Should you voluntarily self-disclose a sanctions violation to OFAC? What a disclosure changes

What the disclosure changes

The arithmetic sits in OFAC's Economic Sanctions Enforcement Guidelines, Appendix A to 31 CFR part 501. Two questions set the base amount OFAC proposes in a Pre-Penalty Notice: was the case egregious, and did you disclose it.

Case	Base amount of the proposed penalty	Rule
Non-egregious, voluntarily self-disclosed	One-half the transaction value, capped at $188,850 per violation	V.B.2.a.i
Non-egregious, not disclosed	The "applicable schedule amount" — a step scale from $1,000 on a transaction under $1,000, to $200,000 at $100,000, to the statutory maximum at $200,000 and above, capped at $377,700	V.B.2.a.ii, I.B
Egregious, voluntarily self-disclosed	One-half the applicable statutory maximum	V.B.2.a.iii
Egregious, not disclosed	The applicable statutory maximum	V.B.2.a.iv

Those caps track the IEEPA statutory maximum. Where the statute at issue carries a lower maximum, the non-egregious caps come down with it: half that maximum in a disclosed case, the maximum itself in an undisclosed one (V.B.2.a.i–ii).

Under 31 CFR 505.401(a)(2), the IEEPA maximum is the greater of $377,700 or twice the transaction amount. Egregiousness is decided by OFAC's Director or Deputy Director, weighing the General Factors with emphasis on willfulness or recklessness and on awareness of the conduct.

What counts as voluntary

The Guidelines define a voluntary self-disclosure as self-initiated notification to OFAC prior to or at the same time that OFAC or any other federal, state or local agency discovers the apparent violation — or a substantially similar one. Five things take a filing outside that definition:

A third party was required to and did notify OFAC because it blocked or rejected the transaction — regardless of whether you knew about that filing.
The disclosure contains false or misleading information.
The disclosure, read with any supplement, is materially incomplete.
It was not self-initiated, including where it follows the suggestion or order of a government agency or official.
For an entity, it was made by an individual without the authorisation of senior management.

Answering an administrative subpoena or filing a licence application is not a disclosure either. This is where the clock matters: a bank that blocks your payment files its own report, and once it does, the same facts are no longer yours to disclose. Those third-party duties are set out in Do you have to report a blocked or rejected transaction to OFAC?

What you file, and when

Submissions go through OFAC's Disclosure Portal, reached from the self-disclosure page. Notification alone is not the whole filing: the Guidelines require a report "of sufficient detail to afford a complete understanding of an apparent violation's circumstances," and FAQ 13 says OFAC generally expects that report within 180 days of the initial notification where it was not included up front.

Format is not cosmetic. OFAC's Production Submission Standards, dated 5 July 2024, apply to disclosures and especially to productions over 100 pages, and state that OFAC may consider adherence to them when assessing a person's cooperation.

What a disclosure to OFAC does not do

It does not reach the criminal side. The Tri-Seal Compliance Note on voluntary self-disclosure of 26 July 2023, linked from OFAC's own page, states that disclosures made only to regulatory agencies such as OFAC do not qualify under the Justice Department National Security Division's policy, which runs separately.

It also does not stay private. 31 CFR 505.102 requires OFAC to publish, for each entity penalty or settlement, an indication of whether the entity voluntarily disclosed — with the name, a description and the amount, on the civil penalties page.

Disclosure is also not the only mitigation. The Guidelines generally reduce the base amount by 25 to 40 percent for substantial cooperation without a qualifying disclosure, and by up to 25 percent for a first violation — no penalty notice or Finding of Violation in the five years before the transaction.

How far back the review runs

Before you scope an internal review, fix the window. OFAC's guidance on the extension of the statute of limitations, 22 July 2024, records that the statute for civil and criminal IEEPA and TWEA violations went from five years to 10 years on 24 April 2024, reaching any violation whose latest date was after 24 April 2019.

In an AI assistant

list_ofac_actions on the Distributed Risk MCP server reads designations, removals, licences and FAQs from the record, newest first, inside Claude or ChatGPT. search_federal_register catches changes to the penalty provisions themselves, and search_screening_lists re-runs the names in the transactions under review. Setup is in Using a sanctions MCP server.

Establishing what happened — who the counterparty was, who owns it, which transactions are in scope — is investigative work before it is a filing decision. Distributed Risk arranges that investigation with a partner firm that works in the jurisdiction: send the question.

Questions

Does a blocking report count as a disclosure? No. They are separate filings under separate rules, and a third party's report can disqualify a later disclosure of the same facts.

Does disclosing avoid a penalty? Not by itself. OFAC treats a disclosure as a mitigating factor that may reduce the base amount, and the Guidelines also let it close a matter with no action, a cautionary letter or a Finding of Violation. The outcome turns on the General Factors, not on the disclosure alone.

What if the ownership chain is the problem? Work the chain before you characterise the violation: Does the OFAC 50 Percent Rule block your counterparty?

Is this legal advice? No. This page is a procedural summary drawn from the public record. Counsel decides what applies.