OFAC Voluntary Self-Disclosure Process 2026: 50% Penalty Reduction

A U.S. financial institution discovered during a routine audit in January 2026 that it had processed $2.3 million in payments involving a sanctioned entity over eight months. The compliance officer faced a choice: disclose immediately and secure a 50% penalty reduction, or wait to complete the internal investigation and risk OFAC learning of the violation first—forfeiting all mitigation credit.

The Office of Foreign Assets Control (OFAC) voluntary self-disclosure process allows companies and individuals to report apparent sanctions violations before OFAC discovers them independently. The reward is substantial: a 50% reduction in civil monetary penalties under the Economic Sanctions Enforcement Guidelines (31 CFR Appendix A to Part 501). As of February 6, 2026, organizations can submit disclosures through OFAC's new online portal or via email to [email protected]. Detailed reports are expected within 180 days of initial notification—a timeline that sounds generous until you realize it means missing even one external report during those months could cost you the entire mitigation credit.

Voluntary Self-Disclosure (VSD) is a self-initiated notification to OFAC of an apparent violation of U.S. sanctions regulations, submitted before OFAC independently learns of the conduct through other sources such as financial institutions, government agencies, or third-party reports (31 CFR Appendix A to Part 501, section (l)).

Key Takeaways

• 50% penalty reduction applies to complete voluntary self-disclosures under OFAC's Economic Sanctions Enforcement Guidelines.
• Launched February 6, 2026, the new Voluntary Self-Disclosure Portal streamlines secure submission while preserving all substantive requirements.
• Detailed follow-up reports must arrive within 180 days of initial notification—miss this window and you lose mitigation credit.
• Once OFAC receives external reports of your violation, your disclosure ceases to be voluntary. The penalty reduction disappears.
• Remedial measures and compliance program enhancements stack on top of the 50% VSD reduction for additional mitigation.

What Qualifies as a Voluntary Self-Disclosure to OFAC?

Three threshold requirements determine whether OFAC will treat your disclosure as voluntary. The disclosure must be self-initiated—you report the violation yourself, not in response to OFAC knocking on your door. It must contain enough detail to identify the violation or include a clear commitment to provide specifics later. And critically, OFAC must not have already received information about the violation from a financial institution, government agency, or any other outside party.

Timing dominates everything here. If OFAC receives external reports before your disclosure lands, you've lost the voluntary character entirely and with it the 50% penalty reduction. This window can close fast. Financial institutions routinely report suspicious transactions to OFAC, sometimes within days of discovery. Once your own bank flags the transaction—whether your company reports it or not—the clock has essentially run out on securing VSD status.

Initial notifications need not be exhaustive. OFAC understands that organizations discover violations through audits requiring further investigation. Identify the nature of the apparent violation, cite the sanctions regulation implicated, provide preliminary transaction information, and you've met the threshold. The two-step procedure exists precisely because most companies cannot compile complete information instantly. What matters is notifying OFAC promptly once you've credible evidence of a potential problem.

When Should Companies Submit a Voluntary Self-Disclosure?

Submit initial notifications immediately upon discovering credible evidence of an apparent sanctions violation. Not after you've finished investigating. Not after legal review. Now. The Economic Sanctions Enforcement Guidelines require disclosure before OFAC independently learns of the violation. Once you know a potential problem exists, the clock is ticking.

Common discovery scenarios include automated screening alerts flagging historical transactions involving sanctioned parties, shipments to prohibited destinations identified during export compliance audits, dollar-clearing transactions that potentially triggered sectoral sanctions restrictions, or acquisition due diligence revealing target company exposure. Each creates real risk that financial institutions, customs authorities, or other entities will report to OFAC through separate channels.

Evaluate your specific risk profile. How severe is the violation? What transaction value involved? Did violations repeat or appear isolated? Does your compliance program look competent? Most critically: how likely is it that external parties already know? Material violations involving significant amounts, multiple occurrences, or obvious compliance program failures demand immediate disclosure. Even isolated human errors warrant consideration—the cost of disclosure usually beats the cost of OFAC learning about it first.

