INTERNATIONAL TRADE LAW
Sanctions Escalation Process: A Practical Guide
A sanctions escalation process is the written path that moves a red flag from the employee who spots it to the person with authority to freeze the transaction and decide what happens next — fast enough to stop the deal before it closes. Without one, concerns die in inboxes and risky transactions go through by default. This guide explains how to build a path that actually works.
Escalation is part of the internal controls that sit at the heart of OFAC’s Framework for OFAC Compliance Commitments. Controls that detect a problem are worthless if there is no defined route for acting on it.
Why Escalation Is the Weak Point
Most sanctions failures are not failures of detection — someone usually senses that something is off. They are failures of response: the concern is raised to a manager who lacks authority, gets passed around while the clock runs, or is quietly overruled by the people who want the deal done. A good escalation process removes that ambiguity. Everyone knows who to tell, that person has the power to stop the transaction, and the decision gets documented.
The Core of a Working Process
A workable escalation process answers four questions in writing, before any concern ever arises:
| Question | What “good” looks like |
|---|---|
| Who raises a concern, and how? | Any employee, through a known channel, with no fear of retaliation |
| Who has authority to freeze? | A named role (usually the compliance officer) who can halt a deal unilaterally |
| What gets frozen, and when? | The transaction pauses on a credible concern — not after it closes |
| Who decides the outcome? | Compliance and, for serious issues, senior leadership and outside counsel |
The single most important design rule: the person who can stop the transaction must be independent of the person who profits from it. If sales can override compliance, you do not have an escalation process — you have a suggestion box.
What Happens After a Transaction Is Frozen
Once a concern is escalated and the deal is paused, the process should move through a predictable sequence: investigate the facts (who is the counterparty, who owns them, where are the goods and money going), apply the law (screen against the SDN List, run the 50% Rule, check for an applicable license), and then decide — clear it, reject it, block it, or seek a license. If a transaction must be blocked or rejected, OFAC reporting obligations are triggered, and the compliance officer owns filing those reports.
When to Consider a Voluntary Self-Disclosure
If the investigation reveals that a violation has already happened, the escalation process should route the decision to counsel on whether to make a voluntary self-disclosure (VSD) to OFAC. The incentive is concrete: a qualifying VSD can cut the base civil penalty by up to 50% under OFAC’s Economic Sanctions Enforcement Guidelines. To qualify, the disclosure generally has to come before OFAC (or another agency) learns of the violation independently, and it has to be complete and truthful.
The mechanics changed recently. In February 2026, OFAC launched an online portal for submitting voluntary self-disclosures, replacing the old email/paper process. An initial notification through the portal is still expected to be followed by a detailed report (generally within 180 days). Building the VSD decision point into your escalation process — rather than improvising it under pressure — is what preserves the option to disclose early and capture the mitigation.
Document Everything
Whatever the outcome, write it down: the concern, who raised it, what was investigated, what was decided, and why. This protects the company two ways. It shows OFAC a functioning program if the transaction is later questioned, and it builds the record you would need for a VSD. Keep these records for 10 years — OFAC extended its recordkeeping requirement from five to 10 years in March 2025 to match the longer statute of limitations. A short companion read on the broader control set is the sanctions compliance checklist.
Frequently Asked Questions
Who should have the authority to freeze a transaction? A named compliance role with independence from the sales or revenue function — someone who can halt a deal without sign-off from the people who benefit from it. Spell out the role in writing so there is no debate in the moment.
Do we have to report every concern to OFAC? No. Many escalated concerns are resolved internally as false alarms or cleared after diligence. Reporting obligations arise when a transaction is actually blocked or rejected, or when you choose to make a voluntary self-disclosure of a violation.
What is the benefit of a voluntary self-disclosure? A qualifying VSD can reduce the base civil penalty by up to 50%. It generally must be made before OFAC learns of the violation on its own and must be complete and truthful. Run the decision through counsel.
How long do we keep escalation records? Ten years, following OFAC’s March 2025 recordkeeping extension. Retain the concern, the investigation, the decision, and the reasoning.
An escalation process is only as good as the authority and documentation behind it. Reidel Law Firm helps importers and exporters design sanctions escalation and internal controls that hold up under scrutiny, delivered as a flat-fee compliance memo with direct attorney access. Get an export compliance memo →
