OFAC enforcement penalties for sanctions violations can reach $377,700 per violation or twice the transaction value, whichever is greater, but that ceiling only applies in the worst cases. The agency’s Economic Sanctions Enforcement Guidelines at 31 C.F.R. Part 501, Appendix A give OFAC four possible responses to an apparent violation, and the dollar amount in a civil penalty depends almost entirely on two questions: was the conduct egregious, and did you voluntarily disclose it. The 2026 maximum stays at the 2025 figure because the Office of Management and Budget canceled this year’s inflation adjustment.1The White House. M-26-11 Cancellation of Penalty Inflation Adjustments for 2026
The Four Ways OFAC Can Respond
Not every apparent violation ends in a fine. OFAC uses a graduated scale, and where your case lands depends on the severity of the conduct, the strength of the evidence, and the General Factors described below.2Legal Information Institute. 31 CFR Appendix A to Part 501 – Economic Sanctions Enforcement Guidelines
- No action. OFAC finds insufficient evidence of a violation or decides the conduct does not warrant an administrative response. If you knew you were under review, you will usually get a letter confirming the case is closed.
- Cautionary letter. OFAC cannot conclude a violation occurred but believes the underlying conduct could lead to one. The letter flags compliance concerns without formally finding that any law was broken.
- Finding of violation. OFAC determines a violation occurred and formally documents it, but concludes a monetary penalty is not the right response. You get 30 days to submit a written response before it becomes final. A final finding is reviewable in federal district court.3eCFR. 31 CFR Part 590 Subpart G – Penalties and Findings of Violation
- Civil monetary penalty. Reserved for conduct serious enough to justify a financial sanction, calculated through the base penalty matrix below.
The gap between a cautionary letter and a finding of violation matters more than the labels suggest. A cautionary letter is not a determination that you broke the law. A finding of violation is exactly that. Both go into your record with OFAC and shape how the agency treats any future apparent violation.
What Makes a Case Egregious
The egregious designation is the single most consequential call OFAC makes, because it controls which penalty formula applies. The agency weighs eleven General Factors overall, but four of them do most of the work, and the first two dominate.2Legal Information Institute. 31 CFR Appendix A to Part 501 – Economic Sanctions Enforcement Guidelines
Willfulness or Recklessness
OFAC looks hardest at your state of mind. A deliberate decision to violate sanctions law almost guarantees an egregious finding, and recklessness can get you there too. Stripping identifying information from wire transfers, using shell companies to obscure the involvement of sanctioned parties, or ignoring red flags a reasonable person would catch all point toward the conduct OFAC treats most harshly. The question is not whether you intended to break a specific regulation but whether you acted with knowledge that the conduct was unlawful or showed conscious disregard for whether it was.4eCFR. Appendix A to Part 501 – Economic Sanctions Enforcement Guidelines
Awareness Within the Organization
This factor asks who knew what. OFAC focuses on supervisory and managerial staff in the business unit involved, along with other senior officers. If senior management approved the transactions, explicitly or implicitly, the case tilts heavily toward egregious. If the conduct happened without management’s knowledge, OFAC will ask whether that ignorance was a genuine oversight gap or a deliberate decision not to look. An organization structured to avoid learning about sanctions risk gets no credit for not knowing.
Harm to Sanctions Program Objectives
OFAC evaluates the actual damage to U.S. foreign policy and national security goals. A large-dollar transfer to a designated terrorist organization or a shipment of controlled technology to a proliferation network is the kind of harm that drives egregious findings. The agency considers the nature of the goods or services, the specific objectives of the executive order or statute being enforced, and whether the sanctioned party received meaningful economic benefit. Technical violations that deliver no real resources to a prohibited party weigh much less.
Individual Characteristics of the Subject
A large multinational bank with a dedicated compliance department is held to a different standard than a small domestic business that stumbled into a sanctions issue for the first time. OFAC considers commercial sophistication, the volume and complexity of international transactions, and prior enforcement history. Previous violations on your record make an egregious designation harder to avoid.
Voluntary Self-Disclosure
Self-disclosure is the most powerful penalty-reduction tool in the guidelines, and it cuts the base penalty in half. But the definition is specific. Voluntary self-disclosure means self-initiated notification to OFAC of an apparent violation by the party that committed or participated in it. The initial notification must be followed within a reasonable time by a report detailed enough to give OFAC a complete understanding of the circumstances, and OFAC generally expects that detailed report within 180 days of the initial filing.4eCFR. Appendix A to Part 501 – Economic Sanctions Enforcement Guidelines
A disclosure does not qualify as voluntary if:
- A third party was required to report the violation and did so because a reasonable person would have expected the subject not to self-report.
- You had reason to believe OFAC or another law enforcement agency was already investigating.
- You were legally required to report the violation by statute or regulation.
- The disclosure was not made within a reasonable time after you became aware of the problem, and you cannot justify the delay.
- The disclosure was incomplete or contained false or misleading information.
Responding to an administrative subpoena, answering an OFAC inquiry, or filing a license application does not count. OFAC does not offer amnesty; self-reporting lowers your penalty but does not eliminate enforcement consequences.
