Diplomatic attempts to halt uranium enrichment in Iran are sputtering. Genocide continues in Sudan's Darfur region. The Burmese military junta attacked pro-democracy demonstrators with apparent indifference to international opinion. And Castro's Cuba endures past his retirement despite four decades of embargo. To appear tough and effective against these foreign policy challenges, U.S. federal and state regulators are taking a hard line on economic sanctions compliance. Financial institutions are feeling the brunt, as their deep connections in global markets and their status as highly regulated entities offer authorities a lot of bang for their buck. The $80 million penalty paid by ABN AMRO in 2005-06 is merely the most high-profile example of the sanctions crackdown.

Indeed, attention is now shifting to insurers' and reinsurers' compliance with U.S. economic sanctions. Insurance, like other industries, has gone global, and the Treasury Department's Office of Foreign Assets Control (OFAC) has taken note. Insureds may reside in many countries, or, even if they do not, insured risks might arise anywhere on the globe. So, potential OFAC sanctions issues can arise in broad offerings with global policies territories and even in seemingly narrow, domestic markets. Also, cross-border business can play into tensions between U.S. requirements and other jurisdictions' laws.

Federal Economic Sanctions 

Here are just a few examples of difficult economic sanctions issues that have surprised insurers or reinsurers: 

  • An Iranian citizen living in Los Angeles (who is not sanctioned by the United States) dies, having identified as his beneficiary a relative living in Tehran (who is a sanctioned person under U.S. law, and to whom U.S. companies therefore generally cannot send payments).
  • Mechanical difficulties force an insured ship to take refuge at Port Sudan, where it requires repairs otherwise covered as sue-and-labor expense under an ocean marine policy before it can continue on course. Payments of repair and related expenses to Sudanese entities arguably violate U.S. laws.
  • A U.S. citizen legally traveling in Iran is injured in a car accident and receives medical treatment in an Iranian hospital. Can the U.S.-based insurer, which promises global coverage, reimburse the Iranian hospital for covered services?
  • While driving in Mexico, a U.S. individual causes a collision with a Cuban citizen, who sustains injury and property damage covered by the U.S. auto policy.
  • A policyholder's goods are aboard an Iranian-registered vessel when a covered event occurs.
  • A policyholder's bank account, to which claims should be paid, is co-owned by an individual living in Burma.
  • An insured does substantial business with a company in which a Syrian businessman holds a stake, and this businessman has been identified by the U.S. government as a Specially Designated National (SDN).

These scenarios raise sanctions issues due to economic contacts with Cuba, Sudan, Iran, Burma or an SDN. Additionally, these difficult sanctions questions would arise regardless of whether a U.S. insurer directly, or a U.S. reinsurer indirectly, faced such a fact pattern. Indeed, both insurers and reinsurers are subject to U.S. sanctions rules to the extent they are organized under U.S. law, conduct business in the United States or with respect to the Cuba sanctions program only, are owned by a U.S. corporate parent. Therefore, for example, a European reinsurer with a U.S. corporate parent should take care not to do business linked to Cuba, even if it occurs without the U.S. parent's involvement.

OFAC asserts authority over insurance operations in the United States, notwithstanding the McCarran-Ferguson Act. The Supreme Court held in Garamendi v. American Insurance Association that McCarran-Ferguson applies only to the interstate commerce power of Congress and not to foreign policy. Insurers should expect no dispensation from OFAC where sanctions regulations and state law conflict on issues such as selective offering of policies, the cancellation of policies or a refusal to pay claims. Little, if any, guidance exists for insurers impacted by such conflicting regulatory regimes.

Reinsurers face additional risks. Because reinsurers are at least one contractual layer removed from policyholders, they have less ability in the first instance to manage OFAC-related risks. Reinsurance treaties may cause the greatest sanctions headaches, as reinsurers often agree to cover a "class of risks" without reviewing the cedent's individual policyholders, or even before individual policies in that class are written. OFAC adheres to the idea that U.S. reinsurers should simply write sanctions-based and geographic exclusions into reinsurance contracts, notwithstanding adverse commercial consequences.

Against this backdrop, maximum civil and criminal penalties for OFAC violations recently increased. Under most sanctions programs, a U.S. person could face a civil fine up to $250,000 or twice the value of the transaction at issue, whichever is greater—even if the person had no knowledge of the violation. Willful violations of the sanctions regulations could trigger criminal fines as high as $1 million and incarceration up to 20 years.

Conventional approaches to sanctions compliance can raise problems for direct insurers and reinsurers, but a good-faith effort to devise and implement a compliance program should be undertaken nonetheless. To the extent possible, insurers and reinsurers should screen a company's policyholders, beneficiaries and claims information for risks in sanctioned countries, which include Iran, Cuba, Sudan and, in some circumstances, Burma. They also should filter for SDNs—the individuals, organizations, businesses and even vessels identified by the U.S. government as involved in terrorism, narcotics trafficking or rogue governments. Underwriting questionnaires should be revised to solicit such information. Policies, claims payments and other transactions appearing to involve OFAC-sanctioned entities should be flagged for internal and external OFAC experts. Insurers and reinsurers need to navigate carefully when their legal obligations to pay claims may come into conflict with U.S. sanctions rules that prohibit direct and indirect payments to sanctioned entities.

On paper, OFAC does not require any compliance program but instead operates a strict liability regime: a company is liable for a violation even if it is unaware of business with a sanctioned entity. But practically, an interdiction policy sensitive to an insurer's or reinsurer's unique OFAC-related risk profile is a necessity if a company hopes to mitigate a sanctions-related penalty.

State Divestment Laws 

State pension funds—either directly or through fund managers—are major investors in insurance and reinsurance companies and their corporate parents, whether in the United States or abroad. Thus, insurance companies should gauge their exposure to the raft of state divestment laws enacted in the past year. In 2007, 25 states adopted laws requiring state funds to divest from companies that do business in Sudan, Iran or other OFAC-sanctioned nations. Congress blessed this effort, adopting legislation to thwart constitutional challenges based in the Commerce or Supremacy Clauses. Already in 2008, over ten state legislatures are considering divestment bills.

Any U.S. or foreign insurance company that counts state pension funds among its investors should immediately take stock of its business relating to Sudan, Iran or other OFAC-sanctioned countries—especially if it insures or reinsures such business. Although there are no indications at this point that merely offering global coverage will run afoul of state divestment laws, this legislation is all quite new, and there is virtually no enforcement history to suggest its limits. At least one state, Illinois, allows divestment on the basis of a single OFAC penalty arising from a violation of the Sudan sanctions program, no matter how minor or inadvertent the violation. Further, aggressive interpretations by ambitious or publicity-driven state officials could subject insurance companies to substantial reputational harm, even if no penalty is assessed or no divestment is ultimately compelled. "Sensitive" investors may divest on the mere initiation of an investigation by state authorities.

With OFAC and individual states are increasingly focusing on insurance-related transactions, the stakes are rising for insurance companies, insurance executives, brokers, underwriters and claims handlers. As is evident from the examples cited above, OFAC-related risks might arise from even ordinary and well-intentioned, everyday insurance operations. The threat to an insurer's or reinsurer's finances and reputation is considerable. The threat of criminal penalties, while not large in most circumstances, nonetheless highlights the gravity of this exposure. Thus, assessing, avoiding and mitigating potentially sanctionable activity should become standard procedure for insurance companies, just as it is for those companies that intentionally participate in international business transactions closer to the border of transactions that OFAC and state legislation were intended to proscribe.