How Does the Two-Step OFAC VSD Procedure Work?

Step one: submit an initial notification that secures your voluntary status. Identify the violation's basic facts—which sanctions program, what transactions, approximate value, affected parties. This notification triggers the disclosure timeline and protects you from losing mitigation credit if external reports reach OFAC later. Step two: provide a detailed follow-up report after investigation concludes, typically within 180 days per OFAC's published FAQs.

That 180-day window is realistic for most investigations but not infinite. If you need more time, request an extension early and explain specifically why. OFAC generally grants reasonable requests when organizations demonstrate good-faith progress. But don't assume extensions are automatic—demonstrate clear necessity and specific completion timelines.

The two-step structure doesn't lower substantive requirements. You still must provide complete, accurate information. The procedure simply recognizes that thorough fact-gathering requires time while preserving the incentive to notify OFAC immediately. Initial notification secures your position; the follow-up report proves you were serious.

What Information Must Initial Notifications Include?

Minimum content: identify the sanctions regulation potentially violated with specific program citations (for example, the Iranian Transactions and Sanctions Regulations at 31 CFR Part 560), describe the conduct appearing to violate those regulations, provide preliminary transaction details including approximate values and date ranges, and identify the parties involved. Stop there if necessary—you've met the threshold.

Effective notifications do more. State clearly that this constitutes a voluntary self-disclosure. Explain how you discovered the potential violation: audit finding, compliance review, specific triggering event. Outline your investigation scope and anticipated timeline. Commit to providing detailed follow-up. This framing establishes good faith and positions you favorably for eventual enforcement discussions.

Best practices: submit through OFAC's Voluntary Self-Disclosure Portal for secure transmission and receipt confirmation. Copy relevant counsel to establish privilege. Avoid premature legal conclusions about severity or intent. Preserve flexibility for subsequent findings that refine initial characterizations. Resist downplaying violations in initial submissions—candor matters to OFAC throughout the process.

What Must Detailed Follow-Up Reports Include?

Comprehensive reports address nine essential categories. First, thorough description of the conduct and circumstances: business context, parties involved, mechanics of how the violation occurred. Second, precise identification of the sanctions regulation violated, with complete 31 CFR citations. Third, complete transaction details—total value, transaction count, dates, payment methods, party identities, supporting documentation including invoices, shipping records, and payment records.

Fourth, explain how you discovered the violation: internal audit, compliance trigger, third-party notification. This demonstrates program effectiveness. Fifth, detailed description of remedial measures already implemented: transaction cessation, party blocking, procedure revisions, technology enhancements, personnel actions, control improvements. Sixth, planned future remedial actions with timelines and accountability.

Seventh, comprehensive compliance program documentation showing structure before and after violation—written policies, screening procedures, training records, audit protocols, governance frameworks. Eighth, root cause analysis explaining why existing compliance measures failed and how remedial measures address those deficiencies. Ninth, voluntarily submit supporting documentation without waiting for OFAC requests: transaction records, due diligence files, communications, materials evidencing violation or remediation. Don't make OFAC ask for anything twice.

What Are the Significant Benefits of Filing a Complete VSD?

Organizations that file complete and timely voluntary self-disclosures receive a 50% reduction in the base civil monetary penalty amount, as explicitly provided in OFAC's Economic Sanctions Enforcement Guidelines at 31 CFR Appendix A to Part 501.

The 50% penalty reduction is concrete. For violations carrying base penalties in the hundreds of thousands or millions of dollars, this translates directly to your bottom line. OFAC calculates base penalty amounts using statutory maximum penalties, transaction values, and aggravating or mitigating factors—then applies the 50% reduction before settling. This reduction operates automatically for complete disclosures and can layer with additional mitigation credit for cooperation quality and remedial measures.

Beyond the penalty math, voluntary disclosure builds something harder to quantify but equally valuable: regulatory goodwill. When you disclose proactively, OFAC sees you as a responsible actor committed to compliance. That reputation shapes how they approach future interactions, enforcement decisions, and willingness to work constructively on your compliance program. You also eliminate enforcement uncertainty. Instead of waiting for an investigation you don't know is coming, you learn your exposure, provision reserves accurately, and avoid the operational disruption of surprise OFAC inquiries.

