The case pages on this site report penalties as numbers. This page explains where the numbers come from, using the two published methods: OFAC’s Economic Sanctions Enforcement Guidelines, which sit in the US regulations as Appendix A to 31 CFR Part 501, and OFSI’s monetary penalties guidance in the UK. Both are public, and both are worth reading in full by anyone trying to understand why one firm receives a warning letter and another a nine-figure settlement.
The possible responses
OFAC’s Guidelines list what an investigation may lead to, among them: no action, a request for more information, a cautionary letter, a Finding of Violation, or a civil monetary penalty. A cautionary letter is used where OFAC “believes that the underlying conduct could lead to a violation in other circumstances”. A Finding of Violation documents that a violation occurred without imposing a penalty. A civil penalty is the last step.
OFSI’s guidance uses a four-level seriousness model. Level 1 cases are likely to be dealt with by a private warning letter. Level 2 cases are likely to be published as a “Disclosure” without a monetary penalty. Level 3 cases are likely to result in a civil monetary penalty, and Level 4 cases may be referred for criminal investigation in the first instance.
What counts as a “violation”: intent is a factor, not a precondition
The US Guidelines list wilfulness and recklessness as the first of their general factors, which raise or lower the response, rather than as a precondition. What they say is that “to the extent the conduct at issue is the result of willful conduct or a deliberate intent to violate”, the enforcement response “will be stronger”. Awareness of the conduct is the second factor, and the Guidelines say OFAC will give substantial weight to both, “with particular emphasis on General Factors A and B”, when deciding whether a case is egregious.
The UK moved the same way in law. On 15 March 2022 the Economic Crime (Transparency and Enforcement) Act 2022 removed the requirement for OFSI to show that a person had knowledge or reasonable cause to suspect they were in breach before imposing a monetary penalty. OFSI’s guidance adds that this applies to civil liability and “is not relevant to any assessment of whether a criminal offence has been committed”.
The US calculation
OFAC sorts a case on two questions and starts from a base amount.
- Is it egregious? Decided from the general factors. The Guidelines describe an egregious case as one that “represents a particularly serious violation of the law calling for a strong enforcement response”.
- Was it voluntarily self-disclosed? A voluntary self-disclosure is a “self-initiated notification to OFAC” made before or at the same time as OFAC or another authority discovers the violation or a substantially similar one.
The base amount for each of the four combinations is set by the Guidelines:
| Voluntarily self-disclosed | Not self-disclosed | |
|---|---|---|
| Non-egregious | one-half of the transaction value, subject to a cap | the “applicable schedule amount”, a figure that steps up with the size of the transaction |
| Egregious | one-half of the applicable statutory maximum | the applicable statutory maximum |
For most sanctions programmes the statutory maximum under IEEPA is the greater of a fixed dollar figure, adjusted for inflation each year, or twice the value of the underlying transaction. That is why a single payment can carry a penalty larger than itself.
The base amount is then adjusted. Substantial cooperation without a voluntary self-disclosure “generally will be reduced between 25 and 40 percent”. A first violation, meaning no penalty notice or Finding of Violation in the previous five years, can reduce it by up to 25 per cent. The general factors include the existence and adequacy of the firm’s compliance programme, its remedial response, harm to the objectives of the sanctions programme, and the individual characteristics of the firm. Each may be mitigating or aggravating.
The UK calculation
OFSI’s statutory maximum is the greater of £1,000,000 and 50 per cent of the estimated value of the funds or resources involved. The baseline for a Level 3 case is “up to 75% of the statutory maximum amount”, and for a Level 4 case it is likely to be between 75 and 100 per cent. The current guidance, revised in February 2026, then describes three reductions:
- a discount of up to 30 per cent for voluntary, prompt and complete self-disclosure together with full cooperation;
- a 20 per cent discount under its Settlement Scheme; and
- a discount of up to 20 per cent for an early factual account submitted through its early account scheme, which is open to entities rather than individuals.
The guidance also sets out fixed monetary penalties of £5,000 and £10,000 for information, reporting and licensing failures.
Examples from the case pages
-
A disclosure discount in practice. Citibank London received a single penalty covering eight matters with a 20 per cent voluntary-disclosure and cooperation discount applied. Deutsche Bank London also disclosed voluntarily, and one payment that pre-dated the 2022 change in the law was not treated as a breach at all.
-
The other column. In BNP Paribas, the conduct the settlement describes is a systematic practice of removing sanctioned parties from payment messages. That is the kind of fact the willfulness and awareness factors are written to capture, and the penalty is of a different order of size from the screening failures above.
-
A settlement above the base. In its June 2026 release on FTI Consulting, OFAC set the settlement at twice the base penalty, citing the effect on future compliance by similar firms. That release is read closely in a note.
What this page does not do
It describes the published methods. It does not predict the outcome of any particular case: both authorities state that the figures are guides and that they retain discretion, and the amounts change with annual inflation adjustments and with revised guidance. Check the current text on the authorities’ own pages, linked from the sources below, before relying on any number here.