1. If you’re going to disclose, disclose fully.
Many companies choose to disclose to OFAC situations in which they might have violated U.S. sanctions. Doing so provides three principal benefits to a company. First, a voluntary self-disclosure automatically entitles you to 50 percent off any resulting penalty, setting a ceiling on OFAC’s base penalty calculation at either one-half the transaction value or one-half the applicable statutory maximum, depending on whether a violation is determined to be egregious. Second, it allows a company to frame the narrative of the violations to OFAC in order to highlight the company’s compliance and remedial efforts. Finally, it incentivizes OFAC to mitigate any penalty under OFAC’s Enforcement Guidelines. Great deal, right?
All of this can go out the window if a disclosure is “materially incomplete.” Furthermore, filing an incomplete or misleading disclosure might actually cause OFAC to increase any penalties for non-cooperation—the opposite of the desired outcome. If you believe time is of the essence and want to report to OFAC while continuing to investigate a potentially broader range of apparent violations (perhaps to avoid the loss of voluntary self-disclosure credit if another company beats you to a report), then consider submitting a preliminary notification with a specific timeline for completing the review, and a promise to provide periodic updates.
2. Make sure to mention favorable laws and precedents.
Despite its mandate to implement and enforce U.S. sanctions globally, OFAC is a relatively small administrative agency with only a few hundred employees. Caseloads are heavy. Companies that disclose potential violations often mention relevant specific and general licenses, as well as relevant provisions from OFAC’s regulations, but forget to mention other areas of the law relevant to their case, such as agency law. “Agency” law here means the law of principal-agent relationships (i.e., employer-employee, parent-sub, etc.), not the administrative law applicable to government agencies.
Agency law is especially important for companies that bestow titles on their employees indicating seniority and managerial rank but not managerial responsibilities. OFAC enforcement staff are going to read titles like “vice president,” “director,” and “project manager” through the lens of OFAC’s Enforcement Guidelines, which direct them to look at whether a company willfully or recklessly violated sanctions, and whether there was awareness on the part of the company of the problematic conduct. When a managerial employee willfully or recklessly violates sanctions, the employer is deemed to have been willful or reckless; similarly, if a managerial employee is aware of the conduct, the employer is deemed to be aware. When a contractor or nonmanagerial employee willfully or recklessly violates sanctions, or is aware of the problematic conduct, however, the employer is not necessarily deemed willful or reckless, or deemed even aware of the conduct, and the distinction may turn on agency law. However, very few companies provide job descriptions in their correspondence with OFAC without being asked first.
3. Don’t ignore OFAC’s policy goals.
Sanctions are a major U.S. national security and foreign policy tool. Often, a single sanctions regime will reflect multiple policy priorities. For example, almost every sanctions program contains exemptions and general licenses designed to facilitate the free flow of ideas, humanitarian aid, and nonsanctioned people throughout the world. Don’t ignore these policy considerations when going before OFAC. OFAC’s Enforcement Guidelines specifically direct the agency to review whether a violation harmed the relevant sanctions program’s objectives. Before communicating with OFAC about a potential violation, review the relevant program objectives and consider how the activity at issue fits into that policy framework. If there are credible arguments that the activity doesn’t undermine policy objectives, make them. Doing so could lead OFAC to decide that the case isn’t worth the resources required by an enforcement action.
4. Don’t treat OFAC like the SEC or litigation.
Sanctions law is a sufficiently niche practice area that the outside/in-house counsel interacting with OFAC frequently specializes in some other area of law, such as the Foreign Corrupt Practices Act or general litigation. Bringing those experiences and related mindsets to OFAC can be a mistake when you don’t have a clear understanding of the inner workings of OFAC. By the time OFAC calls you to discuss settlement, the debate over whether a violation occurred is essentially over. Many litigators make the mistake of trying to debate elements of the offense and citing improperly to the Federal Rules of Civil Procedure, which do not apply to OFAC proceedings. SEC practitioners often seek to “appeal” enforcement actions to OFAC’s director or political officials in the Treasury Department in the same way they would appeal an SEC action to the Commission. This can lead OFAC to view a party as relatively unsophisticated, and is unlikely to change the outcome of an enforcement case. If you believe the penalty OFAC intends to issue is unjust or unlawful, the person to discuss that with is the same enforcement or compliance officer who’s been handling your case all along; if you still believe the result is unfair, at that point feel free to request a meeting with the head of OFAC’s Enforcement Division or with OFAC’s Director, but do so with eyes wide open. Those OFAC officials will have already reviewed and approved the resolution of the case, presumably after considering and rejecting the arguments you are making. OFAC takes mitigation arguments provided by opposing counsel seriously, and usually addresses them in the administrative record. An example of this can be found in the public filings of Exxon Mobil Corporation et al. v. Mnuchin et al., where OFAC specifically addressed Exxon’s mitigation arguments in its penalty notice.
5. Take responsibility for compliance gaps.
Companies often try to pin sanctions violations on rogue employees or agents. While sometimes true, such arguments often signal to OFAC that the company isn’t really serious about trying to comply with U.S. sanctions, but is instead trying to find a scapegoat. If the person at a company most responsible for a violation of the law is a senior manager, then the company is responsible and should take responsibility. It frustrates OFAC enforcement staff when senior managers are painted as low-level employees to be scapegoated, and when this discrepancy is discovered, it often prolongs OFAC investigations by requiring OFAC to issue additional subpoenas, driving up legal costs for firms under investigation.
A much better approach is to factually state who at the company was involved and what their job titles and responsibilities were, and let OFAC make the determination as to whether they’re senior or not. This shows that the company is doing its best to remediate its violations by coming clean. This is also true when the underlying cause of a violation was a compliance program gap rather than a willful employee. Rather than state that “it would have been impossible to comply,” factually describe the compliance program that was in place at the time, explain why that compliance program was reasonable given the firm’s risk profile, and discuss what you will do to prevent similar missteps in the future.
Following these tips won’t necessarily prevent your company from receiving a penalty, but they are likely to reduce your legal expenses, increase the level of mitigation that OFAC grants, and provide you, your company, and your counsel with long-term OFAC goodwill.