David Mortlock, Britt Mosman, Ahmad El-Gamal, Willkie Farr & Gallagher LLP

This is an extract from the Edition 10 of GIR's The Practitioner’s Guide to Global Investigations. The whole publication is available here.

This is an Insight article, written by a selected contributor as part of GIR's co-published content. Read more on Insight

1 Overview of the US sanctions regime

The United States imposes economic and trade sanctions on individuals, entities and jurisdictions based on US foreign policy and national security goals. These measures are administered and enforced primarily by the US Department of the Treasury’s Office of Foreign Assets Control (OFAC), through a combination of statutes, regulations, executive orders and interpretive guidance.

OFAC’s regulations are strict liability, meaning that OFAC need not prove fault or intent to enter an enforcement action and issue a civil penalty. Additionally, if a party wilfully violates US sanctions laws, the Department of Justice (DOJ) and the US Attorney may pursue criminal investigations and enforcement actions. Other regulators, such as the Financial Crimes Enforcement Network and the New York Department of Financial Services, may also play a role in enforcing US sanctions regulations, imposing additional penalties for failures to maintain specific controls to help ensure compliance with OFAC-administered regulations. Both federal and state regulators may pursue enforcement actions for the same conduct simultaneously, potentially leading to multiple related investigations by several entities.

The United States maintains comprehensive sanctions programmes, also called embargoes, generally prohibiting activity involving Cuba, Iran, North Korea, the Crimea region of Ukraine, the Donetsk People’s Republic of Ukraine (DNR) and the Luhansk People’s Republic of Ukraine (LNR).[1] In addition to comprehensive sanctions, OFAC implements targeted sanctions on specific individuals and entities (persons) under one or more of its sanctions programmes targeting various activities, such as narcotics trafficking, terrorism, proliferation activities involving nuclear or other weapons of mass destruction, or human rights violations. Both direct and indirect activities involving governments or persons that are the subject of targeted sanctions can give rise to violations of US sanctions laws.

1.1 Statutes and official guidance

The United States maintains several sanctions regimes, each with its own restrictions and regulations. In addition to the country-specific sanctions programmes, such as the Iranian Transactions and Sanctions Regulations (ITSR), which primarily govern US sanctions on Iran, OFAC can also sanction persons under several targeted sanctions programmes, such as the Foreign Narcotics Kingpin Act or the Global Magnitsky Act.

Pursuant to these sanctions programmes, persons designated by the Department of State or the Department of the Treasury will be added to OFAC’s List of Specially Designated Nationals and Blocked Persons (SDN List). US persons are generally prohibited from engaging in any transactions, directly or indirectly, involving persons on OFAC’s SDN List, as well as any entity of which 50 per cent or more is owned by one or more persons on the SDN List, unless either authorised by OFAC or exempt.[2] In addition, the sanctions programmes administered by OFAC generally prohibit US persons from facilitating actions of non-US persons that, although completely legal for a non-US person, could not be directly performed by US persons owing to sanctions restrictions.

OFAC also imposes certain more narrowly targeted sanctions on particular regions or persons; for example, certain sectors of Russia’s economy are on OFAC’s Sectoral Sanctions Identifications List (SSI List). Listed persons operating in identified sectors of the Russian economy, such as financial services, energy and defence, will be added to the SSI List under one of the Directives implemented pursuant to Executive Order 13662.[3] Each Directive places specific prohibitions, requirements and restrictions on transactions by US persons with those listed persons.

Additionally, OFAC has imposed a new investment prohibition that bars US persons from the commitment of capital or other assets for the purpose of generating returns or appreciation in Russia.[4] As another example, OFAC has placed investment restrictions on certain Chinese companies identified as Chinese Military-Industrial Complex Companies (CMICs), prohibiting US persons from purchasing publicly traded securities – or any securities that are derivative of, or are designed to provide investment exposure to, such securities – of any entity on the non-SDN CMIC List.[5]

OFAC maintains an updated list of US sanctions programmes and country information on its website[6] and a compilation of frequently asked questions that provide details of and guidance on a wide range of topics, including OFAC’s interpretation of newly issued sanctions regulations, enforcement practices specific to certain sanctions programmes and the implementation of authorisations provided in general licences.[7] OFAC also regularly releases separate guidance documents that advise companies of specific risk factors for certain industries and suggest best practices for designing appropriate sanctions compliance programmes.

