Self‑disclose to OFAC or Fight the Inquiry? When to Disclose (2026 Guide)

When a U.S. company discovers a potential sanctions violation, a flagged shipment, a screened counterparty match, a mis‑classified export, the general counsel faces a binary, high‑stakes choice: file a voluntary self‑disclosure (VSD) with the Office of Foreign Assets Control or prepare to defend an eventual agency investigation. The decision to self‑disclose to OFAC vs. defend in 2026 USA carries materially different consequences for civil penalties, criminal exposure, legal costs, and corporate reputation. OFAC’s launch of a centralized VSD Portal in early 2026, combined with an escalating enforcement posture across Treasury and the Department of Justice, has shifted the calculus sharply, making the timing and substance of this decision more consequential than at any point in the past decade.

Who Faces This Decision, and Why It Matters Now

The choice between voluntary self‑disclosure and a defensive posture applies to every “U.S. person” within OFAC’s jurisdictional reach: domestic corporations, U.S.‑based subsidiaries of multinationals, financial institutions, exporters, and individuals who facilitate transactions touching sanctioned jurisdictions, parties, or goods. It also extends to non‑U.S. entities that deal in U.S.‑origin goods or U.S.‑dollar‑denominated transactions and are therefore subject to secondary sanctions exposure.

The question is not merely academic. OFAC enforcement actions in 2025 and 2026 have demonstrated a willingness to impose significant civil monetary penalties on companies of all sizes, from multinational banks to mid‑market manufacturers. The DOJ has simultaneously intensified criminal referrals for sanctions evasion and export‑control violations, with gatekeeper accountability (compliance officers, trade managers, C‑suite executives) now an explicit enforcement priority. For companies that discover a potential violation today, waiting carries its own risk: delay can be characterised as concealment, eliminating the mitigation credit that timely self‑disclosure would have provided.

This guide provides a structured, dimension‑by‑dimension framework to help GCs, CLOs, compliance heads, CFOs, and export managers make that decision, with concrete “Choose A when / Choose B when” guidance rather than generic hedging. It also addresses the parallel question of export‑controls enforcement under the Bureau of Industry and Security (BIS), where the voluntary disclosure calculus runs on a similar but distinct track under the Export Administration Regulations (EAR).

Option A: Voluntary Self‑Disclosure, Process, Benefits, and Limits

Legal Definition and Official Guidance

A voluntary self‑disclosure is a written notification to OFAC that a company has reason to believe it committed an apparent violation of U.S. sanctions regulations. Under OFAC’s Economic Sanctions Enforcement Guidelines, a disclosure qualifies as “voluntary” only if it is made before OFAC or any other federal agency has initiated an inquiry, investigation, or obtained knowledge of the potential violation from another source. The disclosure must be filed through OFAC’s VSD Portal, the centralized submission system that replaced the prior email‑and‑mail process in early 2026, and must include a comprehensive account of the underlying conduct.

To be considered complete, a VSD should provide a chronological narrative of the apparent violation, identification of all parties involved, copies of relevant transactional documents and screening results, a root‑cause analysis, and a description of remedial measures already implemented or planned. OFAC expects an initial notification to be filed promptly once the company has a reasonable basis to believe a violation has occurred, even if the full investigation is still underway. The company may then supplement the initial filing as additional facts emerge.

Typical Timeline and Deliverables

The VSD process unfolds in stages. An initial notification, typically a concise letter identifying the nature of the apparent violation, the programs implicated, and preliminary transactional details, should be filed within days to weeks of discovery. A full narrative report, supported by transactional records, screening outputs, and remediation documentation, follows within 60 to 180 days depending on complexity. OFAC then reviews the submission, may pose follow‑up questions, and ultimately determines an enforcement response. Industry observers expect the 2026 VSD Portal to compress agency response times modestly, though OFAC has not published binding processing deadlines.

Practical Concessions and Penalty Mitigation

OFAC treats a qualifying VSD as a significant mitigating factor in its penalty calculus. Under the Enforcement Guidelines, a timely and thorough self‑disclosure can result in substantially reduced civil penalties relative to the base amount OFAC would otherwise impose. In non‑egregious cases accompanied by a VSD, OFAC has historically resolved matters with cautionary letters or penalties well below the statutory maximum. However, voluntary self‑disclosure does not guarantee a specific outcome, OFAC retains full discretion, and aggravating factors such as willful or reckless conduct, management awareness, harm to sanctions programme objectives, or a pattern of violations can offset the mitigating weight of a VSD.

Critically, a VSD does not confer criminal immunity: if the facts reveal wilful violations, OFAC may refer the matter to the DOJ regardless of the disclosure.

Option B: Do Not Self‑Disclose Immediately, Prepare to Defend

Defensive Posture: Internal Investigation and Privilege

The alternative to immediate disclosure is to initiate a privileged internal investigation under the direction of outside counsel, gather and preserve evidence, and prepare a defensive strategy before deciding whether, and when, to approach the agency. This approach prioritises the preservation of attorney‑client privilege and work‑product protections. Documents created at the direction of counsel, interview memoranda, and analytical work product remain shielded from compelled production (absent waiver), which gives the company greater control over the narrative and timing of any engagement with OFAC or the DOJ.

