An OFAC enforcement notice arrives. The compliance team has twenty-four hours of focused attention before the board asks what happens next. Will this become a civil monetary penalty? Is voluntary self-disclosure still an option? Can the matter be settled before a formal penalty order issues? These questions require answers within hours, not weeks – and the answers determine whether the outcome is manageable or existential.
Penalty defence and settlement under OFAC is a structured regulatory process governed by IEEPA and the applicable sanctions programme regulations. OFAC has discretion to resolve apparent violations through a range of outcomes, from a no-action finding to a formal penalty. The process turns on how quickly counsel is engaged, how the violation is characterised, and whether a voluntary self-disclosure (VSD – a proactive, written self-report of an apparent violation before OFAC opens an investigation) is submitted in time to attract the mitigating credit the agency affords it.
This page explains the OFAC enforcement process from first identification through to settlement, the factors that drive the outcome, and how Calder & Vance advises clients at each stage. As of April 2026, OFAC's enforcement posture continues to treat procedural compliance and cooperation as material variables in settlement negotiations.
What is the OFAC enforcement process and who does it apply to?
OFAC administers economic sanctions under IEEPA, TWEA, and programme-specific authorities. Its enforcement jurisdiction extends to US persons wherever located, to non-US persons transacting in US dollars or through the US financial system, and – through secondary-sanctions risk – to non-US entities dealing with designated parties even where no US nexus exists in the primary transaction.
When OFAC identifies a potential violation, it issues a request for information, a subpoena, or – in more serious cases – a pre-penalty notice setting out its intention to impose a civil monetary penalty. The business then has an opportunity to respond before any penalty is finalised. That response window is critical.
The process runs in distinct phases. First, OFAC conducts its investigation, which may begin from a bank's blocking report, a whistleblower referral, or the firm's own VSD. Second, if OFAC decides to proceed, it issues a pre-penalty notice. Third, the respondent submits a response. Fourth, OFAC issues a final penalty or, if the matter is settled, a settlement agreement. Not every investigation reaches a penalty notice; a substantial proportion of matters are resolved at the investigation stage, particularly where a well-structured VSD was submitted early.
Do the rules apply to your business? If your firm uses correspondent banking in US dollars, employs US nationals, or holds any US-origin technology, the answer is almost certainly yes – and that reach extends beyond what most compliance teams initially map.
The voluntary self-disclosure decision: timing and the mitigation credit
A timely VSD is the single most consequential procedural decision in OFAC enforcement. OFAC's published guidelines treat a VSD as a significant mitigating factor, capable of substantially reducing a base penalty amount.
Timing matters acutely. A VSD submitted before OFAC opens an investigation carries considerably more weight than one submitted after the agency has already made contact. In our experience, businesses that discover an apparent violation and wait for legal advice before filing often lose the window that produces the greatest mitigation credit. The right approach is to engage counsel immediately, scope the apparent violation quickly, and submit a preliminary VSD if the facts appear to support it – with a follow-on, detailed submission once the investigation is complete.
The VSD itself must be accurate. An incomplete or misleading VSD creates a new enforcement risk and can convert a manageable apparent violation into a serious compliance failure. Counsel's role is to scope the violation rigorously, identify all transactions that may be in scope, and ensure the submission is complete before it is filed.
The position above covers the standard case. Your facts – the counterparty, the transaction structure, the goods or services involved, the degree of US nexus – change the analysis materially.
For an initial assessment of your VSD options, contact Calder & Vance at info@caldervance.com.
How does OFAC calculate a civil penalty, and what factors drive the outcome?
OFAC's penalty calculation is not mechanical; it turns on a published set of aggravating and mitigating factors applied to the transaction value of the apparent violation.
Aggravating factors include: wilful or reckless conduct, a pattern of conduct rather than an isolated incident, the involvement of senior management, and harm to US foreign-policy objectives. Mitigating factors include: a VSD, a strong pre-existing compliance programme, prompt remedial action, and cooperation with the investigation. OFAC assigns weight to each factor and produces a base penalty amount. That base amount can be reduced substantially where the mitigating side is well-documented and credibly presented.
The egregious case standard – applied where OFAC finds wilful or reckless conduct by a senior official – results in a penalty calculated from the statutory maximum rather than the transaction value. That distinction is significant. Statutory-maximum calculations can reach multiples of the actual transaction value, particularly for large or repeated transactions. Avoiding the egregious finding is therefore an early strategic priority, and it depends on demonstrating the opposite: that the business acted in good faith, had controls in place, and self-corrected when the violation came to light.
In our practice, we regularly advise on the construction of the penalty-mitigation record – the documentation of compliance-programme quality, senior-management oversight, and remedial steps – that OFAC weighs against the aggravating factors. That record is built during the investigation phase and must be ready before the pre-penalty response is filed.
What is the settlement process, and how is an agreement reached?
Settlement under OFAC is the resolution of an apparent violation by agreement, typically in the form of a settlement agreement that specifies the agreed penalty amount and requires certain remedial undertakings. Settlement avoids a final penalty order and, in many cases, avoids a public enforcement action entirely.
OFAC has discretion at every stage. It can close a matter with a no-action finding, issue a cautionary letter, accept a VSD without further action, or pursue a civil monetary penalty. Settlement sits between the cautionary letter and the contested penalty order. In our experience, settlement is the most common outcome in matters where the business cooperated fully, submitted a credible VSD, and demonstrated a remediated compliance programme.
