The U.S. Department of the Treasury’s Office of Foreign Asset Control (OFAC) accelerated its enforcement in the first quarter of 2019. OFAC announced 13 penalties or settlements, nearly doubling the count for the entirety of 2018.[1] Although the facts of each resolution are unique, a few key trends and takeaways should be noted.
Training and Oversight at Foreign Subsidiaries Is Critical
Recent resolutions reflect the compliance risk that foreign subsidiaries present, particularly when they are newly acquired. Kollmorgen Corporation’s resolution, for instance, reflects the challenges of integrating foreign subsidiaries into a culture of compliance.[2] In the process of acquiring a Turkish company in 2013, Kollmorgen learned that the company had been conducting business with Iranian entities.[3] Kollmorgen laudably took a number of steps in response to learning this information, including circulating an Iran sanctions memorandum among the subsidiary’s employees, conducting in-person trainings on its Iran sanctions compliance policies, requiring the subsidiary’s management to periodically certify its cessation of prohibited operations, and establishing a whistleblower hotline.[4]
Despite these efforts, the subsidiary continued to engage in business with Iranian entities.[5] To conceal its conduct, the subsidiary’s management repeatedly provided fraudulent certifications, falsified corporate records otherwise evidencing prohibited dealings, and threatened to fire employees refusing to travel to Iran to conduct business on its behalf.[6] Kollmorgen discovered the violations in late 2015 when one of the subsidiary’s employees filed an internal complaint via the company’s whistleblower hotline.[7] Upon learning that the conduct in Iran persisted, Kollmorgen immediately hired outside counsel to investigate and ultimately filed a voluntary self-disclosure with OFAC.[8] Following its investigation, Kollmorgen upgraded its existing compliance program, improving compliance training, implementing preapproval for all foreign after-sales service trips, and requiring the subsidiary to inform major customers of its ban on business with Iranian entities.[9] Kollmorgen terminated responsible management and paid a civil penalty of $13,381 to OFAC.[10]
Kollmorgen illustrates how difficult it can be to institute a culture of compliance at a foreign subsidiary, particularly one that is relatively new to the requirements of U.S. law. Kollmorgen took a number of positive steps at the time of acquisition to promote compliance, but after uncovering violations, it went further by implementing continuous sanctions audits of its subsidiary and reviewing the latter’s customer databases for relationships with sanctioned countries and entities.
Although a company should tailor its compliance program to its unique risks and needs, fundamental elements may include:
- providing in-person compliance training delivered in multiple forms;
- providing bespoke training for new employees and regular refreshers for current employees;
- tasking senior compliance officers and local compliance personnel with identifying unique, on-the-ground risks;
- reviewing trade compliance policies and procedures with local compliance managers;
- establishing a whistleblower hotline and emphasizing obligations to report any and all violations;
- regularly circulating memoranda informing employees of relevant U.S. sanctions and export obligations;
- conducting reviews of foreign subsidiaries’ customer databases for business conducted with sanctioned countries or entities;
- applying controls blocking sanctioned entities from making orders or requesting services;
- requiring foreign subsidiaries’ customers to abide by terms and conditions prohibiting the resale of products, directly or indirectly, to sanctioned countries;
- auditing foreign subsidiaries’ transactions; and
- requiring foreign subsidiaries’ senior management to certify sanctions compliance.
Know Your Supplier
Although “know your customer” may spring to mind in compliance discussions, “know your supplier” applied with equal force in recent resolutions. Multiple resolutions saw companies penalized for sanctions violations that occurred when companies acquired raw materials or supplies. ZAG IP, LLC’s (ZAG) resolution illustrates this risk.[11] In 2014, ZAG sought to purchase 400,000 metric tons of cement clinker from an Indian supplier.[12] Before shipment, though, the Indian supplier informed ZAG that it had insufficient cement clinker on hand due to technical complications.[13] Looking to mitigate, ZAG’s managing director identified a trading company based in the United Arab Emirates capable of providing alternative Iranian-origin clinker.[14] Relying on this company’s misrepresentation as to the inapplicability of U.S. sanctions, ZAG purchased the clinker, knowing that the goods were produced by an Iranian supplier and shipped from Iran.[15] ZAG ultimately had to pay a civil penalty of $506,250 to settle with OFAC.[16]
Although ZAG involved violations that occurred within a relatively short timeframe, California-based e.l.f. Cosmetics (ELF) suffered from an ongoing supply chain issue.[17] ELF imported 156 shipments of false eyelashes containing North Korean-sourced materials over the course of five years from two China-based suppliers.[18] The shipments totaled $4,427,019.[19] ELF’s compliance program, which focused on quality control rather than sanctions compliance, failed to reveal that 80 percent of the false eyelash kits contained materials from North Korea.[20] Ultimately, ELF paid $996,080 to settle potential civil liability.[21]
Following this settlement, ELF implemented an improved compliance program.[22] Many of the components of its program are listed below, alongside additional elements recommended for all U.S. companies that obtain raw materials or supplies from foreign entities:
- implement supply chain audits that verify the country of origin for goods and services used in imported products;
- audit payment information related to production materials and review supplier bank statements;
- require suppliers to certify compliance with all U.S. export controls and trade sanctions;
- provide mandatory training for those who interact with foreign suppliers; and
- implement measures to block payments from or to countries subject to U.S. sanctions laws and regulations.
