OFAC Voluntary Self-Disclosure: Process Guide

OFAC's maximum civil penalty under IEEPA reached $377,700 per violation as of January 15, 2025 (Federal Register, 90 FR 3688). For a mid-sized exporter with 15 shipments to a screening-missed party, exposure crosses $5.6M before transaction value multipliers kick in. Voluntary self-disclosure cuts that base penalty in half—but only if the filing arrives at Treasury before anyone else reports the violation.

Key Takeaways

• Voluntary self-disclosure reduces base civil penalties by 50% in non-egregious cases, capped at $188,850 per violation (31 CFR 501, Appendix A, January 2025 adjustment)
• The two-step disclosure process—initial notification followed by detailed report—typically spans 4-12 months from first contact to OFAC resolution
• OFAC extended recordkeeping requirements from 5 to 10 years effective March 12, 2025, matching the updated statute of limitations under the 21st Century Peace through Strength Act
• 2025 civil penalties have exceeded $254 million year-to-date, with the GVA Capital case alone accounting for $216M of that total

What Qualifies as Voluntary Self-Disclosure?

A disclosure qualifies for VSD credit only when it meets four conditions simultaneously. Miss one, and the penalty reduction vanishes.

OFAC's Enforcement Guidelines at 31 CFR Part 501, Appendix A define voluntary self-disclosure as self-initiated notification to OFAC of an apparent violation prior to or simultaneous with discovery by OFAC or any other government agency. That definition sounds straightforward. The disqualifiers are where companies stumble.

Third-party reporting kills VSD credit immediately. When your bank's compliance team files a blocked transaction report before your disclosure lands at OFACDisclosures@treasury.gov, you're out. Financial institutions have independent reporting obligations under 31 CFR 501.604—they won't wait for your internal investigation to wrap. A disclosure prompted by subpoena or formal inquiry also fails the self-initiated test. Same result if the disclosure comes without authorization from senior management.

I've watched companies lose VSD credit because their compliance officer filed before the general counsel signed off. The 50% reduction: gone.

The timing pressure creates an ugly choice. File too early with incomplete information, and OFAC may determine the disclosure lacks sufficient detail. Wait too long to investigate properly, and a counterparty's compliance team may beat you to Treasury. Practitioners typically file an initial notification within 48-72 hours of discovering a potential violation, followed by a detailed report within 60-90 days.

How Does OFAC Calculate Penalties With and Without VSD?

The penalty math splits into four scenarios based on two variables: egregious versus non-egregious conduct, and VSD versus no VSD.

For non-egregious cases with VSD, the base penalty equals one-half of the transaction value, capped at $188,850 per violation (31 CFR 501, Appendix A, 2025 adjustment). Ship $50,000 in industrial equipment to a screened-missed SDN, your starting point is $25,000—not the statutory maximum. That cap matters. Without it, a $2M transaction would generate a $1M base penalty before any adjustments.

Non-egregious cases without VSD follow the "applicable schedule amount" formula. Base penalty equals the transaction value, capped at $377,700. That same $50,000 shipment now starts at $50,000 instead of $25,000. Double the exposure for skipping disclosure.

Egregious cases operate differently. With VSD, base penalty is half the statutory maximum—$188,850 per violation under IEEPA regardless of transaction value. Without VSD, you face the full $377,700 per violation or twice the transaction value, whichever is greater. The June 12, 2025 GVA Capital penalty at $215,988,868 landed at the statutory maximum precisely because OFAC classified the conduct as egregious and non-disclosed (Treasury.gov Enforcement Release).

What makes conduct egregious? OFAC considers willfulness, awareness of the sanctions program, pattern of conduct, sophistication of evasion methods, harm to sanctions program objectives, and whether the violation involved blocked persons rather than just prohibited transactions. GVA Capital's case checked multiple boxes: the firm continued managing investments for a designated Russian oligarch despite receiving legal advice warning against exactly that conduct, and they withheld 1,300 responsive documents from an OFAC subpoena for over two years.

Routing shipments through shell companies in third countries while knowing the ultimate consignee is SDN-listed—that's egregious. Shipping to a newly-designated entity three days post-designation when your database hadn't updated—probably not.

The Two-Step VSD Process

Most practitioners file OFAC voluntary disclosures in two phases. Skipping the initial notification is technically possible. Bad idea operationally.

The initial notification goes to OFACDisclosures@treasury.gov within days of discovering a potential violation. Keep the content high-level: the disclosing party's identity, general nature of the apparent violation, acknowledgment that internal investigation is underway, and commitment to file a complete report within reasonable timeframe. This notification stakes your place in line. If a bank files a blocked transaction report next week, you've already established the disclosure as self-initiated.

The complete report follows after internal investigation concludes. OFAC expects sufficient detail to afford a complete understanding of the violation's circumstances. That means: identity of all parties involved, transaction value and payment flow, dates and timeline, which sanctions program applies, root cause analysis of how screening failed, remedial measures already implemented, and any aggravating or mitigating factors you want OFAC to consider.

