Voluntary Sanctions Disclosures in the United States and United Kingdom: Similar Objectives, Different Approaches.

Businesses operating across the UK and US will be familiar with the increasingly close relationship between the US Department of the Treasury’s Office of Foreign Assets Control (OFAC) and HM Treasury’s Office of Financial Sanctions Implementation (OFSI).

As explored in our previous alert, the UK and US sanctions regimes share many common features, while retaining some important differences. One area where those similarities and differences are particularly apparent is the agencies’ approaches to voluntary self-disclosure (VSD). This article compares the approaches taken by OFAC and OFSI, including how each authority defines a VSD, the procedures for making a disclosure, and the impact that self-reporting can have on potential enforcement outcomes. 

What is Voluntary Self-Disclosure?

Generally stated, a VSD is a report from a person or company to a regulator notifying the regulator of a potential breach by the reporting person or entity, made before the regulator independently discovers the conduct. However, the specific definitions provided by OFAC and OFSI differ. 

OFAC’s regulations define a VSD as “a self-initiated notification” of a potential sanctions violation by a person subject to OFAC’s sanctions, made “prior to or at the same time that” OFAC or another government authority “discovers the apparent violation or another substantially similar apparent violation.”¹  (OFAC defines an “apparent violation” as any “actual or possible” sanctions violation.²) 

OFAC’s regulations also specify circumstances in which a self-initiated notification does not qualify as a VSD, such as where a third party has already notified OFAC of the apparent violation because the third party blocked or rejected the relevant transaction; the disclosure is materially incomplete; or, in the case of a company, the disclosure is made by an individual within the company without the authorization of senior management.³  The regulations also caution that neither a response to an administrative subpoena (or other request for information) from OFAC nor an application for a license qualifies as a VSD.⁴

OFSI, on the other hand, has not provided a formal definition of what it considers to be a qualifying VSD. Nevertheless, to be treated as voluntary, OFSI expects the facts in reports to be accurate and materially complete and will not generally consider a report to be voluntary where OFSI had already requested information concerning the breach, is already aware of the matter and the disclosure is prompted by that awareness, or where the disclosure is prompted or required as part of a separate law enforcement or regulatory investigation. 

Comparing the US and UK Voluntary Disclosure Regimes

OFAC’s and OFSI’s frameworks surrounding VSDs have broadly similar objectives but differ in their structure and guidance. 

Making a Disclosure

OFAC “strongly encourages” parties to submit VSDs through its recently launched online Disclosure Portal.⁵  OFSI similarly permits submission of a VSD via email or through an online reporting form available on the OFSI website.^6,7

OFAC

OFAC’s regulations set forth the requirements for a disclosure to qualify as a VSD in a section known as the “Economic Sanctions Enforcement Guidelines” (Enforcement Guidelines).⁸  A disclosure to OFAC must, at a minimum, include “a report of sufficient detail to afford a complete understanding of an apparent violation’s circumstances.”⁹  A comprehensive VSD will address the factors that OFAC may consider in determining its response to an apparent violation, which OFAC describes in its Enforcement Guidelines and are discussed further below.  

OFSI

OFSI has not set out guidance as directly as OFAC on what qualifies as a VSD; however, guidance published by OFSI in February 2026 (the February 2026 Guidance) provides useful insight. The February 2026 Guidance states that “OFSI encourages reporters to include as much detail as possible in their report to assist OFSI’s understanding of the case and circumstances.”¹⁰  OFSI’s suspected breach form shows that the report should include a description of the suspected breach, the individuals or entities involved, and the times, dates, and jurisdictions of the wrongdoing, as well as any supporting evidence available.¹¹

Timing and Cooperation

The timing of a VSD is key for both regulators. 

OFAC

As noted, a disclosure to OFAC qualifies as a VSD only if it is submitted before, or at the same time as, the apparent violation is discovered by OFAC or another official body. In addition, the disclosure must provide sufficient information to afford OFAC a “complete understanding” of the circumstances. Where a detailed report is not submitted with the initial notification, OFAC generally expects a complete report to follow within 180 days.¹²

OFSI

OFSI also places weight on timing and cooperation. The February 2026 Guidance indicates that OFSI expects potential breaches to be reported as soon as reasonably practicable after they are discovered. This may involve making an initial disclosure followed by a more detailed account of the facts and circumstances once further information becomes available. 

For both regulators, the VSD is only the beginning of the process. Continued cooperation is an important factor when assessing enforcement actions, and organizations should be prepared to respond promptly to requests for further information as investigations progress. Indeed, OFAC specifically cautions parties that the VSD “should also be followed by responsiveness to any follow-up inquiries by OFAC.”¹³

Enforcement and Mitigation

Both OFAC and OFSI have a range of enforcement options available in response to a reported breach of sanctions laws. The appropriate action will depend on the facts of each case, including the seriousness of the breach, the level of cooperation provided, and any remedial steps taken.

