On Nov. 9, 2009, the Department of the Treasury’s Office of Foreign Assets Control (“OFAC”) issued the Economic Sanctions Enforcement Guidelines (“2009 Guidelines” or “the Guidelines”) as a final rule, effective Nov. 9, 2009.1 The 2009 Guidelines amend the interim final rule that OFAC previously published on Sept. 8, 2008 (“2008 Guidance”) with a request for comments.2 The Guidelines were amended, in part, as a result of public comments made in response to the 2008 Guidance. A summary of the 2008 Guidance, as well as additional background regarding OFAC, is set forth in our Alert dated Oct. 31, 2008, available on the Schulte Roth & Zabel website.
THE 2009 GUIDELINES—GENERALLY
The 2009 Guidelines provide a general framework for the enforcement of all U.S. sanctions programs administered by OFAC and are applicable to all persons who are subject to OFAC’s sanctions programs (“Subject Persons”). The Guidelines identify the factors (referred to as “general factors”) that OFAC considers in determining the appropriate enforcement response to an “apparent violation” of the sanctions programs. An “apparent violation” is conduct that constitutes an actual or possible violation of U.S. economic sanctions laws. The enforcement guidelines and procedures that were issued by OFAC in 2003 and 2006 have been withdrawn, with the exception of the Cuba Penalty Schedule, which applies only to specific violations of the Cuban Assets Control Regulations, such as unauthorized travel to Cuba.3 The Guidelines apply to most enforcement matters that are currently pending before OFAC or that will come before OFAC in the future.4
SUMMARY OF THE 2009 GUIDELINES
I. OFAC Enforcement Actions
OFAC may take any of the following enforcement actions in response to an apparent violation: (1) no action, (2) sending a request for additional information, (3) sending a cautionary letter, (4) issuing a Finding of Violation, (5) imposing a civil monetary penalty, (6) making a criminal referral, or (7) taking other administrative action, such as (i) license denial, suspension, modification or revocation, or (ii) issuing a cease and desist order.
A cautionary letter is a final enforcement response to an apparent violation, unless OFAC later learns of additional related violations or relevant facts, but does not constitute a final agency determination of whether a violation occurred. A final determination that a violation has occurred is made when OFAC issues a “Finding of Violation” or a “Penalty Notice” imposing a civil monetary penalty. OFAC will issue a Finding of Violation when it concludes that a violation occurred and should be documented, but decides that imposing a civil penalty is not the appropriate enforcement action. As discussed below, OFAC will issue a Penalty Notice when it concludes that a violation occurred and decides that a civil penalty is appropriate.
Before OFAC makes a final determination that a violation has occurred, a Subject Person will be given the opportunity to respond to the allegations. After the Subject Person provides OFAC with any relevant information, evidence or arguments, if OFAC still believes that a violation occurred, it will consider the applicable general factors outlined below when deciding how to address the violation.
II. General Factors OFAC Will Consider
In determining the appropriate response to an apparent violation and, where appropriate, to calculate the proposed civil penalty amount, OFAC may consider some or all of the following general factors.
A. Willful or Reckless Violation of Law. OFAC will generally take more serious enforcement action if the Subject Person willfully or recklessly violated the law. As part of its analysis to determine whether this factor applies, OFAC will consider the following:
- Willfulness. Was the relevant conduct, activity, or transaction the result of willful misconduct or a deliberate choice to act knowing that such action is a violation of U.S. law?
- Recklessness. Did the Subject Person show a reckless disregard or fail to use a minimal degree of caution or care to avoid the conduct, activity, or transaction that violated U.S. law?
- Concealment. Did the Subject Person attempt to hide conduct, activity, or transactions constituting a potential violation to mislead OFAC, federal, state, or foreign regulators, or other parties involved in the conduct/transactions?
- Pattern of Misconduct. Did the potential violation result from a pattern or practice of behavior or was it isolated and atypical?
- Prior Notice. Was the Subject Person on notice, or should it have reasonably been on notice, that the conduct at issue violated U.S. law?
- Management Involvement. If the Subject Person is an entity, at what level did the willful or reckless misconduct occur?
B. Awareness of Conduct at Issue. Generally, the more a Subject Person knows or has reason to know about the conduct, activity, or transaction that is a potential violation of U.S. law, the more elevated OFAC’s enforcement response will be. If the Subject Person is a corporation, OFAC will focus on the awareness of the supervisory or managerial level staff in the relevant business unit, as well as the corporation’s senior officers and managers. As part of its analysis to determine whether this factor applies, OFAC will consider the following:
- Actual Knowledge. Did the Subject Person actually know about the conduct, activity or transaction that caused the potential violation?
