Insurance and reinsurance companies, whether based in the US or elsewhere, should be aware of the expectations of the US authorities with respect to compliance with US economic sanctions. The Office of Foreign Assets Control (OFAC), within the US Department of the Treasury, is the lead agency in promulgating and administering US economic sanctions. While OFAC has issued some relevant guidance, highlights of which are summarised below, in several areas this guidance has not been updated for several years. It is therefore important to read OFAC’s guidance in light of the current stepped-up pace of sanctions enforcement, the factual settings giving rise to charges, and broad recent assertions by OFAC and US criminal prosecutors of jurisdiction over non-US persons. As noted below, in recent years, multi-million dollar penalties have been imposed on a number of US and non-US financial institutions for economic sanctions violations.
The broad application of US economic sanctions
All ‘US persons’ must comply with US economic sanctions. A US person is (i) any US citizen or permanent resident alien (ie, a ‘green card’ holder), wherever located; (ii) the worldwide operations of any entity organised under US law, but generally excluding subsidiaries formed under non-US law; and (iii) any person located within or operating from the US. The sanctions against Cuba also apply to any entity, wherever organised, that is ‘owned or controlled’ by a US person. Going further, criminal enforcement actions have recently been brought against non-US persons for causing the export of goods or financial services from the US to targeted persons or countries.
US economic sanctions generally prohibit financial transactions or dealings with the following individuals, entities, governments and countries, and require US persons to block (freeze), upon receipt, any property of persons of types (ii), (iii) or (iv):
- persons located within or doing business from Burma, Cuba, Iran or Sudan;
- several thousand individuals and entities (wherever located) included in the OFAC list of Specially Designated Nationals (SDNs);
- the governments of Cuba, Iran or Sudan, any entity owned or controlled thereby, and their agents; and
- Cuban nationals and companies, their controlled entities, Cuban branches of non-Cuban companies, and their agents.
In addition, no US person may approve, assist, finance, guarantee or otherwise ‘facilitate’ any transaction that would, if engaged in by a US person, violate the sanctions. This would include any insurance or reinsurance by a US insurance company relating to any business activity of a non-US person involving a targeted person or country. For example, OFAC guidance suggests that it would be a violation of the facilitation prohibition for a US insurance company to write a property insurance policy for an international hotel chain if that policy covers hotels in Iran, or to write an aviation liability policy for a non-US air carrier if the policy covers scheduled stops in Cuba.
Even non-US insurers and reinsurers operating from outside the US should consider the potential impact of US sanctions when crafting their regulatory compliance programmes. As demonstrated in recent criminal enforcement actions against non-US banks, any payments or transactions denominated in US dollars and involving a targeted person or country could raise sanctions enforcement risk. In addition, a number of persons targeted by US economic sanctions are now also targeted by EU and UK economic sanctions, including several major Iranian state banks (currently Bank Sepah, Bank Melli and Bank Saderat). More broadly, OFAC is quick to point out, doing business with many of the targeted persons, such as those designated for ties to the proliferation of weapons of mass destruction or international terrorism, could raise reputational risks.
For any violation, OFAC may impose a civil penalty up to the greater of $250,000 and twice the ‘amount of the transaction that is the basis of the violation’. Available criminal penalties are up to 20 years in prison and a fine up to the greater of $1m and twice the ‘pecuniary gain or loss’. Large penalties have been imposed on non-US financial institutions found to have violated the sanctions, including ABN Amro in 2005 (a $40m civil penalty for sanctions and anti-money laundering violations) and Lloyds TSB in January 2009 (a $350m criminal penalty for sanctions violations).
Compliance programme considerations
As for banks and other types of financial institutions, for insurance and reinsurance companies US economic sanctions compliance is taking an increasingly important role, within the broader umbrella of compliance with US anti-money laundering obligations under the Bank Secrecy Act, and its implementing regulations, as expanded following passage of the USA PATRIOT Act.
Perhaps the greatest practical compliance burden imposed by US sanctions on insurance and reinsurance companies is maintaining appropriate sanctions screening mechanisms. Best practices and any reasonably thorough assessment of sanctions risks will dictate that such screening include both automated list-based systems (looking, among other things, for matches to the SDN list) and due diligence procedures carried out by front-office and back-office personnel. OFAC suggests that insurance companies carry out such screening and diligence at multiple points in time: when a policy is issued or other client relationship is established, periodically on existing clients, and prior to processing any claim or making any payment.
Automated screening systems alone are unlikely to be sufficient. OFAC recommends that companies examine all documentation and information available regarding the proposed client, contract or coverage for any indication that sanctioned persons or countries might be involved. Even an indirect interest, such as a request to name a financial institution in a targeted country as additional insured on a policy, may present a sanctions issue. Reinsurers should bear in mind that OFAC takes the view that they may violate the sanctions if they enter into a facultative placement or reinsurance treaty and any of the ceding company’s underlying policies involve targeted persons or countries.
Insurance and reinsurance companies may wish to consider developing propriety global target lists, which would include persons targeted by US, UK, EU or multilateral sanctions, as well as other persons identified by the insurer’s personnel as potentially raising compliance issues or risks. As always when creating a global sanctions compliance programme, it is important to bear in mind the company’s potentially inconsistent obligations under non-US data protection and privacy laws, and under the sanctions blocking laws in place in EU member states, Mexico and Canada.1
- While automated tools play a critical part in sanctions screening programmes they typically will produce large numbers of ‘false hits’, which must then be examined to distinguish them from any true matches with the target lists. If at all possible this review should be carried out before issuing the proposed policy or carrying out the proposed transaction or payment. If there appears to be a true match, the insurance company will likely be required to block (freeze) the relevant client account or policy, and any related funds received or payable by the company. Upon any such blocking, the company must make a report to OFAC, and must not carry out any transactions related to such account, policy or funds without prior OFAC approval.
- OFAC has long taken a broad view of the application of US sanctions to global risk policies, indicating in its published guidance that US insurers may violate the sanctions by issuing any global policy without language excluding coverage relating to targeted persons or countries. In guidance updated in 2007, OFAC suggested that US insurers include the following exclusion: ‘whenever coverage provided by this policy would be in violation of any US economic or trade sanctions, such coverage shall be null and void.’
- In its guidance, OFAC indicates that it recognises the commercial difficulty of insisting upon such a clause in many contexts, but expressly states that a US insurer must do so if commercially practicable. If not, OFAC has indicated that, upon written application by an insurer or reinsurer, it will consider providing a ‘specific license’ to allow the issuance of the policy (note that a separate specific license may be required to pay any claims thereunder).2 OFAC might be willing to issue a specific license in other specific circumstances, to authorise otherwise prohibited conduct. For example, OFAC has indicated in earlier guidance that it might issue a specific license to authorise payment under a blocked automobile insurance policy, to an ‘innocent third party’, such as a person injured by the policyholder in an accident. Note also that there are limited and complex exceptions to the general prohibitions under the US sanctions regulations, permitting insurance of licensed exports of certain agricultural and medical commodities to Cuba, Iran and Sudan, and certain life insurance payments otherwise prohibited under the Cuba sanctions.
- As reflected in a short guidance note issued by OFAC in 2008, another recurring issue is the provision by US insurers (or their non-US affiliates) of travel insurance products to non-US individuals, who then 2 In 2007 guidance, OFAC indicated that in these situations it will review the facts surrounding the proposed global insurance policy, including ‘risk frequency and risk severity’, to ensure that ‘issuance of the policy will not undermine US foreign policy goals’. visit Cuba and present a related claim. Given the broad application of the US sanctions against Cuba to affiliates of US insurers it may be prudent for such affiliates to exclude Cuba from the geographic scope of retail travel insurance policies in an effort to prevent such problematic claims from arising. It will be important to seek to craft any such exclusion and related policies in a manner compliant with any applicable sanctions blocking laws.
Insurance and reinsurance firms with a global footprint, or insuring global risks, should take into account, in establishing and reviewing their regulatory compliance policies, the broad scope of application of US economic sanctions, the stepped-up pace of enforcement, and the broad interpretations set out by OFAC. OFAC has long recommended that insurers and reinsurers implement, for economic sanctions purposes, the standard components of any regulatory compliance programme, including designating a responsible compliance officer, carrying out periodic risk analysis, maintaining appropriate screening procedures, establishing a training programme, and carrying out internal compliance audits.