OFAC

OFAC’s Enforcement Guidelines describe both the factors OFAC considers when assessing a sanctions violation and the range of potential enforcement outcomes that may follow. These factors include, among others, (1) the extent to which the conduct was willful or reckless; (2) whether the conduct was voluntarily self-disclosed; (3) the disclosing party’s cooperation with OFAC; (4) the harm caused to sanctions program objectives by the apparent violation; and (5) whether the party has implemented a risk-based sanctions compliance program.¹⁴  

After assessing the apparent violation, and depending on the particular facts and circumstances of each case, OFAC may (1) decide that no further action is required; (2) request additional information; (3) issue a cautionary letter; (4) issue a finding of violation; (5) impose a civil monetary penalty; (6) refer the matter for criminal investigation; or (7) take other enforcement action.¹⁵

If OFAC determines that a civil monetary penalty is appropriate, it will also assess whether the case represents an “egregious” violation (i.e., a “particularly serious violation” warranting “a strong enforcement response”), which can result in a higher penalty calculation. In determining whether a violation is egregious, OFAC considers the applicable factors, with particular emphasis on the willfulness or recklessness of the conduct, and the reporting entity’s awareness of the conduct at issue.¹⁶ The Director or Deputy Director of OFAC makes the ultimate determination whether a case is egregious.  

A qualifying VSD can significantly reduce the potential civil monetary penalty that OFAC might assess. The Enforcement Guidelines show that a qualifying VSD may reduce the applicable base penalty amount by up to 50%. Even in cases where a disclosure does not qualify as a VSD, OFAC may still apply reductions of between 25% and 40% for other mitigating factors, including cooperation.

OFSI

OFSI adopts a broadly similar approach; however, this framework is less prescriptive than OFAC’s. Under the February 2026 Guidance, following its assessment of a case, OFSI may issue a private warning letter, refer regulated bodies to their relevant professional regulator, publish details of a breach, impose a monetary penalty, or refer the matter to law enforcement agencies for criminal investigation and potential prosecution. When considering the guidance, and the potential available enforcement outcomes, it is important to note that OFSI distinguishes between voluntary self-disclosure and a third-party disclosure.

Where OFSI is considering imposing a monetary penalty, it will determine whether this is appropriate and proportionate. OFSI considers the facts on a case-by-case basis and determines a baseline penalty amount before considering whether any discounts apply. The February 2026 Guidance indicates that OFSI may apply a discount of up to 30% to a monetary penalty where there is a qualifying VSD and the reporting party has shown ongoing cooperation. In assessing the level of discount to be applied, OFSI will consider factors such as whether the breach was reported promptly, whether OFSI was provided with a complete account of the circumstances, and the extent to which the reporting party continued to cooperate throughout the investigation. 

Importantly, OFAC cannot mandate or compel individuals or entities to voluntarily disclose any potential violation due to the right against self-incrimination established by the Fifth Amendment to the US Constitution. In contrast, reporting to OFSI is mandatory in certain prescribed circumstances, including, in the regulated sector, where the relevant firm knows or reasonably suspects that a person is a designated person or has breached a prohibition, or where it holds funds or economic resources for a prohibited person.¹⁷  Even in these cases, the subject’s conduct in terms of disclosure may still attract a discount in the event OFSI decides to take enforcement action. Under both frameworks, there is a clear incentive for individuals and entities to make a voluntary disclosure, where one is not already required, especially given the potentially significant penalties that can be imposed by OFAC and OFSI, and the potentially substantial benefits of making a VSD.¹⁸

Disclosure Trends

During the 2025–26 financial year, OFSI reported receiving 29 voluntary disclosures, demonstrating the continued importance of self-reporting as part of sanctions compliance programs. Although OFAC does not publish equivalent annual self-disclosure statistics, both regulators continue to encourage voluntary reporting by rewarding cooperation and proactive compliance conduct when assessing enforcement outcomes.¹⁹

Practical Considerations for Multinational Businesses

For multinational businesses operating across multiple jurisdictions, VSD decisions rarely arise in isolation. Although the OFAC and OFSI frameworks differ in certain respects, their overall objectives are broadly aligned. Both regulators encourage prompt reporting and ongoing cooperation and both offer mitigation where organizations proactively engage with the relevant regulator. Key differences lie in the structure of the frameworks and the weight afforded to VSDs.

Organizations should consider carefully balancing the benefits of early disclosure against the need to establish a factual basis for any report. This can be particularly challenging for reporters in the US where the existence of whistleblower programs incentivizes individuals to report suspected wrongdoings directly to regulators. This increases pressure on individuals to report the suspected breach before the company formally makes a VSD, and vice versa, creating a “race to the regulator.” Parties reporting a breach in the UK do not face the same race to report, but OFSI does expect voluntary disclosure from each party involved in a breach. In both jurisdictions, a timely initial disclosure may be made, followed by a more complete account once further details are available. 

