OFAC's enforcement authority has a 5-year statute of limitations under the International Emergency Economic Powers Act (IEEPA). This means OFAC generally cannot impose penalties for violations that occurred more than 5 years before they initiate an enforcement action. However, the clock starts from when the violation occurred, not when it was discovered. If violations are ongoing or part of a pattern, newer violations can reset the clock. Important nuances: (1) The limitations period can be tolled (paused) under certain circumstances. (2) If OFAC has already initiated an investigation or issued a pre-penalty notice within the 5-year window, they can continue that enforcement action. (3) Criminal prosecutions under IEEPA have different statute of limitations (generally longer). (4) Some sanctions authorities have different limitation periods. Finding old violations raises a difficult question about voluntary disclosure - even though they might be time-barred for penalties, disclosure might be appropriate from a compliance standpoint. I analyzed this issue using materials from https://ofacblockedfundslawyers.com/ when we found historical compliance gaps. Consider the nature and severity of violations, whether they indicate systemic compliance failures that might still exist, and what it says about your current compliance culture. Document your review and the decisions you make about how to handle any findings.