For decades, the US Government has maintained broad trade and economic sanctions designed to isolate and penalize certain governments, entities and individuals. Despite questions regarding the effectiveness of sanctions as a policy tool—particularly “unilateral” restrictions maintained only by the United States—such measures have proliferated in recent years in response to a widening array of policy challenges, including global terrorism, nuclear proliferation, money laundering, public corruption and narcotics trafficking. US sanctions laws create significant compliance challenges for non-US companies as well as US companies because of their broad extraterritorial reach, aggressive government enforcement, and emerging theories of liability for persons and entities with only limited ties to the United States.

In the face of growing tensions regarding Iran’s suspected nuclear weapons program, US enforcement authorities are, with growing vigor, aggressively pursuing suspected violations of US trade and economic sanctions targeting Iran. This Client Alert describes the growing arsenal of criminal and civil enforcement initiatives that are being used to identify, isolate and punish companies that conduct business with countries and entities targeted by US sanctions laws. These and related developments are increasingly forcing both US and non-US companies that do any form of business involving US-sanctioned countries to carefully examine the increasing legal compliance, enforcement, reputational and public relations risks arising from such business.

Heightened Enforcement

Recent enforcement actions by the US Department of Justice (DOJ) and the US Treasury Department’s Office of Foreign Assets Control (OFAC) yielding penalties in the hundreds of millions of dollars, including in cases involving non-US companies, serve as hard evidence of these expanding enforcement efforts.

Criminal Enforcement by DOJ

In a case that pushed the extraterritorial limits of US sanctions enforcement, Lloyds TSB Bank plc (Lloyds), a UK bank headquartered in London, agreed in January 2009 to forfeit $350 million to the United States and the New York County District Attorney’s Office in connection with alleged violations of OFAC’s Iranian Transactions Regulations and other sanctions regulations administered under the International Emergency Economic Powers Act (IEEPA). According to court documents, Lloyds allegedly falsified outgoing US wire transfers from the UK and Dubai relating to OFAC-sanctioned countries or persons on OFAC’s Specially Designated Nationals (SDN) list. Lloyds purportedly removed material information—such as customer names, bank names, and addresses—from payment messages so that the wire transfers would pass undetected through filters at US financial institutions. This process of “stripping” information allegedly allowed more than $350 million in transactions to be processed by US correspondent banks used by Lloyds that might have otherwise been blocked or rejected due to sanctions regulations. (In December 2009, OFAC executed a separate $217 million administrative settlement with Lloyds in connection with the same underlying facts; this separate administrative settlement treated the new fine as having been satisfied through the previous $350 million payment, but it imposed an annual internal review requirement for future years.)

In December 2009, in the largest forfeiture case ever entered for IEEPA violations, Credit Suisse Group agreed to forfeit $536 million to the US Government and the New York County District Attorney’s Office in connection with wire transfers involving US sanctioned countries and persons. Like Lloyds, Credit Suisse was charged with removing identifying information from payment messages so that the wire transfers would pass undetected through filters at US financial institutions, allegedly allowing the movement of hundreds of millions of dollars through the US financial system. US authorities alleged that had the “stripped out” identifying information been provided, all such transfers would have identifiable as being prohibited under US law. In this sense, the basic premise for the action against Credit Suisse (and Lloyds) was that US sanctions laws bar non-US entities from transferring payments through the United States banking system and effectively “causing” US persons and entities to take actions involving sanctioned countries or persons.

Administrative Enforcement by OFAC and Other Authorities

OFAC, the lead agency for administrative enforcement of US sanctions, has significantly expanded its internal enforcement resources and efforts in recent months. OFAC’s enforcement office, led by a former DOJ prosecutor, is more focused than ever on identifying and pursuing potential violations, issuing administrative subpoenas to companies under review and coordinating with other agencies, including DOJ, on criminal as well as civil enforcement matters.

