iIn the last nine quarters alone, since January 2018, the Department of Treasury’s Office of Foreign Assets Control (OFAC), which administers most U.S. economic sanctions programs, has imposed $1.28 billion in civil penalties on foreign companies, or on U.S. companies based on the conduct of their foreign holdings/subsidiaries.[1]
The U.S.’s aggressive assertion of authority to enforce its economic sanctions programs, not only against U.S. parties but also against foreign companies, is a significant trap for the unwary, with the potential for far-reaching adverse consequences.
In this Advisory, we provide an overview of the principal hooks through which OFAC can assert jurisdiction over foreign parties, briefly recap the significant business consequences that can flow from violation of U.S. sanctions, and illustrate with some enforcement examples.
A. Bases for OFAC jurisdiction over foreign parties
1. U.S. presence, including U.S. financial system
Persons located in, and activities occurring in, the U.S. must comply with U.S. economic sanctions. OFAC interprets this hook liberally, to cover any transaction that “touches” U.S. soil, including by movement of funds through a financial institution in the United States.
Foreign companies, therefore, need to closely monitor for contracts requiring payment in US dollars (which will entail dollar clearance activity through a bank in the United States), shared services provided from a location within the United States (such as processing of invoices, hosting of data, etc.), or even offering software as a service (or for download) from United States servers.
2. U.S. persons
U.S. persons, including citizens, dual citizens, lawful permanent residents, and entities organized under U.S. law, must comply with U.S. economic sanctions in all their activities, anywhere in the world. This prohibition extends not only to direct engagement in transactions that would violate U.S. economic sanctions, but also to indirect involvement, via approving, guaranteeing, or in any way facilitating such transactions by others, including when the others are foreign persons acting outside the United States.
Foreign companies, therefore, need to be aware of board members, directors, or employees who hold U.S. citizenship or U.S. green cards, and also management, marketing, referral, or shared service and support functions that may occur in, or with support from, the United States or U.S. ex-pats.
3. U.S. goods
Exports and re-exports of goods that are subject to U.S. export laws (typically goods manufactured in the U.S., or containing more than a de minimis amount[2] of controlled U.S. content), generally also must comply with restrictions imposed by U.S. economic sanctions. Failure to comply may trigger enforcement not only by OFAC, but also by the Department of Commerce’s Office of Export Enforcement (“OEE”), which shares jurisdiction with OFAC in these case due to the incorporation of many economic sanctions restrictions into the Export Administration Regulations (“EAR”).
Foreign companies, therefore, need to be aware of suppliers in the U.S., or that are located outside the U.S. but supply U.S. origin goods, or goods that are produced with more than a de minimis amount of U.S. content. To guard against surprises, foreign companies should consider asking whether the goods they purchase outside the U.S. are subject to U.S. export controls, and pay close attention to information provided by suppliers.
4. U.S. ownership or control
Foreign businesses that are owned or controlled by U.S. persons generally are not directly required to comply with U.S. economic sanctions regulations provided that no other hooks for U.S. jurisdiction exist in a particular transaction (although such entities may need to take extra precautions to ensure no involvement by U.S. persons). However, U.S. sanctions regulations on Iran and Cuba expressly require compliance by foreign entities that are owned or controlled by U.S. persons.[3]
Foreign companies that are majority-owned by U.S. individuals, funds, or other entities, therefore, need to exercise special care to avoid direct or indirect dealings involving parties that are located or incorporated in Cuba or Iran, or are owned or controlled by such parties, or that are part of the government of Cuba or Iran, or owned or controlled by the same (e.g., government entities such as embassies, or government-owned companies wherever located). Foreign companies should also be prepared to terminate all preexisting business involving Cuba or Iran if they are acquired by a U.S. entity, and to undergo stringent due diligence inquiries in the context of any proposed M&A activity.
5. Secondary sanctions - no U.S. nexus
A limited number of so-called “secondary sanctions” authorities exist and permit (or require) OFAC to impose sanctions on foreign persons for conduct that has no U.S. nexus, but that involves U.S. sanctions targets. These secondary sanctions primarily arise in the context of transactions involving Iran, North Korea, Russia, and Syria.[4]
Foreign companies should be aware that some transactions with absolutely no connection to the United States may create a risk of the company or its senior executives being designated as an SDN or subject to other sanctions. Likewise, foreign financial institutions handling financial transfers related to such transactions may also be exposed to secondary sanctions.
B. Consequences of OFAC violations
The U.S. government wields some big sticks with which to punish non-compliance with U.S. economic sanctions regulations.
In extreme cases, foreign parties may be designated as Specially Designated Nationals and Blocked Persons (SDN), and subject to blocking of all property and property interests in the custody or control of a U.S. person, denial of entry to the United States, and other sanctions. For willful violations, the government can also pursue criminal penalties, including fines up to $1 million per violation, and possible jail time.