OFAC’s enforcement authority and procedures are set forth in its Economic Sanctions and Enforcement Guidelines.[8] The Guidelines establish, among other things, the potential outcomes of an investigation or enforcement action and the method and relevant factors for calculating the base penalty amount of an apparent sanctions violation.

1.2 Persons to whom sanctions apply

US sanctions generally restrict activities within the jurisdiction of the United States and by US persons, generally defined as any US citizen, permanent resident alien, entity organised under the laws of the United States or any jurisdiction within the United States (including foreign branches), or any person in the United States.[9] For Iran and Cuba, the prohibitions also extend to any entity owned or controlled by a US person.

The US government may also impose sanctions against non-US persons for certain activity, even with no nexus to the United States. ‘Secondary sanctions’ authorise OFAC or the US State Department to impose sanctions against non-US persons for certain specified activity with Iran, Russia and North Korea. These are intended to discourage non-US persons from engaging in the specified activity and can result in sanctions against the foreign company itself; for example, when the United States reimposed secondary sanctions for certain activity involving specified sectors of the Iranian economy following the US withdrawal from the Joint Comprehensive Plan of Action (JCPOA), non-US persons became exposed to secondary sanctions for engaging in certain significant activity involving Iran’s automotive, shipping, shipbuilding or energy sectors, or involving Iranian SDNs.[10]

Non-US persons should also be aware that they may face liability for causing a US person to engage in conduct that violates US sanctions laws. Examples of this include utilising US financial institutions and involving US subsidiaries or employees in a transaction that violates US sanctions laws. The Department of Commerce, Department of the Treasury and Department of Justice published a tri-seal compliance notice detailing the obligations of foreign-based persons to comply with US sanctions, which states that non-US persons are prohibited from causing a US person to violate US sanctions laws and provides additional considerations for non-US persons.[11]

1.3 Licensing

OFAC may issue a general licence or a specific licence to authorise certain activity that would otherwise be prohibited by sanctions.

A general licence is available to any person engaging in activity that fits the criteria set forth in the licence. Each general licence relates to a particular sanctions programme and generally offers broad authorisations covering certain categories of transactions; for example, a general licence is typically available to authorise the export of food, medicine and medical devices to countries that are the subject of a comprehensive embargo.

In addition to the general licence for the export of food, medicine and medical devices, most sanctions programmes also include general licences permitting certain transactions with respect to official business of the US federal government or international organisations such as the United Nations, certain transactions regarding the transmission of telecommunications and services for personal communications, and the provision of legal services in respect of requirements and compliance with US law (among other things).

It is important to analyse carefully the general licence specific to each country programme as the requirements and restrictions may vary from programme to programme; for example, the general licence for the export of agricultural commodities, medicine and medical devices to Iran set forth in the ITSR includes authorisations only for certain covered persons and excludes the export of some specified goods.[12]

Furthermore, some sanctions programmes contain general licences authorising the export of certain goods or services that are highly tailored to a specific country and its respective sanctions programme and that do not appear in any form in other country sanctions programmes. Cuba, Venezuela and Russia, for example, have highly individualised sets of general licences that change frequently and are specific to the unique sanctions programme for each country.

Specific licences are granted case by case under certain limited situations and conditions. Requests for specific licences may be submitted directly to OFAC. These licences will typically be granted only if the activity is in the interests of US foreign policy.

1.4 Key jurisdictions

The United States maintains comprehensive sanctions on Cuba, Iran, North Korea, the Crimea Region of Ukraine, the DNR and the LNR. Additionally, OFAC imposes significant sanctions on Russian persons and the government of Venezuela.

1.4.1 Cuba

The comprehensive sanctions on Cuba, governed by the Cuban Assets Control Regulations (CACR),[13] generally prohibit any transaction by a person subject to US jurisdiction, including foreign entities owned or controlled by a US person, in which Cuba or a Cuban national has an interest. This includes the export of goods and services, such as financial services, to Cuba and the import of Cuban goods into the United States. US persons are also prohibited from approving, financing, facilitating or guaranteeing any transaction by a foreign person in which they would be prohibited from engaging themselves.

