How an OFAC investigation actually begins

An OFAC investigation rarely opens with anything dramatic. It opens with an administrative subpoena from the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC), signed by an enforcement officer. The tone is measured. The language is broad: produce information and records concerning transactions of a certain type over a certain period.

The instinctive response is to answer it personally, briefly, addressing exactly what was asked, and be done with an unwelcome subject. At this stage the agency usually holds a fragment of the picture: a single shipment, a single payment, a single report from a bank. The answer to the subpoena determines whether that fragment stays a fragment.

From there, the matter runs for years, and at the moment that matters most (when the number is calculated), the agency will not be weighing oral explanations or good intentions. It will be reading three written documents. All three come from the recipient. All three carry the recipient’s signature.

Document one: the answer to an administrative subpoena

The authority is 31 C.F.R. § 501.602. The rule is short and unforgiving: every person must furnish, upon demand, complete information about any transaction subject to the sanctions regulations, whether the transaction was completed or is only proposed, and whether it was licensed. The agency may demand information before, during, or after a transaction, may require production of the underlying records, and may require the response under oath.

Two features of that rule are routinely missed until it is too late.

First, the standard is completeness, not good faith. A response that is entirely honest but reads the question narrowly does not satisfy the rule. That is not merely a tactical misstep; it is a separate violation, punishable independently of whatever conduct prompted the subpoena.

Second, a reporting violation has no transaction value. Penalties for shipping goods or processing a payment at least start from the size of the transaction. A failure to furnish information has no underlying figure at all, yet the same statutory ceiling under the International Emergency Economic Powers Act (IEEPA) applies: $377,700 per violation in 2026.

The practical consequence is difficult to overstate: by the time you draft the answer, you should know more about your own transactions than the agency does. The internal review comes before the response, not after it.

Why answering a subpoena is not a voluntary self-disclosure

This misconception is common and expensive.

The reasoning feels sound: I told them everything myself, so I disclosed voluntarily, and I get the discount. The Economic Sanctions Enforcement Guidelines (Appendix A to Part 501) close that door directly. A disclosure does not qualify as a voluntary self-disclosure (VSD) where OFAC or another government agency has already discovered the violation or a substantially similar one in the same course of conduct. An answer to an administrative subpoena can never be a voluntary self-disclosure, because by definition the agency has already found something.

What follows from that is strategic rather than clerical. Deciding to disclose more than was asked is a real decision with real consequences, and it should be made with open eyes, not in reliance on a discount that will not arrive.

Something else will arrive, though. The Guidelines separately provide for a reduction of roughly 25 to 40 percent off the base penalty for substantial cooperation where no voluntary self-disclosure was made. That is less than half, but in large numbers the difference runs into six figures. Once an OFAC investigation is open, that is the target worth aiming at: the discount that exists rather than the one that does not.

Document two: the records standing behind the answer

A subpoena response does not stand on its own. It rests on records, and the rules governing those records changed recently in a way that is still underappreciated.

On 24 April 2024, legislation extended the statute of limitations for violations of IEEPA and the Trading with the Enemy Act (TWEA) from five years to ten. OFAC then aligned its recordkeeping requirements, first by an interim final rule published on 13 September 2024 and then by a final rule in March 2025. Since 13 March 2025, § 501.601 has required full and accurate records of every transaction subject to the sanctions regulations to be kept for ten years.

Three things follow.

• Transactions already written off mentally are back in play. Deals from 2016 to 2018, long treated as time-barred, are again on the table.
• Missing records are no longer neutral. The explanation that five years passed and documents were destroyed under a retention policy used to work. It now works only for transactions older than ten years, and only where the retention policy genuinely exists in writing and was applied consistently.
• And the third point matters most. Records that disappear after a subpoena arrives are not an absence of evidence. They are evidence. The agency reads gaps: where documents survive for one period and not for the adjacent one, that asymmetry becomes a first-order aggravating factor and can reframe the character of the entire matter.

