedural routes for co-operation credit that are structurally similar to OFAC's voluntary self-disclosure mechanism, but with their own timing requirements and eligibility conditions. A business facing enforcement on both sides of the Atlantic must manage two separate disclosure and co-operation tracks simultaneously.

The EU picture adds a further layer. An EU directive on the criminalisation of sanctions violations sets minimum criminal penalties at the member-state level, with maximum imprisonment terms of at least five years for serious offences and corporate fines expressed as a percentage of worldwide turnover, as currently in force. Member states were required to transpose this directive by 20 May 2025; transposition continued through 2026, meaning the criminal exposure for a European business can now sit alongside both OFAC and OFSI civil proceedings.

The cross-cutting rule is firm: where two or more regimes both apply to the same conduct, the stricter prohibition governs. A business subject to both OFAC and OFSI must satisfy the more demanding of the two tests on every element. Netting out the two regimes – treating compliance with one as compliance with both – is a structural error that enforcement regularly exposes.

What are the most common mistakes that inflate an OFAC penalty?

Delaying the decision on voluntary self-disclosure is the single most frequent error we see. The window for voluntary self-disclosure is not unlimited. Once OFAC has independent notice of an apparent violation – whether through a blocked-funds report, a counterparty disclosure, or an inter-agency referral – the disclosure is no longer voluntary for Enforcement Guidelines purposes. Businesses that spend weeks in internal review before calling counsel often find that the window has closed by the time they are ready to act.

A second common error is over-disclosing. A voluntary self-disclosure is a legal document. It should be accurate, complete, and structured. An unguided submission that concedes facts not yet established, characterises conduct more seriously than the record supports, or fails to include mitigating evidence is worse than a carefully prepared disclosure that takes more time to build. Pace matters – but accuracy matters more.

A third mistake is treating the blocked-property report as a substitute for a disclosure strategy. Blocked-property and rejected-transaction reports must reach OFAC within 10 business days of the relevant transaction. That reporting obligation is mandatory and separate from the voluntary self-disclosure decision. Satisfying the reporting obligation does not discharge the enforcement exposure. We regularly advise clients who have filed a timely blocked-property report and then assumed the matter is closed – it is not.

A common misconception is that staying silent is safer than self-disclosing. In practice, the opposite is generally true. A business that discloses promptly and co-operates fully gives itself access to the most favourable penalty category. A business that waits and is found through an investigation enters the egregious, non-disclosed tier, where the penalty range is highest and the scope for negotiation is narrowest. Silence is not a penalty defence. It is a factor that the Enforcement Guidelines treat as the absence of a mitigating one.

What is the role of a compliance programme in the penalty analysis?

An effective compliance programme at the time of the violation is one of OFAC's listed mitigating factors. It does not prevent a penalty. But it is evidence that the violation was an isolated failure in an otherwise functioning control environment, rather than proof of a systemic gap. OFAC examines five elements when assessing whether a compliance programme is effective: management commitment, risk assessment, internal controls, testing and auditing, and training.

In a live enforcement matter, we assess the compliance programme the client had at the time of the apparent violation, identify the control gaps that contributed to the failure, and document the remediation steps taken after discovery. That documentation forms part of the mitigation package submitted to OFAC. A business that can show it identified the failure quickly, stopped the conduct, remediated the programme, and co-operated fully with the investigation is presenting the best available mitigation case. No outcome is guaranteed, but the structure of the presentation directly affects where within the applicable range the final penalty lands.

What does a well-designed compliance programme look like in the context of an enforcement investigation? It is one that created a contemporaneous record: screening logs showing what was queried and when, escalation documentation showing how hits were reviewed, approval records showing who authorised the transaction and on what basis. A programme that operated but left no paper trail cannot be proved in an enforcement proceeding. Contemporaneous documentation is the difference between asserting a programme existed and demonstrating it.

How does Calder & Vance support the enforcement response?

We act for multinationals, financial institutions, and exporters on sanctions and export-control matters across the major regimes. Our enforcement practice covers the full sequence from the triggering event to final resolution: scoping the apparent violation, advising on voluntary self-disclosure, preparing the penalty defence, and managing the regulator's queries through to conclusion.

On a penalty calculation matter, our work typically follows this sequence. We begin with a rapid internal review to establish the transaction record, the control environment at the time of the violation, and the question of whether OFAC already has independent notice. That review determines whether the disclosure window is still open and, if so, how quickly a submission must move. We then assess the egregiousness indicators – the conduct, management awareness, harm, and sanctions history – and build the mitigation package around the factors that genuinely apply. We do not embellish the record. We identify and document what is legitimately there.

Where multi-regime exposure is present – and for any business with US, UK, and EU entities, it frequently is – we co-ordinate the disclosure and co-operation strategy across the regimes to avoid a response to one regulator that creates unnecessary exposure before another. In a recent matter, a financial institution with operations in multiple jurisdictions faced apparent violations in both the US and UK regimes arising from the same underlying transaction flow. We scoped the apparent violations under both regimes, assessed the disclosure obligations running in parallel, and structured the co-operation strategy to present consistent, accurate information to both regulators. The matter concluded without a public penalty designation.

We also provide penalty calculation methodology legal advice at the pre-enforcement stage, where a business has identified an apparent violation internally but has not yet received any contact from OFAC. That advice – on whether and how to disclose, what the likely penalty range is, and what remediation steps will support mitigation – is often the most valuable we provide, because it is given while the most important decisions can still be made proactively.

Related practices

• Corporate liability attribution under OFSI – how the UK regime attributes liability through ownership and control chains
• Port access restrictions under BIS/EAR – export-control enforcement and the impact on trade routes and licensing
• EU vs SECO: corporate liability attribution – comparative analysis of EU and Swiss enforcement approaches

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.