The CACR contains several general licences authorising activities supporting the Cuban people and private enterprise in Cuba.[14] Additionally, the CACR currently contains general licences regarding travel-related transactions for a variety of specified activities. All general licences should be checked frequently to confirm that relevant authorisations are still in effect and that additional restrictions or requirements have not been put in place, limiting the scope of the general licences.

1.4.2 Iran

OFAC’s sanctions programme on Iran is primarily governed by the ITSR,[15] which generally prohibit the export, re-export, sale or supply, directly or indirectly, from the United States or by a US person, wherever located, of any goods, technology or services to Iran and US person facilitation of those prohibited transactions. The prohibitions in the ITSR also apply to foreign entities owned or controlled by a US person.

OFAC reimposed significant secondary sanctions that threaten sanctions on non-US persons for certain transactions involving Iranian SDNs and for specified activities in key sectors of the Iranian economy following the United States’ withdrawal from the JCPOA on 8 May 2018.[16] With the issuance of Executive Order 13902 in January 2020, even more sectors of the Iranian economy became the subject of secondary sanctions, meaning that most trade with Iran now potentially carries secondary sanctions exposure.[17]

1.4.3 North Korea

The North Korean Sanctions Regulations[18] generally prohibit the export, re-export, sale or supply, directly or indirectly, from the United States or by a US person, wherever located, of any goods, technology or services to North Korea and facilitation of those prohibited transactions by US persons.

In addition to the primary sanctions detailed above, a number of North Korea-related executive orders authorise the imposition of secondary sanctions on persons determined to be engaging in certain specified commercial activities involving North Korea.[19]

1.4.4 Crimea, Donetsk People’s Republic of Ukraine and Luhansk People’s Republic of Ukraine

The Ukraine-/Russia-related Sanctions Regulations generally prohibit the export, re-export, sale or supply, directly or indirectly, from the United States or by a US person, wherever located, of any goods, technology or services to Crimea and the facilitation of those prohibited transactions by US persons.[20] Executive Order 14065 similarly prohibits the above-listed activities with respect to the DNR and the LNR.[21]

1.4.5 Russia

Russia is the subject of various US sanctions, which have increased in severity and complexity in response to Russia’s invasion of Ukraine. A significant number of prominent Russian persons appear on OFAC’s SDN List, including key political and military officials, oligarchs, Russian state-owned enterprises and financial institutions.

In addition, pursuant to Executive Order 13662,[22] OFAC issued Directives 1 to 4, imposing sectoral sanctions against entities identified on OFAC’s SSI List[23] operating in certain sectors of the Russian economy, such as financial services, energy and defence.[24] Following Russia’s invasion of Ukraine in 2022, OFAC issued four additional Directives pursuant to Executive Order 14024, two of which target entities identified on OFAC’s SSI List operating in the financial services sector of the Russian economy. The remainder target the Russian Central Bank, National Wealth Fund and Ministry of Finance.[25]

The sharp increase in sanctions targeting Russia necessitates additional diligence and vigilance from persons operating in Russia, or entering into transactions with or involving Russian persons, to ensure that they are not entering into transactions that would constitute violations of the US sanctions on Russia.

Prior to the publication and implementation of the Russian Harmful Foreign Activities Sanctions in February 2022, the original four Directives imposed pursuant to Executive Order 13662 prohibited US persons from dealing in new debt and equity on behalf of designated Russian entities operating in Russia’s financial, energy and defence sectors and from providing support for deepwater and Arctic offshore or shale projects involving listed Russian entities or where a listed Russian entity has an ownership interest of 33 per cent or more. Directive 1 was expanded by Executive Order 14024, published on 15 April 2021, to prohibit US financial institutions from participating in the primary market for rouble-denominated or non-rouble-denominated funds by, or the lending of rouble-denominated or non-rouble-denominated funds to, Russia’s Central Bank, National Wealth Fund or Ministry of Finance.[26]