Average time from initial notification to settlement runs 12-18 months based on publicly available enforcement data. The July 15, 2025 Interactive Brokers settlement resolved 12,367 violations spanning July 2016 through January 2024—the company's self-initiated compliance review began in 2018 and the investigation consumed years. Smaller cases with clean fact patterns sometimes close in 6-8 months. Complex matters with multiple sanctions programs or DOJ parallel investigations stretch past 24 months.

One element practitioners sometimes miss: OFAC may request additional information during review. Responding slowly or incompletely undermines the cooperation credit that stacks on top of VSD credit. Cooperation can reduce penalties by another 25-40% beyond the VSD reduction (31 CFR 501, Appendix A, General Factor E).

What Happens After Filing?

OFAC's response spectrum runs from no action through criminal referral. Where your case lands depends heavily on conduct severity and disclosure quality.

No action letters close the matter entirely. OFAC issues these when the conduct doesn't actually constitute a violation, or when circumstances don't warrant enforcement action. Companies sometimes file disclosures out of abundance of caution—screening hit followed by investigation, uncertainty about whether goods actually reached the flagged party. No action provides a clean exit with documentation.

Cautionary letters acknowledge the apparent violation but impose no penalty. OFAC uses these for minor, isolated violations by parties with otherwise clean records and functioning compliance programs. The letter becomes part of your enforcement history. Future violations may reference it as a compliance history factor—not ideal, but far better than a civil penalty.

Findings of Violation confirm the violation occurred but impose no monetary penalty. OFAC reserves these for cases where aggravating factors are minimal but conduct warrants more than a cautionary letter. The distinction matters for repeat offense calculations.

Civil penalties follow the matrix described above. Settlement negotiation involves the disclosing party's counsel and OFAC staff exchanging views on transaction value calculation, egregious versus non-egregious classification, and applicable mitigating factors. Penalties in settlement agreements don't constitute admission of violation—intentional legal architecture.

Criminal referral to DOJ represents the worst outcome. OFAC makes these referrals for willful violations, particularly those involving sophisticated evasion schemes, blocked persons with national security implications, or obstruction during investigation. The July 2023 Tri-Seal Compliance Note from DOJ, BIS, and OFAC emphasized that disclosing to civil authorities doesn't automatically protect against criminal prosecution—DOJ's National Security Division runs its own VSD program and won't credit disclosures made only to OFAC.

Two 2025 Cases: Same Year, Opposite Outcomes

The Interactive Brokers and GVA Capital cases—both resolved in summer 2025—demonstrate how VSD transforms enforcement outcomes.

Interactive Brokers identified 12,367 apparent violations spanning Iran, Cuba, Syria, Crimea, Russia, Venezuela, and Chinese Military-Industrial Complex sanctions between 2016 and 2024. Statutory maximum civil penalty: $5.2 billion. The company conducted self-initiated compliance review starting in 2018, voluntarily disclosed the violations, and cooperated extensively throughout the multi-year investigation.

Settlement amount: $11,832,136. Less than 0.25% of statutory maximum exposure.

OFAC determined the case non-egregious despite the violation count because the apparent violations constituted less than 0.0001% of IB's total trading volume. VSD credit and substantial cooperation drove the dramatic reduction from a $60.1 million base penalty to final settlement. The July 15, 2025 enforcement release explicitly states the settlement amount "reflects OFAC's determination that the apparent violations were non-egregious and voluntarily self-disclosed."

Now compare GVA Capital from June 12, 2025: no VSD, egregious conduct finding, statutory maximum penalty of $215,988,868. The firm knew Kerimov was on the SDN list. They got legal advice warning them. They kept managing his investments anyway. When OFAC subpoenaed documents, they produced 173 pages initially—then coughed up 1,300 more after receiving a Pre-Penalty Notice two years later.

The arithmetic difference between $11.8M and $216M comes down to disclosure timing and cooperation quality.

Common VSD Filing Mistakes

Certain errors recur across disclosure filings. Each one costs either penalty reduction or credibility.

Waiting for perfect information delays filing past the third-party reporting window. Your bank's compliance software flags the same transaction your investigation examines. Their blocked transaction report hits OFAC first. Your disclosure becomes response rather than initiation. File the initial notification with what you know; supplement later.

Minimizing transaction scope in initial filings backfires during OFAC's independent review. If your disclosure claims one apparent violation but OFAC's analysis reveals seventeen related transactions, the credibility gap affects cooperation credit. Better to acknowledge uncertainty about scope in the initial notification than appear to have understated the problem. GVA Capital's subpoena response—173 documents initially, then 1,300 more two years later—demonstrates the cost of incomplete production.

Failing to implement remedial measures before filing signals ongoing compliance deficiency. OFAC's Enforcement Guidelines explicitly consider "adequacy of the subject person's OFAC compliance program at the time of the apparent violation" and "remedial response" as factors affecting penalty determination. Filing a disclosure while continuing to screen quarterly against a list that updates daily creates obvious tension.

Treating VSD as fire-and-forget rather than ongoing engagement undermines cooperation credit. OFAC staff will have questions. They'll request transaction documentation. Response time and completeness both factor into cooperation assessment. Companies that go silent after filing sometimes find their cooperation credit reduced or eliminated.