The strongest disclosures—those paired with comprehensive remediation and genuine cooperation—sometimes result in cautionary letters or administrative responses rather than civil penalties, particularly for less serious violations by organizations with otherwise solid compliance records. OFAC has issued numerous cautionary letters in cases where voluntary disclosure, thorough investigation, and genuine remedial commitment demonstrated organizational seriousness without requiring financial penalties.

How Penalty Calculations Work With Voluntary Self-Disclosure

OFAC begins with statutory maximum penalties established by the International Emergency Economic Powers Act and other authorizing statutes. These inflation-adjusted ceilings can reach hundreds of thousands of dollars per violation. Then comes the base penalty calculation—OFAC weighs transaction value, violation duration, your organization's sanctions sophistication, whether violations were self-initiated or involved deception, and your compliance program quality.

After establishing the base penalty amount, OFAC applies aggravating and mitigating factors from the Economic Sanctions Enforcement Guidelines. Aggravating factors: willful or reckless conduct, management involvement, systematic violations, attempts to conceal, lack of cooperation. Mitigating factors: limited sanctions sophistication, isolated transactions, prompt remedial action, effective compliance programs, voluntary self-disclosure. The 50% reduction for complete VSD applies here, reducing the adjusted base penalty to reach your final settlement number.

Takeaway: Voluntary self-disclosure locks in a guaranteed 50% reduction regardless of violation characteristics—making it valuable whether you're dealing with a single missed transaction or systemic control failures.

What Additional Mitigation Credit Can Organizations Receive?

Organizations submitting voluntary self-disclosures can earn additional mitigation credit beyond the guaranteed 50% reduction through exceptional cooperation, comprehensive remedial measures, and strong compliance programs. OFAC evaluates cooperation quality based on investigation thoroughness, documentation completeness, timeline adherence, responsiveness, and willingness to provide information OFAC hasn't requested. The organizations that go furthest—identifying related transactions on their own, conducting expansive lookback reviews, volunteering information—get rewarded for that effort.

Remedial measures carry substantial weight. OFAC distinguishes between reactive fixes (addressing the immediate violation) and proactive systemic improvements (preventing future violations). Reactive: terminating violative transactions, blocking involved parties, correcting isolated control failures. Proactive: comprehensive policy revisions, enterprise-wide technology implementations, organizational restructuring to elevate compliance authority, enhanced due diligence procedures, expanded training, increased compliance resources. Organizations implementing proactive measures before or immediately after discovering violations demonstrate institutional commitment that shifts enforcement outcomes.

Your compliance program strength provides context for everything. Robust programs with isolated violations caused by human error receive far more favorable treatment than organizations lacking basic sanctions controls. OFAC's Framework for Compliance Commitments identifies five essential components: management commitment, risk assessment, internal controls, testing and auditing, training. Organizations documenting strength across these components before violations occur establish baseline credibility that supports mitigation arguments.

How to Submit Your Voluntary Self-Disclosure: Portal vs. Email

Starting February 6, 2026, the U.S. Department of the Treasury offers the Voluntary Self-Disclosure Portal—a web-based submission method that provides encrypted transmission, automated receipt confirmation, secure document uploads, and submission tracking. Organizations access the portal through Treasury's official website, authenticate their accounts, and submit initial notifications or detailed reports through structured web forms.

Several security features support this approach. Encrypted transmission protects sensitive financial and proprietary information. Structured forms guide you through required fields, reducing incomplete disclosures. Document upload accepts supporting materials including transaction records, due diligence files, remedial action plans. Automated confirmation provides immediate receipt acknowledgment—you know your submission arrived.

Email submissions to [email protected] remain fully acceptable. Organizations choose email when portal technical issues arise, when submitting from jurisdictions with restricted internet access, when organizational security policies prohibit uploading sensitive documents to external portals, or when legal counsel prefers traditional methods for documentation purposes. Email submissions should use clear subject lines identifying the message as a voluntary self-disclosure, attach documents in common formats (PDF preferred), and request read receipts or follow up via phone to confirm receipt.

