A practical guide | Reams Law | November 2026

It usually starts with something small. A sales manager notices that a “new distributor” in a third country is reselling to a customer in Russia. A bank rejects a wire and cites sanctions. An internal audit finds that a product shipped to China needed a license nobody applied for. Or a federal agent calls asking about a shipment from two years ago.

When a company discovers a possible sanctions or export-control violation, the decisions it makes in the first few weeks often matter more than the violation itself. This guide explains how voluntary self-disclosure works with OFAC and BIS, why the stakes have risen, and what to do first.

Why the stakes are higher than they used to be

• A ten-year lookback. In April 2024, Congress extended the statute of limitations for civil and criminal violations of the International Emergency Economic Powers Act (IEEPA) and the Trading with the Enemy Act from five years to ten years. OFAC followed in 2025 by extending its recordkeeping requirement to ten years. Conduct you thought was long behind you may still be actionable.
• Strict liability for sanctions. OFAC can impose civil penalties even if a company did not know it was dealing with a sanctioned party. Civil penalties under IEEPA can exceed $375,000 per violation or twice the value of the transaction, whichever is greater.
• Enforcement focus on middlemen. OFAC, BIS, and the Department of Justice have made diversion through third countries a priority, and they expect companies to notice red flags.

What voluntary self-disclosure is — and what it gets you

A voluntary self-disclosure (VSD) is a report a company makes to the government about its own possible violation, before the government learns of it from another source.

• OFAC. Under OFAC’s Enforcement Guidelines, a qualifying VSD generally cuts the base civil penalty in half, and many self-disclosed matters end with a cautionary letter or no penalty at all. A disclosure does not qualify if OFAC already learned of the conduct from a bank’s blocking or reject report, another agency, or a third party.
• BIS. BIS treats a VSD as a significant mitigating factor under 15 C.F.R. § 764.5. BIS has also said that a deliberate decision not to disclose a significant possible violation is an aggravating factor. Minor or technical violations can often be submitted in a streamlined, abbreviated format.
• DOJ. For potentially criminal export-control and sanctions violations, the Justice Department’s National Security Division has its own disclosure policy, which can lead to a declination of prosecution for companies that self-report, cooperate, and remediate.

Disclosure is not always the right answer. Some issues turn out not to be violations at all. Others are better handled through a license application or a correction. The decision should be made deliberately, with counsel, and after the facts are known.

What to do first

1. Stop the activity. Hold pending shipments, payments, or services to the counterparty while you investigate.
2. Preserve documents. Issue a hold covering emails, messaging apps, shipping records, invoices, screening logs, and wire records. Do not delete anything.
3. Bring in counsel early. An investigation run by counsel helps protect attorney-client privilege and work product.
4. Find the facts. What was exported, its classification, the value, the end user, the end use, ownership of the parties, and who knew what, when.
5. Consider an initial notification. OFAC and BIS both allow an initial VSD followed by a full narrative report, which can preserve credit while the investigation is completed. BIS generally expects the full report within 180 days of the initial notification.
6. Fix the root cause. Screening gaps, missing ownership checks, and untrained staff are the usual culprits. Remediation weighs heavily in how the government resolves a case.

If the government contacts you first

An OFAC administrative subpoena, a BIS Office of Export Enforcement visit, a grand jury subpoena, or a detained shipment at Customs each calls for a prompt, careful response. Do not ignore it, and do not let employees give informal interviews before you understand the scope of the inquiry. Responses have deadlines, and incomplete or inaccurate answers create problems of their own.

Frequently asked questions

Do I have to report a possible violation?

In most cases there is no general legal duty to self-report, though some situations (such as blocked property) carry mandatory reporting obligations. But BIS treats a deliberate failure to disclose a significant violation as an aggravating factor, so the choice has consequences either way.

We are a small company. Will OFAC really care?

Yes. OFAC and BIS have penalized small and mid-sized businesses, and enforcement actions often cite a lack of basic screening and ownership checks. The good news is that a reasonable, risk-based compliance program for a smaller company is usually achievable and affordable.

Our customer is in China. Does that create special risk?

China is a primary focus of U.S. export-control enforcement, and ownership of Chinese counterparties can be hard to trace. Reams Law has Chinese speakers available for consultations, which can help with reviewing Chinese-language records and corporate information.

Talk to Reams Law

Reams Law advises companies in Oklahoma, Texas, Missouri, and California on sanctions and export-control investigations, voluntary self-disclosures, government inquiries, and compliance programs. If you have found a possible problem — or the government has found you — call (405) 285-6878 or contact us online. See also our page on Sanctions and Export Controls.

This article is general information, not legal advice, and reading it does not make anyone a client of this firm. Sanctions and export-control rules and enforcement policies change frequently, and the right approach depends on the specific facts. Consult counsel before making any disclosure to the government.