Omitting the sanctions program analysis leaves OFAC to classify conduct without input. The disclosure should identify which sanctions program applies—OFAC administers over 30 distinct programs with different prohibitions and penalty authorities. Some programs carry higher penalty ceilings than IEEPA's $377,700 base.

How the 10-Year Recordkeeping Rule Affects VSD Strategy

OFAC's March 12, 2025 rule extending recordkeeping requirements from 5 to 10 years changed the VSD calculation for historical violations (31 CFR 501.601, final rule published March 21, 2025).

Previously, violations older than 5 years often fell outside practical enforcement reach. Limited records meant limited ability to investigate or prosecute. Companies sometimes discovered screening failures from 2017 or 2018 but faced reduced disclosure pressure because documentation gaps made prosecution difficult for OFAC anyway.

The 10-year window now matches the extended statute of limitations enacted under the 21st Century Peace through Strength Act (Public Law 118-50, April 24, 2024). Violations from 2015 forward remain within OFAC's enforcement reach through 2025 and beyond. Records that might have been disposed under the old 5-year rule must now be retained. OFAC's expectation is that companies can reconstruct transaction details for the full decade—not having records because you followed the old rule won't necessarily provide protection.

For SMB exporters running lean compliance operations, the 10-year requirement creates real archival burden. Transaction records, screening logs, customer due diligence files, correspondence about flagged matches—all of it needs retention for a decade. Platforms that maintain screening audit trails automatically have an advantage over spreadsheet-based approaches that lose data when someone clears old rows.

When VSD Doesn't Make Sense

Voluntary disclosure isn't universally optimal. Certain situations favor alternative approaches.

De minimis violations with minimal transaction value and isolated occurrence may not justify disclosure effort. OFAC's Enforcement Guidelines include a "transaction value" floor for the applicable schedule amount—$1,000 for transactions under $1,000. Violations involving negligible value sometimes resolve through no action even without formal disclosure—though risk assessment remains case-specific and should involve counsel.

Cases where third parties have already reported leave no VSD credit to capture. If you know the transaction was blocked and reported by your correspondent bank, filing a separate disclosure adds administrative burden without penalty reduction benefit. Cooperation during the resulting investigation still matters, but the 50% VSD credit is off the table.

Criminal exposure changes calculus entirely. Willful violations involving blocked persons on terrorism or proliferation lists may warrant parallel disclosure to DOJ's National Security Division rather than civil-only disclosure to OFAC. The DOJ's VSD policy doesn't credit disclosures made only to other agencies. Companies facing potential criminal liability need coordinated strategy across civil and criminal disclosure pathways—the June 2025 Unicat case involved simultaneous OFAC settlement ($3.88M), DOJ non-prosecution agreement ($3.325M forfeiture), and BIS administrative resolution ($391K).

Violations that may not be violations sometimes resolve without disclosure. Screening hits require investigation. Investigation sometimes reveals the screened name wasn't the SDN—common name match with different identifying information. Disclosing non-violations wastes OFAC resources and creates unnecessary file entries. The challenge is confident legal analysis before the filing window closes.

FAQ

What is the maximum OFAC civil penalty for IEEPA violations?

The maximum civil penalty under IEEPA is the greater of $377,700 per violation or twice the transaction value (31 CFR Part 501, as adjusted January 15, 2025). Criminal penalties for willful violations can reach $1M per violation and 20 years imprisonment. The $377,700 figure adjusts annually for inflation under the Federal Civil Penalties Inflation Adjustment Act.

How long does OFAC take to resolve a voluntary self-disclosure?

Resolution timelines vary from 6 months for straightforward single-transaction matters to 24+ months for complex cases involving multiple sanctions programs or parallel DOJ investigations. The Interactive Brokers settlement announced July 15, 2025 resolved violations spanning 2016-2024—the company's self-initiated compliance review began in 2018.

Does filing a VSD guarantee reduced penalties?

Filing alone doesn't guarantee reduction. The disclosure must qualify under OFAC's definition—self-initiated, before discovery by OFAC or other agencies, with sufficient detail, and authorized by senior management. Cooperation throughout investigation and remedial measures implemented also affect final penalty calculation. VSDs that arrive after third-party reporting receive no VSD credit.

Can I disclose a potential violation I'm not certain occurred?

OFAC accepts disclosures of apparent or potential violations. Characterize facts accurately, including uncertainty about whether violation occurred. However, disclosing non-violations creates unnecessary file entries and may affect OFAC's future assessment of your compliance program. Engage counsel to evaluate facts before filing.

The 50% penalty reduction through voluntary self-disclosure represents meaningful exposure mitigation for exporters who discover OFAC screening gaps. The process demands speed without sacrificing thoroughness—an operational tension that batch screening or quarterly reviews can't easily resolve. Platforms like Lenzo that maintain continuous screening with complete audit trails simplify both violation detection and the remediation documentation OFAC expects when disclosure becomes necessary. Whether the math favors disclosure depends on transaction value, violation characteristics, and whether anyone else has already reported the same conduct.