- Reason to Know. If the Subject Person did not have actual knowledge of the conduct, activity, or transaction, did the Subject Person have reason to know based on readily available information and with the exercise of reasonable due diligence that the conduct, activity, or transaction would or might occur?
- Management Involvement. If the Subject Person is an entity, did senior management know about the conduct, activity, or transaction at issue?
C. Harm to Sanctions Program Objectives. The level of enforcement action taken by OFAC may increase if the conduct, activity or transaction at issue has a harmful effect on the policy goals of an OFAC sanctions program. This may include an assessment of the following:
- Economic or Other Benefit to the Sanctioned Individual, Entity or Country. What benefit, economic or other, was conferred to a sanctions target as a result of the potential violation?
- Implications for U.S. Policy. What effect did the potential violation have on the integrity of the relevant sanctions program and its policy objectives?
- License Eligibility. Was the conduct that caused the potential violation likely to have been licensed under OFAC’s existing licensing policy?
- Humanitarian Activity. Was the conduct at issue in support of humanitarian activity?
D. Individual Characteristics. OFAC may determine that increased enforcement action is appropriate for certain Subject Persons that are expected to have a greater awareness of the OFAC sanctions programs, e.g., large, commercial entities with a high volume of international business. Some of the characteristics may include:
- Commercial Sophistication. What is the commercial sophistication and experience of the Subject Person?
- Size of Operations and Financial Condition. What is the size of the Subject Person’s business operations and what is its financial condition?
- Volume of Transactions. What is the Subject Person’s annual volume of transactions?
- Sanctions History. The 2008 Guidance provided that OFAC would consider a Subject Person’s “sanctions violation history.” The 2009 Guidelines have been amended by deleting the word “violation” from this provision to clarify that OFAC will not limit its consideration of the sanctions history to prior formal determinations of sanctions violations, but will also consider prior actions by OFAC that do not constitute a formal determination of a violation, such as settlements, and cautionary or warning letters. Further, the Guidelines have been amended to provide that OFAC generally will consider a Subject Person’s sanctions history only for the five years preceding the conduct at issue.
E. Compliance Program. As part of its analysis in assessing the appropriate enforcement response to an apparent violation, OFAC will consider the “existence, nature and adequacy of a Subject Person’s risk- based OFAC compliance program at the time of the potential violation, where relevant.” (emphasis added). If a Subject Person is a regulated entity with an OFAC compliance program in place and OFAC has entered into a Memorandum of Understanding (“MOU”)5 with the Subject Person’s regulator, OFAC will follow the MOU’s procedures to consult with the regulator about the quality and effectiveness of the compliance program. Even if there is no MOU in place, OFAC may consider the views of federal, state, or foreign regulators, as applicable.
As noted in many of the comments received by OFAC, the 2008 Guidance did not make an explicit reference to “risk-based” compliance. To clarify that OFAC has not moved away from considering an institution’s risk-based compliance program and to confirm that OFAC will continue to apply risk-based principles in assessing the overall adequacy of a Subject Person’s compliance program, General Factor E was amended to make explicit references to risk-based compliance. First, the terms “adequacy” and “risk-based” (emphasized above) were added to General Factor E. Second, OFAC reissued, and added as an annex to the Guidelines, an OFAC Risk Matrix with information about risk- based compliance programs for financial institutions. This OFAC Risk Matrix is a slightly edited and consolidated version of the risk matrix that was originally an annex to the 2006 Economic Sanctions Procedures for Banking Institutions, which has been withdrawn.
F. Remedial Response. As part of its analysis to determine what enforcement action to take, OFAC will consider the following questions:
- What, if any, corrective action did the Subject Person take since becoming aware of a potential violation?
- Did the conduct, activity, or transactions at issue stop?
- If an entity, did the Subject Person determine the cause and extent of the potential violation, and take steps to identify any other potential violations?
- Have the Audit Committee and Board of Directors been informed?
G. Cooperation with OFAC. Under this general factor, OFAC will consider the level of cooperation provided by the Subject Person. Among the factors OFAC may consider in evaluating a Subject Person’s cooperation with OFAC are:
- Did the Subject Person make a voluntary self-disclosure about the potential violation?
- Did the Subject Person provide all relevant information regarding the apparent violation?
- Did the Subject Person research and disclose relevant information regarding any other apparent violations caused by the same course of conduct?
- Did the Subject Person cooperate with and promptly respond to OFAC’s requests for information?
- Did the Subject Person enter into a statute of limitations tolling agreement, if requested by OFAC?
