The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) is significantly increasing its enforcement actions against companies that violate U.S. sanctions. After only issuing seven civil monetary penalties in 2018, OFAC has already issued four penalties in 2019, which were all voluntarily self-disclosed. This trend likely signals a dramatic shift in OFAC’s enforcement philosophy. U.S. and non-U.S. companies should evaluate their compliance programs in light of this increasingly aggressive posture.

Enforcement Responses

OFAC has historically closed the vast majority of its enforcement cases without issuing a penalty. For example, in Fiscal year 2016, OFAC issued 17 penalties[1] and closed nearly 1,000 enforcement cases with either a “No Action Letter” or a “Cautionary Letter.” The graph below provided by OFAC at its 2016 symposium provides a clear visual representation of this disparity.

During its past outreach events, OFAC frequently highlighted the low percentage of its enforcement cases that lead to penalties. This was done in part to encourage companies to submit voluntary self-disclosures of apparent sanctions violations. OFAC has generally favored increased insight of transactions it otherwise would not have learned over punishment for those violations.

The first four OFAC enforcement actions of 2019 arise from apparent violations that were all voluntarily self-disclosed. This continues the trend from 2018 in which five of the seven penalties were disclosed and represents a significant change to historical norms in sanctions enforcement.

Red Flags

The 2019 enforcement actions to date have several commonalities that reflect OFAC’s enforcement prioritization. For example, the e.l.f. Cosmetics, Inc. and ZAG IP, LLC settlements involve transactions with goods or materials from sanctioned countries. The Kollmorgen Corporation and AppliChem GmbH penalties both arise from transactions by non-U.S. affiliates that occurred after their acquisitions by U.S. companies.

There is one principle similarity in these violations that reveals OFAC’s highest enforcement prioritization. In all four cases, the violating companies ignored warning signs which clearly indicated increased risk of sanctions violations. The Kollmorgen Corporation and AppliChem GmbH violations occurred after the identification of pre-acquisition transactions that would be prohibited if conducted by a U.S. company. ZAG IP, LLC relied on statements from a UAE-based supplier that certain material from Iran was not subject to sanctions, while e.l.f. Cosmetics, Inc. sourced products from a high-risk region of China (presumably the southeastern area of the Liaoning province) without using enhanced due diligence procedures to ensure compliance with the North Korea sanctions program.

Fully Functioning Compliance Program

OFAC expects companies to have compliance programs commensurate with their overall risk. This expectation is not fixed, as the agency continues to increase its demands on sophisticated international companies. As OFAC seeks to more aggressively enforce sanctions, companies should at a minimum be able to demonstrate a fully functioning compliance program. The following three steps will help avoid the common compliance failures that OFAC is increasingly more likely to penalize.

  1. Acknowledge warning signs and act on the derogatory information;
  2. Use appropriate risk mitigation measures to decrease sanctions compliance risk; and
  3. Fully document the detection of all red flags and the corresponding risk mitigation measures.