How to Respond to an OFAC or BIS Administrative Subpoena in the USA (2026): Practical Steps, Risks and Rights

Executive Summary: What This Guide Covers and Immediate Takeaways

An OFAC administrative subpoena USA recipients now receive arrives against a backdrop of intensifying, coordinated enforcement among the Office of Foreign Assets Control (OFAC), the Bureau of Industry and Security (BIS) and the Department of Justice (DOJ). For in-house counsel, exporters, financial institutions and compliance officers, the first hours after service are decisive: they determine whether privilege is preserved, whether metadata survives, and whether an administrative inquiry stays civil or escalates into a parallel criminal matter. This guide provides a neutral, practitioner-authored playbook covering immediate triage, the legal authority behind OFAC and BIS subpoenas, privilege and document-preservation strategy, grounds to challenge or negotiate production, and how to manage DOJ coordination, with checklists and templates designed for real-world use.

The five immediate takeaways below apply the moment a subpoena is served:

• Do not delete anything. Suspend all routine data destruction and confirm that automated deletion policies are paused for relevant systems.
• Read the scope carefully. Identify the temporal range, subject matter, custodians and the response deadline stated on the face of the document.
• Assemble your response team. External counsel, IT/records custodians, and a single communications point of contact should be engaged within hours.
• Issue a litigation hold. A defensible preservation notice must go out promptly to all relevant custodians.
• Assess criminal exposure early. Where facts suggest potential willful conduct, involve criminal defense counsel before producing anything.

This guide addresses civil and administrative subpoenas issued by OFAC and BIS, not grand jury subpoenas, but it treats parallel DOJ risk as a live consideration throughout, because that risk is precisely what distinguishes current enforcement from prior years.

Immediate Triage: The First 24–72 Hours After Service

The period immediately after you respond to an OFAC subpoena or a BIS demand is where cases are won or lost operationally. Mistakes made here, deleted mailboxes, uncoordinated employee interviews, careless internal emails, are difficult to unwind later. The following six-step sequence should be treated as a checklist and executed in parallel where possible.

1. Confirm Receipt and Read the Scope Immediately

Record the exact date and method of service. The subpoena itself is the controlling document: it defines the response deadline, the categories of records demanded, and the relevant time period. Read it line by line and flag any ambiguity in the definitions section, agencies often draft broadly, and the precise wording of each request will shape both your preservation obligations and your negotiating position. Note the name and contact details of the issuing officer; early, professional engagement with that officer frequently sets a cooperative tone.

2. Assemble the Response Team

Within hours, identify and convene a core team. At minimum this includes:

• Lead external counsel with OFAC and BIS enforcement experience to direct strategy and preserve privilege.
• Records and IT custodians who can map data sources, suspend deletion, and describe retention systems.
• An internal legal or compliance lead to coordinate business units and gather background facts.
• A single communications point of contact to prevent inconsistent or premature statements.

Keep the team small at the outset. The fewer people who touch the matter early, the easier it is to control the narrative and protect privilege.

3. Implement a Litigation Hold and Preservation Notice

A written litigation hold must go out promptly. It should identify the subject matter, instruct recipients not to delete or alter any potentially relevant material, including emails, chat messages, drafts, calendar entries and voicemails, and require acknowledgment. Sample language for a preservation notice might read: “You are directed to preserve all documents and electronically stored information relating to [subject/transactions] for the period [date range]. Do not delete, modify, or discard any such material. Automated deletion or archiving affecting these records must be suspended immediately.” Critically, the hold must extend to metadata and to systems that purge data automatically, such as short-retention messaging platforms.

4. Identify Custodians, Date Ranges and Systems

Map the universe of potentially responsive data. Which employees were involved in the transactions at issue? Which email domains, file shares, ERP systems, trade-compliance platforms and messaging tools might hold relevant records? Documenting this early creates a defensible record of your good-faith preservation effort and accelerates collection later.

5. Conduct an Initial Privilege Assessment

Before any collection or review, counsel should form a preliminary view of where privileged material is likely to reside, internal legal analyses, communications with counsel, and any prior compliance assessments. In the corporate context, the Supreme Court’s decision in Upjohn Co. v. United States, 449 U.S. 383 (1981) confirms that attorney-client privilege can extend to communications between counsel and employees beyond the “control group,” provided the communications were made to enable legal advice. Understanding Upjohn’s scope from day one protects those communications during collection.

6. Establish a Communications Protocol and Information Lockout

Instruct employees not to discuss the matter externally or among themselves outside privileged channels, and route all inquiries to the designated point of contact. A short internal memo, a “first 24-hour memo”, should capture the date of service, the response deadline, the team, the preservation steps taken, and the initial scope assessment. This memo becomes the backbone of the file and demonstrates a disciplined, defensible response.