The 2008 Guidance provided that OFAC would consider whether a Subject Person has entered into a tolling agreement or a waiver of the statute of limitations under the general factor for “cooperation with OFAC.” OFAC received comments arguing that it is unfair to consider whether a Subject Person has given a statute of limitations waiver or entered into a tolling agreement and this should be eliminated as a general factor. The 2009 Guidelines note that it is not OFAC’s general practice to seek waivers of the statute of limitations; thus, this provision has been eliminated. However, the 2009 Guidelines still provide that OFAC will consider whether a Subject Person has entered into a tolling agreement because OFAC believes this is a positive factor that should be considered as a basis for mitigating an enforcement response or lowering a penalty amount.
H. Timing of Apparent Violation in Relation to Imposition of Sanctions. OFAC will consider this factor in determining the appropriate enforcement action, particularly “if the apparent violation took place immediately after relevant changes in the sanctions program regulations or the addition of a new name to OFAC’s list of Specially Designated Nationals and Blocked Persons (SDN List).” (emphasis added). In the 2009 Guidelines, the general factor for “timing of apparent violation in relation to imposition of sanctions” was amended by changing “soon” to “immediately.” This change is to clarify that mitigation for changes to sanctions programs or additions to the SDN List is unlikely in situations where the apparent violations did not occur immediately after the change or addition. Companies engaged in international commerce will need to be very attentive to changes in the sanctions programs.
I. Other Enforcement Action. Under this general factor, OFAC will consider whether other federal, state, or local agencies have taken action against the Subject Person for the potential violation or similar violations, including whether the settlement of alleged violations of OFAC regulations is part of a comprehensive settlement with other federal, state, or local agencies.
J. Future Compliance/Deterrent Effect. In determining an appropriate enforcement response, OFAC will consider the impact administrative action may have on promoting future compliance with U.S. economic sanctions by the Subject Person and other Subject Persons, particularly those in the same industry sector.
K. Other Relevant Factors on a Case-By-Case Basis. OFAC will also consider other relevant factors to ensure that its enforcement response and, if applicable, the amount of the civil monetary penalty, is proportionate with the violation.
Some commenters raised concerns relating to a Subject Person’s inability to comply with an OFAC request for information due to foreign law. OFAC advised that, in situations where a foreign law affects a Subject Person’s ability to provide the information requested, OFAC will consider this under the general factor for “other relevant factors on a case-by-case basis.” In such situations, OFAC expects a detailed explanation of the applicable law and the steps that the Subject Person has taken to avail themselves of all legal means to provide the information requested.
III. Calculating a Civil Monetary Penalty
A. Factors In Establishing A Base Penalty Amount. If OFAC decides that a civil penalty is appropriate, it will determine a base penalty amount based on three factors: (1) whether the case is “egregious,” (2) whether the apparent violation was voluntarily self-disclosed by the Subject Person, and (3) the applicable statutory maximum penalty amount.
- Egregious Case. “Egregious” cases are those where an analysis of the applicable general factors indicates that there has been a serious violation of law that warrants a strong enforcement response. The Guidelines do not clearly define “egregious” or state the standards for determining whether a transaction is egregious, but indicate that substantial weight will be given to considerations of the willfulness and recklessness of the violation, as well as the level of harm to the sanctions program objectives and the individual characteristics of the Subject Person. Other things being equal, a higher civil penalty will be imposed for egregious cases.
- Voluntary Self-Disclosure. A significant amendment in the 2009 Guidelines is a change of the definition of a “voluntary self-disclosure.” OFAC will consider the existence of a voluntary self- disclosure in determining the appropriate enforcement response, and if a civil penalty is deemed the appropriate action, voluntary self-disclosure will result in a 50 % reduction in the base penalty amount for a violation. In the Guidelines, “voluntary self-disclosure” means “self-initiated notification to OFAC of an apparent violation by a Subject Person that has committed, or otherwise participated in, an apparent violation of a statute, Executive order, or regulation administered or enforced by OFAC, prior to or at the same time that OFAC, or any other federal, state, or local government agency or official, discovers the apparent violation or another substantially similar apparent violation.” In addition, “[n]otification of an apparent violation to another government agency (but not to OFAC) by a Subject Person, which is considered a voluntary self-disclosure by that agency, may be considered a voluntary self-disclosure by OFAC, based on a case-by-case assessment of the facts and circumstances.”