The Directives imposed in early 2022 after Russia’s invasion of Ukraine further expanded and added to the Directives already in place. Directive 1A, which superseded Directive 1, expanded the prohibition on rouble and non-rouble bonds issued by Russia’s Central Bank, National Wealth Fund or Ministry of Finance to secondary market transactions. Directive 2 prohibits US financial institutions from opening or maintaining correspondent accounts or payable through accounts for or on behalf of or processing transactions involving foreign financial institutions subject to Directive 2. Directive 3 is similar to the prior Directives implemented under Executive Order 13662, prohibiting transactions involving new debt with more than 14 days’ maturity or new equity of entities subject to Directive 3. Finally, Directive 4 prohibits any transactions involving Russia’s Central Bank, National Wealth Fund or Ministry of Finance. Several entities that were initially listed on the SSI List and subject to one of the Directives listed above – such as Sberbank, which was initially listed as subject to Directive 2 – were later designated as SDNs by OFAC in response to Russia’s continuing aggression.

Companies engaging in transactions with SSI entities should scrutinise payment terms to ensure that they do not violate the requirements of the applicable Directive or enter into a transaction involving a Russian financial institution, entity or individual that has been added to OFAC’s SDN List. Companies should also be aware of OFAC’s 50 per cent rule, which states that any entities of which 50 per cent or more, in the aggregate, is owned by any sanctioned entity or entities will also be subject to those same sanctions. This is particularly important when conducting due diligence on Russian entities, as several have complex business structures where multiple sanctioned entities hold interests at varying levels of the ownership chain.

In addition to the blocking and sectoral sanctions imposed by OFAC on Russian entities, the United States has imposed prohibitions on the provision and export of certain services to Russia. On 6 April 2022, President Biden signed Executive Order 14071, prohibiting new investment in the Russian Federation by a US person, wherever located.[27] In a novel use of sanctions based on the International Emergency Economic Powers Act, the Executive Order also prohibits the exportation, re-exportation, sale or supply, directly or indirectly, from the United States, or by a US person, of any category of services as may be determined by the Secretary of the Treasury to any person located in the Russian Federation. OFAC has since issued seven determinations pursuant to Executive Order 14071 prohibiting the exportation, re-exportation, sale or supply, directly or indirectly, from the United States, or by a US person, wherever located, of accounting, trust and corporate formation, management consulting services, architecture services, engineering services, and various other services to any person located in the Russian Federation.[28]

The United States, in partnership with other G7 countries, has also implemented a price cap for the provision of certain services (covered services)[29] regarding the maritime transport of Russian oil and petroleum products. US persons are prohibited from providing covered services as they relate to the maritime transport of Russian oil and petroleum products unless the oil or petroleum products were purchased at or below the price cap.[30]

The United States also maintains secondary sanctions on Russia. The Countering America’s Adversaries Through Sanctions Act (CAATSA) mandates the imposition of sanctions against persons determined by the President to have knowingly facilitated a ‘significant transaction’[31] for or on behalf of any person subject to sanctions imposed by the United States with respect to the Russian Federation, including for or on behalf of a Russian person or entity on OFAC’s SDN List.[32] OFAC has effectively limited this threat of sanctions to transactions with any Russian person on its SDN list.[33]

CAATSA also mandates that the President impose sanctions on persons determined to have knowingly engaged in a significant transaction with a person involved in the intelligence or defence sectors of the Russian government. The Department of State published the List Regarding the Defense Sector of the Government of the Russian Federation[34] of persons determined to be part of, or operating for or on behalf of, Russian defence or intelligence sectors.[35]

Finally, CAATSA also mandates that the President impose sanctions on persons determined to have made significant investments above a specified threshold that directly and significantly contribute to Russia’s ability to construct energy export pipeline projects initiated on or before 2 August 2017, or that provide significant goods, services, technology, information or support to directly and significantly facilitate the maintenance or expansion of the construction, modernisation or repair of energy export pipelines.[36]

1.4.6 Venezuela

Executive Order 13884 blocks all property and interests in property of the government of Venezuela.[37] This means that US persons are generally prohibited from engaging in any transaction in which the government of Venezuela has an interest, including with entities of which 50 per cent or more is owned by the government of Venezuela.

Additionally, Executive Order 13850 blocks the property of additional persons who may be contributing to the situation in Venezuela, including those operating in specified sectors of the Venezuelan economy as determined by the Secretary of the Treasury.[38] Notably, OFAC designated the Venezuelan state oil company, Petróleos de Venezuela SA, pursuant to this authority on 28 January 2019.