Tactical Steps

• Engage criminal defence counsel immediately if the facts suggest potential wilful conduct or if the company is aware of a parallel DOJ investigation.
• Issue a litigation hold covering all potentially relevant documents, electronic communications, and screening records.
• Conduct counsel‑directed interviews of key personnel under Upjohn warnings, documenting the scope and basis of privilege for each interview.
• Prepare detailed privilege logs anticipating future government subpoenas or document requests.
• Engage forensic accountants or data analysts to reconstruct transaction flows and identify the full scope of potential violations, under privilege.
• Assess insurance coverage under D&O and E&O policies before any disclosure that might trigger coverage disputes.

When Delay Is Rational

A defensive posture is not inherently adversarial, it is a deliberate sequencing choice. Delay is rational when the company has credible evidence that no violation occurred and needs time to assemble exculpatory facts. It is also rational when the facts strongly suggest wilful misconduct by individual employees or officers, making immediate self‑disclosure to OFAC a potential trigger for DOJ criminal prosecution before the company has secured its defensive position. Companies facing cross‑jurisdictional criminal exposure, for example, parallel investigations in the EU or UK, may likewise benefit from coordinated counsel engagement before disclosing to any single authority.

The risk of this approach is real: if OFAC independently discovers the violation (through a bank filing, a tip, or inter‑agency intelligence sharing), the company loses all VSD mitigation credit and may face adverse inferences from the delay.

Self‑Disclosure vs. Investigation: Side‑by‑Side Comparison

The following table is the centrepiece of this decision framework. It compares the two options across every material dimension a GC or compliance head must evaluate when deciding whether to self‑disclose to OFAC or defend in 2026.

The comparison underscores a core principle: voluntary self‑disclosure is the stronger path when the violation is clear and the conduct was non‑wilful; defending is the stronger path when the facts are ambiguous or criminal exposure is already acute. A hybrid approach, privileged investigation first, VSD filing within a compressed window, is often the practical middle ground, but it requires experienced sanctions counsel to execute without forfeiting mitigation credit.

Dimension‑by‑Dimension Analysis

Each dimension below expands on the comparison table with concrete numbers, statutory references, and actionable guidance. Use these sections to pressure‑test which option aligns with your company’s specific facts.

Penalties and Liability: Civil vs. Criminal

The statutory framework for OFAC penalties derives primarily from the International Emergency Economic Powers Act (IEEPA), codified at 50 U.S.C. Chapter 35. IEEPA authorises civil penalties per violation and criminal penalties, including imprisonment, for wilful violations. The Export Administration Regulations (EAR), administered by BIS, impose a parallel penalty regime for export‑control violations. The table below summarises the exposure under each path.

The practical takeaway: voluntary self‑disclosure does not eliminate penalty exposure, but it meaningfully compresses the likely range. Companies that fail to disclose and are later investigated face the full statutory cap per violation, and if the transaction count is high, the aggregate exposure can be orders of magnitude larger than a mitigated settlement.

Timing and Process

Under the VSD path, the initial notification should be filed within days to weeks of discovery. OFAC’s 2026 VSD Portal is designed to provide structured submission tracking and, early indications suggest, faster acknowledgement of receipt. The full investigative report and remediation documentation typically follow over a 60‑ to 180‑day period. OFAC then conducts its own review, which can take 12 to 24 months depending on case complexity.

Under the defensive path, the company controls the timing of its internal investigation but has no control over when OFAC (or DOJ) may independently initiate an inquiry. Once OFAC opens a formal investigation, it issues administrative subpoenas, sets production deadlines, and may refer the matter to DOJ on its own timeline, a process that can extend 18 to 36 months or longer, and over which the company has limited influence.

Cost: Legal Fees, Remediation, and Fine Ranges

The cost differential is significant. The VSD path front‑loads legal and remediation spend but typically results in lower total cost because mitigated penalties and avoided litigation savings offset the upfront investment. The defensive path defers some costs but risks exponential escalation if the matter proceeds to formal enforcement or criminal prosecution.

Enforceability and Practical Outcomes

OFAC does not publish a fixed penalty‑reduction formula for voluntary self‑disclosures. Its Enforcement Guidelines identify VSD as a mitigating factor, but the weight OFAC assigns to it depends on the totality of the circumstances, including the quality and timeliness of the disclosure, the egregiousness of the underlying conduct, and the adequacy of remediation. In non‑egregious cases with a qualifying VSD, OFAC has historically issued cautionary or “no‑action” letters. In more serious cases, VSD has contributed to settlements substantially below what the statutory framework would permit. No company should expect a guaranteed outcome; experienced sanctions counsel can model the likely range based on published precedent.

