An OFAC information request lands in the compliance inbox. The clock is already running. Whether the communication takes the form of a subpoena, a request for information, a cautionary letter, or an informal agency inquiry, the governing principle is the same: delay, incomplete production, and missteps in tone or scope can convert a containable enforcement matter into a significantly more serious one. For any cross-border business with US-dollar exposure, counterparties in sensitive markets, or operations touching a designated person, this risk is immediate and concrete.
Responding to regulator information requests under OFAC requires a structured legal approach: scoping the request precisely, identifying and preserving potentially responsive material, managing privilege and confidentiality, and calibrating what the response communicates about broader compliance posture. The process takes place under the authority of IEEPA and related statutes, with OFAC holding wide investigative powers. How a business responds in the first phase materially shapes the outcome of the entire matter.
This page explains how OFAC information requests work, where responses go wrong, how the UK and EU enforcement authorities handle analogous requests, and how Calder & Vance assists businesses at each stage of the process.
What is an OFAC information request and what does it trigger?
An OFAC information request is a formal or semi-formal demand that a person or business produce documents, records, or other information relevant to a potential sanctions violation under IEEPA or the governing programme regulations. It is not, in itself, a penalty notice – but it is the opening move of a process that can lead to one.
OFAC's investigative authority is broad. The agency can request transactional records, communications, counterparty identification data, ownership charts, compliance policies, and internal audit findings. The scope of a given request depends on the apparent nature of the underlying conduct: a screening failure, a suspected blocked-property transaction, a potential dealing with a designated person, or a more systemic compliance failure across a product line or region.
Receiving the request triggers several immediate obligations and decisions. First, a litigation hold must attach to all potentially responsive material. Destruction or alteration of documents after receipt is an independent basis for adverse findings, entirely separate from the original conduct under review. Second, the business must assess whether the request is directed at an apparent violation or at a broader compliance examination – the two warrant different response strategies. Third, counsel needs to evaluate whether a voluntary self-disclosure (VSD) – a voluntary report to OFAC of an apparent violation before being compelled to produce it – remains available and beneficial, or whether the request forecloses that route. In our experience, businesses that engage counsel within the first few working days of receipt preserve significantly more options than those that wait.
What authority governs OFAC information requests, and what are the filing obligations?
OFAC administers US economic sanctions under IEEPA, the Trading with the Enemy Act, and a series of programme-specific instruments, each giving the agency power to conduct investigations, examine records, and require production of information from US persons and, in some cases, non-US persons whose activities touch the US financial system or US jurisdiction.
The legal basis for production obligations sits in the primary statutory instruments and the programme regulations administered under them, none of which require a court order for an initial information request. OFAC does not need to commence formal litigation to compel basic production; the agency's investigative mechanism operates by administrative demand, backed by civil penalty authority for non-compliance or obstruction.
Deadlines are set in the request itself and are typically short. Missing a response deadline – even for genuinely administrative reasons – is treated as an aggravating factor under OFAC's enforcement guidelines. The agency distinguishes between a business that engages promptly, requests a reasonable extension where genuinely needed, and demonstrates good-faith cooperation, versus one that goes silent or produces only partial responses. The former is treated materially better at the penalty stage.
One practical point bears emphasis. OFAC's authority is extraterritorial in several respects. A non-US parent company, a European bank, or an Asian trading house with US-dollar clearing activity or US-person involvement can receive an OFAC inquiry. The fact that the requesting letter is addressed to a non-US entity does not make the obligation domestic law only. This is the position that surprises many compliance teams outside the United States, and it is one we routinely address in our cross-border practice.
Related practices
- Apparent violation assessment – EU – scoping apparent violations and enforcement risk under EU sanctions
- Voluntary self-disclosure – EU – advising on VSD timing, content, and mitigation under EU enforcement regimes
The position above covers the standard case. Your facts – the counterparty, the goods, the jurisdiction, the size of the exposure – change the analysis materially. For an assessment of your position under the applicable OFAC programme, contact Calder & Vance at info@caldervance.com.
How does the response process work in practice?
Responding to an OFAC information request is a structured multi-stage process that runs from initial triage through document collection, legal review, production, and post-production dialogue with the agency. Each stage carries its own deadlines and its own risks.
The first stage is triage. Counsel reads the request precisely – what is asked, what period is covered, what entities and individuals are in scope, and what legal standard applies to the production obligation. Triage also determines whether the request is a stand-alone inquiry, part of a broader examination across multiple regulators, or one of several simultaneous requests (a pattern that can arise in complex cross-border matters where OFAC, OFSI, and the relevant EU member-state authority are all examining the same conduct). In our practice we treat this initial read as the single most important investment of time in the entire matter.
