A mid-size trading company discovers that several transactions settled over the preceding quarter involved a counterparty whose ultimate parent had, unknown to the compliance team, appeared on the SDN List (OFAC's list of Specially Designated Nationals and blocked persons) throughout that period. The transactions are complete. The funds have moved. What happens next, and how the company responds in the first days, will shape every outcome that follows.
Remediation after a sanctions breach under OFAC is a structured, time-sensitive process governed by IEEPA and the OFAC regulations applicable to the relevant programme. It begins with scoping the apparent violation, moves through a voluntary self-disclosure decision, and concludes with a remediation plan that the regulator weighs when determining any civil penalty. The difference between a prompt, well-documented response and an ad hoc reaction can be the difference between a no-action outcome and a significant civil monetary penalty.
This page sets out the governing authority, the procedure sequence, the cross-border dimensions that complicate a US-centric response, the risk flags that counsel looks for, and how Calder & Vance assists businesses working through this process.
What governs remediation after a sanctions breach under OFAC?
OFAC's civil enforcement authority derives from IEEPA – the International Emergency Economic Powers Act – and from TWEA, the Trading with the Enemy Act, in certain legacy programmes. Those statutes empower OFAC to impose civil monetary penalties, issue cease-and-desist orders, and, where it concludes a violation is egregious, refer matters to the Department of Justice for criminal prosecution. The procedural rules that determine how OFAC exercises that authority, including the factors that reduce or increase a penalty, are set out in OFAC's enforcement guidelines. Those guidelines are the operative document for any remediation exercise.
Two penalty bands exist: a statutory maximum per transaction and a transaction-value-based alternative maximum, whichever is greater. OFAC applies a multi-factor analysis – covering the nature of the violation, the subject's compliance programme, its voluntary self-disclosure, and its remedial response – to arrive at a proposed civil penalty. The remediation plan your counsel submits is read directly against those factors. A plan that demonstrates thorough root-cause analysis and credible corrective measures carries real weight.
OFAC also distinguishes between egregious and non-egregious cases. For egregious matters, the statutory maximum is the starting point. For non-egregious matters, OFAC typically starts at half the transaction value. This distinction turns heavily on whether the violation was wilful or reckless versus the product of a compliance failure that the subject is now correcting. In our cross-border practice, we have seen businesses inadvertently push a non-egregious matter toward egregious treatment through poorly timed or incomplete disclosures. Early, accurate scoping prevents that outcome.
Scoping the apparent violation: the first decision point
Before any disclosure decision is made, the business must understand what actually happened. Scoping an apparent violation means identifying every transaction that may be implicated, the legal basis of the potential prohibition, and the nature of the US nexus that gives OFAC jurisdiction. The US nexus is often the most consequential question for a non-US business: OFAC's jurisdiction reaches transactions processed in US dollars through US correspondent banks, goods with a US-origin component, and services exported from the United States, among other jurisdictional hooks.
The scoping exercise should be counsel-directed from the outset. Attorney-client privilege attaches to the legal analysis. Internal factual records – transaction logs, payment instructions, screening results – do not attract privilege on their own, but the selection and compilation of those records by counsel can, in certain circumstances, receive work-product protection. A business that conducts the scoping exercise without legal direction may generate documents that become adverse evidence rather than protected analysis.
In a recent matter, a financial-services firm in Europe identified a batch of correspondent-banking transactions routed through a US bank that had benefited an entity caught by the 50 percent rule (OFAC's rule treating entities owned 50 percent or more in the aggregate by blocked persons as themselves blocked, even when the entity is not named on the SDN List). The firm engaged us to scope the full transaction set, identify the point at which the ownership threshold was reached, and produce a privilege-protected chronology. That chronology became the foundation of the voluntary self-disclosure and the remediation plan. The matter resolved without a penalty.
The position above covers the standard case. Your facts – the counterparty structure, the transaction flow, the goods or services involved, the regime programme in play, and whether other jurisdictions are engaged – change the analysis materially. For an assessment of your exposure under OFAC, contact Calder & Vance at info@caldervance.com.
Voluntary self-disclosure: the decision and the mechanics
A VSD (voluntary self-disclosure to OFAC) is one of the most significant mitigating factors in the penalty matrix. OFAC's enforcement guidelines treat a timely, complete, and accurate VSD as a factor that substantially reduces the penalty base in non-egregious cases. For egregious matters, a VSD typically halves the base penalty. The decision to disclose is therefore rarely straightforward: a VSD that is incomplete, premature, or inaccurately scoped can convert a mitigating factor into an aggravating one.
