INTERNATIONAL TRADE LAW
Sanctions Incident Response Checklist
When a possible sanctions violation surfaces, the first moves are to stop the conduct, preserve the records, investigate the facts, and get counsel involved before deciding whether to disclose to OFAC — because how you respond can change the outcome as much as what happened. A sanctions incident is not only a compliance failure to fix; it is a sequence of legal decisions with real consequences, and the early hours matter. This checklist lays out that sequence for exporters.
First: contain and preserve
The moment a credible concern appears — a delayed screening hit, a payment to an unexpected party, an after-the-fact match — do two things immediately. Contain the conduct: pause the transaction, hold the shipment or funds, and avoid further dealings with the party in question until the facts are clear. Preserve the records: emails, screening logs, invoices, shipping documents, and the decision trail. Do not delete, “clean up,” or rewrite anything. Spoliation turns a manageable compliance problem into a far worse one, and the records are what a later review will turn on.
Stand up the response team
A defined team avoids scrambling. Pull together the designated compliance officer, senior management, and legal counsel, with operations and finance available for the facts. Engaging counsel early matters for two reasons: experienced sanctions counsel shapes the investigation and disclosure strategy, and counsel involvement can help protect the investigation’s analysis under privilege. Define who decides and who speaks for the company before the questions start coming.
Investigate the facts
Before anyone decides whether to disclose, establish what actually happened:
- What occurred — the transaction, the parties, the destination, and the goods or funds involved.
- Which prohibition may be implicated, and whether an exception or authorization could apply.
- Root cause — a screening gap, an ownership chain missed under the 50 Percent Rule, a training failure, or a deliberate workaround.
- Scope — whether this is isolated or one instance of a pattern.
Keep the investigation organized and documented. Its findings drive every decision that follows.
Understand what’s at stake
Most U.S. sanctions carry strict civil liability, meaning a violation can be penalized even without intent to break the law. That is why a documented, good-faith response counts for so much. Under OFAC’s Economic Sanctions Enforcement Guidelines (31 CFR Part 501, Appendix A), the agency weighs a list of factors when it considers an enforcement case — including the willfulness of the conduct, the harm to sanctions objectives, the quality of the company’s compliance program, and its cooperation. The strength of your program and the credibility of your response are squarely within the factors that move an outcome up or down.
Weigh voluntary self-disclosure
A central decision is whether to make a voluntary self-disclosure (VSD) to OFAC. The Enforcement Guidelines treat a qualifying VSD as a mitigating factor: for a non-egregious case, a self-disclosure can cut the base civil penalty roughly in half. Even where a company does not self-disclose — for instance, where OFAC learns of the matter from a third party — substantial cooperation can still earn meaningful credit. This is a legal judgment that turns on the specific facts, the strength of the evidence, and timing, so it should be made with counsel rather than reflexively in either direction.
| Response posture | General effect under OFAC’s guidelines |
|---|---|
| Qualifying voluntary self-disclosure (non-egregious) | Base civil penalty can be reduced by about half |
| Substantial cooperation without self-disclosure | Mitigation credit, though less than a qualifying VSD |
| Concealment or obstruction | Aggravating — drives exposure the wrong way |
Remediate and close the loop
Fixing the root cause is both the right thing and part of the mitigation picture. Update the policies and procedures, tighten screening, retrain the affected roles through the training program, and feed the lessons into your audit and exam readiness. Document the remediation and track it to completion — and keep the full incident file, since OFAC’s recordkeeping requirement now runs ten years for covered records (31 CFR 501.601). For the agency context, see what OFAC is and how it affects your business.
Frequently asked questions
Do we have to report a sanctions violation to OFAC? Some situations carry specific reporting obligations — for example, blocking or rejecting a transaction — and those are mandatory. A broader voluntary self-disclosure of an apparent violation is a strategic choice rather than an automatic duty. Because the line between them depends on the facts, confirm your obligations with counsel rather than assuming silence is safe.
How fast do we need to act? Quickly, but not carelessly. Contain the conduct and preserve records immediately; take the time to investigate properly before deciding on disclosure. Timeliness is part of what makes a self-disclosure “voluntary,” so delay can cost you credit — but a rushed, inaccurate disclosure creates its own problems.
Will self-disclosing just hand OFAC a case against us? That is the instinct, but the guidelines are designed to reward disclosure: a qualifying voluntary self-disclosure can roughly halve the base penalty, and cooperation generally improves outcomes. Whether it is the right move in your situation is a fact-specific call for counsel.
A possible sanctions violation just surfaced? Reidel Law Firm helps exporters contain the incident and decide whether and how to disclose — before the clock runs against you. Start with a flat-fee import/export compliance memo, in plain English, with direct attorney access. Get an import/export compliance memo →