Legal Authority, Scope and Timelines: The OFAC Administrative Subpoena USA Framework vs. BIS

Understanding who issued the subpoena and under what authority is essential to calibrating your response. OFAC and BIS operate under distinct statutory frameworks, pursue different subject matter, and carry different referral profiles.

Who Can Issue the Subpoena?

OFAC administers and enforces economic and trade sanctions programs, a substantial portion of which are grounded in the President’s authority under the International Emergency Economic Powers Act (IEEPA), codified at 50 U.S.C. Chapter 35. OFAC’s civil enforcement processes are described on the Treasury Department’s OFAC Enforcement pages. BIS, by contrast, administers and enforces the Export Administration Regulations (EAR) under the Export Control Reform Act of 2018. Its investigative and administrative enforcement authority is described on the BIS Enforcement pages, and the regulatory framework it enforces appears in Title 15, Subtitle B, Chapter VII of the eCFR. Confirm the specific statutory and regulatory authority cited on the face of the subpoena you received.

Typical Breadth and Common Document Requests

OFAC subpoenas typically focus on transactions involving sanctioned parties, countries or property interests, wire transfers, correspondent banking records, know-your-customer files, and internal sanctions-screening logs. BIS subpoenas center on the export, reexport or transfer of controlled items, shipping documents, export classifications, end-user certifications, license applications and technology-transfer records. Both agencies routinely request internal communications, compliance-program documentation and prior audit findings.

Timing and Deadlines

There is no single universal deadline. The response window is set on the face of the subpoena, and it is the controlling authority. Where the timeline is unworkable given the volume of data, counsel should request an extension early and in writing rather than waiting until the deadline approaches. Agencies frequently grant reasonable extensions when the request is made promptly and accompanied by a credible collection plan.

Comparison Table: OFAC vs. BIS Administrative Subpoenas

Consult the primary sources linked above for the current text of the governing statutes and regulations, and confirm the specific authority cited on the subpoena you received.

Privilege, Document Preservation and Production Strategy

Privilege protection is the single most consequential legal issue in responding to any OFAC administrative subpoena USA matter, because production to an agency can waive privilege over the materials produced and, in some circumstances, over related subject matter. A disciplined strategy preserves privilege while still enabling a cooperative, credible production.

Attorney-Client Privilege and Work Product in Corporate Investigations

In the corporate setting, privilege attaches to communications made to secure legal advice, and, following Upjohn, is not limited to senior management. Communications between counsel and lower-level employees can be privileged where they were made at the direction of counsel to obtain legal advice for the company. Work-product protection separately shields materials prepared in anticipation of litigation or an enforcement proceeding. Both protections must be identified and mapped before collection so that privileged material is segregated rather than inadvertently produced.

Drafting a Defensible Litigation Hold and Preserving Metadata

A litigation hold is only defensible if it is documented, distributed to the right custodians, and actually enforced. Preserve native files with metadata intact; producing a flattened PDF that strips creation dates, authorship and edit history can undermine both credibility and any later authenticity argument. Confirm that backup systems and short-retention messaging platforms are captured, and document each preservation step contemporaneously.

Privilege Logs: What to Include and Redaction Best Practices

When privileged material falls within the scope of a request, it is withheld or redacted and recorded on a privilege log. A defensible log identifies, for each withheld item, the date, author, recipients, document type, and the basis for the privilege claim, without disclosing the privileged content itself. Redactions should be precise: redact only the privileged portions, produce the remainder, and note the redaction on the log. Over-redaction invites disputes; under-redaction risks waiver.

The Crime-Fraud Exception and Risk Indicators

Privilege is not absolute. Under the crime-fraud exception, communications made in furtherance of a crime or fraud lose protection. In United States v. Zolin, 491 U.S. 554 (1989), the Supreme Court held that a court may conduct an in-camera review of allegedly privileged materials to determine whether the crime-fraud exception applies, where the party seeking review makes a threshold factual showing. Counsel should be alert to indicators, for example, legal advice sought to structure or conceal prohibited transactions, that could expose communications to this exception, and should factor that risk into any decision to rely on privilege for sensitive materials.

When to Seek In-Camera Review or a Protective Order

Where the agency contests a privilege assertion, options include seeking in-camera review so a neutral decision-maker can assess the claim without broad disclosure, or negotiating a protective order or confidentiality agreement to limit the use and dissemination of sensitive productions. These tools are most effective when raised early and supported by a well-prepared privilege log.