The mechanics of a VSD require the subject to submit an initial notice – typically within a short period of first identifying the apparent violation, though OFAC's guidance does not specify a rigid calendar deadline at the VSD stage – followed by a complete report once the full factual picture is established. The complete report must address the nature of the violations, the timeline, the parties, the amounts, the US nexus, the root cause, and the remediation measures taken or planned. OFAC may ask supplemental questions. Counsel manages those exchanges to avoid inadvertent over-disclosure or inconsistency.
The VSD decision is also shaped by whether other regulators are watching. A US dollar-clearing bank may have already filed a suspicious activity report. The business's home-country financial-intelligence unit may have independent reporting obligations. The interplay between an OFAC VSD and, for example, a parallel OFSI self-report or an EU member-state notification can create sequencing risks that a single-jurisdiction approach misses entirely.
If a transaction has already been flagged, or a filing has been rejected or queried, an early legal review preserves options that narrow quickly. Contact us at info@caldervance.com to discuss an immediate review.
Building the remediation plan: what OFAC expects
The remediation plan is the document that operationalises the corrective response. OFAC's enforcement guidelines set out the compliance-related factors it assesses, which track the five-element standard OFAC has articulated for an effective sanctions compliance programme: management commitment, risk assessment, internal controls, testing and auditing, and training. A remediation plan that maps each corrective measure to those five elements demonstrates that the business has understood not only what went wrong but why, and what structural change prevents recurrence.
In practice, the remediation plan typically addresses several distinct workstreams running in parallel:
- Root-cause analysis – a documented account of the gap in the screening, ownership-and-control mapping, or transaction-monitoring process that allowed the breach to occur.
- Immediate corrective measures – actions taken before the plan is submitted (enhanced screening, suspension of the relationship, escalation protocols).
- Systemic changes – updates to the compliance programme, the screening tool parameters, the ownership-chain investigation procedure, and the escalation matrix.
- Training – targeted retraining for the function that failed, and broader awareness for senior management.
- Testing – a commitment to test the new controls within a defined period after implementation.
The timeline for building and submitting the plan is driven by OFAC's schedule. OFAC typically allows a defined response window after receiving the initial VSD notice. Within that window, the complete report and the remediation plan must be ready. In our experience, the most common failure is not the quality of the remediation measures themselves – businesses often take swift corrective action – but the quality of the written plan that explains them. OFAC reads the document; it cannot inspect the company's day-to-day operations. The plan must be precise, credible, and verifiable.
How does OFAC remediation interact with other regimes?
For any business with operations outside the United States, OFAC remediation does not occur in isolation. The same underlying conduct that triggers an OFAC apparent violation will frequently also engage OFSI in the United Kingdom, the relevant EU member-state competent authority enforcing Council regulations, and potentially the regulators of other jurisdictions where the business operates or where the funds or goods moved. The obligations differ, sometimes substantially, and a response calibrated only to OFAC may leave the business exposed elsewhere.
Under OFSI, for example, the reporting obligation for knowledge or reasonable cause to suspect that a person is a designated person – or that a sanctions prohibition has been breached – arises within a defined statutory window that is shorter than many businesses expect. OFSI's enforcement posture has shifted toward more active penalty use, and OFSI's powers to impose civil monetary penalties operate independently of any OFAC proceeding. A business that resolves an OFAC matter through a VSD and remediation plan still faces a separate OFSI exposure if the conduct touched UK financial services or was conducted by a UK person.
At the EU level, the obligation to report frozen assets and suspected violations rests with regulated entities and, in some programmes, with all persons subject to the relevant Council regulation. Enforcement competence sits with the member states – so the business may face parallel proceedings in multiple EU jurisdictions. The EU General Court remains the avenue for challenging a designation, but that is distinct from the enforcement of transaction prohibitions, which member-state competent authorities manage.
A cross-regime remediation strategy therefore requires co-ordinated analysis across all implicated jurisdictions from the outset, with sequencing decisions on disclosure that account for the reporting timelines, privilege rules, and enforcement postures of each regime. Where local counsel in the relevant jurisdiction is required – for a member-state authority or for an OFSI formal response – Calder & Vance co-ordinates that engagement from the centre.