The second stage is document collection and privilege review. Responsive documents must be identified across systems – email, trading platforms, compliance databases, screening logs, payment records. Attorney-client privilege and work-product protection apply to the process, but the scope of protection in US enforcement proceedings differs from the equivalent protections in English or EU law. A business with counsel in multiple jurisdictions needs a coordinated approach; producing documents in one jurisdiction without an eye to the implications for parallel proceedings in another is a common, costly mistake.
The third stage is drafting the response. The cover letter that accompanies production is not a formality. It sets out the scope of the search, any limitations on the production, representations about completeness, and – critically – the business's characterisation of its compliance posture. OFAC reads cover letters carefully. A letter that frames the business as a cooperative, compliance-minded firm that identified and addressed a discrete failure reads differently from one that reads as defensive or evasive. We draft these letters with both the immediate proceeding and the longer-term enforcement relationship in mind.
The fourth stage is managing the follow-on dialogue. OFAC may come back with supplemental requests, targeted questions, or requests for interviews with key personnel. Each of those exchanges is, in effect, an extension of the formal response process. How witnesses are prepared, what representations are made orally, and what additional documents are produced all feed into OFAC's penalty calculus.
How do UK and EU enforcement authorities handle analogous requests?
OFSI – the Office of Financial Sanctions Implementation, HM Treasury's sanctions enforcement arm in the United Kingdom – and the competent national authorities in EU member states operate analogous information-gathering powers, but the procedural architecture differs in ways that matter for businesses facing simultaneous inquiries across regimes.
Under the UK regime, OFSI has statutory powers to require information and documents from persons it suspects of involvement in a financial-sanctions breach, and to share information with law enforcement and with foreign counterpart agencies. The OFSI enforcement process is governed by a published penalty framework, and the agency's guidance sets out the factors it weighs in determining whether to impose a monetary penalty and at what level. The UK and US regimes share the concept of cooperation credit – cooperating with OFSI, like cooperating with OFAC, is a mitigating factor – but the procedural steps and timelines differ.
In EU member states, the enforcement architecture is national. There is no single EU enforcement body equivalent to OFAC or OFSI. A business facing an inquiry from a German, French, or Dutch competent authority is engaging with national law and national procedure, even though the underlying sanctions regulation is a directly applicable EU instrument. Coordination between national authorities is improving, but it is neither automatic nor seamless.
The cross-border implication for businesses receiving an OFAC request is this: if the same conduct is visible to OFSI or an EU national authority – through a shared bank, a connected counterparty, or a cross-border transaction – a coordinated multi-regime response is essential from the outset. Responses calibrated only for OFAC, without regard to the UK or EU positions, regularly create evidentiary problems in the parallel proceedings. We manage that coordination as a standard feature of our cross-border enforcement work, involving local counsel in relevant EU jurisdictions where needed.
What are the principal risk flags in responding to an OFAC information request?
The most serious risk in an OFAC information response is not the original conduct – it is the response itself. A poorly managed production can transform a civil enforcement matter into something significantly more serious.
The risk flags we see most often in our practice fall into six categories.
- Incomplete or selective production. Producing only the documents that appear favourable, or limiting the search to obvious custodians and obvious systems, invites a finding of obstruction or non-cooperation. OFAC's enforcement guidelines treat incomplete production as an aggravating factor.
- Over-disclosure of privileged material. Failing to conduct a proper privilege review before production can waive attorney-client privilege, potentially opening internal legal advice to agency examination. This is particularly acute when legal advice was sought contemporaneously with the conduct under review.
- Inconsistent representations across jurisdictions. A business that describes the same transaction differently to OFAC and to OFSI, or that makes representations in one proceeding that contradict documents in another, creates a significant integrity problem. Coordination is non-negotiable.
- Missing the deadline without an agreed extension. Even a single missed deadline without a pre-agreed extension is an aggravating factor. Requests for extension should be made promptly, in writing, with a genuine reason stated.
- Failing to identify a VSD opportunity. If the information request reveals conduct that has not yet been voluntarily disclosed, and a VSD is still available and beneficial, the business should consider it actively. A VSD filed before OFAC discovers the conduct through its own investigation is a significant mitigating factor under the agency's published guidelines.
- Inadequate document preservation. Any destruction, alteration, or deletion of potentially responsive material after receipt of the request – even if the act was routine and automated – must be identified, halted, and, if it has already occurred, disclosed. Concealment of such an event compounds the enforcement problem materially.
Does your business have a litigation hold protocol that activates automatically on receipt of a regulatory inquiry? Many compliance programmes have strong screening and monitoring tools but no pre-designed response to a formal government demand. That gap is the one that tends to cost the most.