The negotiation involves legal submissions on the applicable mitigating and aggravating factors, a proposed penalty amount, and, usually, an undertaking to implement specific compliance enhancements. OFAC typically expects those enhancements to be concrete and measurable – not general statements of intent. Counsel's role in the settlement phase is to negotiate the penalty base, challenge the characterisation of the facts, and draft the compliance undertakings in terms that are achievable and do not create future exposure.
If a transaction has already been flagged, or a pre-penalty notice has been received, an early review can preserve options that narrow with time. Contact us at info@caldervance.com for a confidential assessment.
How does OFAC enforcement compare with OFSI and EU sanctions enforcement?
The OFAC process is the most structurally defined of the three major Western enforcement regimes, but clients operating across jurisdictions must track all three simultaneously – a violation may trigger parallel proceedings.
OFSI, the UK financial-sanctions authority operating under SAMLA and the relevant thematic regulations, has a published enforcement approach that shares structural features with OFAC's. OFSI also recognises self-reporting as a mitigating factor. However, the penalty base, the procedural steps, and the licensing considerations differ from the OFAC model. Critically, OFSI has the power to impose a civil monetary penalty on the basis of a strict-liability standard – intention is not required. That strict-liability element makes early self-reporting and programme-quality documentation even more significant in the UK regime.
EU enforcement is decentralised. The Council Regulation creates the legal prohibition; enforcement is a matter for each member state's competent authority. That means a violation touching a French bank, a German exporter, and a Dutch payment firm may produce three separate enforcement proceedings under three national regimes, each with its own procedural rules, penalty scales, and timelines. Coordinating the response across those proceedings is a task we regularly advise on for cross-border clients.
Where OFAC, OFSI, and an EU member-state authority are all in play, the priority is to ensure that statements made in one proceeding do not prejudice the position in another. The VSD submitted to OFAC may be discoverable in related proceedings. The remediation steps agreed with OFSI are visible to an EU authority reviewing the same facts. Managing the sequencing and the content of communications across regimes requires a coordinated strategy from day one.
For a detailed comparison of the OFSI enforcement process, see our Penalty defence and settlement under OFSI service page. For EU apparent-violation assessment, see our EU apparent violation assessment service.
Common risk flags and mistakes in OFAC enforcement proceedings
The most costly mistakes in OFAC enforcement proceedings are procedural, not substantive. A business that made a genuine compliance error and responds correctly will typically reach a better outcome than one that was less culpable but handled the enforcement process poorly.
The most common risk flags we see are:
- Delayed VSD submission – waiting for a complete investigation before filing, and losing the early-disclosure credit in the process.
- Inconsistent internal accounts – early internal communications that characterise the violation differently from the VSD, creating an apparent inconsistency that OFAC will note.
- Incomplete scope – submitting a VSD that covers some but not all of the transactions in scope, which OFAC may treat as a failure of cooperation when the full picture emerges.
- Premature remediation statements – announcing compliance enhancements to OFAC before they are implemented, and then failing to deliver them on the agreed timeline.
- Underweighting secondary-sanctions risk – treating the violation as purely a US-nexus matter, when the same facts generate exposure under OFSI or an EU national authority.
A pervasive myth in this area is that a strong compliance programme protects a business from a penalty once an apparent violation has occurred. It does not. A compliance programme is a mitigating factor; it reduces the penalty. It is not a shield. The programme's quality matters for the calculation, but the violation is still a violation. Businesses that invest in compliance should maintain that investment not because it prevents enforcement, but because it reduces the penalty base when enforcement occurs and demonstrates to OFAC that the violation was an aberration rather than a systemic failure.
How Calder & Vance advises on OFAC penalty defence and settlement
Our enforcement team advises across the full lifecycle of an OFAC matter: from the moment a potential violation is identified through to the execution of a settlement agreement and the implementation of agreed remedial measures.
In practice, that means we scope the apparent violation, advise on whether and when to submit a VSD, prepare and file the disclosure, manage OFAC's requests for information, prepare the pre-penalty response, negotiate the penalty base and the settlement terms, and draft the compliance undertakings.
In a recent matter, a financial-services business identified a series of transactions that appeared to involve a counterparty with indirect links to a designated person through a layered ownership structure. We assessed the exposure under the 50 percent rule (OFAC's rule treating entities owned 50 percent or more by blocked persons as themselves blocked), scoped the apparent violation, prepared a timely VSD, and managed OFAC's subsequent queries. The matter was resolved without a formal penalty order. No outcome is guaranteed; each matter turns on its own facts.
Where a matter also engages OFSI or an EU national authority, we coordinate with local counsel in the relevant jurisdiction to ensure a consistent response across proceedings. Our practice covers the major Western regimes under one roof, which means the cross-regime sequencing and communication strategy are managed from a single point of instruction.
We also advise clients whose matters have reached the pre-penalty notice stage without prior counsel involvement. Receiving a pre-penalty notice is not the end of the process. A well-constructed response can still move the outcome materially, and settlement remains available even at that stage.
Related practices
- EU apparent violation assessment – identifying and scoping apparent violations under EU Council regulations before enforcement action begins.
- Penalty defence and settlement under OFSI – UK financial-sanctions enforcement response, self-reporting, and penalty negotiation.
- Post-breach enforcement risk under EU sanctions – managing decentralised EU enforcement across multiple member-state authorities.