Related practices
- EU apparent violation assessment – scoping an apparent breach under EU Council sanctions regulations for cross-border businesses.
- Regulator information requests – Australia – managing DFAT-led sanctions information requests and enforcement engagement in the Australian regime.
- Regulator information requests – EU – responding to competent-authority inquiries under EU Council regulations across member-state jurisdictions.
Risk flags: what escalates a remediation matter
Several factors, if present, materially increase the complexity and the stakes of a remediation exercise. Identifying them early determines the resource and the strategic approach.
Wilfulness or recklessness is the most serious escalation factor. If the evidence shows that a manager knew, or consciously disregarded, a red flag – a screening hit that was overridden without documented justification, a compliance officer's advice that was set aside – OFAC will treat the matter as egregious. The penalty base doubles, and criminal referral becomes a real possibility. Root-cause analysis must be honest about this: a narrative that papers over a knowing override will not survive OFAC's document review.
Senior-management involvement is a related concern. If a C-suite or board-level individual directed or approved the conduct, the personal exposure is distinct from the corporate exposure. OFAC can and does target individuals in enforcement actions. In our experience, this risk is most acute where the business is closely held and the sanctioned relationship was commercially important.
Repeat violations complicate a remediation submission considerably. A business that disclosed an OFAC apparent violation within the preceding five years and is now facing a second matter will not receive the same treatment as a first-time subject. OFAC's guidelines treat repeat conduct as an aggravating factor, and the remediation plan must explain why the previous corrective measures failed and what is structurally different this time.
Concurrent criminal exposure – for example, where the conduct also engaged export-control violations under the EAR, or where there is a money-laundering dimension – requires careful co-ordination between civil and criminal counsel. An admission in an OFAC remediation submission can be used in a criminal proceeding. Sequencing the disclosures and managing the privilege perimeter across both tracks is a distinct task from the OFAC remediation work itself. Have you assessed whether the same conduct also touches BIS or DOJ jurisdiction?
A common misconception: remediation is not just a compliance exercise
Businesses sometimes treat OFAC remediation as a compliance project – update the screening tool, retrain the team, write an internal report, file it with OFAC. The misconception is that this is sufficient. Remediation is, in legal substance, an enforcement-defence exercise conducted under the scrutiny of a regulator with civil and criminal penalty powers. The standards for completeness and accuracy that OFAC applies to a submitted plan are higher than those that apply to an internal audit report.
The plan is a legal submission. Inconsistencies between the plan and the underlying transaction records will be identified by OFAC examiners. Overstatements of the remedial measures taken – promising controls that have not yet been implemented, or presenting a testing programme as complete when it has only been designed – are treated as aggravating, not mitigating. We regularly advise clients who have received a notice of apparent violation because an earlier, self-prepared remediation submission created precisely these problems.
A well-constructed plan, prepared by counsel who understands how OFAC reads these documents, is not a formality. It is the primary mechanism by which a business demonstrates the credibility of its corrective response.
How Calder & Vance assists
Our enforcement and investigations practice covers the full remediation cycle from the first internal alert through to the resolution of any OFAC proceeding. We do not offer a generic compliance-review product. Our work is tailored to the specific programme, the specific transactions, and the specific risk factors present in each matter.
In a remediation engagement we typically:
- Scope the apparent violation – identify every transaction, map the ownership and control structure of the counterparty, establish the US nexus, and produce a privilege-protected chronology.
- Advise on the VSD decision – assess the completeness of the factual picture, the egregiousness risk, the parallel-jurisdiction reporting obligations, and the sequencing of any disclosure.
- Prepare and submit the VSD – draft the initial notice, manage the timeline to the complete report, and co-ordinate any supplemental exchanges with OFAC.
- Build the remediation plan – conduct root-cause analysis, map corrective measures to the five-element standard, draft the submission, and stress-test the narrative against the underlying records.
- Manage the cross-border dimension – co-ordinate with OFSI, with EU member-state competent authorities, and with local counsel in other affected jurisdictions to align the parallel remediation workstreams.
- Handle penalty negotiation – if OFAC issues a pre-penalty notice, prepare the response and present the mitigating case in full.
We act for multinationals, financial institutions, exporters, and trading firms across sectors. Our cross-regime coverage means that a US enforcement matter does not require a separate firm for the UK or EU dimension. To discuss your matter in confidence, contact our team at info@caldervance.com.