How to report a sanctions violation
How to report a sanctions violation
If you discover your organization — or your AI agent — has violated OFAC sanctions, the single most important step is prompt voluntary self-disclosure. OFAC considers it the #1 mitigating factor when calculating penalties.
What is voluntary self-disclosure?
Voluntary self-disclosure (VSD) is the process of proactively notifying OFAC that a sanctions violation may have occurred. It must be done before OFAC discovers the violation independently, and the disclosure must be complete and truthful.
When to report
Report as soon as a potential violation is identified. OFAC's Enforcement Guidelines explicitly state that the timeliness of disclosure is a key factor. Waiting to "investigate internally first" can undermine the voluntary nature of the disclosure.
How to file a VSD
OFAC's VSD process involves submitting a detailed report to OFAC's Enforcement Division. The submission should include:
- Description of the violation — what happened, when, who was involved, the transaction amounts and counterparties.
- Compliance program description — your existing compliance infrastructure, including any screening tools in place.
- Corrective actions taken — what you've done to prevent recurrence (e.g., adding pre-payment screening, improving agent monitoring).
- Supporting documentation — transaction records, agent logs, screenshots, correspondence.
The penalty reduction
Under OFAC's Economic Sanctions Enforcement Guidelines, a voluntary self-disclosure that meets OFAC's criteria can reduce the base penalty by up to 50%. In cases where the violation is deemed "non-egregious" and VSD was timely, OFAC often issues a cautionary letter with no monetary penalty at all.
Related questions
- What happens if you violate OFAC sanctions?
- How do OFAC penalties get calculated?
- Can I self-disclose an agent-caused violation?
Why this matters
The difference between a self-disclosed violation and one discovered by OFAC enforcement is often the difference between a cautionary letter and a multi-million dollar penalty. For autonomous agent operators, where violations can accumulate at machine speed, having a VSD protocol in place before you need it is essential.