OFAC has published several general licences authorising certain activities by US persons that would otherwise be prohibited by the Venezuela-related sanctions programme. A majority of these general licences change frequently and are very specific in respect of the actions they authorise and to whom they apply. As such, companies should ensure they scrutinise and carefully monitor any general licence relied on to conduct business otherwise prohibited by the Venezuela-related Executive Orders.

2 Offences and penalties

Generally, US primary sanctions prohibit transactions only by US persons or transactions subject to US jurisdiction. For Cuba and Iran, the restrictions also apply to foreign entities that are owned or controlled by a US person.[39] ‘Owned or controlled’ is understood to encompass holding at least 50 per cent of the equity interest by vote or value, holding a majority of seats on the board of directors or otherwise controlling actions, policies and personnel decisions of the foreign entity.[40]

Although non-US companies themselves are generally not required to comply with OFAC regulations, they can still face potential liability for exporting goods or services from the United States to a target of US sanctions or for ‘causing a violation’ by involving a US person in a transaction that would be prohibited for that US person.[41] The most typical way that such a violation by a non-US person might occur is if a transaction involving a target of US sanctions is denominated in US dollars because most US dollar transactions clear through US banks and, therefore, involve the services of a US financial institution.[42]

Under secondary sanctions, access by a non-US company to US markets or the US financial system may be restricted, including by being added to the SDN List, if the entity engages in certain conduct relating to Iran, Russia or North Korea.

3 Commencement of sanctions investigations

The US government can learn of a potential sanctions violation in several ways, including through voluntary self-disclosure (VSD), a report of a blocked or rejected transaction, referral from another government agency and even publicly available information, such as a media report.

If a company learns of a potential violation, it may submit a VSD to OFAC. This has many benefits, including a significant reduction in the base penalty for a potential enforcement action; however, parties should carefully consider whether to file based on the circumstances of, and facts surrounding, the potential violation and their history of engagement with OFAC.

In addition to VSDs, the US government often learns of potential violations through blocked or rejected transaction reports filed by US persons, typically financial institutions, based on suspected sanctions violations. Since June 2019, all US persons must submit reports to OFAC within 10 business days of blocking or rejecting a transaction.[43] Previously, all parties had to report transactions involving blocked property to OFAC, but only US financial institutions were obliged to report rejected transactions.[44]

OFAC may also learn of sanctions violations through anti-money laundering reports, primarily suspicious activity reports or criminal investigations conducted by the DOJ or other federal and state law enforcement agencies.

On learning of a potential violation, OFAC may send an initial request for information to the parties with an administrative subpoena or, depending on the nature of the violation, send an informal set of questions to the involved parties, including non-US persons.

4 Enforcement

4.1 Factors to consider

The test in the United States for civil enforcement of sanctions is one of strict liability. This means that companies can be liable for sanctions violations without proof of knowledge, fault or intent, highlighting the importance of sanctions compliance programmes. Parties should also determine whether there was a wilful violation of US sanctions laws that could lead to a criminal investigation or enforcement action. Parties should balance the need to move quickly after identifying a potential violation with taking the time to understand the nature of the violation to determine whether a VSD is appropriate and to whom the parties should report.

Additionally, OFAC has increasingly worked with other government agencies to bring joint enforcement actions for sanctions violations and attempted evasion of sanctions, and an enforcement action by OFAC can attract the attention of other regulators and law enforcement authorities. This includes the parallel enforcement actions by OFAC and the Financial Crimes Enforcement Network against Bittrex, Inc, a virtual currency exchange based in the United States, settling violations of both the Bank Secrecy Act and various sanctions programmes administered by OFAC.[45] Another example is the ongoing Halkbank matter in which the US Supreme Court heard Halkbank’s appeal of the DOJ enforcement action against it. The DOJ case was built on OFAC’s civil enforcement action against Halkbank for apparent violations of the Iranian Transactions and Sanctions Regulations. The case was argued before the Supreme Court on 17 January 2023 and the Supreme Court’s opinion was published on 19 April 2023, remanding the case back to the Second Circuit.[46] The Second Circuit ruled, in short, that, because the Supreme Court ruled that deference should be given to the Executive Branch’s determination on common law sovereign immunity and the alleged criminal activity in question was related to Halkbank’s commercial activities, common law foreign sovereign immunity does not protect Halkbank in this case.[47] Halkbank then filed an appeal for a writ of certiorari to the Supreme Court on 5 May 2025, which remains pending following the filing of several motions and briefs.[48]

4.2 Compliance framework

In May 2019, OFAC issued ‘A Framework for OFAC Compliance Commitments’.[49] This guidance document encourages a risk-based approach, noting that no single compliance programme is suitable for every institution; however, the document provides five components that OFAC highlights as essential to any effective compliance programme:

  • management commitment;
  • risk assessment;
  • internal controls;
  • testing and auditing; and
  • training.