Privilege, Evidence, and Litigation Risk

Filing a VSD inherently involves sharing factual information with OFAC, transaction records, chronologies, screening logs, and root‑cause findings. Materials prepared by counsel for the purpose of the disclosure may lose work‑product protection once transmitted to the government, depending on the scope of any confidentiality agreement. Companies must work with counsel to segregate privileged analytical work from factual submissions, maintain detailed privilege logs, and consider whether a selective‑waiver argument applies. On the defensive path, privilege can be preserved longer, but OFAC administrative subpoenas can compel production of underlying business records regardless. The practical difference is that VSD allows the company to choose what to share and when; a subpoena removes that choice.

What Changed in 2026: Policy Updates That Shift the Calculus

Two developments in 2025–2026 have materially altered the self‑disclosure vs. defend analysis for U.S. companies.

OFAC’s Centralized VSD Portal. Launched in early 2026, the portal replaced OFAC’s prior ad‑hoc email and mail submission process with a structured digital intake system. The portal assigns a tracking identifier at submission, provides acknowledgement of receipt, and is designed to improve workflow management within OFAC’s enforcement division. The likely practical effect is faster initial processing and more standardised follow‑up, which compresses the window in which a company can prepare its submission. Companies that delay to “get everything perfect” before filing risk losing the VSD timing advantage.

Elevated Enforcement Posture. OFAC and DOJ have signalled, and demonstrated through enforcement actions in 2025 and 2026, a heightened focus on gatekeeper accountability. Compliance officers, trade managers, and senior executives are individually named in enforcement releases with increasing frequency. DOJ’s corporate enforcement policy continues to reward voluntary self‑disclosure while extracting significantly larger penalties from companies that are investigated without having self‑disclosed. For companies weighing whether to self‑disclose to OFAC or defend, these OFAC penalties trends in 2026 mean the cost of choosing wrong has increased on both sides, but particularly on the side of delay.

Decision Framework: When to Choose Self‑Disclosure vs. Defence

Use the checklist and table below as a rapid triage tool. The framework assumes you have already engaged, or are about to engage, experienced international trade counsel.

Choose Option A, Voluntary Self‑Disclosure, when:

• Your internal investigation confirms an apparent violation with clear factual support.
• The conduct appears non‑wilful (systemic screening failure, clerical error, misclassification).
• You can file the initial VSD notification before OFAC or another agency learns of the violation.
• You are prepared to implement remediation measures (enhanced screening, controls, training) concurrently.
• Your priority is minimising civil penalty exposure and demonstrating a proactive compliance culture.

Choose Option B, Defend / Delay Disclosure, when:

• The facts are genuinely ambiguous and you have credible evidence that no violation occurred.
• The conduct at issue appears wilful, and immediate disclosure could trigger a DOJ criminal referral before you have secured your defensive position.
• You are already aware of a parallel criminal investigation (grand jury subpoena, FBI contact, DOJ inquiry).
• Cross‑jurisdictional criminal exposure exists and coordinated multi‑counsel strategy is required before approaching any single authority.
• Immediate disclosure would waive privilege over materials critical to an anticipated defence.

Urgent triage rule: If you have received a grand jury subpoena, an FBI contact letter, or a DOJ target letter, stop, do not file a VSD. Engage criminal defence counsel immediately. If you have not received any of these, and the conduct appears non‑wilful, begin VSD preparation within 72 hours of discovering the potential violation.

When, and Why, to Engage a Lawyer for This Decision

The decision to self‑disclose to OFAC vs. defend is not one that should be made by a compliance department alone. The following situations require immediate engagement of specialist counsel.

• Hire sanctions / compliance counsel when: you need to prepare and file a VSD; you require an OFAC licence application; your compliance programme needs a post‑violation overhaul; or you need to respond to an OFAC administrative subpoena or pre‑penalty notice.
• Hire criminal defence counsel when: the facts suggest wilful or knowing violations; you have received or anticipate a DOJ inquiry, grand jury subpoena, or target letter; individual officers or employees face personal criminal exposure; or the company is the subject of a parallel BIS or FBI investigation.

Before your first call with counsel, assemble these materials: a chronological incident timeline; copies of the flagged transactions and screening outputs; your current compliance programme documentation (policies, procedures, training records); any internal communications discussing the potential violation; and a list of individuals with knowledge of the relevant conduct. Having these ready accelerates the VSD readiness assessment and allows counsel to advise on the disclosure‑versus‑defend question within 48 to 72 hours.

To find an international trade lawyer in the USA, use the Global Law Experts directory to identify sanctions and export‑control specialists with VSD experience.

Sources

1. OFAC, Voluntary Self‑Disclosure (Disclosure Portal and Guidance)
2. OFAC, Recent Actions and Enforcement
3. U.S. Department of Justice, Enforcement and Criminal Division
4. Bureau of Industry and Security (BIS), Enforcement and Compliance
5. IEEPA, 50 U.S.C. Chapter 35 (Cornell LII)
6. Export Administration Regulations (EAR), eCFR Title 15
7. U.S. Sentencing Commission