How does a voluntary self-disclosure interact with an OFAC information request?
A voluntary self-disclosure (a proactive report to OFAC of an apparent violation before the agency discovers it through its own investigation) interacts with an information request in a way that the timing of each shapes the other.
If OFAC sends an information request before any VSD has been filed, the business must assess whether a VSD is still open. In general, the VSD credit is available only where the disclosure is genuinely voluntary – that is, not prompted by the agency's own investigation or an imminent likelihood of discovery. Receiving an OFAC information request may, depending on its scope, foreclose the full VSD credit for the conduct covered by that request. It may not, however, foreclose VSD credit for related but distinct conduct that OFAC has not yet reached.
The interaction between the VSD assessment and the information-request response has to be managed simultaneously and with care. Filing a VSD mid-response, without coordination with the information-request production, can create inconsistencies that undermine both the VSD and the production. Filing nothing, when a VSD is still available and material, is equally costly. We analyse both positions at the outset and advise on the appropriate sequencing as a first-day task.
For businesses that have already filed – or are in the process of filing – a VSD under EU or UK procedures, the interaction with a parallel OFAC request adds a further layer. OFSI and OFAC have a developed information-sharing relationship, and EU national authorities operate within frameworks that similarly permit cross-border information exchange. The VSD filed with one authority can, and sometimes does, inform the investigation by another. We structure multi-regime disclosures with this in mind from the start. For further detail on the EU VSD process, see our related practice page: Voluntary self-disclosure – EU (full service overview).
A common misconception: "we can manage this internally without specialist counsel"
The most persistent myth we encounter at the bofu stage of an OFAC inquiry is that an in-house compliance team – however capable and well-resourced – can manage the information-request response without external counsel. The rationale typically offered is that the business knows the facts, the compliance team knows the regime, and external counsel will only slow things down.
That view underestimates the structural complexity of the problem. The OFAC information-response process is not primarily a compliance task. It is a legal proceeding. The decisions made about what to produce, how to characterise the business's conduct, whether to file a VSD, how to structure privilege assertions, and how to communicate with OFAC are all decisions with legal consequences that a compliance officer – without external legal privilege protection covering the analysis – is structurally unable to make safely.
In a recent matter, a technology-sector business received an OFAC request for information following a screening alert that had been cleared internally as a false positive. The in-house team began compiling documents before instructing counsel. By the time we were engaged, the team had already produced several communications that weakened a privilege argument relevant to the broader compliance review. We assessed the apparent violation, prepared and submitted a structured response, and managed the follow-on dialogue. The matter resolved without a formal penalty – but the privilege issue, created before counsel was involved, required careful management throughout. Earlier instruction would have avoided it entirely.
In our cross-border practice, we also regularly see businesses that instruct counsel in their home jurisdiction but not a counsel with dedicated OFAC expertise. UK or EU counsel unfamiliar with OFAC's procedural and substantive expectations – the way the agency reads a cover letter, what it considers responsive, what mitigation arguments it weights – can, with the best intentions, produce a response that reads poorly to the agency. Specialist sanctions counsel is not an overhead. It is the most cost-effective investment at this stage of an enforcement matter.
If a transaction has already been flagged, or an information request has been received, an early review preserves options that narrow with every passing day. Contact Calder & Vance at info@caldervance.com to discuss your position.
How Calder & Vance assists businesses responding to OFAC information requests
Our enforcement and investigations practice provides end-to-end assistance for businesses at every stage of an OFAC information-request process, from the moment of receipt through final resolution.
In the first phase, we scope the apparent violation, advise on the legal obligations triggered by the request, and issue immediate guidance on document preservation. We assess whether a VSD remains available and beneficial, and we deliver a clear recommendation on timing and sequencing within the first session.
In the production phase, we assess eligibility for privilege claims, manage the document review across all custodians and systems, and prepare the cover letter and any representations made to the agency. Where the matter touches the UK or EU regimes – which is the norm rather than the exception in our cross-border practice – we coordinate with the parallel proceedings from the outset, working alongside local counsel in relevant EU jurisdictions as appropriate.
In the post-production phase, we manage OFAC's follow-on questions and requests, prepare any witnesses for voluntary interviews, and monitor the enforcement proceeding through to its conclusion. Where a civil monetary penalty is ultimately assessed, we prepare the penalty defence and, where appropriate, challenge the penalty calculation. For related EU apparent-violation analysis, see our practice page: Apparent violation assessment – EU.
We offer a defined-scope initial review at a fixed fee. That review delivers a written assessment of the information request, the apparent violation, the VSD question, and the recommended response strategy. It is designed to give a General Counsel or board a clear picture of the matter and the path forward, within a cost and timeline that is known in advance.