Since publishing the Framework, OFAC has highlighted the importance of an effective risk-based compliance programme and has reserved the final paragraph of published enforcement actions to discuss how the facts relate to the Framework and how both the party subject to the enforcement action and other businesses in its industry can mitigate risks by implementing compliance policies and procedures proportional to the risks faced by the party and the industry as a whole.[50] OFAC has indicated that the strength of a party’s compliance programme can also be a significant mitigating or aggravating factor that it will consider when calculating a penalty amount.[51]

To further mitigate sanctions risks, parties should also ensure that their compliance programme meets the criteria presented in the DOJ’s ‘Evaluation of Corporate Compliance Programs’.[52] The DOJ will evaluate a party’s compliance programme when determining whether to impose a monitor on the party once an enforcement action regarding an apparent violation of US sanctions laws is concluded.

4.3 Best practices

Once an investigation has commenced, parties should proactively collaborate and cooperate with the agency conducting the investigation. OFAC enforcement actions and enforcement guidelines highlight cooperation as a mitigating factor to be taken into account in an enforcement action.[53] Furthermore, if the DOJ is conducting an investigation into a wilful violation of US sanctions, the party must fully cooperate with the DOJ to receive the benefits associated with submitting a VSD. Generally, full cooperation includes internal investigations to discover the root cause of an apparent violation, responding to regulators’ requests for additional information in a timely and complete manner, preserving all sensitive or relevant documents, and collaborating with regulators to develop and implement effective remedial measures.[54]

Once an investigation has commenced, under no circumstances should parties attempt to hide or destroy material information or evidence. Any indication that the parties have attempted to oppose an investigation is likely to lead to federal and state investigators taking a more hostile approach.

4.3.1 Self-reporting to Office of Foreign Assets Control

OFAC generally views VSDs favourably, and a VSD will reduce the base penalty of an apparent violation by up to 50 per cent. To be considered voluntary, a disclosure must be self-initiated and submitted to OFAC before it or any other government agency or official discovers the apparent violation. One exception is that a VSD to another government agency may be considered a VSD to OFAC, depending on the specific case.

A VSD to OFAC must include, or be followed by, a report containing sufficient details to provide a complete understanding of the circumstances of the apparent violation. In some instances, it may be beneficial to the party to make a preliminary disclosure to OFAC before knowing all the facts, to be timely and to ensure that disclosure is considered voluntary. Parties should ensure that their VSD and follow-up report contain all the details known at the time they are made and be prepared to respond to any follow-up enquiries.[55]

OFAC’s enforcement guidelines list several instances where notices will not be considered a VSD, including licence applications, notifications from a third party of an apparent violation or a substantially similar apparent violation because it blocked or rejected a transaction, or if the disclosure:

  • includes false or misleading information or is materially incomplete;
  • is not self-initiated;
  • is made without the authorisation of senior management; or
  • is in response to an administrative subpoena or other enquiry form.[56]

OFAC’s policies and requirements with respect to VSDs were further summarised in the Department of Commerce, Department of the Treasury and Department of Justice Tri-Seal Compliance Note: ‘Voluntary Self-Disclosure of Potential Violations’ (Tri-Seal Compliance Note).[57] Published on 26 July 2023, the Tri-Seal Compliance Note provides guidance to businesses on recent updates to compliance and VSD requirements while also underscoring the enhanced level of cooperation and coordination among the bodies responsible for enforcing US sanctions and export control laws.

