Unfortunately, OFAC’s reasoning in concluding enforcement actions is not
always clear. While the agency publishes details of settlements on its website,
the information provided is typically minimal. There will be a brief description
of the parties involved and the alleged violations, and a list of the factors—both
aggravating and mitigating—that OFAC considered in deciding what penalty
Nonetheless, these settlement announcements provide useful insight into
strategies to mitigate violations that do occur. This article attempts to outline
some of those strategies, both for purposes of protecting against violations and
to remediate them when they do occur.
OFAC currently administers approximately 25 different sanctions programs
against designated countries, governments and other entities, individuals, and
even vessels. As a general matter, U.S. persons (including U.S. companies and all
persons in the United States) cannot do any business with a sanctioned party.
Banks and other financial institutions are on the front lines of U.S. sanctions
compliance, as they process millions of transactions, on a daily basis and
across international boundaries. And it’s not just U.S. banks that are in the
cross hairs: as demonstrated in its enforcement action against the Canadian
bank, OFAC views its jurisdiction to extend to any party that transacts in or
through the United States. (See also the penalties imposed against Standard
Chartered, HSBC, and—most significantly—BNP Paribas for further evidence
of the long arm of OFAC jurisdiction.)
To be clear, OFAC is unlikely to attempt to exercise jurisdiction over a non-U.S. entity operating entirely outside the United States. But it is also clear that
OFAC may try to exercise jurisdiction over any transaction that involves U.S.
dollars—and which therefore needs to pass through the United States at least
electronically at some point.
Canadian Bank Violations
The January 2017 enforcement action against the Canadian bank is instructive
as to how OFAC pursues enforcement actions. In the action, OFAC asserted that
the bank was involved in trade finance transactions, from approximately 2003
through 2011, in violation of U.S. sanctions on Cuba and Iran. (Note that, as
is frequently the case with OFAC enforcement actions, the violations occurred
many years before the agency actually settled the matter, i.e., these matters often
take a long time to conclude.)
According to OFAC, the bank maintained accounts with one Canadian
company that was owned by a Cuban entity, and another Canadian company
that was an agent for an Iranian entity designated on OFAC’s List of Specially
Designated Nationals and Blocked Persons. The bank also apparently maintained
accounts on behalf of numerous Cuban nationals residing
OFAC determined that the bank conducted dozens of
transactions through the U.S. financial system on behalf of
these parties; by OFAC’s calculations, the unauthorized transactions
totaled over $2 million. The transactions reportedly involved non-U.S.
bank personnel who—according to OFAC—knew or should have known of
the customers’ connections to sanctioned nations and entities. OFAC asserted
that the shortcomings of these personnel were largely the result of ineffective
compliance policies and procedures. (More on avoiding that later.) According to
OFAC, the bank, a large sophisticated financial institution with a global presence,
should have had more effective compliance controls in place.
But OFAC also decided to reduce the penalty as a result of several factors.
In particular, OFAC noted the bank’s substantial cooperation during the
investigation, including its voluntary self-disclosure, provision of detailed
and well-organized information in response to OFAC requests, and signing