An OFAC enforcement notice lands in your inbox. The letter references an apparent violation, names a civil penalty base, and sets a response deadline. Your legal team has hours, not days, to decide whether to contest, settle, or self-disclose — and each route carries its own risk profile. The wrong move at this stage can convert a negotiable penalty into a final settlement your institution carries for years.
Penalty defence and settlement under OFAC is a structured adversarial process governed by IEEPA and OFAC's enforcement guidelines. The outcome turns on how quickly counsel scopes the apparent violation, how thoroughly the voluntary self-disclosure decision is handled, and how effectively the mitigating and aggravating factors are marshalled in the pre-penalty notice response. A well-prepared defence regularly produces a materially lower settlement figure than the stated penalty base.
This page explains the OFAC enforcement process, the factors that drive settlement, how the US position compares with OFSI and the EU, and what Calder & Vance does at each stage.
What governs OFAC penalty proceedings — and who is exposed?
OFAC's civil enforcement authority derives from IEEPA and, for older programmes, from the Trading with the Enemy Act. The agency is empowered to impose civil monetary penalties for apparent violations of its programme regulations without a court proceeding. Any person subject to US jurisdiction is in scope — and so, through secondary-sanctions pressure, are certain non-US persons conducting dollar-denominated transactions or using US financial infrastructure.
The reach of OFAC jurisdiction surprises many cross-border businesses. A European exporter whose invoice routes through a New York correspondent bank has a US nexus. A multinational with a US subsidiary faces exposure for conduct elsewhere in the group. In our experience, the jurisdictional question is often underdeveloped in the initial internal review — and OFAC's own enforcement record demonstrates that it does not confine itself to US-incorporated entities.
Who specifically needs to consider penalty defence and settlement counsel? The short answer: any business that has self-reported a potential violation, received an OFAC subpoena or voluntary compliance request, identified a sanctions hit in a retrospective review, or discovered that a processed transaction involved a blocked party or a prohibited jurisdiction. The earlier counsel is engaged, the wider the options.
How does the OFAC enforcement process work from notice to settlement?
The OFAC enforcement process moves through defined stages: the apparent violation, the pre-penalty notice phase, the response period, the issuance of a penalty notice, and — in most contested matters — negotiation toward a settlement agreement. Each stage has a short statutory window for response, and missing a deadline can forfeit the right to contest.
At the apparent-violation stage, OFAC may send an initial inquiry letter or a subpoena for records. This is the moment to instruct specialist counsel. The internal record — transaction data, screening logs, communication trails, and ownership documentation — must be secured immediately. Deleting or failing to preserve relevant records creates an independent aggravating factor in OFAC's subsequent analysis.
When OFAC issues a pre-penalty notice, the recipient typically has a limited period to submit a written response. That response is the primary vehicle for presenting mitigating factors: a compliance programme that met the five-element standard, voluntary self-disclosure, the presence of a sanctions-aware risk culture, and the absence of wilful conduct. OFAC's enforcement guidelines give substantial weight to whether the apparent violation was voluntarily reported before OFAC opened an investigation.
Settlement discussions usually begin in parallel with or after the pre-penalty notice response. OFAC has discretion to reduce the base penalty significantly. The agreed civil penalty, the compliance commitments, and sometimes a no-admit, no-deny formulation are recorded in a settlement agreement. That agreement is published on OFAC's website — meaning the firm name and the settlement figure enter the public record. Reputational consequence is therefore always part of the calculus.
The position above covers the standard enforcement trajectory. Your facts — the regime involved, the nature of the underlying violation, the quality of your compliance programme, and the jurisdictions of the parties — change the analysis in ways that can materially affect the outcome.
To discuss an OFAC enforcement matter at the earliest stage, contact Calder & Vance at info@caldervance.com.
Voluntary self-disclosure — what does it mean and when does it help?
A voluntary self-disclosure (VSD) is a proactive report to OFAC by a person who has identified an apparent violation before OFAC opens its own investigation. OFAC's enforcement guidelines treat a qualifying VSD as a significant mitigating factor, and in practice the penalty base applied to voluntarily disclosed matters is substantially lower than for non-disclosed violations of equivalent gravity.
