OFAC Penalties: How Fines Are Calculated

OFAC settled 22 enforcement actions in the first three quarters of 2025, with penalties ranging from $31,000 to $11.8 million (Treasury.gov, October 2025). Same agency, same regulations, wildly different outcomes. The company that paid $31,000 violated the same sanctions program as the one that paid $11.8 million.

The difference isn't random. OFAC follows a penalty calculation framework that weighs specific factors in a specific order. Understand that framework, and you understand the difference between a six-figure settlement and an eight-figure disaster.

We've walked clients through OFAC penalty negotiations, reviewed dozens of settlement agreements, and tracked the patterns in published enforcement actions. The math isn't mysterious — it's just not widely understood outside enforcement defense circles.

Key Takeaways

• OFAC's base penalty calculation starts with the statutory maximum ($356,579 per violation as of January 2025) or the transaction value, whichever is greater
• Voluntary self-disclosure cuts base penalties by 50% as a starting point — the single biggest factor in penalty reduction
• "Egregious" versus "non-egregious" classification determines whether penalties fall in the upper or lower half of the available range
• Aggravating factors (management awareness, harm to sanctions objectives, prior violations) push penalties up; mitigating factors (compliance program, cooperation, remediation) push them down
• Settlement amounts in published cases represent negotiated outcomes — the initial penalty calculation often started 3-5x higher

How Does OFAC Calculate the Base Penalty?

OFAC's penalty framework starts with establishing the "base penalty amount" — the starting point before adjustments. The base depends on whether the case qualifies as "egregious" or "non-egregious."

For non-egregious cases, the base penalty equals the greater of: (a) the applicable statutory maximum per violation ($356,579 under IEEPA as of January 2025, adjusted annually for inflation), or (b) the transaction value. Most SMB cases involve transaction values below the statutory max, so $356,579 becomes the operative number.

For egregious cases, the base penalty equals the greater of: (a) twice the statutory maximum per violation ($713,158), or (b) twice the transaction value. The multiplier doubles everything.

The egregious/non-egregious determination hinges on several factors OFAC weighs together: Did the violation involve willful or reckless conduct? Did management know or have reason to know? Did the conduct cause significant harm to sanctions program objectives? Was there a pattern of violations? Did the violator attempt to conceal the conduct?

We've seen cases tip from non-egregious to egregious on a single factor. A company with sloppy compliance but no management knowledge stays non-egregious. Add one email showing a VP knew about the problematic transaction, and the whole case flips to egregious. That flip doubles the starting penalty before any other adjustments.

What Makes a Case "Egregious"?

OFAC's Economic Sanctions Enforcement Guidelines lay out the egregious factors, but the real-world application involves judgment calls that published guidance doesn't fully capture.

Willful or reckless conduct weighs heavily. "Willful" means the company knew the conduct violated sanctions and did it anyway. "Reckless" means the company should have known — the information was available, the red flags were there, but nobody bothered to look. Reckless conduct can push a case to egregious just as surely as willful conduct.

Management involvement matters enormously. A line employee who processes a prohibited transaction without management knowledge points toward non-egregious. A transaction approved by senior management, or conducted with management's awareness, points toward egregious. OFAC looks at who knew, when they knew, and what authority they had.

Harm to sanctions objectives affects the classification. Transactions that directly funded sanctioned activities — weapons programs, terrorism, human rights abuses — get treated more harshly than technical violations with minimal real-world impact. A $50,000 wire to a designated narcotics trafficker lands differently than a $50,000 software license to a company that later appeared on the SDN list.

Pattern of conduct versus isolated incident changes the calculus. One problematic transaction among thousands of clean ones looks like an error. Twenty problematic transactions over eighteen months looks like a system failure or deliberate evasion.

Concealment or obstruction destroys any benefit of the doubt. Altering records, misleading auditors, slow-walking document production — any of these can flip a case to egregious regardless of how minor the underlying conduct was.

How Does Voluntary Self-Disclosure Affect Penalties?

Voluntary self-disclosure is the single most powerful penalty reduction factor. OFAC's guidelines provide a 50% reduction in the base penalty amount for cases involving voluntary self-disclosure and no aggravating factors.

The math matters here. A non-egregious case with a $356,579 base penalty drops to $178,290 starting point with voluntary self-disclosure. An egregious case with a $713,158 base drops to $356,579. That 50% cut happens before other mitigating factors apply.

But voluntary self-disclosure has requirements. The disclosure must be voluntary — not triggered by a subpoena, audit inquiry, or government investigation you've become aware of. It must be complete — covering all relevant violations, not just the ones you think they might find anyway. And it must be timely — made promptly after discovery, not after months of internal debate about whether to come forward.

We've watched companies blow their voluntary self-disclosure credit by waiting too long. A client discovered a potential violation in March, spent four months investigating internally, and finally disclosed in July. During those four months, OFAC had opened an investigation based on a separate lead. The disclosure no longer qualified as voluntary. The 50% reduction vanished.

The timing pressure creates real tension. Disclose too fast and you might not understand what you're disclosing. Disclose too slow and you might lose the credit. Our general guidance: file an initial disclosure within 60 days of discovering a potential violation, then supplement with additional details as your investigation continues.

What Factors Increase Penalties?

OFAC's aggravating factors can push penalties well above the base calculation. Each factor present adds weight; multiple factors compound.

