Founding Attorney
An OFAC voluntary self-disclosure is a self-initiated report of an apparent sanctions violation. It must reach OFAC before, or at the same time as, discovery by OFAC or another government agency. A qualifying disclosure halves the base amount of any proposed civil penalty. OFAC’s new Sanctions Penalties Regulations, effective September 25, 2026, keep that incentive in place.
On September 25, 2026, the Office of Foreign Assets Control (OFAC) issued a new rule. It adds the Sanctions Penalties Regulations as 31 CFR Part 505. The final rule in the Federal Register gathers penalty rules that OFAC used to repeat across many sanctions programs. According to OFAC, the rule makes no substantive changes to those penalties. Next, OFAC plans to replace program-by-program penalty text with cross-references to Part 505. Meanwhile, two other 2026 steps shape the disclosure decision. First, OFAC opened an online disclosure portal on February 6, 2026. Second, the Justice Department adopted a Department-wide Corporate Enforcement Policy on March 10, 2026.
What OFAC’s New Part 505 Rules Change, and What They Do Not
Part 505 is mostly a housekeeping rule, but it has practical value. Now the core penalty process for sanctions under the International Emergency Economic Powers Act (IEEPA) sits in one part. Subpart D covers IEEPA penalties and Findings of Violation. Subpart E covers penalties under the United Nations Participation Act. The key provisions are these:
- Civil penalties. For IEEPA violations, the civil maximum is the greater of $377,700 or twice the transaction value (§ 505.401).
- Criminal penalties. Willful violations can bring a fine of up to $1,000,000. Individuals also face up to 20 years in prison.
- Pre-Penalty Notice. A written response is due within 30 days. Missing that deadline waives the right to respond (§ 505.402).
- Penalty Notice. This notice is final agency action. The violator may then seek review in federal district court (§ 505.403).
- Finding of Violation. The recipient has 30 days to contest it. Without a response, the finding becomes final (§ 505.405).
- Publication. OFAC posts entity penalty and settlement details on its civil penalties and enforcement page at least monthly. However, it generally does not name individuals (§ 505.102).
Notably, the rule leaves OFAC’s penalty guidelines alone. Those guidelines still sit in Appendix A to 31 CFR Part 501. Therefore, the value of an OFAC voluntary self-disclosure (VSD) stays the same. Indeed, the rule’s preamble repeats that OFAC halves base penalties when it learns of a violation through a voluntary self-disclosure.
What Counts as an OFAC Voluntary Self-Disclosure
OFAC defines the term in its Economic Sanctions Enforcement Guidelines. First, the notice must be self-initiated. Second, it must come from the person who committed, or took part in, the apparent violation. Third, it must reach OFAC before, or at the same time as, discovery by OFAC or any other federal, state, or local agency. That timing test covers the violation itself and any substantially similar violation.
However, notice alone is not enough. The disclosure must include a detailed report, or the discloser must file one within a reasonable time. That report should give OFAC a complete understanding of what happened. After that, the discloser should answer OFAC’s follow-up questions. In some cases, a disclosure made only to another agency may also count. OFAC decides that question case by case. Many apparent violations start with a screening gap. For example, the 50 percent rule can block a company that appears on no list.
When a Disclosure Does Not Qualify
The guidelines exclude several situations from the definition:
- A third party, such as a bank, must report the blocked or rejected transaction, and it does so.
- The disclosure contains false or misleading information.
- The disclosure is materially incomplete, even with later supplements.
- An agency suggested or ordered the disclosure, so it is not self-initiated.
- For a company, an individual discloses without senior management’s authorization.
- The person is only answering an OFAC subpoena or inquiry, or filing a license application.
Even so, a disclosure that misses the definition still has value. OFAC’s enforcement guidelines treat cooperation as a separate mitigating factor.
How a Voluntary Self-Disclosure Changes the Penalty Math
First, OFAC decides whether a case is “egregious.” The Director or Deputy Director makes that call. In doing so, OFAC gives the most weight to willful or reckless conduct and to awareness of the conduct. It also weighs harm to sanctions program objectives and the subject’s individual characteristics. Then the base penalty turns on two questions. Was the case egregious? And did a voluntary self-disclosure occur?
| Case type | With a voluntary self-disclosure | Without a voluntary self-disclosure |
|---|---|---|
| Non-egregious | One-half of the transaction value, capped at $188,850 per violation | Applicable schedule amount, capped at $377,700 per violation |
| Egregious | One-half of the statutory maximum | The statutory maximum |
Consider a simple example. Suppose a non-egregious violation involves an $80,000 transaction. With a qualifying VSD, the base amount is $40,000, or half the transaction value. Without one, the base is the $100,000 schedule amount for transactions of $50,000 up to $100,000. In other words, the disclosure cuts the starting point by more than half in this example.
After that, OFAC adjusts the base amount for the general factors. For example, substantial cooperation without a qualifying VSD generally cuts the base by 25 to 40 percent. Likewise, a first violation generally earns a reduction of up to 25 percent. A violation usually counts as a first one if the person received no penalty notice or Finding of Violation in the five years before the transaction. In every case, the proposed penalty cannot exceed the statutory maximum.
How to File a VSD Through OFAC’s Online Portal
OFAC launched its online Voluntary Self-Disclosure Portal on February 6, 2026. The agency strongly encourages parties to use it. If the first VSD filing lacks a detailed report, OFAC generally expects that report within 180 days. Accordingly, companies should plan the internal review around that window. A practical VSD sequence looks like this:
- Stop the conduct and preserve all related records.
- Scope the issue: transactions, parties, dates, values, and any sanctions or export controls involved.
- For a company, obtain senior management’s authorization to disclose.
- File the initial notice promptly, before any agency discovers the issue.