The decision to self-disclose is not automatic. Three questions must be answered before counsel advises a VSD: Has OFAC already opened an investigation independently? Does the apparent violation involve conduct that is egregious under OFAC's criteria? And does the business have the record quality to support a complete and accurate disclosure? An incomplete VSD — one that understates the scope or omits relevant transactions — is treated by OFAC as worse than no VSD at all.
Timing matters acutely. A disclosure that follows a press report, a subpoena to a correspondent bank, or an inquiry to a related entity loses the voluntary character. In our practice we regularly advise clients who have discovered a potential violation and want to understand whether the window for a genuine VSD remains open. That assessment must happen fast. Does your compliance team have a pre-agreed escalation protocol that triggers an immediate legal review when a screening hit or a retrospective audit surfaces a potential violation?
Where the disclosure decision is genuinely borderline, the jurisdictional overlay matters too. If the same underlying conduct touches EU or UK persons or assets, a parallel disclosure obligation may arise under the relevant thematic EU sanctions regulations or under OFSI's mandatory reporting rules. A US-focused VSD strategy that overlooks the UK or EU dimension can inadvertently create a separate breach through late reporting in those regimes.
How do the mitigating and aggravating factors work in practice?
OFAC's enforcement guidelines set out a catalogue of factors that its analysts weigh when calibrating a penalty from the statutory base. Mitigating factors include a fully functional compliance programme in place at the time of the violation, voluntary self-disclosure, co-operation with the investigation, and a demonstrated record of prior compliance. Aggravating factors include wilful or reckless conduct, harm to US foreign policy objectives, awareness of the violation by senior management, and a pattern of prior violations.
In our experience the most contested ground in a penalty negotiation is the characterisation of the compliance programme. OFAC applies a five-element compliance standard: management commitment, risk assessment, internal controls, testing and auditing, and training. A business that can demonstrate all five elements, documented and operational at the time of the breach, positions itself meaningfully better in the settlement discussion than one that relies on post-breach remediation alone.
The egregious / non-egregious distinction is the other critical fork. An egregious violation — typically one involving wilful conduct, a threat to US national security, or a significant harm — is subject to a substantially higher maximum penalty and receives no reduction for VSD beyond the applicable cap. The determination of egregiousness is made by OFAC, not the subject, but counsel's analysis of the facts against the published criteria shapes the pre-penalty response and the settlement posture.
A common misconception worth addressing: businesses often believe that because the underlying transaction had a legitimate commercial rationale, the violation is automatically non-egregious. That is not correct. OFAC's egregiousness analysis focuses on the sanctions conduct, not the commercial purpose. Sound commercial reasons for the underlying deal do not neutralise wilful disregard of a screening alert or a known ownership issue.
Cross-border dimension — how does OFAC compare with OFSI and the EU?
Businesses facing OFAC enforcement rarely face only OFAC enforcement. A violation involving an EU-connected entity triggers exposure under the relevant Council Regulation enforced by national competent authorities. A violation involving a UK person or UK-connected assets may attract OFSI action under the Sanctions and Anti-Money Laundering Act — known as SAMLA. The penalty regimes differ materially, and managing them in parallel requires a co-ordinated strategy.
Under OFSI, the ownership and control test — the UK rule for determining whether a non-listed entity is caught through a listed person — turns on both ownership and control, not ownership alone. That is a meaningful divergence from OFAC's purely mechanical 50 percent or more ownership rule. A transaction that passes the OFAC ownership threshold test may still be prohibited under OFSI's control limb. In our cross-border practice, we see this divergence create real surprises for US-centric compliance teams.
The EU regime presents its own enforcement architecture. National competent authorities in each Member State prosecute apparent violations of Council regulations. The applicable enforcement procedures, timelines, and penalty bases differ by Member State. Disclosure to OFAC does not constitute disclosure to EU or UK authorities — and an OFAC settlement does not bind OFSI or any EU regulator. Each regime must be managed on its own terms.
