A payment firm discovers, mid-transaction review, that a batch of transfers processed over the previous eighteen months touched counterparties linked to a designated regime. The apparent violations are historic. The amounts are significant. OFAC has not yet made contact – but internal counsel knows that a voluntary disclosure window exists, and that the gap between acting and waiting can define the outcome. This is the moment when the quality of penalty defence and settlement ofac legal support becomes material.
OFAC administers civil monetary penalties for apparent violations of US sanctions through a structured pre-penalty and settlement process governed by IEEPA and the relevant programme regulations. A respondent has a defined window to submit a written response to a pre-penalty notice, and OFAC's own penalty guidelines provide for significant reductions – including for voluntary self-disclosure (VSD, the proactive reporting of an apparent violation before OFAC initiates contact), a well-tested compliance programme, and prompt remediation. The difference between a base-penalty calculation and the final settled amount can be substantial, and counsel involvement from the earliest stage materially affects both figures.
This page explains the OFAC enforcement process, the key decision points in a penalty defence, how the US regime compares with OFSI and EU enforcement mechanics, and the role Calder & Vance plays at each stage of the matter.
What is the OFAC enforcement process and who administers it?
OFAC – the Office of Foreign Assets Control, within the US Department of the Treasury – administers the civil enforcement of US economic sanctions under authority derived principally from IEEPA and, for certain programmes, from TWEA. When OFAC identifies an apparent violation, it may issue a pre-penalty notice (a formal document setting out the alleged violation, the statutory base penalty, and the period for response) or it may resolve the matter by a no-action finding, a cautionary letter, or a formal settlement agreement without issuing a pre-penalty notice at all.
The pathway OFAC chooses depends on its assessment of egregious conduct, the degree of wilfulness or recklessness, prior violations, and the respondent's cooperation. That assessment is not fixed at the moment the violation occurred. It responds to what the respondent does next. In our experience, the single most consequential decision is whether to disclose voluntarily and when – because the VSD regime cuts the base-penalty calculation for civil matters by a proportion that OFAC's published guidelines quantify.
DOJ handles criminal sanctions-related matters, including wilful violations and knowing export-control breaches. The civil and criminal tracks can run in parallel. A respondent engaging only with the OFAC civil process should remain alert to the possibility that DOJ engagement may follow, particularly where the facts involve senior management knowledge or deliberate structuring of transactions.
How does the pre-penalty notice response work – and how long does it take?
Once OFAC issues a pre-penalty notice, the respondent has a defined period to submit a written response contesting the findings, presenting mitigating facts, or proposing a settlement figure. OFAC's regulations specify the response window; in practice the agency routinely grants extensions to respondents who engage promptly and in good faith.
The written response is the single most important document in the civil penalty process. It is not a denial of facts alone. An effective response works through every mitigating factor in OFAC's penalty guidelines: the strength of the respondent's sanctions compliance programme at the time, whether the violation was self-identified and disclosed, the degree of management culpability, the nature of the goods or services involved, and the extent of remedial action taken. Each factor can reduce the penalty from the statutory base. Together they can bring the settlement significantly below that figure.
As to timelines: OFAC enforcement matters routinely span one to three years from initial inquiry or VSD to final settlement. Cases involving a pre-penalty notice and a contested response tend to run longer. Cases resolved through a voluntary disclosure and proactive cooperation can close faster, though no outcome timeline is guaranteed. The practical implication is that penalty defence is not a sprint. It is a managed process, and the firm's posture in the early months determines the room it has later.
The position above covers the standard civil-penalty pathway. Your facts – the programme involved, the transaction type, the counterparty, the volume of apparent violations, and whether DOJ has any interest – change the analysis materially. For an initial assessment of your exposure under OFAC, contact Calder & Vance at info@caldervance.com.
Voluntary self-disclosure: the single most consequential decision
A VSD, submitted before OFAC opens its own inquiry, is the strongest mitigating factor available under the US civil-penalty regime. OFAC's published guidance treats a non-egregious violation accompanied by a timely VSD as a matter warranting a substantially reduced base-penalty calculation. The reduction is real and material, and it compounds with other mitigating factors.
What makes the VSD decision hard is that it is irreversible in both directions. A firm that discloses has committed to a course of cooperation. A firm that chooses not to disclose forfeits the reduction if OFAC subsequently identifies the violations through its own intelligence, a third-party report, or a related enforcement action against a counterparty. And OFAC does find violations through those channels. The SDN List and OFAC's screening of financial flows across the US financial system create multiple indirect exposure points for transactions that touched blocked persons or programmes.
When is disclosure the right call? The analysis turns on: (1) whether the apparent violations are discoverable by OFAC through independent means; (2) the egregious-conduct factors present; (3) the adequacy of the firm's compliance programme; and (4) the collateral implications for counterparties, employees, and related enforcement authorities. This is not a legal-compliance-team decision alone. It requires external counsel with direct OFAC enforcement experience, and it requires speed – because the window between identifying the violation and OFAC's own discovery can close quickly. Have you assessed the discoverability risk honestly?
