When a US company discovers that it may have committed a violation of the International Traffic in Arms Regulations, the Export Administration Regulations, or US economic sanctions laws, one of the most important decisions it faces is whether and how to disclose that violation to the relevant enforcement agency. Voluntary self-disclosure — the proactive reporting of a potential violation before the agency discovers it through independent investigation — is among the most powerful tools available for managing export control and trade compliance enforcement risk. The DDTC, BIS, and OFAC all maintain formal voluntary disclosure programs that offer significant penalty mitigation in exchange for timely, complete, and candid self-disclosure. Understanding how each agency’s program works, what they require, and how they differ from one another is essential for any company navigating a potential violation.
The decision to self-disclose is among the most consequential and difficult decisions in export control compliance. It requires balancing the significant benefits of voluntary disclosure against the risks and costs: the disclosure triggers the agency’s active scrutiny of the company’s compliance posture, requires a comprehensive internal investigation that takes resources and time, potentially surfaces additional violations that must also be disclosed, and commits the company to a period of intensive regulatory engagement. At the same time, a decision not to disclose — when the violation is likely to be discovered independently — typically results in dramatically worse enforcement outcomes. Companies that self-disclose consistently receive materially lower penalties and more favorable consent agreement terms than companies whose violations are discovered through government investigation.
The DDTC Voluntary Self-Disclosure Process
The DDTC’s voluntary self-disclosure program is governed by 22 CFR 127.12, which provides that a company that discovers a potential ITAR violation may voluntarily report the violation to the DDTC and that such disclosure will be considered as a mitigating factor in any enforcement proceeding. The DDTC strongly encourages self-disclosure and has repeatedly stated publicly that it gives substantial weight to voluntary disclosure in determining penalties and enforcement outcomes. The DDTC’s written guidance and practice indicate that companies that make full, timely, and accurate VSDs typically receive significantly reduced civil penalties and are less likely to face criminal referral than companies whose violations are discovered independently.
The DDTC VSD process has two steps. The first step is an initial notification, typically a brief letter to the DDTC’s Office of Defense Trade Compliance, informing the agency that the company has discovered a potential violation and intends to submit a full disclosure. This initial notification is important because it establishes the ‘self-disclosure’ timeline: even if the full investigation is not yet complete, the initial notification demonstrates that the company came forward voluntarily before the government was aware of the violation. The initial notification should describe the general nature of the violation in summary terms and indicate the company’s commitment to conducting a thorough internal investigation and providing a complete report.
The second step is the full disclosure report, submitted after the company has completed its internal investigation. The full disclosure report is a detailed narrative and factual analysis of the violation that must include: the identity of the registrant and the responsible empowered official; a chronological description of the facts giving rise to the disclosure; identification of the defense articles, technical data, or defense services involved and their applicable USML classification; the countries and foreign persons involved; the nature and scope of the violation (whether it was a single transaction or a pattern of conduct); the number of transactions involved; the monetary value of the transactions; a root cause analysis explaining how the violation occurred; a description of any remedial actions taken; and, critically, a description of the company’s export compliance program and the specific improvements made or planned in response to the violation.
How DDTC VSD Compares to BIS VSD
The BIS voluntary self-disclosure program for EAR violations, governed by 15 CFR 764.5, is structurally similar to the DDTC program but has some important differences. Like the DDTC program, BIS offers substantial penalty mitigation for voluntary self-disclosures — BIS policy treats a complete and timely VSD as a mitigating factor that ‘significantly’ reduces the base penalty amount, and BIS practice generally results in penalty amounts at the low end of the applicable range for companies with strong compliance programs that disclose promptly. BIS has published guidance indicating that the average penalty in VSD cases is substantially lower than in cases where the violation was discovered by the government.
The BIS VSD process also has an initial notification step and a full disclosure step, with timelines similar to the DDTC process. One significant structural difference is that BIS has published a more detailed and prescriptive guidance on what a VSD must contain, and BIS staff engage more actively with companies during the investigation phase, which can be both an advantage (more clarity on what the agency needs) and a challenge (less control over the pace of the investigation). Another difference is that BIS and DDTC have different jurisdictional domains: if the same transaction involves both EAR-controlled and ITAR-controlled items, separate disclosures to both BIS and DDTC may be required, each following the applicable agency’s process. The agencies coordinate in some multi-agency cases, but the companies must manage each disclosure process independently.
OFAC Voluntary Self-Disclosure
The Office of Foreign Assets Control (OFAC) administers US economic sanctions programs and has its own voluntary self-disclosure policy, distinct from the DDTC and BIS programs. OFAC’s voluntary disclosure program is described in its Enforcement Guidelines (31 CFR Part 501, Appendix A) and in specific guidance published by OFAC. Under OFAC’s guidelines, voluntary self-disclosure of an apparent sanctions violation — made before OFAC learns of the conduct from a third party and within a reasonable time after the company discovers the potential violation — is treated as a mitigating factor that can reduce the base penalty by 50 percent or more. OFAC has historically resolved the majority of its significant enforcement actions through settlements, and the settlement penalty amount in VSD cases is consistently lower than in cases where OFAC discovered the violation independently.
OFAC’s VSD process requires a thorough factual description of the apparent violation, including: the specific OFAC program(s) potentially violated; the dates, amounts, and nature of the transactions; the parties involved (including any sanctioned persons or entities); the manner in which the transactions were processed (payment systems, financial institutions, correspondence bank chains); and the remediation and compliance program enhancements implemented in response. OFAC gives particular attention to the ‘root cause’ of the violation — whether it resulted from systemic compliance failures (more serious) or an isolated error in an otherwise strong compliance program (less serious). Companies that can demonstrate that the violation was an isolated aberration in a genuinely robust compliance program are significantly better positioned than those whose violations reflect systematic gaps.
Preparing and Submitting an Effective VSD
An effective voluntary self-disclosure requires a rigorous, well-documented internal investigation conducted under attorney-client privilege and attorney work product protection. The investigation should be led by experienced export control or sanctions counsel — not just the company’s general counsel or compliance staff, who may lack the specialized expertise and the independence needed for a credible investigation. The investigation must be thorough: it should review all potentially relevant transactions within the applicable lookback period, interview all relevant witnesses, analyze the applicable regulatory requirements and how they were or were not satisfied, and produce a clear and accurate factual record.
The VSD report itself should be drafted with care. It must be accurate and complete — any material omission or inaccuracy will undermine the company’s credibility with the enforcement agency and can transform a mitigating disclosure into an aggravating one. It should be organized logically, with a clear factual narrative and a separate analysis of the applicable legal framework. The remediation section should be specific and credible: agencies are skeptical of boilerplate descriptions of ‘enhanced compliance training’ and look for concrete, tailored remediation that addresses the specific root causes of the identified violations. A company that can demonstrate that it has already implemented meaningful remediation before submitting the VSD is in a stronger position than one that promises future improvements.
Timing matters significantly. VSDs that are submitted promptly after discovery — typically within 60 to 90 days after the initial notification, depending on the complexity of the investigation — are treated more favorably than those that drag on for months or years. Agencies are sensitive to the possibility that delayed disclosures may reflect incomplete investigation or strategic withholding of information, and they scrutinize the completeness and candor of late-filed VSDs with additional skepticism. Companies that are committed to self-disclosure should make completing the investigation and filing the VSD a genuine organizational priority, not an afterthought to be addressed after more pressing business matters.