An OFAC Voluntary Self-Disclosure (VSD) is a formal, self-initiated notification submitted to the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) disclosing an apparent violation of one or more economic or trade sanctions programs administered under the International Emergency Economic Powers Act (IEEPA, 50 U.S.C. §§ 1701–1708), the Trading with the Enemy Act (TWEA, 50 U.S.C. §§ 4301 et seq.), the Cuban Liberty and Democratic Solidarity Act, and related authorities. The legal architecture for VSD treatment is set out in OFAC's Economic Sanctions Enforcement Guidelines, codified at 31 C.F.R. Part 501, Appendix A, published in final form in November 2009. Under those Guidelines, a qualifying VSD is one of five "General Factors" that OFAC weighs in determining an administrative response, and it triggers a categorical 50 percent reduction in the base civil monetary penalty applicable to "egregious" cases and a halving of the base amount in non-egregious matters.
Procedurally, a disclosure must satisfy three core elements to qualify under §501 Appendix A(I)(I): it must be made by the Subject Person (or someone acting on its behalf), it must occur prior to or simultaneously with OFAC's discovery of the apparent violation from another source, and it must include, or be followed within a reasonable time by, a report containing sufficient detail to afford OFAC a complete understanding of the conduct. The initial notification is typically a short letter or email to OFAC's Enforcement Division identifying the discloser, summarizing the suspected violation, and committing to a full follow-up report. The follow-up — frequently styled as a "narrative" or "root-cause analysis" — sets out the transactional facts, the sanctions nexus (which Specially Designated National, blocked jurisdiction, or sectoral identifier was implicated), the value of the transactions, the compliance failures that permitted them, and the remedial measures undertaken.
Several variants and disqualifiers shape practice. A disclosure does not qualify if a third party — a correspondent bank, a counterparty, a whistleblower, or a foreign regulator — has already alerted OFAC, although OFAC retains discretion to credit "substantial cooperation" even where formal VSD status is unavailable. Disclosures of conduct that constitutes "egregious" conduct (analyzed under the General Factors including willfulness, awareness, harm to sanctions program objectives, and the sophistication of the violator) still qualify for VSD credit, but the maximum statutory penalty under IEEPA — currently adjusted annually for inflation and exceeding $350,000 per violation as of 2024 — remains the ceiling. Filings are made through OFAC's online reporting portal or by direct correspondence with the Enforcement Division at the Treasury Annex in Washington.
Contemporary enforcement practice illustrates the mechanism. In the April 2023 settlement with Microsoft Corporation, the company received credit for a voluntary self-disclosure of apparent violations of the Ukraine-/Russia-Related, Cuba, Iran, and Syrian Sanctions Regulations involving its Russian subsidiary, reducing what OFAC characterized as a non-egregious base penalty. The June 2023 Swedbank Latvia settlement and the December 2023 Binance settlement — the latter coordinated with the Department of Justice and FinCEN and totaling over $4 billion in aggregate penalties — turned in part on the absence of timely voluntary disclosure. By contrast, the 2019 Apple Inc. settlement involving SDN-listed software developer SIS d.o.o. exemplified a textbook VSD: prompt notification, comprehensive root-cause analysis, and a sharply mitigated penalty.
The VSD must be distinguished from adjacent compliance instruments. It is not equivalent to a Specific License application under 31 C.F.R. §501.801, which seeks prospective authorization for an otherwise-prohibited transaction. Nor is it the same as the Department of Justice National Security Division's Voluntary Self-Disclosure Policy for Business Organizations, revised in March 2023, which governs criminal exposure under the Export Control Reform Act and IEEPA's criminal provisions; sophisticated counsel typically file parallel disclosures with both OFAC and NSD where willfulness is plausibly in issue. It is also distinct from the mandatory reporting obligations imposed on U.S. financial institutions by §501.603 (blocked-property reports) and §501.604 (rejected-transaction reports), which are regulatory filings rather than enforcement-mitigating disclosures.
Edge cases have proliferated. The treatment of subsidiary conduct under the "facilitation" prohibition raises questions about which corporate entity must file. Disclosures involving cryptocurrency transactions, addressed in OFAC's October 2021 Sanctions Compliance Guidance for the Virtual Currency Industry, have introduced novel attribution issues. The 2024 amendments extending the statute of limitations for IEEPA and TWEA violations from five to ten years, enacted in the 21st Century Peace through Strength Act (P.L. 118-50), have materially expanded the retrospective window over which a discloser must investigate. OFAC has also clarified that disclosures made after a subpoena or administrative inquiry has been served do not qualify, though cooperation credit remains available.
For the working practitioner — sanctions counsel, chief compliance officer, or general counsel at a U.S. or U.S.-connected firm — the VSD decision is among the most consequential a sanctions-touching enterprise will make. The calculus weighs the near-certain mitigation benefit against the operational burden of a comprehensive internal investigation, the reputational exposure of a published enforcement release on Treasury's website, and the cascading consequences for export-control (BIS), securities (SEC), and foreign regulatory regimes. In a post-Russia-sanctions environment in which OFAC designations and enforcement resources have expanded dramatically, the VSD remains the central self-regulatory mechanism by which firms reset their relationship with the agency.
Example
In April 2023, Microsoft Corporation submitted a voluntary self-disclosure to OFAC concerning apparent violations of the Ukraine-/Russia-Related, Cuba, Iran, and Syrian Sanctions Regulations, resulting in a substantially mitigated settlement of approximately $2.98 million.