Hence, a step that should be automatic. On the day the subpoena arrives, issue a written litigation hold on all correspondence, including personal mailboxes and messaging applications used for business; all data in operating systems; all material held by vendors and service providers. Auto-deletion goes off. The hold is written and dated, because in due course you may have to prove not only that nothing was destroyed, but that you took steps to preserve it.

Document three: the response to a Pre-Penalty Notice

Where an OFAC investigation does not end in a cautionary letter or a closure, the next document is a Pre-Penalty Notice (PPN). It is a written notice of intent to impose a civil monetary penalty, setting out the alleged violations, the legal basis, the proposed amount, and two predeterminations: whether the case is egregious, and whether there was a voluntary self-disclosure.

The nature of the document is worth grasping precisely. A Pre-Penalty Notice is not a decision. It is the agency’s stated opening position. The decision comes in the next document, the Penalty Notice, which constitutes final agency action. The response to the Pre-Penalty Notice is the only formal opportunity to move the number before that point.

What belongs in that response, and what does not:

• Factual objections addressed to each alleged violation separately. Generalized disagreement achieves nothing; what works is specificity: how the allegation was established, what supports it, and whether that support withstands examination.
• A challenge to the two predeterminations. These, rather than the general factors, set the order of magnitude: moving a matter out of the egregious category changes the figure severalfold, while mitigating factors move it by percentages.
• Mitigating factors, with evidence attached. An assertion that compliance has been overhauled carries no weight without the procedures, the training materials, and proof that they were actually deployed.
• Financial circumstances, where the proposed figure is disproportionate to the scale of the business. Ability to pay is considered, but only on documentary support.

And one point about the genre of the document. A response to a Pre-Penalty Notice is a written statement addressed to the United States government. Everything in it stays in the file permanently and may be used in any subsequent proceeding, including a criminal one. A response written as an emotional explanation works against its author.

Where the civil case turns criminal

OFAC is an administrative agency imposing civil penalties. But its matter can be referred to the U.S. Department of Justice (DOJ), and parallel proceedings cannot be ruled out. Three provisions belong in view from day one.

• 50 U.S.C. § 1705(c) – willful violation of IEEPA: up to $1 million in fines and up to twenty years of imprisonment. The 2024 legislation extended the criminal limitations period to ten years as well.
• 18 U.S.C. § 1001 – false or misleading statements to a federal agency: up to five years. It reaches written submissions made to OFAC. Note the structure of the offence: liability attaches to the statement itself, regardless of how the underlying matter is ultimately resolved.
• 18 U.S.C. § 1519 – destruction, concealment or alteration of records to obstruct a federal investigation: up to twenty years. This is the provision that converts careless tidying of a mailbox into a more serious charge than the sanctions violation that started everything.

The practical consequence is straightforward. Where a matter carries any indication of willfulness, or any question over the preservation of records, a response drafted purely as a civil argument about the number is the wrong instrument. The position is to be developed together with criminal defense counsel, and the decision about what to disclose and where to rely on constitutional protections is taken before the submission goes out, not after.

The first forty-eight hours

Regardless of the substance, several steps are worth taking immediately:

• Fix the dates. The postmark on the envelope, not the day the letter was opened. Identify the governing provision and the exact expiry date.
• Issue a written litigation hold and switch off auto-deletion across every system, vendors included.
• Do not answer the same day, and do not call the agency before a written letter of representation has been submitted.
• Run an internal review and establish the full scope of the problem yourself before any response is drafted.
• Assess whether there is a criminal dimension and, if so, bring in a defense counsel in parallel.
• Where the deadline is genuinely insufficient, file a written extension request in the first days.

An OFAC investigation is rarely lost on the facts. It is lost on documents written before anyone weighed the consequences of each sentence. The three documents described here are produced years apart, but they are read together and assessed as a single record. The first of them is usually written alone, in one evening, to get an unpleasant subject off the desk. It is also the one that most often decides the outcome.