Notification to OFAC of an apparent violation is not a voluntary self-disclosure if a third party is required to and does notify OFAC of the apparent violation or a substantially similar apparent violation by filing a blocking or reject report with OFAC, regardless of when OFAC receives the third party’s notice or whether the Subject Person was aware of the third party’s disclosure. The Guidelines note other situations where notification to OFAC of an apparent violation will not be considered a voluntary disclosure, including disclosures that (1) include false or misleading information, (2) are materially incomplete, (3) are not self-initiated (e.g., disclosures resulting from suggestion or order of a federal agency), or (4) are made by an individual in a Subject Person entity without the authorization of the entity’s senior management. Disclosure of a violation to OFAC in response to an OFAC subpoena or other inquiry, or as part of filing a license application, will not be treated as a voluntary disclosure.
OFAC received comments to the 2008 Guidance suggesting that the definition of a “voluntary self-disclosure” should include self-initiated notifications of apparent violations made to OFAC in good faith, regardless of whether a third party is obligated to report an apparent violation. OFAC rejected this approach because (i) it would be difficult to ascertain whether a disclosure is made in “good faith” and (ii) there is no need to incentivize self disclosures in situations where OFAC is made aware of an apparent violation by a third party. However, to maintain the incentive to disclose apparent violations of which OFAC would not otherwise be aware, OFAC amended the definition of voluntary self-disclosure so that, if a third party that is required to report an apparent violation to OFAC fails to do so, and the Subject Person notifies OFAC of the apparent violation in a manner otherwise consistent with a voluntary self-disclosure, the notification will be considered a voluntary self-disclosure. In cases where a third party complies with its legal obligation to notify OFAC before OFAC takes its final enforcement action, the Subject Person’s notification will not be considered a voluntary self-disclosure even if the Subject Person’s notification preceded the third party’s notification.
Additionally, the 2009 Guidelines clarify that filing a suspicious activity report (“SAR”) does not preclude a determination of a voluntary self-disclosure if, after filing the SAR, the Subject Person subsequently notifies OFAC of the apparent violation (which is the same conduct at issue in the SAR), provided OFAC has not learned of the apparent violation prior to the Subject Person’s notification. This is significant given that many recent OFAC enforcement actions have been brought against financial institutions that are subject to the SAR regulations.
Even in cases where there has been no voluntary self-disclosure as defined, the 2009 Guidelines include, as did the 2008 Guidance, a provision whereby a base penalty amount will generally be reduced between 25 and 40 % if a Subject Person provides substantial cooperation to OFAC. This enables a Subject Person whose conduct was reported to OFAC by a third party to obtain almost all of the benefit of a voluntary self-disclosure if deemed warranted by OFAC. Such cooperation may include providing all relevant information related to an apparent violation, and researching and disclosing relevant information regarding other apparent violations.
- Statutory Maximum. The 2009 Guidelines include an amendment clarifying that the statutory maximum civil penalty for alleged violations subject to the Trading With the Enemy Act (“TWEA”) is $65,000 per violation, and the statutory maximum for alleged violations subject to the International Emergency Economic Powers Act (“IEEPA”) is the greater of $250,000 or twice the value of the transaction. Thus, the base penalty amounts differ for apparent violations subject to TWEA and for those subject to IEEPA. The 2008 Guidance did not take note of this difference between the two statutes.
B. Calculating A Base Penalty Amount For Most Violations. In consideration of voluntary self-disclosure and the egregiousness of a potential violation, a base penalty amount will generally be calculated as follows:6
- Non-Egregious Case, Voluntarily Self-disclosed. The base amount of the proposed civil penalty will be one-half of the transaction value, capped at a maximum base amount of $125,000 per violation, except in cases involving TWEA. In cases involving TWEA, the base penalty will be capped at one-half of the maximum statutory penalty under TWEA, which is currently $32,500 per violation.
- Non-Egregious Case, Not Voluntarily Self-disclosed. The base amount of the proposed civil penalty will be the “applicable schedule amount,” capped at a maximum base amount of $250,000 per violation, or in cases involving TWEA, capped at the maximum statutory penalty under TWEA, which is currently $65,000 per violation. “Applicable schedule amount” is defined in 31 C.F.R. Part 501, Appendix A, section I(B).
- Egregious Case, Voluntarily Self-disclosed. The base amount of the proposed civil penalty will be one-half of the applicable statutory maximum penalty (i.e., $125,000 for IEEPA cases and $32,500 for TWEA cases).
- Egregious Case, Not Voluntarily Self-disclosed. The base amount of the proposed civil penalty will be the applicable statutory maximum penalty (i.e., $250,000 for IEEPA cases and $65,000 for TWEA cases).