- Finish the internal review and file the detailed report.
- Fix the root cause and document changes to the compliance program.
- Answer OFAC’s follow-up questions and assess any criminal exposure.
Sanctions vs. Export Controls: Which Agency Gets the VSD?
Many problems involve both sanctions and export controls. For example, a shipment to a party on the Commerce Department’s Entity List may also involve a blocked person. OFAC handles the sanctions side. However, export controls under the Export Administration Regulations belong to the Bureau of Industry and Security (BIS). BIS has its own VSD rule in 15 CFR § 764.5, and its Office of Export Enforcement reviews those filings. For that reason, screening should cover both the SDN List and the Entity List.
The BIS rules differ in useful ways. Under 15 CFR § 764.5, a firm’s deliberate decision not to disclose a significant apparent violation is an aggravating factor. For significant violations, BIS expects a full narrative within 180 days of the first notice, absent an extension. Meanwhile, defense exports under the ITAR go to the State Department. Under 22 CFR § 127.12, a full disclosure must follow within 60 calendar days of an incomplete first notice. Consequently, one set of facts can trigger several filings. In practice, counsel should keep the facts consistent across every enforcement agency. Customs problems follow a separate track, too. For instance, CBP prior disclosure rules govern customs penalties under a different statute. The table below compares the three main civil disclosure channels.
| Agency | Rule | Follow-up deadline | Effect of disclosure |
|---|---|---|---|
| OFAC (sanctions) | 31 CFR Part 501, Appendix A | Detailed report generally within 180 days | A qualifying VSD cuts the base penalty by 50 percent |
| BIS (export controls) | 15 CFR § 764.5 | Full narrative within 180 days for significant violations | Mitigating factor; deliberate non-disclosure is aggravating |
| State Department DDTC (ITAR) | 22 CFR § 127.12 | Full disclosure within 60 days of an incomplete notice | May be a mitigating factor |
The 10-Year Look-Back and Record Retention
Timing matters as well. In April 2024, Congress extended the limitations period for IEEPA violations from five to 10 years. Under 50 U.S.C. § 1705(d), OFAC must start a civil action within 10 years after the latest date of the violation. Importantly, a pre-penalty notice or a Finding of Violation counts as starting the action. OFAC’s guidance applies the longer period to any violation that was not already time-barred when the law took effect. Even so, an old violation can still support a voluntary self-disclosure if no agency has found it yet.
Recordkeeping rules now match that window. Under 31 CFR § 501.601, persons who engage in transactions subject to OFAC rules must keep full records for 10 years. That change took effect on March 12, 2025. In addition, OFAC may require a tolling agreement before it continues settlement talks.
Criminal Exposure and DOJ’s Corporate Enforcement Policy
An OFAC filing is a civil, administrative step. However, willful violations are crimes under 50 U.S.C. § 1705(c). OFAC may refer apparent violations to law enforcement for criminal investigation. Moreover, a referral does not stop OFAC from also imposing a civil penalty.
On March 10, 2026, the Justice Department released its first Department-wide Corporate Enforcement Policy for criminal matters. Under that policy, DOJ will decline to prosecute companies that voluntarily disclose, cooperate, and remediate, absent certain limited aggravating circumstances. The disclosure must go to the appropriate DOJ component. For crimes under sanctions and export controls laws, that is the National Security Division. Consequently, a company weighing an OFAC voluntary self-disclosure should also decide, with counsel, whether a parallel DOJ disclosure makes sense.
Challenging an OFAC Penalty in Court
A Penalty Notice is final agency action, so the violator can seek review in federal district court. In that litigation, courts apply the Administrative Procedure Act, and review is deferential. In Epsilon Electronics, Inc. v. U.S. Department of the Treasury, 857 F.3d 913 (D.C. Cir. 2017), OFAC had imposed a $4,073,000 penalty. OFAC calculated it under its guidelines after finding that none of the violations was voluntarily disclosed. The D.C. Circuit called its review “highly deferential” and upheld liability for 34 shipments. Even so, it held that OFAC had not adequately explained its findings on five 2012 shipments. As a result, the court sent the matter back to OFAC to reconsider those shipments and the total penalty. By contrast, a settlement is not a final agency determination that a violation occurred. For that reason, companies often weigh a negotiated settlement against litigation.
Frequently Asked Questions About OFAC Voluntary Self-Disclosure
No. A VSD is a mitigating factor in OFAC enforcement, not a safe harbor. OFAC may still issue a cautionary letter, a Finding of Violation, or a civil penalty. However, a qualifying VSD can cut the base amount of a proposed penalty by 50 percent.
Then your own later notice will not count as an OFAC voluntary self-disclosure for that violation. The guidelines exclude cases in which a third party must report, and does report, a blocked or rejected transaction. Even so, substantial cooperation can still reduce the base penalty by 25 to 40 percent.
Generally, OFAC has 10 years after the latest date of the violation. Congress set that period in 50 U.S.C. § 1705(d) in April 2024. Notably, a pre-penalty notice or Finding of Violation starts the action for this purpose.
No. OFAC states that Part 505 makes no substantive changes to the penalty provisions. Therefore, the IEEPA civil maximum remains the greater of $377,700 or twice the transaction value.
Conclusion
OFAC’s new Part 505 does not change penalty amounts. Instead, it places the penalty process in one part and restates the value of early disclosure. Together with the new portal and DOJ’s 2026 policy, the disclosure path is now clearer. Still, each decision turns on timing, facts, criminal exposure, and litigation risk. Therefore, companies should act quickly once they spot a possible violation. Our OFAC sanctions practice advises businesses on these filings, related export controls questions, and enforcement investigations.
If your business has found a possible sanctions problem, contact our team to discuss your options. We can review the facts and help you plan next steps tailored to your situation.
