On August 10, 2012, President Obama signed into law the Iran Threat Reduction and Syria Human Rights Act (ITRA). A unique intersection between export controls and securities regulation, the ITRA added new §13(r) to the Securities Exchange Act of 1934, requiring issuers that file reports under §13(a) of the Securities Exchange Act to disclose in their annual or quarterly reports whether they or any of their affiliates have engaged in (i) activities that could violate U.S. sanctions programs on Iran and trigger penalties under U.S. laws; or (ii) transactions with the government of Iran. On December 4, 2012, the SEC’s Division of Corporate Finance issued interpretive guidance on the requirements of §13(r).

The United States maintains a strict embargo prohibiting US persons and companies from engaging in virtually every transaction that could involve the Iranian government, instrumentalities of the Iranian government, “specially designated nationals” in or from Iran, and persons or companies in Iran. Under guidance related to the Iran Sanctions Program administered by the Office of Foreign Assets Control (OFAC) at the US Department of the Treasury, non-US affiliates of a US entity may engage in transactions involving Iran if, and only if the US entity in no way “facilitates” such transaction. However, such transactions may be prohibited by the laws of the affiliate’s jurisdiction. Penalties for violations of the Iran sanctions program are severe, and can range up to criminal penalties of $500,000 per violation and 10 years’ imprisonment.

Issuers required to make the §13(r) disclosure must describe the nature and extent of the Iran-related activity, the gross revenue and net profits attributable to such activity, and whether the issuer or applicable affiliate intends to continue the activity. Section 13(r) defines “affiliate” as that term is defined by Rule 12b-2 under the Exchange Act: “a person that directly, or indirectly through one or more intermediaries, controls, or is controlled by, or is under common control with, the person specified.” The rule applies to reports required to be filed after February 6, 2013 (regardless of when the report is actually filed) and requires disclosure of the specified activities for the entire period covered by the report, even if the activity occurred before August 10, 2012. If an issuer and its affiliates have not engaged in any of the specified activities, they do not need to include a statement to that effect. Information disclosed pursuant to §13(r) will be publicly available upon filing.

Section 13(r) contains an exception in that transactions specifically authorized by an agency of the U.S. Federal government, such as through an OFAC-issued general or specific license, do not need to be reported pursuant to §13(r). This exception does not apply to transactions that have been specifically approved only by a foreign government.

This new rule (i) requires certification of compliance with US export controls, for domestic and foreign issuers; (ii) disclosure of information on potential direct and indirect violations of the U.S. sanctions programs on Iran; and (iii)disclosure of otherwise permitted transactions involving Iran. All of this information is for public consumption and for review by U.S. regulators. Covered issuers have specific, time-sensitive, action items because of §13(r). Such issuers must carefully review and catalogue (i) their direct interactions with the Iranian government and covered Iranian businesses and people; and (ii) the interactions between the issuer’s defined “affiliates” and the Iranian government and covered Iranian businesses and people. This latter requirement may be especially challenging for large, de-centralized business structures, and those structures that provide significant autonomy to non-U.S. affiliates as well as issuers controlled by, or under common control with, a foreign company. Nonetheless,  ssuers need to develop and understand this information before it enters the public domain.

To the extent a covered issuer has engaged directly in activities that could violate relevant U.S. law, including the Iran Sanctions Program, it should consider making a voluntary disclosure to OFAC. Determination of whether a transaction violates U.S. law should be made by counsel. A voluntary disclosure to OFAC should be made prior to the filing of the relevant §13(a) report, and should mitigate the issuer’s OFAC liability exposure. In specific cases, some liability for such violations, expanding on the Caremark standard, could rest with members of the issuer’s Board or other senior officers, not just the person(s) most involved with the violating transaction. While the issuer may also consider applying for a specific license from OFAC to transact business with the Iranian government or Iranian entities, the vast majority of such applications are rejected.

OFAC has initiated several investigations related to prohibited “facilitation” by a US entity. Their guidance on “facilitation” prohibits “U.S. Persons” from assisting with or aiding transactions that violate a US sanctions program. The “facilitation” does not need to be material or significant in order to violate a sanctions program. Covered issuers should be concerned that the level of reporting on affiliate transactions as required by §13(r) could pique OFAC’s interest as to a possible facilitation violation. Any affiliate transaction with Iran that involved a US parent, even in extremely minor ways, could trigger OFAC interest. Maintaining full and accurate records that document the “non-involvement” of a US entity in Iran-related transactions is crucial to defending a facilitation investigation. As with direct transactions, above, if an issuer discovers an affiliate transaction that could amount to prohibited facilitation, it should consider making a voluntary disclosure to OFAC.

In the process of reviewing this transactional history, covered issuers should not inadvertently provide support for in-process or future affiliate transactions involving Iran or Iranian entities. Certain issuers should develop, and strictly observe, a recusal policy for certain transactions. Such recusal policy should prevent U.S. Persons from (i) receiving, initiating or forwarding any correspondence, documents or other materials related to future or possible business with a sanctioned country such as Iran; (ii) attending meetings where there are discussions related to future business in sanctioned countries such as Iran; and (iii) participating in any conversations or telephone calls where future business with sanctioned countries is discussed. Developing the transactional history should only be done in a manner consistent with this recusal policy. However, such a recusal policy would only be workable for U.S. companies under common control by or with foreign companies, as a recusal policy would conflict with the oversight obligations of a U.S. public company’s Board of Directors.

The recusal policy should be part of the issuer’s risk-based export control compliance program (and if it does not have one, it should develop one right away). A robust compliance policy would designate a person or group within the company as responsible for export compliance. The policy also should specify how export compliance “red flags” should be escalated within the issuer.

A purpose of §13(r) is to shine a light on all Iran-related transactions, even permitted business, and, in the process, exert moral pressure on covered foreign and domestic issuers to stop doing business with Iran. The new reporting requirements require disclosure of Iranian transactions that may be permitted under foreign law and OFAC sanctions programs, an extraterritorial extension of U.S. law that should be a particular concern for foreign issuers. Further, these requirements would cover transactions approved by OFAC or otherwise outside the scope of OFAC sanctions, a concern for both domestic and foreign issuers. In addition, §13(r) disclosures could trigger shareholder proposals on not doing business with or in Iran and be used by non-shareholder groups to pressure the issuer on transactions with Iran. Section 13(r)-disclosed information could be used in civil litigation against an issuer by purportedly aggrieved parties.