When to Use the Portal vs. Email Submission

Select submission methods based on practical considerations—both methods satisfy OFAC disclosure obligations equally. Portal advantages: organizations comfortable with web-based submission, those prioritizing transmission security and receipt confirmation, entities submitting from locations with reliable high-speed internet, and organizations preferring structured guidance through submission requirements. Portal tracking features benefit organizations managing multiple disclosures or coordinating between internal compliance teams and external counsel.

Email submission remains preferable when portal technical difficulties arise, when submitting from locations with connectivity limitations, when organizational policies restrict third-party portal access, or when time sensitivity requires immediate submission without account setup delays. Legal counsel often prefers email for documentation purposes. Email systems generate automatic timestamp and delivery records that provide clear evidence of submission timing—critical for establishing that disclosure occurred before OFAC received external reports.

What Remedial Measures Should Accompany Your VSD?

Remedial measures are corrective actions you implement in response to apparent violations. They address immediate compliance failures, prevent recurrence, and demonstrate institutional commitment to sanctions compliance. OFAC evaluates remedial measures as a critical VSD component, weighing both speed of implementation and comprehensiveness of systemic improvements. Effective responses combine immediate transaction-level corrections with enterprise-wide compliance program enhancements that address root causes rather than symptoms.

Start with a three-tier approach: stop the bleeding, fix what broke, and prevent recurrence. Immediate containment means shutting down ongoing violative transactions, blocking payments to sanctioned parties, cutting ties with problematic counterparties, and watching related accounts closely. Next, address the specific control failures that enabled violations—tighten screening procedures, strengthen due diligence, integrate sanctions lists properly, and review historical transactions for similar patterns. These intermediate steps target the root cause, not just the symptom.

Long-term prevention requires deeper systemic changes. Update policies to reflect lessons learned. Deploy technology for automated screening and monitoring across the enterprise. Restructure compliance teams to strengthen their authority and resources. Retrain staff on identified knowledge gaps. Expand audits to test whether controls actually work. Strengthen governance so senior management stays engaged. Here's the thing: organizations that implement these improvements before filing detailed reports signal genuine commitment to OFAC, and that matters in enforcement decisions.

What Compliance Program Enhancements Does OFAC Expect?

OFAC looks for five core components in a risk-based sanctions program: management commitment, risk assessment, internal controls, testing and auditing, and training. When violations surface, OFAC compares the compliance program that existed before the violation to the one afterward. That gap—between pre-violation and post-violation quality—tells OFAC whether the organization actually learned something and whether it will violate again.

Management commitment starts at the board level. Sanctions compliance needs board-level oversight, senior executive accountability when things fail, adequate budget, regular reporting to decision-makers, and incentive structures that reward compliance performance across business units. Risk assessment should map sanctions exposure across products, services, customers, and geographies, then update that map as the business evolves. Document how you calibrate controls based on risk levels. Enhanced due diligence should flag high-risk relationships before they become problems.

Internal controls need automated screening wired into every transaction system. Customer due diligence procedures should look for sanctions red flags. Transaction monitoring rules should target sanctions-specific risk indicators. Escalation procedures must get potential violations to the compliance team fast. Create documentation that leaves a clear audit trail. Testing and auditing should include independent assessments, regular control testing across critical systems, lookback reviews after control changes, and external validation of program effectiveness. Training must be role-specific—different jobs require different knowledge—and should reflect recent enforcement actions and real violation scenarios. Measure whether training sticks. Refresh it regularly so knowledge doesn't fade.

What Common Mistakes Should Organizations Avoid in the VSD Process?

Five mistakes consistently undermine voluntary self-disclosure benefits. First: delay. Organizations often spend weeks or months completing exhaustive internal investigations before notifying OFAC. Meanwhile, external parties might report the violation independently—and the moment OFAC learns of it from outside, you lose the 50% penalty reduction. Submit initial notification immediately once you find credible violation evidence. Then investigate thoroughly before the detailed report. The two-step approach protects mitigation credit while accommodating legitimate investigation needs.