On record-keeping, OFAC and most parallel regimes impose a retention obligation. OFSI's financial-sanctions record-keeping requirements under SAMLA call for records to be maintained for five years. The EAR imposes comparable retention requirements on export transactions. Failure to produce records in an enforcement proceeding — whether because they were not kept or because they were not retained long enough — is itself an aggravating factor and can impede a co-operative posture.
If a transaction has already been flagged, or a filing has been refused, an early review across all relevant regimes can preserve options that narrow quickly with time.
For an assessment of your cross-regime enforcement exposure, write to Calder & Vance at info@caldervance.com.
What are the most common risk flags in OFAC enforcement matters?
Several patterns recur in OFAC enforcement matters, regardless of sector. Recognising them early is the difference between a managed resolution and a protracted investigation.
- Delayed internal escalation. Compliance teams that identify a potential hit and conduct an extended internal review before escalating to legal counsel lose critical time. OFAC's investigation may already be under way by the time senior management is briefed.
- Incomplete ownership analysis. Relying on a direct-ownership screen without tracing intermediate holding structures is the most frequent source of undetected violations. The 50 percent rule — OFAC's rule treating entities owned 50 percent or more in the aggregate by blocked persons as themselves blocked — applies through each layer of the ownership chain.
- Inconsistent screening across business lines. A corporate group that screens at the bank account level but not at the beneficial-owner level of its trade-finance transactions creates a structural gap that OFAC enforcement has repeatedly exposed.
- Treating a compliance programme as a paperwork exercise. A sanctions compliance programme that exists in policy but has not been tested, audited, or resourced will not satisfy OFAC's five-element standard — and will not carry weight as a mitigating factor.
- Failure to consider secondary-sanctions exposure. Non-US entities dealing with designated persons or with entities in heavily sanctioned programmes face secondary-sanctions risk. Being outside US jurisdiction does not eliminate exposure if the transaction touches dollar clearing, US financial institutions, or US persons.
- Parallel disclosure oversight. An OFAC voluntary self-disclosure that does not address the EU or UK dimension of the same conduct can leave a business facing a separate enforcement action in a second jurisdiction — with none of the goodwill credit that a proactive disclosure would have produced.
How Calder & Vance approaches OFAC penalty defence and settlement
Calder & Vance acts for businesses at every stage of an OFAC enforcement matter — from the moment an internal review surfaces a potential violation through to the execution of a settlement agreement and the post-settlement compliance undertakings. Our approach is structured, disclosure-disciplined, and co-ordinated across regimes.
In a recent matter, a financial-services business identified a series of processed transactions that appeared to involve a blocked counterparty following a retrospective review triggered by a change in its screening vendor. We scoped the apparent violation, assessed the voluntary self-disclosure question against OFAC's published criteria, prepared the pre-penalty notice response with a full mitigating-factors analysis, and managed the settlement negotiation. The matter resolved without an egregiousness finding.
Our engagement covers the following actions at each phase:
- Apparent-violation phase: scope the apparent violation, preserve and organise the internal record, assess VSD eligibility and timing, identify parallel-regime exposure (EU, UK, secondary sanctions).
- Pre-penalty notice response: build the five-element compliance programme evidence, prepare the written response, address aggravating factors, and present mitigating factors in OFAC's own analytical language.
- Settlement negotiation: engage directly with OFAC's enforcement team, manage the negotiation of the civil penalty and the compliance commitments, and advise on the reputational dimension of the published settlement.
- Post-settlement compliance: design or strengthen the compliance programme to meet the undertakings given in the settlement agreement and reduce the risk of recurrence.
We offer a fixed-fee initial assessment of an apparent OFAC violation. That assessment covers the jurisdictional analysis, the VSD question, and the preliminary factors review — giving your board and compliance committee a clear picture before committing to a full engagement.
Related practices
- EU apparent violation assessment – scoping and advising on apparent violations under EU Council sanctions regulations
- OFAC penalty defence: advanced enforcement matters – extended support for complex, multi-party OFAC enforcement proceedings
- OFSI penalty defence and settlement – equivalent service for enforcement matters under the UK financial-sanctions regime