Prior violations within the past five years signal a compliance program that isn't working. OFAC tracks enforcement history, and repeat violators face steeper penalties. A company settling its second OFAC case pays more than a first-time violator with identical conduct.

Awareness by senior management transforms what might be employee error into organizational failure. OFAC looks for evidence that executives knew — emails, meeting minutes, approval chains. Management awareness often appears in the published settlement language, and it consistently correlates with higher penalties.

Sophistication of the violator matters. A multinational corporation with a legal department and compliance staff gets less benefit of the doubt than a small business with no dedicated compliance function. OFAC expects more from companies that have the resources to know better.

Harm to sanctions objectives remains somewhat subjective but clearly influences outcomes. Violations involving weapons proliferation, terrorism financing, or human rights abusers draw harsher treatment than technical violations involving lower-risk sanctions programs.

Willful blindness — deliberately avoiding knowledge that would confirm a violation — gets treated as actual knowledge. Telling employees not to ask questions about suspicious transactions doesn't insulate management from the awareness factor.

Acting with knowledge of a pending investigation or enforcement action makes everything worse. Continuing prohibited conduct after learning you're under scrutiny demonstrates exactly the kind of disregard OFAC punishes most severely.

What Factors Decrease Penalties?

Mitigating factors can reduce penalties substantially below the base amount, and they stack. A company hitting multiple mitigating factors while avoiding aggravating factors can see dramatic penalty reductions.

Existence of a compliance program at the time of the violation helps — but only if the program was real. OFAC looks for written policies, training records, screening procedures, audit mechanisms. A compliance program that exists on paper but wasn't actually implemented provides no mitigation.

Remedial response after discovering the violation demonstrates good faith. Did the company stop the prohibited conduct immediately? Did it enhance its compliance procedures? Did it discipline responsible employees? Did it engage outside counsel or compliance experts? OFAC credits companies that take violations seriously and fix the underlying problems.

Cooperation with the investigation reduces penalties. Responding fast to document requests, making employees available for interviews, handing over organized and complete information — all of this earns credit. Dragging feet, dumping documents in disorganized piles, or coaching witnesses on what to say earns the opposite.

No prior violations establishes the company as a first-time offender. OFAC distinguishes between companies with clean records and repeat violators, with first-timers receiving more favorable treatment.

Limited harm to sanctions objectives can mitigate penalties. A technical violation that didn't actually benefit a sanctioned party or undermine U.S. policy goals gets treated less harshly than conduct that directly supported prohibited activities.

Acting in good faith — reasonably interpreting ambiguous regulations, following industry practice, relying on legal advice — can reduce penalties. Good faith doesn't excuse violations, but it distinguishes honest mistakes from willful evasion.

How Do Published Settlements Compare to Initial Calculations?

The settlement amounts OFAC publishes represent negotiated outcomes, not initial penalty calculations. Understanding this gap matters for anyone facing potential enforcement.

We've seen cases where OFAC's initial penalty proposal exceeded $5 million, but the final settlement landed under $800,000. The company had voluntary self-disclosure credit, a strong compliance program, full cooperation, thorough remediation, and no prior violations. Each factor reduced the number.

We've also seen cases go the other direction. A company expected a manageable penalty based on transaction size, but OFAC found management awareness, pattern conduct, and concealment. The initial proposal came in at multiples of what the company anticipated.

The settlement negotiation process typically involves multiple rounds. OFAC issues a pre-penalty notice with its proposed amount and reasoning. The company responds with arguments for reduction, evidence of mitigating factors, and sometimes challenges to OFAC's legal theory or factual findings. OFAC considers the response and either adjusts its position or proceeds toward a formal penalty.

Most cases settle. Going to court means fighting Treasury on its home turf, with the burden of proof stacked against you. Companies usually do the math and decide a negotiated settlement, even a painful one, beats the uncertainty and legal bills of litigation.

Platforms like Lenzo can help identify potential violations before they become enforcement cases — catching screening gaps, flagging problematic transactions, documenting compliance efforts. The best penalty is the one you never face because you caught the problem first.

FAQ

What's the maximum OFAC penalty per violation?

The statutory maximum under IEEPA is $356,579 per violation as of January 2025, adjusted annually for inflation. However, penalties can exceed this amount when transaction values are higher or when egregious factors apply (which double the base). Criminal penalties for willful violations can reach $1 million per violation and 20 years imprisonment. Some sanctions programs have different statutory frameworks with higher maximums.

Does company size affect OFAC penalties?

Not directly in the formula, but indirectly through several factors. Larger companies with more resources face higher expectations for compliance sophistication — OFAC gives less benefit of the doubt to multinationals with legal departments than to small businesses without dedicated compliance staff. Larger companies also tend to have larger transaction volumes, which can mean more violations and higher aggregate penalties.

How long do OFAC investigations typically take?

Investigations range from several months to several years depending on complexity. Simple cases with voluntary self-disclosure and cooperation can resolve in 6-12 months. Complex cases involving multiple programs, numerous transactions, or parallel criminal investigations can extend 3-5 years. The uncertainty is one reason voluntary self-disclosure and cooperation matter — they tend to accelerate resolution.

OFAC penalty calculations follow a structured framework, but the outcomes depend heavily on factors within the company's control. Voluntary self-disclosure, compliance program quality, cooperation, and remediation all move the numbers. Companies that understand the framework before they face enforcement can make decisions that significantly reduce their exposure.

The cheapest penalty is always the one you avoid entirely by catching violations before OFAC does.