Can You Refuse to Comply? Grounds to Challenge, Limit or Negotiate Production

Recipients frequently ask whether they can simply decline to comply with a BIS or OFAC administrative subpoena. The short answer is that outright refusal carries significant enforcement risk, but you are not obligated to produce everything demanded without objection. The realistic goal is usually to narrow, stage or negotiate, not to stonewall.

Common Legal Objections

Three objections recur in administrative subpoena practice:

• Overbreadth. Where requests sweep in records with no plausible connection to the agency’s inquiry, counsel can seek to narrow the temporal scope, custodian list or subject matter.
• Undue burden. Where compliance would require disproportionate cost or effort relative to the relevance of the material, a burden objection supports a request to phase production or limit scope.
• Privilege. Privileged and work-product materials are withheld or redacted and logged, as discussed above.

Administrative and Judicial Challenge Routes

Agencies generally cannot compel compliance unilaterally; enforcement of an administrative subpoena typically requires resort to a court, which allows a recipient to raise objections in that forum. This gives the recipient a meaningful opportunity to contest overbroad or unduly burdensome demands. In practice, however, many disputes are resolved through negotiation with the issuing officer rather than litigation, because courts often enforce properly issued administrative subpoenas that seek relevant information within the agency’s authority.

Tactical Negotiation and Staged Productions

A staged or “rolling” production, producing clearly responsive, non-sensitive records first while negotiating the scope of the remainder, often serves the recipient’s interests. It demonstrates good faith, keeps the agency engaged, and buys time to complete privilege review on more sensitive categories. Written correspondence confirming any agreed narrowing of scope should be preserved as part of the file.

When to Litigate

Litigating a subpoena is a cost-benefit decision. Factors include the breadth of the demand, the sensitivity of the material, the strength of the objection, and the strategic value of preserving a cooperative posture, particularly where cooperation may influence a favorable civil resolution. In most matters, negotiation delivers a better outcome than a contested enforcement proceeding, but a strong overbreadth or privilege position may justify a targeted challenge.

Managing Parallel Criminal Exposure and DOJ Coordination

A defining feature of an OFAC administrative subpoena USA response in the current environment is the elevated possibility of parallel criminal exposure. Coordinated enforcement means that what begins as a civil administrative inquiry can proceed alongside, or be referred to, a DOJ investigation. Managing this dual-track risk is a core strategic task.

How OFAC and BIS Referrals to DOJ Happen

Where an administrative inquiry surfaces indications of willful conduct, evasion or false statements, the matter may be referred to DOJ for potential criminal investigation. The DOJ’s approach to corporate matters is framed by the Justice Manual’s Principles of Federal Prosecution of Business Organizations, which addresses factors such as the seriousness of the conduct, the company’s compliance program, cooperation, and voluntary self-disclosure. Understanding these principles helps counsel anticipate how an administrative matter might be evaluated on the criminal side.

Coordinating Administrative Advocacy and Criminal Defense

When criminal exposure is realistic, administrative advocacy and criminal defense must be coordinated by counsel who can see both tracks. Statements and productions made in the civil process can be used in a criminal one, so every production, interview and written submission should be evaluated for its potential criminal implications. Employee interviews, in particular, require careful handling, including appropriate Upjohn warnings clarifying that counsel represents the company, not the individual.

Voluntary Self-Disclosure vs. Delay

Voluntary self-disclosure can meaningfully affect outcomes, potentially supporting cooperation credit and mitigating penalties under both agency and DOJ frameworks. But disclosure is difficult to reverse and must be timed against the completeness of the internal factual investigation and the strength of the underlying facts. The decision is highly fact-specific and should be made only after counsel has developed a clear picture of the conduct. This is a threshold strategic judgment that warrants dedicated analysis, which is why a decision framework on voluntary self-disclosure versus contesting an inquiry is a natural companion to this guide.

Privilege Logs Where DOJ Is Present

When a DOJ investigation is active or anticipated, privilege discipline becomes even more important. A carefully maintained privilege log, consistent redaction practices, and controlled employee communications reduce the risk of inadvertent waiver that could reverberate across both proceedings. The crime-fraud exception discussed under Zolin also takes on added significance where criminal conduct is alleged, because the government may seek in-camera review of communications it contends furthered the violation.

Practical Scenario

Consider a bank that receives an OFAC subpoena seeking correspondent-banking records tied to a sanctioned jurisdiction. If the internal investigation reveals that a compliance manager overrode screening alerts, the willfulness concern elevates DOJ-referral risk immediately. The correct response is to pause, involve criminal defense counsel, provide the individual with independent representation where appropriate, and coordinate any production so that cooperation credit is preserved without prejudicing the company’s or individuals’ criminal defenses.

Production Logistics: Format, Metadata, Encryption and Chain of Custody

Even a well-strategized response can be undermined by sloppy production mechanics. Getting the logistics right protects credibility and reduces the risk of disputes over completeness or authenticity.