More importantly, because U.S. sanctions regulations generally are a strict liability regime, even inadvertent violations carry severe consequences. Unintentional violations are subject to civil penalties of a little over $300,000 per violation for most sanctions regimes.[5] But OFAC violations can have numerous painful impacts on a foreign company’s business beyond mere payment of fines, including triggering red flags during due diligence by prospective partners, investors, acquirors, and financiers, putting companies in breach of contractual obligations to their banks,[6] creating a disadvantage or disqualification in bidding for contracts, and attracting additional scrutiny from the Committee on Foreign Investment in the United States (CFIUS) when attempting to acquire or invest in U.S. businesses.
Finally, OFAC violations that involve U.S. origin goods can result in a double regulatory whammy, with co-enforcement by OEE, which has authority to bring export control actions against foreign parties that transfer to U.S. sanctions targets goods that originated in the U.S. or that contain more than 10% controlled U.S. content. Like OFAC, OEE can pursue civil fines of over $300,000 per violation for inadvertent violations and recommend criminal prosecution for willful violations. Violators can also be added to the BIS Entity List, making them ineligible to receive exports or reexports of any items subject to the EAR.
C. Examples of enforcement actions based on the conduct of foreign parties
-
Computer servers in the U.S.: Société Internationale de Télécommunications Aéronautiques SCRL (SITA) paid OFAC $8 million to settle allegations that it provided airlines designated as SDNs with software and/or services that were provided from, transited through, or originated in the United States. In particular, OFAC alleged that SITA, a Swiss provider of commercial telecommunications network and information technology services to the civilian air transportation industry allowed its members, which included SDN airlines, to: (1) send messages to other industry parties (such as orders for aircraft maintenance and refueling) using an application that routed the messages through switches located in the U.S.; (2) use U.S.-origin software that allows shared users of a common terminal to manage processes such as check-in and baggage management; and (3) use a global lost baggage tracing and matching system that was hosted on servers in the United States, and maintained by a SITA subsidiary in the United States.[7]
-
Support services from U.S. affiliates: U.S.-based affiliates of UK health insurance company Bupa paid OFAC $128,704 to settle allegations that (among other things) they provided support services – such as transmitting policy documents, maintaining policy records, and processing premium payments – for health insurance policies that their non-U.S. Bupa affiliates issued to SDNs.[8] And Ericsson AB of Sweden (EAB) and Ericsson Inc. (EUS) paid OFAC $145,893 to settle allegations that EAB employees consulted an EUS employee in the U.S. about problems EAB was having with telecommunications equipment EAB had installed in Sudan, and that the EAB and EUS employees subsequently arranged to purchase new equipment from the U.S. and have it delivered to Sudan despite warnings from compliance personnel that providing such equipment to Sudan would violate company policy.[9]
-
Payments in U.S. dollars for transactions between foreign parties: Several UniCredit Bank entities paid a collective $600 million penalty to OFAC to settle allegations that they caused U.S. banks to process payments between foreign parties for transactions that allegedly involved sanctions targets. Among other things, OFAC alleged that the banks issued letters of credit for U.S. dollar purchases of oil and cotton that were being delivered from and to countries not subject to economic sanctions, but that had an underlying nexus to Iran (as explained below). After the goods were delivered, the banks initiated payments in U.S. dollars through U.S. banks, even though, according to OFAC, documents presented in connection with the letters of credit showed that the customer who bought the oil planned to ship it on to Iran, and the customer who sold the cotton stored it in, and planned to ship it to its destination from, Iran.[10]
-
Sale of U.S. origin goods: Ghaddar Machinery Co. SAL of Lebanon paid OEE $368,000 to settle allegations that it exported, from Lebanon to Syria, generator sets that incorporated U.S.-origin engines (which Gaddar obtained from a U.S.-owned supplier in the U.K.).[11] Likewise, Yantai Jereh Oilfield Services Group Co., Ltd. of China paid OFAC $2.8 million to settle allegations that it acquired U.S.-origin oilfield equipment (such as spare parts, coiled tubing strings, and pump sets) for reexport to Iran.[12]
-
U.S. ownership or control: AppliChem GmbH of Germany (AppliChem) paid OFAC $5,512,564 to settle allegations that, after being acquired by a U.S. company and repeatedly warned that it must cease all transactions with countries subject to U.S. economic sanctions, it continued to complete and collect on existing orders with Cuban entities, and created a scheme to conceal Cuba-related business from the U.S. parent by, among other things, referring to Cuba by the code word “Caribbean.”[13] In another post-acquisition situation, Stanley Black & Decker, Inc. (SBD) paid $1,869,144 to settle allegations by OFAC that Jiangsu Guoqiang Tools Co. Ltd. of China (GQ) continued to export goods to Iran after its acquisition by SBD, despite the fact that cessation of business with countries subject to U.S. sanctions was a condition of the closing and that GQ received multiple post-acquisition trainings on economic sanctions compliance. According to OFAC, GQ took steps to conceal its Iran sales from SBD by using trading companies in China and the UAE as conduits, instructing customers not to write “Iran” on business documents, and creating fictitious bills of lading with incorrect ports of discharge and places of delivery.[14] And PACCAR Inc. paid $1,709,325 to settle allegations that its Netherlands subsidiary DAF Trucks N.V. (DAF) sold or supplied 63 trucks to distributors in Europe with reason to know that the trucks were ultimately intended for parties in Iran.[15]
In summary, U.S. economic sanctions present significant risks for foreign companies. As a result, as OFAC recently reiterated, the U.S. government “strongly encourages organizations subject to U.S. jurisdiction, as well as foreign entities that conduct business in or with the United States, U.S. persons, or using U.S.-origin goods or services, to employ a risk-based approach to sanctions compliance,” and to mitigate their sanctions risk exposure “by developing, implementing, and routinely updating a sanctions compliance program (SCP) … incorporate[ing] at least five essential components of compliance: (1) management commitment; (2) risk assessment; (3) internal controls; (4) testing and auditing; and (5) training” (emphasis added).”[16]
[1] This sum includes several extremely large penalties against foreign banks. Penalties imposed by OFAC in this period based on the conduct of non-bank foreign companies totaled $30 million.