On August 6, 2009, following a fiveyear government investigation, OFAC and the Department of Commerce’s Bureau of Industry and Security (BIS) announced a joint civil settlement agreement with DPWN Holdings (USA), Inc, formerly known as DHL Express (USA), Inc. and DHL Express (USA), Inc. (collectively, DHL). Pursuant to the settlement agreement, DHL agreed to pay $9.4 million in civil fines for alleged violations of US sanctions and export controls concerning multiple shipments to Iran, Sudan, and Syria. Another element of the settlement required DHL to engage a third-party consultant with expertise in US export controls to conduct an audit covering the time period of March 31, 2007 through December 2009, and annual calendar audits for 2010 and 2011.

US authorities imposed a similar monitoring requirement in the 2005 settlement involving alleged violations of OFAC rules and other US laws by ABN AMRO Bank N.V. (ABN AMRO).

In that $80 million settlement, the Board of Governors of the Federal Reserve System, the New York State Banking Department, the Illinois Department of Financial and Professional Regulations, and OFAC entered into a consent order with ABN AMRO, a non-US bank, for alleged violations of US sanctions and anti-money laundering laws and regulations. In addition to monetary penalties, ABN AMRO agreed to use a qualified independent third party to review transactions in certain high risk operations.

More recently, on February 5, 2010, Balli Group PLC of the United Kingdom pleaded guilty to two criminal counts in connection with Balli’s export of three US-origin commercial Boeing 747 aircraft to Iran. In one of the largest fines for an export violation in BIS history, Balli agreed to pay $2 million in criminal fines and an additional $15 million in civil penalties to settle charges that it had violated OFAC regulations, US export control regulations and a BIS temporary denial order against Balli. Under the terms of the settlement, Balli will also be placed on corporate probation and will be denied export privileges for five years, with certain penalties suspended if there are no further export violations.

These cases and others illustrate the power and aggressiveness of US enforcement authorities in pursuing violations of US sanctions laws. They are byproducts of more coordinated and sophisticated enforcement approaches, with various federal, state and municipal authorities combining forces to bring cases and extract settlements with significant penalty levels. They also reflect a mix of both civil and criminal enforcement zeal.

We expect that the trend towards more aggressive OFAC administrative enforcement and Justice Department criminal enforcement will continue to expand. In addition to OFAC’s growing enforcement initiatives, the Justice Department continues to focus attention and resources on its National Export Enforcement Initiative. Led by DOJ headquarters in Washington, this criminal enforcement initiative is yielding more criminal cases, bigger settlements and greater awareness and coordination in US Attorney Offices across the United States. Other agencies are also increasingly focused on issues related to Iran, including the Department of Commerce, which administers US export controls on “dual use” goods, and the Department of State, which administers US controls on exports of military products, technology and services.

Other Pressure Points Fueling Risks of Doing Business with US-Sanctioned Countries

At the same time, multinational companies that do business with Iran (or other US-sanctioned countries) face a widening array of risks that go beyond legal enforcement. Increasingly, governments, shareholders, the press, pension funds and other interest groups are looking beyond traditional sanctions laws and regulations and turning to novel forms of financial, public relations and political pressure to achieve their goals. These initiatives include disclosure pressure on public companies by the US Securities and Exchange Commission (SEC); behind-the-scenes efforts by various governments to convince industry to discontinue even lawful business; divestment measures by state and local governments and pension funds; and public relations campaigns by a growing number of nongovernmental interest groups.

SEC Disclosure Pressure Since its creation in March 2005, the SEC’s Office of Global Security Risk (OGSR) has been pressing publiclytraded companies, including non-US companies, to disclose in public SEC filings any business involving countries that have been designated by the US Department of State as “state sponsors” of terrorism (currently, Iran, Sudan, Syria, and Cuba). Staffed by attorneys who review information in the public domain and information brought to them by other agencies, including OFAC, the OGSR issues comment letters to companies pressing for such disclosure, even of lawful or de minimis business involving sanctioned countries. Though not founded in statute or regulation, the driving premise for this disclosure pressure is that non-quantitative risk factors such as reputational risk may be material to shareholders and the investing public. Companies that are essentially forced by the OGSR to disclose such business, even if it is lawful, can then become targets of government investigations, press inquiries and shareholder divestment campaigns. Failures in the SEC’s view, to make appropriate public disclosure of business or compliance risks associated with business in Iran or other embargoed countries can lead to investigation and civil enforcement action by the SEC’s Division of Enforcement. (Of course, every company’s disclosure issues are different and each situation must be evaluated according to its unique facts and circumstances.)