Second mistake: incomplete or inaccurate submissions. When OFAC must request additional details or correct misstatements, the disclosure may no longer qualify as "complete" under the Economic Sanctions Enforcement Guidelines, potentially wiping out the 50% reduction entirely. Invest time in thorough investigation, compile comprehensive supporting documentation, and have experienced sanctions counsel review before filing. Once you've notified OFAC, quality outweighs speed.

Third mistake: missing the 180-day deadline for detailed reports without explanation. OFAC's published FAQs expect detailed reports within 180 days of initial notification. Organizations that miss that window without requesting extensions or providing status updates signal to OFAC that cooperation has stalled. That perception can reduce mitigation credit beyond the standard 50% VSD reduction. Build internal project management around the deadline, request extensions in advance if legitimate complexity requires more time, and send regular updates showing progress.

Fourth mistake: half-measures. Terminating violative transactions without fixing the control failures that allowed them is reactive, not proactive. OFAC evaluates whether remedial measures prevent future violations or merely correct past ones. Conduct root cause analysis to understand why violations occurred. Implement controls addressing those root causes. Document everything thoroughly in your detailed report. The organization that simply stops bleeding without treating the underlying condition will raise red flags.

Fifth mistake: siloed disclosures. Organizations subject to multiple regulators—bank regulators, securities agencies, criminal authorities—sometimes disclose to OFAC without coordinating with others. Uncoordinated timing creates inconsistent narratives, may waive legal privileges unintentionally, or trigger overlapping investigations. Develop a comprehensive disclosure strategy covering all relevant regulators. Coordinate timing and messaging. Involve counsel to protect privileges. One disclosure strategy, one unified approach.

This article is published by an independent law firm for informational purposes only and does not represent or claim affiliation with any government body, international organization, or official authority.

Frequently Asked Questions

What is the deadline for submitting a voluntary self-disclosure to OFAC?

There is no fixed calendar deadline. The requirement is simpler and more urgent: submit before OFAC learns of the violation through other sources—financial institutions, government agencies, third-party reports. Speed matters because the moment external information reaches OFAC, your disclosure loses its voluntary character. Once you discover a potential violation, submit an initial notification immediately to preserve mitigation credit. Then file a detailed report within 180 days.

Can I still get the 50% penalty reduction if I submit my disclosure via email instead of the new portal?

Yes. Submission method does not affect penalty reduction eligibility. The Voluntary Self-Disclosure Portal (launched February 6, 2026) and traditional email to [email protected] work equally well. Both preserve the 50% reduction for complete and timely disclosures. The portal offers convenience and security, but enforcement outcomes depend on substantive quality, not mechanics.

What happens if OFAC discovers my violation before I submit a voluntary self-disclosure?

The disclosure loses its voluntary status and the automatic 50% penalty reduction evaporates. External reports—from financial institutions, customs, other agencies—reaching OFAC first eliminate that mitigation benefit entirely. The disclosure may still demonstrate cooperation and support other mitigation arguments, but the penalty reduction is gone. This timing reality creates real pressure to notify OFAC immediately upon discovering potential violations.

Do I need a lawyer to submit a voluntary self-disclosure to OFAC?

Not legally required, but experienced sanctions counsel significantly improves outcomes. A sanctions lawyer conducts privileged internal investigations, prepares complete and accurate submissions, designs effective remedial measures, negotiates with OFAC, and coordinates disclosures with other regulators. Given sanctions complexity, the stakes of civil penalties, and the strategic importance of disclosure quality, professional representation for material violations pays dividends.

What is the difference between a voluntary self-disclosure and a cautionary letter from OFAC?

You submit a voluntary self-disclosure; OFAC may respond with a cautionary letter. When strong voluntary disclosures address less serious violations with comprehensive remedial measures, OFAC sometimes issues a cautionary letter instead of civil penalties. The letter formally closes the matter while warning against future violations. Cautionary letters represent favorable outcomes for organizations demonstrating genuine compliance commitment.