4.3.2 Self-reporting to Department of Justice

The DOJ’s VSD policy, published on 13 December 2019 and most recently updated in May 2025, states that all business organisations, including financial institutions, are eligible for all the benefits detailed by the policy.[58] Similar to other DOJ self-disclosure policies, companies are eligible for the benefits of the updated VSD policy when they:

  • voluntarily self-disclose export control or sanctions violations to the National Security Division’s Counterintelligence and Export Control Section (CES);
  • fully cooperate with the investigation; and
  • remediate any violations appropriately and in a timely manner.

The threshold for eligibility is self-disclosure of potential violations to the CES. Unlike with OFAC, self-disclosing to any other regulatory agency is not considered an eligible VSD to the DOJ under its new policy.[59]

For a party’s disclosure to be considered voluntary, it must be made before there is an imminent threat of disclosure or government investigation, and reasonably promptly after discovery of the offence. Further, the party must disclose[60] all relevant facts known to it at the time of the disclosure.[61]

To receive credit for full cooperation, parties are required to:

  • disclose all relevant facts in a timely manner;
  • cooperate proactively with the DOJ;
  • preserve, collect and disclose all relevant documents and information;
  • deconflict witness interviews when required; and
  • make officers and employees of the party available for interviews by the DOJ when so requested.[62]

Parties are also required to demonstrate a thorough analysis of the causes of underlying conduct and, where appropriate:

  • engage in remediation;
  • implement an effective compliance programme;
  • discipline employees identified by the party as responsible for the oversight;
  • retain business records and prohibit the improper destruction of those records; and
  • take any additional steps that demonstrate recognition of the seriousness of a party’s misconduct.[63]

Of note, and highlighted by the Tri-Seal Compliance Note, the DOJ has announced that it will generally not seek guilty pleas regarding prompt and complete disclosures that meet the DOJ’s VSD criteria, described above.[64] Furthermore, the Tri-Seal Compliance Note also highlights the fact that the DOJ now examines whether a company has enacted disciplinary measures against employees who participated in, or had oversight over, the conduct that is the subject of the VSD, including compensation clawbacks.[65]

Finally, the most recent update to the DOJ’s VSD policy includes information on how companies that become aware, in the context of a merger or acquisition, of potential criminal violations of export control, sanctions or other laws affecting US national security by a company being acquired can qualify for additional protections from the DOJ’s Mergers and Acquisitions Policy by making a VSD to the DOJ’s National Security Division (NSD) shortly before or shortly after engaging in a transaction to purchase the other company. The additional protections granted under the Mergers and Acquisitions Policy include the following:

  • The NSD will generally not seek a guilty plea from the acquirer.
  • The NSD will presumptively decline to prosecute the acquirer, meaning that the acquirer will not be required to pay a criminal fine or forfeit assets.
  • The disclosure will not affect the NSD’s assessment of the acquirer’s history of recidivism in future matters involving the acquirer.[66]

To qualify for these additional protections, the acquirer must:

  • complete a lawful, bona fide acquisition of another company;
  • voluntarily self-disclose in a timely manner to the NSD any potentially criminal violations of laws affecting US national security committed by the acquired entity;
  • fully cooperate with NSD’s investigation; and
  • remediate the misconduct appropriately and in a timely manner.[67]

Finally, the DOJ’s Criminal Division, in an effort to further incentivise the reporting of misconduct, launched a pilot programme for individual VSDs in April 2024.[68] This programme is largely consistent with the individual disclosure policy established by the US Attorney’s Office for the Southern District of New York (with some differences in the area of focus).[69] While the pilot programme explicitly states that the Criminal Division cannot offer a non-prosecution agreement (NPA) for VSDs relating to sanctions offences without coordinating with and receiving approval from NSD, it is nonetheless another way for the DOJ to learn of potential sanctions violations, to encourage disclosure of such violations and to potentially change the risk calculation for companies of not voluntarily disclosing misconduct.[70]

Considerations

Submitting a VSD to OFAC can have several benefits, the most significant of which is that it is considered a mitigating factor in the calculation of a potential penalty amount. In some cases, a VSD can allow a party to avoid an enforcement action altogether if OFAC determines the conduct does not constitute a violation or that it does not warrant a civil monetary penalty; however, there are general costs associated with making a VSD to either OFAC or the DOJ, including legal expenses, government investigation, additional scrutiny, reputational harm and, in some cases, large monetary penalties. There is also the potential for a government investigation to reveal unknown or undisclosed violations.