[2] The de minimis amount varies, but is typically 10 percent in the case of transactions involving countries subject to U.S. sanctions, and 25% for reexport to non-sanctioned destinations.
[3] See 31 C.F.R. 560.215 (Iran); 31 C.F.R. 515.329(d) (Cuba). Per 31 C.F.R. 560.215(b), “an entity is ‘owned or controlled’ by a United States person if the United States person: (i) Holds a 50 percent or greater equity interest by vote or value in the entity; (ii) Holds a majority of seats on the board of directors of the entity; or (iii) Otherwise controls the actions, policies, or personnel decisions of the entity.”
[4] For example, foreign companies may be exposed to secondary sanctions as a result of certain transactions involving Iranian petroleum products, the Islamic Revolutionary Guard Corps (“IRGC”) and Iran-related Specially Designated Nationals (SDNs), SDNs designated under Executive Orders 13224 and 13382 (relating to support for terrorism and proliferation of weapons of mass destruction), the transfer of armaments to Syria, the Russian energy, defense, and intelligence sectors, and the North Korean energy, financial services, fishing, manufacturing, mining, and transport sectors.
[5] The current maximum civil penalty per violation for most U.S. sanctions regimes is $307,922. In certain cases, related to Cuba and to parties designated as SDNs pursuant to the Foreign Narcotics Kingpin Designation Act, maximum civil penalties per violation are $90,743 and $1,529,991, respectively. Maximum penalties are adjusted annually in accordance with the Federal Civil Penalties Inflation Adjustment Act Improvements Act.
[6] Many multinational financial institutions include clauses broadly requiring compliance with U.S. (and other) economic sanctions in their general service agreements, overdraft facilities, credit agreements, and other contracts. These clauses sometimes go beyond the strict requirements of the law, requiring compliance by parties who would not normally be subject to U.S. jurisdiction, and/or prohibiting transactions involving targets of U.S. economic sanctions even when such transactions could be lawfully conducted under a general or specific license (types of authorization issued by OFAC to permit conduct that would otherwise be prohibited). Breach of such clauses, or of related representations in response to annual Know Your Customer questionnaires from banks, can lead to significant disruption of relationships with financial institutions, and even closure of accounts.
[7] Settlement agreement between OFAC and SITA (February 2020).
[8] Settlement agreement between OFAC and Bupa (October 2014).
[9] Settlement agreement between OFAC and Ericcson AB and Ericsson Inc. (June 2018).
[10] Settlement agreements between OFAC and certain UniCredit Bank entities (April 2019).
[11] Order relating to Ghaddar Machinery (November 2019).
[12] Settlement agreement between OFAC and Yantai Jereh Oilfield Services Group (December 2018).
[13] Settlement agreement between OFAC and AppliChem (February 2019).
[14] Settlement agreement between OFAC and Stanley Black and Decker (May 2019).
[15] Settlement agreement between OFAC and PACCAR Inc. (August 2019). Regarding reason to know, in one case, a dealer first placed an order under the name of a customer in Iran, then, that same day, after DAF rejected that order based on U.S. sanctions, placed an order for the same quantity and type of trucks, with the same specifications, purportedly for a customer in Russia. In a second case, a dealer sent an employee of DAF’s Frankfurt subsidiary draft invoices referencing the Iranian buyer to whom the dealer ultimately resold the trucks. And in a third case, a DAF used truck sales manager introduced a dealer to Iranian buyers who subsequently purchased DAF trucks from an affiliate of the dealer.
