OFAC and Prudential Regulators: Coordinating Bank Compliance Counsel

On a Tuesday morning, a compliance officer at a mid-sized bank receives two letters on the same transaction. One comes from the Office of Foreign Assets Control, asking why a wire involving a sanctioned counterparty was processed. The other comes from the bank’s prudential regulator, the Office of the Comptroller of the Currency, demanding a written explanation of the bank’s sanctions screening controls. The transaction is the same. The questions are different. The deadlines overlap. And the bank’s general counsel now has to decide who answers first, in what order, and with what language — because a careless response to one authority can become an exhibit in the other’s file.

This is the daily reality of bank regulatory affairs. OFAC and the prudential regulators — the OCC, the Federal Reserve, the FDIC, and state banking departments — do not operate in separate rooms. They share information, coordinate examinations, and increasingly expect banks to manage sanctions risk as a core safety-and-soundness issue. For counsel, the challenge is not knowing the rules. It is sequencing them. Firms that handle cross-border legal exposure, including Interpol Red Notice services, understand this coordination problem well, because a single client matter can trigger parallel demands from several authorities at once.

Mapping the Authorities: Who Actually Has Jurisdiction

Before drafting a single response, counsel should build a written authority map. The map answers three questions for each regulator: what legal basis gives it jurisdiction over the conduct, what remedy it can impose, and what information it can compel from the bank.

OFAC operates under a broad statutory framework of sanctions programs tied to countries, sectors, and named persons. Its primary tools are civil penalties, blocking orders, and demands for records. It does not examine the bank’s safety and soundness. It cares about whether a prohibited transaction occurred and whether the bank’s controls should have caught it.

The OCC, by contrast, supervises national banks and federal savings associations. Its interest is prudential: capital, liquidity, internal controls, and compliance risk management. When the OCC asks about sanctions screening, it is asking whether the bank’s control environment is adequate — not whether a specific penalty is warranted. The Federal Reserve plays the same role for bank holding companies and state member banks. The FDIC covers state non-member banks. State banking departments supervise state-chartered institutions and often have their own consumer protection and reporting requirements.

The overlap is real. A single sanctions failure can generate an OFAC enforcement action, an OCC matter requiring corrective action, and a state examination finding — all touching the same facts. Counsel who treat these as separate matters will duplicate work and risk inconsistent statements. Counsel who map them first can identify where the authorities’ interests converge and where they diverge.

The Overlap Problem: Same Facts, Different Standards

The most dangerous assumption in multi-authority matters is that the same facts will be evaluated the same way. They will not. OFAC applies a strict liability standard in many sanctions contexts: intent is largely irrelevant. The prudential regulators apply a reasonableness standard focused on whether management identified, measured, monitored, and controlled the risk. A state examiner may apply yet another lens, sometimes shaped by local consumer protection priorities.

This means a factual admission that helps resolve an OFAC matter can hurt in a prudential examination. For example, telling OFAC that a screening alert was manually overridden by a junior analyst may support a claim of isolated human error. Telling the OCC the same fact may support a finding that the bank’s escalation procedures are inadequate. The facts are identical. The framing is not.

Counsel should therefore prepare a single factual chronology — neutral, documented, and consistent — and then develop authority-specific narratives around it. The chronology never changes. The emphasis does. This discipline prevents the bank from being caught in a contradiction when regulators compare notes, which they routinely do.

Coordination also matters across borders. A bank with operations in the UAE, for instance, may face a local regulatory inquiry alongside a U.S. sanctions question. Legal teams that already manage international exposure, including Interpol Red Notice services for clients facing cross-border enforcement, know that parallel proceedings reward early alignment and punish improvisation.

Sequencing Responses: Who Gets the First Draft

There is no universal rule for which regulator receives the first substantive response. The right sequence depends on deadlines, the severity of the exposure, and the bank’s regulatory relationship history. Still, a few practical principles hold.

Honor the shortest deadline first, but do not rush substance. If OFAC demands records within thirty days and the OCC expects a corrective action plan within sixty, the OFAC response drives the calendar. But the OCC response should not be drafted in isolation. Both documents should rest on the same factual foundation.

Consider the regulator with the greatest remedial power. A prudential regulator can restrict growth, require management changes, or impose a consent order that affects the bank’s entire operating model. OFAC penalties can be severe, but they are typically monetary and program-specific. Counsel should weigh which relationship is most consequential to the institution and sequence accordingly — without ignoring the other.

Communicate the existence of parallel inquiries. Regulators generally expect candor about other pending matters. Telling the OCC that OFAC has also requested records is not an admission of guilt; it is evidence of a functioning compliance function. Concealing the parallel inquiry, by contrast, invites distrust when it surfaces later.

Use a single point of contact internally. One lawyer or compliance lead should own the master chronology and the document log. Multiple teams producing separate responses is the fastest route to inconsistency.

Documentation and Privilege Across Multiple Regulators

Privilege is not uniform across authorities. Communications prepared for one regulator may be discoverable by another if they are shared too broadly or if the privilege claim is not properly documented. Counsel should mark privileged materials clearly, limit distribution, and avoid copying business personnel who do not need the analysis.

Document retention is equally important. OFAC and the prudential regulators have different retention expectations, and state regulators may impose their own. A single retention schedule that satisfies the longest requirement is usually the safest approach. When in doubt, preserve. Spoliation concerns in a multi-authority matter can escalate quickly.

Counsel should also maintain a clean separation between factual records and legal analysis. Factual records — wire logs, screening alerts, training records — should be produced when requested. Legal analysis — risk assessments, remediation opinions, privileged memos — should be controlled. Blurring the two creates waiver risk that is difficult to undo.

Remediation Plans That Satisfy Every Authority

A remediation plan written for one regulator rarely satisfies another without adjustment. OFAC wants to see that the specific conduct will not recur and that the bank has strengthened its sanctions screening. The OCC wants to see that the bank’s control environment is sound, that management is accountable, and that the board is engaged. A state examiner may want evidence of customer-facing process improvements.

The most efficient approach is to build a single remediation framework with modular components. The core elements — root cause analysis, control enhancements, training, testing, and board reporting — serve all authorities. The emphasis shifts depending on the audience. OFAC receives detail on screening and blocking procedures. The OCC receives detail on governance and internal audit. The state regulator receives detail on customer communication and complaint handling.

Timelines should be realistic. Promising aggressive deadlines to one regulator and missing them creates a credibility problem with all of them. It is better to commit to a defensible schedule and meet it than to overpromise and explain later.

Coordinating Counsel and Closing the Loop

The final piece is coordination among the bank’s own advisors. Outside counsel, internal compliance, internal audit, and sometimes forensic consultants all touch the same matter. Without a clear coordination protocol, work product multiplies and messages drift.

A practical protocol includes a weekly status call, a shared document index, a single master chronology, and a decision log that records who approved each response and why. The decision log is invaluable if a regulator later asks why the bank chose a particular course of action.

When the inquiries close, counsel should conduct a joint debrief. What did each authority emphasize? Where did the bank’s responses align well, and where did they create friction? What would the bank do differently next time? This debrief should be documented and used to update the bank’s regulatory response playbook.

Multi-authority matters are not won by knowing the regulations better than the regulators. They are won by managing the sequence, the consistency, and the relationships. A bank that answers OFAC, the OCC, and the state examiner from a single factual foundation — with authority-specific framing and disciplined documentation — turns a potential crisis into a demonstration of control. That is the standard counsel should aim for, and it is achievable with preparation long before the first letter arrives.