When submitting a VSD to OFAC, in particular, parties should carefully consider the possibility that the conduct was wilful and that, as a result, OFAC may refer the case to the DOJ for criminal enforcement.

If a party submits a VSD to the DOJ that satisfies the requirements of its updated VSD policy, there is a presumption that the party will receive an NPA and pay no fine, in the absence of aggravating factors;[71] however, even if a party receives an NPA, at a minimum it will not be permitted to retain any of the unlawfully obtained gain and will be required to pay all disgorgement, forfeiture or restitution resulting from the misconduct.[72]

Even if there are aggravating circumstances, the DOJ will still recommend a fine of at least 50 per cent less for a qualifying party that would have been levied in the absence of a VSD and will not require the imposition of a monitor if the party has implemented an effective compliance programme at the time of resolution.[73] By filing with the DOJ, a party may invite a criminal investigation in addition to heavy, continuing disclosure obligations.[74]

Overall, effective use of OFAC’s and the DOJ’s VSD programmes rests in the strength of a party’s compliance programme, policy and procedures. Even if the policy and procedures fail to prevent an apparent violation, they can help parties quickly and more accurately determine the nature of the violation and whether a VSD to OFAC or the DOJ is necessary and beneficial.

Other government authorities

In addition to OFAC and the DOJ, parties should also consider notifying potential violations to relevant US and non-US regulators, shareholders, counterparties, insurers and other interested parties. Parties should also be aware that OFAC maintains memoranda of understanding with several state and federal banking regulatory agencies, which may impose penalties on financial institutions in connection with apparent violations of US sanctions laws.[75] As such, financial institutions should consider notifying their regulators of potential violations.

Parties should also determine whether the potential violation of US sanctions laws also violates sanctions laws in foreign jurisdictions and whether it would be appropriate to make disclosures to the relevant regulatory bodies. Finally, parties should also be aware that sanctions programmes are often accompanied by export control restrictions implemented and enforced by the Department of Commerce and the State Department.[76]

All these considerations should be made while conscious of the requirements for VSD submissions to OFAC and the DOJ, namely when a VSD is no longer considered eligible for the benefits.

4.3.3 Settlement

OFAC enforcement actions often end in settlement. Settlement discussions may be initiated by either OFAC or the party committing the apparent violation at several points during the enforcement process. These settlements can also include multiple violations or be a part of a comprehensive settlement with other federal, state or local agencies that are also pursuing investigations or enforcement actions in respect of the apparent violation.[77]

5 Trends and key issues

5.1 Recent enforcement activity

Since the release of ‘A Framework for Compliance Commitments’ in May 2019, OFAC has been able to map compliance programmes against the Framework to determine whether a party’s compliance programme should be considered an aggravating or mitigating factor; for example, in an enforcement action against Eagle Shipping International, OFAC stated that:

[a]s noted in OFAC’s Framework for Compliance Commitments, this case demonstrates the importance for companies operating in high-risk industries (e.g., international shipping and trading) to implement risk-based compliance measures, especially when engaging in transactions involving exposure to jurisdictions or persons implicated by U.S. sanctions.[78]

Recent enforcement activity has also shown that OFAC is willing to use a minimal or indirect nexus to the United States to proceed with an enforcement action against a non-US party.[79] OFAC has also showed its willingness to expand its extraterritorial jurisdiction[80] to penalise non-US companies for transactions that would not have been covered by OFAC’s jurisdiction if not for the use of servers located in the United States.[81] In late 2020, OFAC published its first enforcement actions targeting apparent violations of US sanctions laws in the cryptocurrency industry[82] with the US$968,618,825 settlement with Binance Holdings, Ltd representing the largest crypto-enforcement action to date.[83]

5.2 Potential pitfalls

Companies should be wary of OFAC’s focus on bringing enforcement actions against foreign parties for causing US persons to engage in violations of US sanctions laws. As such, non-US companies should ensure that no US persons, including US financial institutions, US subsidiaries or US employees, are involved in any transactions or activities in which US persons would be prohibited from engaging under US sanctions laws. Finally, given the emphasis OFAC places on it, companies should ensure that their compliance programmes are in line with ‘A Framework for Compliance Commitments’.