On October 21, 2015, the US Department of the Treasury’s Office of Foreign Assets Control (“OFAC”) issued a Finding of Violation against BMO Harris Bank as the successor to Marshall and Ilsley Bank, which originated over $67,000 in funds transfers in 2011 on behalf of an entity involved in importing Iranian-origin carpets.  The bank had previously processed funds transfers for this customer under a then-valid general license for the importation of Iranian-origin carpets, which OFAC later revoked.

Importantly, during the time period in which such transactions were legal, the bank had added the customer – which included the word “Persian” in its name – to a “false hit list” containing names that triggered sanctions scrutiny but were not actually sanctioned parties. (Many companies employ software programs that screen proposed transactions for sanctioned parties but whose alert systems can be disabled or overridden in the case of “false hits.”) Once OFAC revoked the general license for carpet imports, the bank did not revise its “false hit list” to remove the customer’s name, and therefore the bank continued to process funds transfers on its behalf because the bank did not receive alerts.

While OFAC did not penalize the bank in this matter, the agency underscored that sanctions risk remains even when conducting screening if a company does not regularly update the sanctions lists against which it screens, including suppressing alerts for false hits on these lists.

In conjunction with announcing this Finding of Violation, OFAC published False Hit Lists Guidance.  This guidance recognizes that companies and financial institutions employ valuable sanctions-related screening tools to efficiently insure that their business transactions remain compliant with US sanctions laws and regulations.  The guidance also recognizes this screening process often includes developing a “false hit list” of individuals and entities who trigger alerts but are not actually subject to sanctions.  Companies may find such lists to be time-saving if one of more of their regular suppliers or customers regularly but erroneously triggers a sanctions screening alert.

However, OFAC cautions that sanctions screening tools and “false hit lists” are only as reliable as the rigor with which they are reviewed and updated for accuracy.  Therefore, OFAC’s guidance recommends that companies and financial institutions implement measures to regularly review, evaluate, and reassess parties included on such lists.  Otherwise, as the BMO Harris Bank Finding of Violation shows, OFAC may undertake enforcement action – and now that it has published guidance, the agency may be more likely to levy harsher penalties for noncompliance.