Native vs. PDF vs. TIFF

Agencies generally prefer productions that preserve the integrity of the records. Native files retain metadata and are often appropriate for spreadsheets and structured data; searchable PDF or TIFF images with load files may be acceptable for documents where metadata is separately provided. Confirm format preferences with the issuing officer before producing at volume, and document any agreement reached.

Metadata Fields to Preserve and Produce

Preserve standard metadata fields, custodian, author, recipients, dates of creation and modification, file paths and document types. Stripping this data can raise questions about spoliation and complicate authentication. Where metadata contains privileged or irrelevant sensitive information, address it through targeted redaction rather than wholesale deletion.

Secure Transfer and Attestations

Productions frequently contain confidential business and personal data, so use secure, encrypted transfer methods and maintain a record of what was produced, when and to whom. A cover letter accompanying each production should describe the scope of the materials, note any withholdings on privilege grounds, and reference the accompanying privilege log.

Redaction Practicalities and Chain of Custody

Apply redactions using tools that permanently remove, not merely visually obscure, the underlying text, and quality-check every redacted document before it leaves your possession. Maintain a clear chain of custody from collection through production so that, if authenticity or completeness is ever questioned, you can demonstrate a reliable, documented process.

Sample Timelines, Checklists and Templates

The tools below translate the strategy above into a repeatable operational sequence. Counsel and compliance teams should adapt these to the specifics of each matter.

Quick-Start Checklist

1. Record the date and method of service and calendar the response deadline.
2. Read and map the scope: dates, subject matter, custodians, definitions.
3. Engage external counsel with OFAC and BIS enforcement experience.
4. Issue and document a litigation hold; suspend automated deletion.
5. Identify data sources and custodians; begin defensible collection.
6. Conduct an initial privilege assessment and segregate privileged material.
7. Assess criminal exposure; involve defense counsel if willfulness is indicated.
8. Contact the issuing officer; confirm format preferences and any extension.
9. Review, redact and log privileged materials; prepare the privilege log.
10. Produce securely with a cover letter; maintain chain of custody.

30/60/90-Day Timeline

The illustrative phasing below assumes a response window that permits it; always calibrate to the deadline set on the subpoena and any agreed extension.

Sample Preservation Notice and Privilege Log Headers

A preservation notice should direct recipients to retain all potentially relevant material, suspend deletion, and acknowledge receipt. A privilege log should, at minimum, capture the following headers: document date; author; recipients; document type; privilege basis (attorney-client, work product); and a description sufficient to assess the claim without revealing privileged content. Detailed, redline-ready versions of these templates, together with a litigation hold sample, are the kind of tactical tools that a dedicated privilege and document-preservation resource can supply.

Next Steps and When to Engage Counsel on an OFAC Administrative Subpoena USA Matter

Responding effectively to an OFAC administrative subpoena USA recipients face is not a purely administrative exercise, it is a legal and strategic one that engages privilege law, production mechanics, and the growing possibility of parallel DOJ exposure. The recurring theme across every section of this guide is discipline in the first hours: preserve everything, read the scope precisely, protect privilege deliberately, and assess criminal risk before producing. Companies that execute those steps well preserve their options; those that improvise often forfeit them.

Because coordinated OFAC, BIS and DOJ enforcement has raised the stakes, specialized counsel should be engaged early, ideally within the first 24 to 72 hours after service. Experienced sanctions and export-control counsel can manage the administrative response, protect privilege, and coordinate with criminal defense where necessary, all while preserving a credible, cooperative posture with the issuing agency. For companies weighing whether to contest, negotiate or voluntarily disclose, that judgment is best made with practitioner guidance grounded in the primary sources cited throughout this guide.

To take the next step, you can review the introduction to Global Law Experts’ exclusive OFAC sanctions specialist via the specialist introduction page, and use the contact pathways there to arrange a confidential consultation on your OFAC administrative subpoena USA response strategy.

Sources

1. U.S. Department of the Treasury, OFAC: Sanctions Programs & Country Information
2. U.S. Department of the Treasury, OFAC: Enforcement
3. U.S. Department of Commerce, Bureau of Industry and Security (BIS): Enforcement
4. Export Administration Regulations (EAR), eCFR Title 15, Subtitle B, Chapter VII
5. International Emergency Economic Powers Act (IEEPA), 50 U.S.C. Chapter 35 (Cornell LII)
6. U.S. Department of Justice, Justice Manual: Principles of Federal Prosecution of Business Organizations
7. Upjohn Co. v. United States, 449 U.S. 383 (1981) (Cornell LII)
8. United States v. Zolin, 491 U.S. 554 (1989) (Cornell LII)