Cross-border issues add a further layer of complexity. A single sanctions incident may trigger reporting considerations in both the US and UK, requiring organizations to consider whether coordinated or parallel disclosures to OFAC and OFSI are appropriate. The Joint Comparative Guidance published in June 2026 notes that OFAC and OFSI are committed to working in close coordination. This can also be seen through recent regulatory actions. For instance, in July 2026, OFAC’s sanctions targeting ransomware attackers were coordinated with sanctions measures announced by the UK.²⁰

Disclosure is only the start of the process. Both OFAC and OFSI place considerable weight on an organization’s remediation efforts and cooperation during an investigation. Demonstrating a willingness to cooperate and providing a detailed VSD can ultimately enhance the prospects of mitigation and reduce the risk of harsher enforcement action.

¹  31 C.F.R. pt. 501 app. A, I.I (2026).
²  Id. subd. I.A.
³  Id. subd. I.I.
⁴  Id. 
⁵  See US Dep’t of the Treasury, Off. of Foreign Assets Control, Recent Actions, Launch of Voluntary Self-Disclosure Portal (Feb. 6, 2026), https://ofac.treasury.gov/recent-actions/20260206_33.
⁶  US Dep’t of the Treasury, Off. Of Foreign Assets Control & HM Treasury, Off. Of Fin. Sanctions Implementation, US and UK Economic Sanctions Authorities: A Comparative Overview, p. 10 (June 23, 2026), https://assets.publishing.service.gov.uk/media/6a3a4c4f00ff27f06e3efc8b/OFAC-OFSI_Comparison_Guide.pdf. 
⁷  Both OFAC and OFSI permit third parties to make anonymous whistleblower reports of suspected breaches outside of the voluntary self-disclosure process. The US Department of Justice also maintains a whistleblower program for criminal violations. See US Dep’t of Justice, Corporate Enforcement and Voluntary Self-Disclosure Policy (Jul. 21, 2026), https://www.justice.gov/dag/media/1430731/dl?inline; US Dep’t of Justice, Corporate Whistleblower Awards Pilot Program (Jul. 30, 2026), https://www.justice.gov/criminal/media/1454776/dl?inline; US Fin. Crimes Enf’t Network, Whistleblower Program (2026), https://www.fincen.gov/whistleblower-program HM Treasury, Off. Of Fin. Sanctions Implementation, Confidential reporting to OFSI (June 27, 2025), https://www.gov.uk/guidance/confidential-reporting-to-ofsi.
⁸  31 C.F.R. pt. 501 app. A, I.I (2026). 
⁹  Id.; See also US Dep’t of the Treasury, Off. of Foreign Assets Control, Department of Commerce, Department of the Treasury, and Department of Justice Tri-Seal Compliance Note: Voluntary Self-Disclosure of Potential Violations (Jul. 26, 2024), https://ofac.treasury.gov/media/932036/download?inline.
¹⁰  HM Treasury, Off. of Fin. Sanctions Implementation, Financial Sanctions Enforcement and Monetary Penalties Guidance, § 6.5 (Feb. 9, 2026), https://www.gov.uk/government/publications/financial-sanctions-enforcement-and-monetary-penalties-guidance/financial-sanctions-enforcement-and-monetary-penalties-guidance.
¹¹  Id.
¹²  US Dep’t of the Treasury, Off. of Foreign Assets Control, FAQ 13, https://ofac.treasury.gov/faqs/13.
¹³  31 C.F.R. pt. 501 app. A, I.I (2026).
¹⁴  Id. subd. III.
¹⁵  Id. subd. II. 
¹⁶  Id. subd. V.B.1.
¹⁷  HM Treasury, Off. of Fin. Sanctions Implementation, Guidance: Reporting information to OFSI – what to do (July 17, 2025), https://www.gov.uk/guidance/suspected-breach-of-financial-sanctions-what-to-do.
¹⁸  OFSI appears to be moving in a similar direction as highlighted by the recent monetary penalty of £4,732,830.58 imposed on Citibank. HM Treasury, Off. of Fin. Sanctions Implementation, Imposition of Monetary Penalty – Citibank, N.A., London Branch (Sept. 2, 2026), https://www.gov.uk/government/publications/imposition-of-monetary-penalty-citibank-na-london-branch. 
¹⁹  It is worth noting that VSDs are also recognized in the EU, however these are usually dealt with by Member States.
²⁰  US Dep’t of State, Press Statement, Sanctioning Ransomware Enablers in Coordinated International Action (Jul. 13, 2026), https://www.state.gov/releases/office-of-the-spokesman/2026/07/sanctioning-ransomware-enablers-in-coordinated-international-action/.