How the Base Penalty Is Calculated
Once OFAC decides whether the case is egregious and whether it was voluntarily disclosed, a four-cell matrix produces the starting number. The figures below reflect the current IEEPA statutory maximum of $377,700 per violation, or twice the transaction amount, whichever is greater.5Federal Register. Inflation Adjustment of Civil Monetary Penalties
Non-Egregious, Voluntarily Self-Disclosed
Base penalty: one-half of the transaction value, capped at $188,850 per violation. This is the lowest category. For a $50,000 transaction, the base is $25,000. For a $500,000 transaction, it caps at $188,850 rather than the $250,000 that half the value would produce.
Non-Egregious, Not Voluntarily Disclosed
Base penalty: the applicable schedule amount, which is generally the transaction value, capped at $377,700 per violation. That same $50,000 transaction now carries a $50,000 base instead of $25,000, and the cap doubles.
Egregious, Voluntarily Self-Disclosed
The math shifts here because the base is no longer tied to the transaction value. It becomes one-half of the applicable statutory maximum. Under IEEPA the statutory maximum is the greater of $377,700 or twice the transaction amount, so for a $1 million transaction the statutory maximum is $2 million and the base penalty is $1 million.
Egregious, Not Voluntarily Disclosed
Base penalty: the full statutory maximum. Using the same $1 million transaction, that is a $2 million starting point before any adjustments. This is the category OFAC reserves for the worst conduct.
What Moves the Number Up or Down
After the base is calculated, OFAC adjusts it using the remaining General Factors. Each factor can cut either way depending on the facts.
Compliance Program
Having a program at the time of the violation is one of the strongest mitigating factors, but OFAC does not credit paper programs. It must be functional, risk-based, and tailored to the organization’s actual exposure. If a violation slipped through a well-designed program with active monitoring, OFAC may significantly reduce the penalty. A program that was window dressing can work against you by suggesting the organization knew the risks and ignored them.6U.S. Department of the Treasury. A Framework for OFAC Compliance Commitments
OFAC’s published framework identifies five components it expects to see: management commitment, risk assessment, internal controls, testing and auditing, and training. The framework is not a safe harbor, but the absence of these elements is something OFAC consistently highlights in enforcement actions.
Remedial Response
What you do after discovering the violation matters almost as much as what caused it. OFAC looks at whether you immediately stopped the conduct, conducted a thorough internal investigation to identify root cause and scope, and put permanent changes in place. Enhancing screening technology, adding compliance staff, providing targeted training to the individuals involved, and reviewing for related violations all carry weight. Fixing the immediate problem without addressing the underlying weakness does not.
Cooperation With OFAC
Cooperation is separate from self-disclosure. You can cooperate fully even if OFAC discovered the violation on its own. The guidelines reward subjects that provide all relevant information, research and disclose related violations from the same conduct, and respond promptly to requests. Entering into a statute-of-limitations tolling agreement when OFAC asks also counts. Substantial cooperation without a voluntary self-disclosure generally produces a 25 to 40 percent reduction of the base penalty.
Responding to an administrative subpoena does not, by itself, earn cooperation credit. OFAC draws a line between doing what you are legally compelled to do and going beyond it. Organized documentation, proactively identifying relevant transactions the agency has not asked about, and making key personnel available for interviews fall on the cooperative side.
Other Adjustments
OFAC also weighs the timing of the violation relative to when sanctions were imposed (a violation shortly after a new designation is treated differently from one occurring years later), whether other agencies have already taken action for the same conduct, and whether the proposed penalty will effectively deter future violations. For a first-time violation, the base is generally reduced by up to 25 percent.
The Notice Process and Your Response Options
When OFAC decides a civil penalty is appropriate, it issues a pre-penalty notice identifying the apparent violation, the proposed penalty amount, and a deadline for a written response. The guidelines do not set a fixed response period; each notice specifies its own deadline. If you miss it, OFAC may proceed directly to a penalty notice.
A penalty notice is final agency action. There is no administrative hearing or internal appeal within OFAC. Your only recourse at that point is judicial review in federal district court. For findings of violation, the response window is 30 days before the finding becomes final, and missing it waives your right to respond.3eCFR. 31 CFR Part 590 Subpart G – Penalties and Findings of Violation
Congress extended the statute of limitations for civil and criminal sanctions violations from five years to ten years in April 2024 through the 21st Century Peace through Strength Act. OFAC can bring an enforcement action for any IEEPA or TWEA violation that occurred within ten years of the latest date of the violation, provided that date was after April 24, 2019.7Federal Register. Reporting, Procedures and Penalties
Criminal Exposure for Willful Violations
The enforcement guidelines address civil penalties, but willful sanctions violations also carry criminal exposure under IEEPA. A person who willfully violates, attempts to violate, or conspires to violate sanctions prohibitions faces a criminal fine of up to $1,000,000 and, for individuals, imprisonment of up to 20 years. Criminal referrals are handled by the Department of Justice, not OFAC, but the same conduct that supports an egregious civil determination can also support a prosecution.8Office of the Law Revision Counsel. 50 USC 1705 – Penalties
The line between civil and criminal liability is willfulness. A negligent or reckless violation may bring a steep civil penalty, but criminal prosecution requires proof the violation was committed knowingly and intentionally. If criminal exposure is a possibility, statements and documents produced during the civil investigation can become evidence in a parallel criminal case, and that changes how the civil process should be handled from day one.