Cross-border dimension: how OFAC enforcement compares with OFSI and EU enforcement
Penalty defence and settlement under OFAC sits within a global enforcement picture. A transaction that generated OFAC exposure may also have touched UK or EU sanctions, and OFSI and the EU exercise their own enforcement authority independently of OFAC. The approaches differ in ways that matter to a cross-border respondent.
Under OFAC, the civil penalty process is administrative: OFAC investigates, issues a pre-penalty notice, and settles with the respondent directly. Under OFSI, financial-sanctions enforcement in the UK is also administrative, but the civil monetary-penalty power under the Sanctions and Anti-Money Laundering Act ("SAMLA") is more recent and OFSI's published enforcement guidance has evolved as OFSI builds its caseload. The UK regime provides a statutory mechanism for internal review and, thereafter, a right of appeal to the Upper Tribunal. The EU regime operates at the member-state level: each jurisdiction enforces the relevant Council Regulation through its own national authority and its own penalty structure, though the substantive prohibition derives from EU law.
A respondent managing simultaneous OFAC and OFSI exposure must coordinate the disclosure and cooperation posture across both proceedings. Statements made voluntarily in one jurisdiction can surface in another. The timeline mismatch between a concluded OFAC settlement and an ongoing OFSI investigation creates its own risks. In our cross-border practice, we routinely advise clients on sequencing disclosure and cooperation across multiple regimes, working with local counsel in the relevant jurisdiction where OFSI or EU national authority engagement is required.
One further cross-border point: US secondary-sanctions risk means that a non-US entity engaged in activity with a sanctioned person or programme may face OFAC exposure even if no US person, US dollar, or US jurisdiction nexus is immediately obvious. The extraterritorial reach of certain US sanctions programmes is broad. A non-US firm receiving an OFAC inquiry should not assume the inquiry is a mistake. It should treat it as a serious enforcement signal and engage counsel immediately.
If a filing has been refused or a notice has been received, an early review preserves options that narrow with time. Contact Calder & Vance at info@caldervance.com for a confidential initial review.
Egregious conduct, wilfulness, and the factors that drive penalty escalation
OFAC distinguishes between egregious and non-egregious apparent violations, and the distinction drives the penalty calculation more than any other single factor. An egregious case – typically one involving wilful or reckless conduct, senior management awareness, or harm to a sanctions programme designed to address national-security concerns – attracts a base-penalty calculation from the statutory maximum rather than from a substantially lower transaction-value figure.
The egregious factors listed in OFAC's published penalty guidelines include: whether a manager or officer directed or approved the conduct; whether the respondent attempted to conceal the transaction; whether the goods or services involved had a nexus to weapons programmes; and whether the respondent has prior OFAC violations. These factors are assessed on the facts as they existed at the time – not as reconstructed in hindsight by an internal investigation conducted after the fact.
This is why internal investigations in apparent-violation matters require external counsel from the outset. The investigation itself, if conducted without privilege or without an eye to the egregious-conduct factors, can inadvertently surface evidence that moves a non-egregious matter toward the egregious range. Conversely, a well-managed investigation that maps the facts clearly – and that demonstrates the violation resulted from a gap in a well-functioning compliance programme rather than from a deliberate decision – can hold a matter in the non-egregious tier.
Risk flags that signal potential escalation to egregious treatment include: evidence of a deliberate decision to transact despite a positive screening result; management-level emails discussing sanctions risk without acting on it; transaction structuring that obscures a nexus to a blocked person; and a pattern of repeated similar violations. Any of these, if present in your file, should be disclosed to external counsel before any internal document is distributed beyond the investigation team.
How Calder & Vance conducts penalty defence and settlement under OFAC
We assess the apparent violation, scope the OFAC exposure, and advise on the VSD decision before any other step. That sequence is deliberate. The compliance programme assessment, the egregious-factor analysis, and the discoverability review inform every document produced in the defence.
In a recent matter, a technology-sector business discovered that a series of software-licence renewals had been processed for an entity subsequently identified as meeting the criteria of a blocked person under the 50 percent rule (OFAC's rule treating entities owned 50 percent or more by blocked persons as themselves blocked, directly or indirectly). The transactions pre-dated an update to the SDN List. We assessed the egregious-conduct factors, scoped the voluntary self-disclosure, coordinated with the firm's internal investigation, and prepared the written response to OFAC. The matter was resolved through a settlement. No penalty outcome is guaranteed in any matter; the facts of each case determine the result.
Our action library for penalty defence and settlement matters includes:
- Scoping the apparent violation and mapping the affected transactions
- Advising on voluntary self-disclosure – timing, scope, and the cooperation posture
- Directing the internal investigation under privilege, with an eye to the egregious-conduct factors
- Preparing the VSD submission and managing OFAC's follow-up queries
- Drafting the written response to a pre-penalty notice, including all mitigating factors
- Negotiating the settlement and advising on the remediation steps OFAC will require
- Coordinating cross-border exposure with OFSI, EU national authorities, or DOJ, through local counsel where required
- Redesigning the compliance programme and controls to support the remediation narrative
A common misconception among clients arriving at this stage is that a compliance programme failure is an aggravating factor. It can be – but a compliance programme that existed, functioned, and self-identified the violation is a mitigating factor. The distinction matters enormously in how the written response frames the programme's adequacy. We help clients draw that distinction clearly and present it effectively to OFAC.
