Background
The United States sanctions regime is a complex and ever-changing regulatory space. The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) maintains sanctions lists which are updated in real-time—not on a predetermined timetable (such as weekly or monthly). Particularly in the wake of the Russian invasion of Ukraine, changes to these lists have occurred with increased frequency.
A recent Finding of Violation (FOV)1 released by OFAC provides insight into OFAC’s expectations regarding how often companies are expected to conduct sanctions screenings whenever there are updates to sanctions lists.
On July 21 2022, OFAC issued an FOV to MidFirst Bank for maintaining accounts and processing payments on behalf of clients after they had been added to OFAC’s List of Specially Designated Nationals and Blocked Persons (the “SDN List”) in violation of 31 CFR § 544.201 under OFAC’s Weapons of Mass Destruction Proliferators Sanctions Regulations Program.
OFAC determined that, although MidFirst had a sanctions screening program, the vendor in charge of periodic screenings of its existing client base was only screening such customers on a monthly basis. In total, MidFirst processed 34 transactions for fourteen days following those clients’ designations to the SDN List. The first of these transactions occurred hours after the individuals were placed on the list. The violations stemmed from MidFirst’s misunderstanding of the frequency of its vendor’s screening of new names added to the SDN List against its existing customer base. Although the vendor conducted daily screenings of new customers and of existing customers with certain account changes (e.g., changes to a customer’s name or address), the vendor only screened MidFirst’s entire existing customer base once a month.
Who must comply with U.S. sanctions?
U.S. sanctions apply to U.S. persons or where there is a U.S. nexus.
OFAC generally defines a U.S. person as including United States citizens wherever located, permanent residents wherever located, entities organized under the laws of the United States or any jurisdiction within the United States (including foreign branches), or any person or entity located within the United States. Importantly, it should be noted that the definition of “U.S. person” can vary by sanctions program.
Non-U.S. persons can also be required to comply with U.S. sanctions if their transactions are conducted in U.S. dollars, or otherwise transit the U.S. financial system. For example, OFAC has previously brought enforcement actions against non-U.S. persons for “causing” U.S. persons to violate their own sanctions obligations. Further, U.S. sanctions or export controls can also apply to non-U.S. persons under certain sanctions programs. Under these “secondary sanctions,” even non-U.S. companies can be restricted from U.S. markets or from use of the U.S. financial system if they engage in prohibited conduct.
What is sanctions screening and due diligence?
Sanctions screening and due diligence are processes by which individuals and entities vet current and potential clients, customers, and counterparties to ensure that existing or prospective transactions do not violate U.S. sanctions.
OFAC encourages the employment of a risk-based approach to sanctions compliance. A risk-based sanctions compliance program is not static, but rather requires continuous monitoring and re-evaluation. OFAC has identified key factors—namely, a company’s (i) size and sophistication; (ii) products, services, and supply chains; (iii) clients, customers, intermediaries, and counterparties; (iv) and geographic locations— that companies should take into consideration when shaping their due diligence and screening programs.
Sanctions screening and due diligence can be done in-house or through a third-party vendor.
How often should sanctions screening be conducted?
OFAC has not given definitive guidance on how often it expects companies to conduct sanctions screening and due diligence. However, companies should (i) conduct sanctions screening and due diligence prior to entering into new transactions or obtaining a new client or customer, and (ii) develop a policy of screening existing clients, customers, and counterparties at intervals that the company deems appropriate based on its assessment of the companies’ risk and exposure.
Enhanced due diligence and more frequent screenings are crucial when engaged in cross-border transactions, particularly involving high-risk jurisdictions.
Why is it important?
For some sanctions regimes, OFAC may impose civil penalties for sanctions violations based on strict liability. Companies or individuals can therefore be held civilly liable even if those persons did not know or have reason to know they were engaging in a prohibited transaction. Sanctions violations can also lead to fines and criminal prosecution.
Questions?
Please contact Bruce Paulsen, Brian Maloney, or any member of S&K’s Maritime Practice Team or Economic Sanctions and Cross-Border Regulatory Practice Group.
1 OFAC issues an FOV when it determines that there has been a violation of an applicable sanctions law or regulation, and has concluded that an administrative response is warranted, but that a civil monetary penalty is not the most appropriate response.