Even an Imperfect Compliance Program Can Limit Exposure
A number of resolutions from the first quarter of 2019 describe violations that occurred despite substantial compliance efforts. These violations do not mean, however, that such efforts were for naught or that companies should not invest in compliance. In some of these resolutions, companies detected illegality relatively soon after it commenced—a result that usually occurs only when some degree of controls are in place. Early detection allows companies to limit the scope of potential violations. The ability to argue that a compliance program was well-founded despite a violation is also important because OFAC can consider the extent of existing compliance programs in determining penalties within a calculated range.
Kollmorgen, whose settlement is described above, serves as a case in point.[23] It adopted numerous pre- and post-acquisition compliance measures intended to ensure that its new subsidiary complied with U.S. sanctions law.[24] Kollmorgen’s efforts were defeated only because employees at its foreign subsidiary intentionally worked toward their circumvention.[25] The scheme was ultimately detected, however, thanks to a whistleblower program that Kollmorgen implemented precisely to address such a situation.[26] When the conduct was discovered, Kollmorgen quickly took steps to try to prevent it from recurring. Kollmorgen terminated responsible management, implemented new compliance training, required preapproval for all foreign after-sales service trips, and obliged its foreign subsidiary to inform its major customers of its ban on any dealings with Iranian entities.[27] The statutory maximum penalty for the violations was $1.5 million, and the base civil penalty would have been $750,000 if OFAC had determined the case to be egregious.[28] Yet OFAC imposed a penalty of just $13,381, citing a number of factors in support of the resolution, including “Kollmorgen’s extensive preventative and remedial conduct.”[29] Resolutions such as this typify the likely material benefit accruing to companies that invest in compliance.
Conclusion
The first quarter of 2019 saw an uptick in the number of enforcement actions, which involved both financial and nonfinancial institutions. Companies should heed OFAC’s renewed enforcement push and analyze the trend lines to determine where enforcement risks lie. These recent resolutions should remind companies to consider the training and oversight necessary to manage employees at foreign subsidiaries, the risk presented by suppliers, and the benefits of a robust compliance program—even when violations occur.
[1] See Resource Center: Civil Penalties and Enforcement Information, U.S. Dep’t Treasury (Apr. 25, 2019).
[2] See OFAC, Kollmorgen Corporation Settles Potential Civil Liability for Apparent Violations of the Iranian Transactions and Sanctions Regulations, U.S. Dep’t Treasury (Feb. 7, 2019) [hereinafter Kollmorgen settlement].
[3] Id. at 1.
[4] Id. at 1-2.
[5] Id. at 2.
[6] Id.
[7] Id.
[8] Kollmorgen settlement, supra note 2, at 2.
[9] Id. at 3.
[10] Id. at 1, 3.
[11] OFAC, ZAG IP, LLC Settles Potential Civil Liability for Apparent Violations of the Iranian Transactions and Sanctions Regulations, U.S. Dep’t Treasury (Feb. 21, 2019).
[12] Id. at 1.
[13] Id.
[14] Id.
[15] Id. at 1-2.
[16] Id. at 1.
[17] OFAC, e.l.f. Cosmetics, Inc. Settles Potential Civil Liability for Apparent Violations of the North Korea Sanctions Regulations, U.S. Dep’t Treasury (Jan. 31, 2019) [hereinafter ELF settlement].
[18] Id. at 1.
[19] Id.
[20] Id.
[21] Id.
[22] ELF settlement, supra note 17, at 2.
[23] See Kollmorgen settlement, supra note 2.
[24] Id. at 1.
[25] