On 20 June 2019 the Department of Treasury's Office of Foreign Assets Control (OFAC) issued a final interim rule (effective on 21 June 2019) amending its reporting, procedures, and penalties regulations, 31 Code of Federal Regulations Section 501 et seq. (RPPR). The RPPR sets forth standard reporting and recordkeeping requirements, license application, and other procedures relevant to the economic sanctions programs administered by OFAC. Among other things, the RPPR provides updated instructions and new requirements for parties filing reports on blocked property, unblocked property, or rejected transactions.
Certain language in the interim final regulations, particularly on rejecting transactions, is broad and inconsistent with prior OFAC practice. Some language could be interpreted as extending reporting requirements on rejected transactions to nonfinancial institutions. The amendments also expand the reporting requirement to apply to all rejected transactions, not just fund transfers (including transactions related to trade finance, securities, checks, foreign exchange, and goods or services). Furthermore, the RPPR amendments require parties to send OFAC additional information in blocked property reports. Depending on the breadth of the OFAC reporting requirements, they could trigger blocking statute considerations in Canada, Europe, the United Kingdom, and other jurisdictions. Because this is an interim final rule, OFAC has encouraged feedback and comments. It is important for financial institutions, companies, and universities to consider their compliance obligations and monitor the comments to this regulation.
On 24 June 2019 the U.S. Supreme Court announced its decision in Food Marketing Institute v. Argus Leader Media, which expanded the scope of business information that is protected from disclosure under Exemption 4 of the Freedom of Information Act (FOIA). In doing so, the Supreme Court has potentially expanded companies' ability to protect from disclosure information that is submitted to OFAC, whether in the form of required reports or information provided voluntarily, such as in license applications. Companies should consider how to present and label such information to most effectively protect against possible future disclosure in response to a FOIA request.
Key points regarding updates to RPPR
The prior rule required only financial institutions to file rejected transactions reports to OFAC, whereas both financial and nonfinancial institutions were required to file blocked property OFAC reports. Based on our plain reading of the provisions, the new RPPR expands the obligation to report rejected transactions from U.S. financial institutions to all U.S. persons, as well as (for purposes of Cuba sanctions) persons subject to U.S. jurisdiction (which includes foreign subsidiaries of U.S. companies). Read literally, this means corporations may have to file rejection reports involving rejected activities involving sanctioned countries (and for foreign subsidiaries, rejected activities involving Cuba).
Specifically, Section 501.604 of the revised RPPR expands requirements for parties filing reports on rejected transactions. The relevant parts of the regulations are set forth here:
501.604, Reports on rejected transactions
(a) Who must report--
(1) Persons rejecting transactions. Any U.S. person (or person subject to U.S. jurisdiction), including a financial institution, that rejects a transaction that is not blocked under the provisions of this chapter, but where processing or engaging in the transaction would nonetheless violate a provision contained in this chapter, shall submit a report to the
Office of Foreign Assets Control.
(2) Financial institution. For purposes of this section, the term "financial institution" includes a banking institution, domestic bank, United States depository institution, financial institution, or U.S. financial institution, as those terms are defined in the
applicable part of this chapter.
(3) Transaction. The term transaction includes transactions related to wire transfers, trade finance, securities, checks, foreign exchange, and goods or services.
Furthermore, the Section 501.604 amendments expand the scope of transactions subject to the reporting requirement to apply to all rejected transactions, not just fund transfers, including transactions related to trade finance, securities, checks, foreign exchange, and goods or services. As written, this would require that covered parties report all transactions that parties rejected for sanctions-related reasons. Currently no questions and answers or any interpretation has been issued by the OFAC.
OFAC has informally advised that the intent of the amendment was to harmonize regulations covering reports on blocked property (Section 501.603) and rejected transactions (Section 501.604). Section 501.603 require "[a]ny U.S. person...including a financial institution, holding property blocked pursuant to this chapter or releasing property from blocked status...shall submit relevant reports...to OFAC."
Section 501.604, as amended, would expand the reporting requirement for rejected transactions to mirror that of blocked property (i.e., requiring the submission of relevant reports to OFAC by "[a]ny U.S. person...including a financial institution..."). Despite the plain meaning of the rule, OFAC has informally suggested that Section 501.604 is not intended to apply to all U.S. persons, which would significantly expand the current reporting requirements facing U.S. companies. Instead, its intent was to focus on financial institutions, including their reporting obligations regarding "U-turn transactions" (i.e., transactions that are conducted on behalf of a designated person or entity or persons in sanctioned jurisdictions and which only pass through the U.S. financial system on their way from one foreign financial institution to another).
Depending on the ultimate scope of these changes, companies would be required to report confidential information on transactions that they rejected for compliance or other reasons. In addition, these changes could raise blocking statute considerations in Canada, Europe, the United Kingdom, and other jurisdictions (depending on the breadth of the new reporting requirements). Companies often try to comply fully with applicable laws and regulations, which can be challenging in the case of Cuba, for example.
Because this is an interim final rule, OFAC is taking comments and they may alter the interim rule or issue further guidance if warranted by public comments. OFAC has informally indicated that it is willing to issue frequently asked questions. However, the current interim rule is in effect. Comments were due on 22 July 2019. In the meantime, although the RPPR amendments seem largely intended to impact financial institutions, nonfinancial institutions should review their compliance systems and practices in light of the potential expansion in reporting obligations.
Key points regarding disclosure of information under the Freedom of Information Act
Shortly after OFAC issued its amendments to the RPPR, the Supreme Court's Food Marketing Institute v. Argus Leader Media decision altered, significantly, the scope of information submitted by companies to government agencies that could potentially be disclosed under FOIA.
In Food Marketing Institute v. Argus Leader Media, a newspaper, the Argus Leader, sought to use FOIA to request store-level data from the U.S. Department of Agriculture (USDA) regarding participation in the USDA's Supplemental Nutrition Assistance Program (SNAP). The grocery stores who participated in SNAP argued that disclosure of such information could cause competitive harms, while the newspaper argued that any such harms failed to raise to the level of "substantial" competitive harm. After the newspaper won at trial and at the U.S. Court of Appeals for the Eighth Circuit, the Supreme Court reversed and held in favor of Food Marketing Institute.
In reversing the Eighth Circuit, the Supreme Court rejected the "competitive harm" test, finding that instead, the "proper test" (based on the relevant statutory language in FOIA) required the courts to consider whether the information at issue was:
- Both customarily and actually treated as private by its owner.
- Provided to the government under an assurance of privacy. If these criteria can be satisfied, that information is "confidential" for purposes of FOIA Exemption 4 and hence protected from disclosure.
Companies submitting information to OFAC, whether pursuant to the expanded requirements of the RPPR or in the context of a license application, should consider how the Food Marketing Institute v. Argus Leader Media ruling has the potential to protect against future disclosure of such information in response to a FOIA request.
In particular, companies need no longer make a demonstration of competitive harm in order to justify withholding in response to a FOIA request but must satisfy the criteria outlined in Food Marketing Institute v. Argus Leader Media. Accordingly, when making submissions to OFAC, companies should clearly and expressly identify any information that they customarily and actually treat as private, as well as any information provided to OFAC under an assurance of privacy. In doing so, companies should also consider the mandatory versus voluntary nature of any such information submissions to OFAC, as the former, arguably, deserve greater protection from disclosure, than information voluntarily provided to the agency.