Sanctions Violation Found? Steps to Take Now

If you discover a potential sanctions violation, stop the activity immediately, preserve every record, run a privileged internal investigation, and decide — with counsel — whether to make a voluntary self-disclosure to OFAC. Acting fast and deliberately is what limits the damage; ignoring it or quietly “fixing” it without a record is what turns a manageable problem into an enforcement case.

This guide lays out the steps in order and explains why voluntary self-disclosure now deserves a hard look.

First, Stop and Preserve

The two things to do in the first hours are simple and time-sensitive:

1. Stop the conduct. Halt the transaction, payment, or shipment so no further potentially prohibited activity occurs. If property may be subject to blocking, do not release it.
2. Preserve the records. Lock down emails, transaction data, screening logs, and shipping documents. OFAC’s recordkeeping requirement now runs ten years (extended from five, effective March 12, 2025), and these records are the backbone of any investigation or disclosure.

Avoid the instinct to delete, “clean up,” or unwind the deal quietly. That destroys the evidence you will need and can make a civil problem look like a cover-up.

Investigate Under Privilege

Once the activity is stopped, establish the facts. A credible internal investigation — ideally directed by counsel so it is protected by attorney-client privilege — should answer:

• What happened — the transaction, the parties, and which prohibition is potentially implicated.
• Scope — whether this was a one-off or a pattern, and over what period. With a ten-year lookback now possible, the review window can be long.
• Root cause — the control that failed (a missed screen, a 50 Percent Rule ownership gap, a bad license assumption).
• Exposure — whether the matter looks egregious or non-egregious, voluntary or not, under OFAC’s enforcement framework.

The findings drive every decision that follows, so document them carefully.

Understand What You’re Exposed To

Sizing the risk early helps you make a clear-eyed disclosure decision. OFAC civil penalties under IEEPA are significant:

Civil liability does not require intent, which is why even an honest mistake needs to be handled deliberately. For what an enforcement process looks like once OFAC is involved, see our guide on responding to an OFAC enforcement action.

Weigh Voluntary Self-Disclosure

A qualifying voluntary self-disclosure (VSD) — telling OFAC about the apparent violation before the agency finds out on its own — is one of the most significant mitigating factors in OFAC’s enforcement guidelines. In egregious cases, the guidelines start the base civil penalty at half the statutory maximum for self-disclosed violations, and a VSD is weighed heavily in non-egregious cases too. The trade-off is the cost and time of a thorough (now potentially ten-year) internal review.

This is a genuine legal judgment call, not a formality — the decision to disclose, and how to frame it, should be made with counsel. In some situations the lawful path forward also involves applying for an OFAC license to authorize what would otherwise be prohibited.

Remediate and Close the Gap

Whether or not you disclose, fix the control that failed. Update screening, tighten the procedure or OFAC compliance program that let the transaction through, retrain the people involved, and document the remediation. OFAC treats meaningful remedial action as a mitigating factor — and it is the only way to stop the same violation from recurring.

Frequently Asked Questions

What’s the first thing to do when I find a possible sanctions violation?

Stop the activity so no further potentially prohibited transaction occurs, and preserve all related records. Do not unwind or delete anything quietly — you need the evidence for the investigation and any disclosure.

Should I report a sanctions violation to OFAC?

Often, yes — a qualifying voluntary self-disclosure is a major mitigating factor and can substantially reduce the base penalty. But it is a legal judgment that depends on the facts, so make the decision with counsel before disclosing.

How far back can OFAC go?

Up to ten years. The statute of limitations for civil and criminal sanctions violations was doubled from five to ten years in April 2024, and OFAC extended its recordkeeping requirement to match.

What are the penalties for a sanctions violation?

Civil penalties under IEEPA run to the greater of about $377,700 per violation (2025–2026, adjusted annually) or twice the transaction value, on a strict-liability basis. Willful violations can bring criminal fines up to $1,000,000 and up to 20 years in prison for individuals.

A potential violation handled fast and well is usually survivable; one buried is not. Reidel Law Firm helps importers and exporters investigate sanctions issues and weigh voluntary self-disclosure on flat-fee terms. Get an export compliance memo.