A transaction closes. Months later, someone on your compliance team, or your own outside counsel, notices something in the counterparty chain that shouldn't be there. Maybe a vendor turned out to be owned by a sanctioned party. Maybe a shipment routed through a country your company had no idea was involved. Maybe a bank flagged a wire after the fact.
Whatever triggered it, you now have a possible sanctions problem sitting inside a deal you already closed. Sanctions violations under U.S. law are largely strict liability. Your company can be exposed even if nobody involved intended to violate anything. That makes the next few decisions important, and the good news is that the U.S. Treasury's Office of Foreign Assets Control ("OFAC") has a well-worn process for exactly this situation. Here is how it works, and where the real decision points are.
Step One: Confirm the Facts Before You Do Anything Else
Before deciding whether to disclose, stop, or defend, your company needs to know what actually happened. That means a focused internal review, usually led by outside counsel so the findings stay protected by privilege, that pins down the transaction, the parties, the money flow, and whether U.S. jurisdiction and a sanctions program were actually implicated. It also means immediately identifying whether any related or follow-on transactions are still in progress, since those need to stop or be licensed before they compound the exposure.
This step also decides everything downstream. OFAC's Enforcement Guidelines weigh factors like the nature of the violation, whether your company had a functioning compliance program, whether the conduct was willful or reckless versus a genuine oversight, and how your company responded once it learned of the issue. Every one of those factors depends on having the facts nailed down first.
Step Two: Decide Whether to Voluntarily Self-Disclose
Once you know what happened, the central decision is whether to submit a Voluntary Self-Disclosure, commonly called a "VSD," to OFAC. A VSD is exactly what it sounds like: your company tells OFAC about the apparent violation before OFAC finds it some other way.
This decision matters because OFAC's own published Enforcement Guidelines treat voluntary disclosure as one of the most significant mitigating factors available. In a non-egregious case, a qualifying VSD by itself cuts the starting point for any penalty calculation roughly in half compared to a case OFAC discovers on its own. Voluntary disclosure is also weighed heavily as cooperation under OFAC's general factors and combined with the other favorable facts in a case, it can support a non-monetary outcome, such as a no-action letter, a cautionary letter, or a Finding of Violation, instead of a fine. Waiting and hoping OFAC never connects the dots is rarely the better bet. Sanctions violations tend to surface anyway, through the counterparty bank, a subpoena in an unrelated matter, or a public designation, and a late or reactive disclosure gets none of the credit a timely one does.
A VSD is not an admission you make lightly, and it is not always the right call. There are real reasons a company might choose not to disclose, or to disclose only after resolving open legal questions about whether a violation occurred at all. This is a decision to make with counsel, transaction by transaction, not a reflexive default.
Why It Matters Whether the Program Traces Back to TWEA or IEEPA
Here is a distinction that rarely comes up until it matters, and it matters quite a bit if OFAC decides to pursue a penalty. Not all U.S. sanctions programs are built on the same legal foundation.
Some of the oldest sanctions programs, most notably the Cuba embargo, were promulgated under the Trading with the Enemy Act, or "TWEA." Congress amended TWEA's implementing framework decades ago to require a real administrative hearing before an administrative law judge, with a right to prehearing discovery, before a monetary penalty becomes final.
Most of today's active sanctions programs, including those touching Iran, Russia, North Korea, and the various terrorism and narcotics designation programs, run instead under the International Emergency Economic Powers Act, or "IEEPA." Congress never extended that same hearing requirement to IEEPA-based programs. Federal courts have confirmed this distinction directly, rejecting arguments that companies and individuals are entitled to an oral hearing, discovery, or cross-examination under IEEPA-based sanctions regulations. The Seventh Circuit did so in Clancy v. Geithner in 2009, and the Second Circuit reached the same result in Karpova v. Snow in 2007, both upholding OFAC's single-round, written-only process against due process challenges.
The practical upshot: if your matter involves an IEEPA program, and most do, there is no oral hearing waiting for you later in the process. Whatever you submit in writing is very likely the entire case OFAC will ever see.
Step Three: If OFAC Moves Forward, the Pre-penalty Notice
If OFAC decides your disclosure, or an investigation it opened on its own, warrants pursuing a penalty rather than closing the matter, it will issue a Pre-penalty Notice. This notice describes the alleged violation, cites the specific rules involved, states the proposed penalty amount, and gives your company a window, typically 30 days, though extensions are often available, to submit a written response.
That written response is the heart of the entire process. For IEEPA-based programs, there is ordinarily no hearing after this. OFAC considers your response, along with the rest of its file, and then issues a final Penalty Notice.
What Belongs in That Response
Because this is likely your only real opportunity to be heard, the response needs to do more than deny wrongdoing or ask for leniency in general terms. It should include every fact, document, and argument that supports a better outcome, tied specifically to OFAC's own published factors: the compliance program you had in place, how quickly you stopped the conduct once discovered, the cooperation and information you provided, and any facts bearing on whether the conduct was willful or an isolated lapse.
It also helps to ask for more than one outcome, in order. OFAC's own guidelines recognize a range of possible responses to the same underlying conduct, running from no-action, to a cautionary letter, to a Finding of Violation that documents the violation without a fine, up to a civil monetary penalty. Rather than asking only for the best of these and leaving OFAC to fill in everything else, an effective response typically leads with a primary request, such as no action or a cautionary letter, and follows it with clearly stated fallback positions, such as a Finding of Violation or a reduced penalty tied to specific mitigating factors, in case the primary request is not granted. Asking for a fallback position does not weaken the primary request. It simply ensures OFAC has a complete, ordered picture of every favorable outcome that the facts support, rather than an all-or-nothing choice.