Divestment Measures The SEC is not alone in seeking to use investor pressure to foment change in the behavior of publicly traded companies. Various state and local governments in the United States, as well as a number of universities and other institutional investors, are increasingly employing their pension and investment funds as tools of foreign policy by systematically divesting themselves of investments in public companies doing business in Sudan, Iran and other countries that raise humanitarian or national security concerns. While most of the measures enacted to date target companies doing business in Sudan, proponents have noted the success of the divestment model and are beginning to apply it with more frequency to target Iran and other terrorist-supporting states. As a result, companies that have taken steps to comply with US federal sanctions laws may nonetheless find themselves the target of divestiture of assets controlled by states, local governments, universities and institutional investors.

Government Arm-Twisting

In recent years, the US Treasury Department has pushed to persuade other governments to “blacklist” banks in countries like Iran, seeking to cut off the target state’s access to financial markets. Under the leadership of Stuart Levey, who in July 2004 became the first Under Secretary of the Treasury for Terrorism and Financial Intelligence— and has continued in that post under President Obama—the Treasury Department has broadened the scope of its activities beyond banks, pressing multinational companies to curtail a broad range of non-banking activities involving Iran—even if such activities are permissible or beyond the reach of US sanctions laws.

Significantly, Under Secretary Levey’s approach is gaining adherents in other capitals. Under President Nicolas Sarkozy, France has toughened its stance toward French oil and gas companies like Gaz de France, pressuring them to refrain from bidding on new projects in Iran and to wind down those already in place. British leaders are also employing tactics of “moral suasion” to convince companies to cut ties to Iran, particularly in the insurance and re-insurance sectors. And German officials have urged domestic companies to show “sensitivity” in their dealings with Iran, even if such business does not violate international sanctions.

‘Naming and Shaming’ Efforts

Finally, recent tensions with Iran have also led to the proliferation of nongovernmental interest groups that are pressing multinational businesses to discontinue all forms of business with Iran. One private organization, United Against Nuclear Iran, has developed an online “Iran Business Registry” in an effort to “name-and-shame” multinational companies by reporting on their dealings in Iran. Increasingly, these “non-legal” initiatives are creating new risk factors for companies, particularly publicly-traded companies, to consider in managing their international business risk profiles. By bringing more attention and public scrutiny to business dealings involving sanctioned countries, these initiatives are further fueling the trend towards more aggressive government investigations and enforcement actions.

Conclusion Recent heightened tensions with Iran, high-profile media accounts, and strong statements from the Obama Administration suggest that the risk of enforcement and other risk factors will continue to rise in the coming months. As the Administration presses for more aggressive multilateral sanctions and the US Congress considers tougher US sanctions targeting Iran, the drive for more aggressive enforcement of existing sanctions will likely continue with even greater force.

There is also a growing correlation between government investigations and enforcement, on the one hand, and the non-legal risk factors such as divestment and adverse publicity on the other. As more companies are targeted by government investigations and enforcement efforts, they are facing ancillary and potentially devastating scrutiny by the press as well as by individual and institutional shareholders. Conversely, as news organizations and private interest groups publish information concerning corporate business activities involving Iran, those same companies are becoming more likely targets of government investigations and enforcement efforts.

In the face of these trends, companies that conduct business with Iran, directly or indirectly, should carefully weigh the relevant risk factors and take appropriate steps to manage such risks. These steps should include conducting rigorous compliance reviews to ensure that their ongoing operations comply with any applicable US sanctions laws, as well as conducting thorough internal investigations of any potential violations. Even if they are not based in the United States, companies can be—and often are—targeted by US government investigations and enforcement actions under an expanding list of theories of liability that stretch traditional notions of extraterritorial jurisdiction. As a result, virtually any company in the world that conducts business with Iran now needs to understand the many different ways the compliance, enforcement and public relations risks can manifest themselves, and they need to exercise extreme vigilance in their efforts to manage those risks.