C. Penalties for Reporting and Record Keeping Violations. Filing a late report with OFAC can result in a penalty amount up to $2,500 if the report is filed within the first 30 days after the due date, or up to $5,000 if filed more than 30 days after the due date. An additional $1,000 penalty may be imposed for every 30 days the report is overdue, up to five years, if the report involves blocked property. In the 2009 Guidelines, the maximum penalty for failing to maintain records was increased from $10,000, to $50,000. This change was made to ensure that the penalty for failure to keep records, as required by the OFAC regulations or a specific license, is commensurate with the penalty for a failure to comply with a requirement to furnish information. The penalty for failure to comply with a requirement to furnish information issued by OFAC can result in a maximum penalty amount of $20,000, or of $50,000 if the potential violation involves a transaction valued over $500,000.
Whereas the 2008 Guidance provided for penalties for failing to “furnish requested information,” the 2009 Guidelines were amended to refer to a “failure to comply” with a request for information from OFAC. This change is to clarify that OFAC will not seek a penalty in a situation where information that is responsive to an OFAC request is withheld on the basis of an applicable and properly invoked privilege, such as information protected by attorney-client privilege or the attorney work product doctrine. However, OFAC expects Subject Persons withholding information on such grounds to invoke the privilege or protection properly by identifying the withheld information on a privilege log, in accordance with any instructions accompanying requests for information and ordinary legal practice.
D. Adjustments for Applicable General Factors. After taking into account whether a case is egregious and whether there has been a voluntary self-disclosure, OFAC may increase or decrease the base penalty amount in consideration of the applicable general factors, discussed above. Additionally, in cases involving substantial cooperation with OFAC but no voluntary self-disclosure, as defined in the Guidelines, OFAC will generally reduce the base penalty amount between 25% and 40%. In cases involving voluntary self-disclosure, substantial cooperation may also be considered as a further mitigating factor.
Further, OFAC will generally reduce the base penalty amount up to 25 % in cases involving a Subject Person’s first violation. In addition, two amendments were made in the 2009 Guidelines with respect to the 25 % penalty reduction for cases involving a Subject Person’s first violation. Specifically, the Guidelines were revised to clarify that an apparent violation generally will be considered a first violation if the Subject Person has not received a Penalty Notice or a Finding of Violation from OFAC within the five years preceding the conduct at issue. A sentence was also added to clarify that, in cases where a set of “substantially similar violations” are addressed in a single Pre-Penalty Notice (“PPN”), the penalty reduction for a first violation will generally apply to the entire set of violations and not solely to the first of the substantially similar violations.
IV. Pre-Penalty Notice (“PPN”) and Penalty Notice
According to the Guidelines, after OFAC has calculated the base penalty amount and made any necessary adjustments based on the applicable general factors, the resulting amount is the civil penalty that OFAC will propose if a PPN is issued or in settlement negotiations. In the event that OFAC issues a PPN, the Subject Person will have the opportunity to respond with arguments, additional information or evidence regarding the allegations and/or the proposed penalty amount. If a Subject Person or OFAC initiates a settlement negotiation, OFAC will consider the Subject Person’s arguments and evidence to determine an appropriate settlement amount. A settlement does not constitute a final finding by OFAC that a violation has occurred.
If a Penalty Notice is issued, the proposed penalty amount in the PPN is the starting point for calculating the final penalty amount imposed. If a Subject Person does not respond to a PPN, OFAC will issue a Penalty Notice—a final finding by OFAC that a violation has occurred—and the penalty imposed will generally be the amount proposed in the PPN. If the Subject Person responds to the PPN, OFAC may adjust the final penalty amount based on any additional evidence presented by the Subject Person, or otherwise obtained by OFAC, and any further review or reconsideration by OFAC. The final penalty imposed in the Penalty Notice will not be more than 10% over the proposed penalty amount in the PPN and will not include additional alleged violations, unless a revised PPN has been issued setting forth the increased penalty amount and additional violations.
Several comments were submitted regarding OFAC’s penalty process in response to the 2008 Guidance. For example, one comment suggested that OFAC offer Subject Persons a meeting before issuing a PPN, and another suggested that OFAC provide a process for appealing final enforcement decisions. OFAC determined that these suggestions were unwarranted because, generally, before a PPN is issued, OFAC will have communicated with the Subject Persons and, as noted above, after a PPN has been issued, ample opportunity is provided for Subject Persons to respond to OFAC’s allegations with additional information or argument. Further, the Guidelines provide sufficient opportunity for Subject Persons to respond to OFAC’s determination that a violation has occurred in cases involving a civil monetary penalty or a Finding of Violation so that no administrative appeal process is necessary in such cases. The Guidelines note that this does not apply to cases involving TWEA, which provides for an Administrative Law Judge hearing on penalty determinations.
The 2009 Guidelines are available on OFAC’s website, at http://www.ustreas.gov/offices/enforcement/ofac/actions/20091109.shtml.