It is also worth knowing that a negotiated settlement is available at essentially any stage of this process, before a Pre-penalty Notice is ever issued or after one is on the table but before a final Penalty Notice. A settlement does not involve a formal determination that a violation occurred, and it is often the most efficient way to close out a matter once the facts are largely undisputed.
One important nuance: none of this means you get only one word in edgewise and then silence. In practice, OFAC caseworkers regularly come back with follow-up or clarifying questions before reaching a final decision, and a company is generally free to supplement its submission with new or more developed information if something material comes to light afterward. The practical reality is closer to this: treat your written response as if it will be the only thing OFAC ever reads, because it very likely will be, but do not assume the door slams shut the moment you hit send. Just do not plan around getting a second bite once the file is closed, because there is no guarantee you will get one.
After the Penalty Notice: Is There Any Way to Challenge It?
Once OFAC issues its final Penalty Notice, that is the point at which the matter becomes something a federal court can review. There is no separate appeal to OFAC itself and no path to an agency hearing for IEEPA-based programs. Instead, a company can file a civil action in federal district court under the Administrative Procedure Act, arguing that OFAC's decision was arbitrary and capricious, contrary to law, or unconstitutional.
That review happens on the closed administrative record built during the Pre-penalty response. There is no new evidence, no trial, and no live testimony. The court decides, as a matter of law, whether OFAC's own record supports what it did. Review of OFAC's factual and policy conclusions is highly deferential. Review of constitutional claims, such as a claim that a regulation never gave fair notice that certain conduct was prohibited, is independent and searching rather than deferential.
This is not a purely theoretical option. In Exxon Mobil Corp. v. Mnuchin, a federal district court in Texas fully vacated a two-million dollar OFAC penalty in 2019 after finding that OFAC's own regulations and public statements never gave Exxon fair notice that its conduct was prohibited. That case did not challenge the lack of a hearing. It challenged whether the underlying rule was ever clear enough to support a penalty at all, and it won entirely on the paper record. Other companies challenging OFAC penalties on more conventional grounds, including in Epsilon Electronics v. Department of the Treasury in 2017, have had their penalties upheld. The lesson from both outcomes is the same: what wins or loses in federal court is decided by what made it into the administrative record during the Pre-penalty response, which is exactly why that response deserves the same care as a filing in active litigation.
The Bottom Line
Discovering a possible sanctions problem after a deal has closed is not a reason to panic, and it is not something to sit on either. OFAC has a defined, well-understood process for exactly this scenario, and the choices that matter most, whether to disclose, what to put in the written response, and how to frame the request, are made early and are difficult to unwind later. Getting experienced counsel involved before that first submission goes out, rather than after, is the single biggest factor within your control.
This post is provided for general informational purposes and does not constitute legal advice. Every sanctions-related matter turns on its own facts, and the right course of action, including whether to voluntarily self-disclose, depends on the specific transaction, program, and evidence involved. If your company has identified a possible sanctions issue, contact Fridman Fels & Soto, PLLC before taking further action.
Frequently Asked Questions
Do we have to voluntarily self-disclose a possible OFAC violation?
No. There is no general legal requirement to self-disclose most sanctions violations to OFAC. The decision is a strategic one, weighed against the likelihood OFAC discovers the issue independently and the mitigation credit a timely, complete disclosure can earn.
What happens if we don't disclose and OFAC finds out on its own?
OFAC treats a voluntary, complete disclosure very differently from one it uncovers itself. A company that waits and is later found out typically loses most or all of the mitigation credit a voluntary self-disclosure would have provided, and may face a higher penalty for the delay itself.
Does a VSD guarantee we won't be penalized?
No. A qualifying voluntary self-disclosure is a significant mitigating factor, not a guarantee. OFAC still weighs the underlying facts, including how serious the conduct was and whether it was willful. Many voluntary self-disclosures do result in no penalty or a substantially reduced one, but that outcome depends on the specifics of the case.
Can we ask OFAC for something less than a full dismissal, like a reduced penalty or a warning letter?
Yes, and doing so is often a sound strategy. A written response can ask for a finding of no violation as the primary outcome while also laying out fallback requests, such as a cautionary letter or a specific percentage reduction tied to particular mitigating factors, in case the primary request is not granted.
If OFAC issues a Pre-penalty Notice, do we get a hearing before it decides?
For most current sanctions programs, including those covering Iran, Russia, and similar IEEPA-based programs, no. The written response to the Pre-penalty Notice is typically the only opportunity to be heard before OFAC issues its final decision. A small number of older programs built on the Trading with the Enemy Act, most notably the Cuba embargo, do provide for a hearing before an administrative law judge.
Once we submit our written response, is that our only chance to add information?
It should be treated that way, but it is not an absolute rule. OFAC can request follow-up information, and companies can generally supplement their submission with new, relevant material before OFAC's final decision issues. The safer approach is to submit a complete, well-documented response the first time rather than count on a later opportunity that may not come.
Can we go to federal court if we disagree with OFAC's final penalty?
Yes. Once OFAC issues its final Penalty Notice, that decision can be challenged in federal district court under the Administrative Procedure Act. The court reviews the closed administrative record rather than holding a trial, and the review is deferential on factual and policy issues but independent on constitutional claims.
How long does this entire process typically take?
It varies widely depending on the complexity of the underlying conduct, whether OFAC requests additional information, and whether the matter proceeds to a formal penalty at all. Matters that end with a voluntary self-disclosure and a no-action or cautionary outcome can resolve in a matter of months. Matters that proceed through a full Pre-penalty Notice, response, and Penalty Notice, and then into federal court, can take considerably longer.