Common mistakes and risk flags in OFAC penalty defence
The most frequently encountered mistake is delay. A firm that identifies apparent violations and spends three to six months in internal deliberation before engaging external counsel forfeits the most time-sensitive mitigation: the voluntary self-disclosure before OFAC's own inquiry begins. By the time external counsel is retained, the VSD window may have closed or – worse – OFAC may already be running a parallel investigation of a counterparty whose files contain the same transactions.
The second mistake is conducting the internal investigation without privilege, or sharing investigation memoranda with auditors, board committees, or counterparties before the privilege structure is confirmed. Once a document leaves a privileged channel, it may become disclosable to OFAC or, in a criminal matter, to DOJ. The investigation architecture should be set by external counsel before the first document request goes to the business.
The third mistake is treating penalty defence as a purely US matter when the underlying transactions also touched UK or EU sanctions. We regularly advise clients who have settled with OFAC and then received an OFSI inquiry based on the same underlying facts. The settlement agreement with OFAC does not bind OFSI. The cooperation posture and the admissions made in the US process must be managed with one eye on the other regimes from the beginning.
A fourth risk flag, less commonly anticipated, is the relationship between penalty defence and future licensing. A firm with an OFAC enforcement history seeking a specific licence in a related programme area will face additional scrutiny. The quality of the remediation narrative in the penalty settlement – the specificity and credibility of the compliance improvements undertaken – becomes evidence in a future licensing review. Penalty defence and licensing are not separate matters in a firm's OFAC relationship. They are chapters of the same file.
Related practices
- EU apparent violation assessment – scoping violations and managing enforcement exposure under EU sanctions
- OFAC penalty defence: compliance programme remediation – redesigning controls to support the mitigation narrative
- OFAC enforcement: voluntary self-disclosure guidance – timing, scope, and cooperation strategy for VSD submissions
Frequently asked questions: OFAC penalty defence and settlement
How long does a penalty defence case take under OFAC?
OFAC civil enforcement matters routinely take one to three years from the initial voluntary self-disclosure or inquiry to final settlement. Cases resolved proactively through a well-prepared VSD and active cooperation tend to close faster than those requiring a contested pre-penalty-notice response. No timeline is guaranteed; the complexity of the underlying violations, the number of transactions, and OFAC's own caseload all affect duration. Engaging counsel early accelerates the early phases, where the disclosure and investigation decisions are made.
What are the main risks in penalty defence and settlement under OFAC?
The principal risks are: losing the voluntary-self-disclosure mitigation through delay; inadvertently producing privileged investigation materials without a proper privilege structure; making factual representations to OFAC that are inconsistent with statements to DOJ or OFSI; and failing to remediate the compliance programme adequately, which OFAC will assess as part of the settlement. A fifth risk, often overlooked, is that a parallel counterparty investigation by OFAC surfaces the same transactions before the respondent discloses.
Do we need specialist counsel for penalty defence and settlement?
Yes. OFAC enforcement involves a specialist penalty-calculation regime, an egregious-conduct analysis, and a settlement-negotiation dynamic that general counsel is rarely positioned to handle without dedicated sanctions enforcement experience. The voluntary-self-disclosure decision alone – with its irreversible consequences in both directions – requires counsel who understands OFAC's current enforcement posture, the discoverability risk in the specific programme involved, and the cross-regime implications for OFSI and the EU if the same transactions are in scope there.
About the author
J. M. Aldridge advises multinationals and financial institutions on US sanctions and export controls, with a focus on OFAC licensing, secondary-sanctions risk, and BIS classification. J. M. Aldridge acts for clients at every stage of the OFAC enforcement cycle, from initial apparent-violation assessment and voluntary self-disclosure through pre-penalty-notice response, settlement negotiation, and compliance-programme remediation. Calder & Vance – International Sanctions & Export Control Counsel.
About Calder & Vance
Calder & Vance is an independent international sanctions and export-control boutique. We advise multinationals, financial institutions, exporters, and individuals on the major regimes – OFAC and BIS in the United States, OFSI and ECJU in the United Kingdom, the EU Council regulations and the EU General Court, the United Nations Consolidated List, and the regimes of Switzerland, Canada, Australia, the UAE, Singapore, and Japan. Our work is limited to lawful compliance, licensing, delisting, enforcement defence, and due diligence. To discuss a matter, contact info@caldervance.com.
Disclaimer: This material is general information, not legal advice, and is not a substitute for advice on your specific facts. Sanctions and export-control rules change frequently and differ by regime; verify the current position before relying on anything stated here. Calder & Vance does not advise on circumventing or evading sanctions. For advice on your situation, contact info@caldervance.com.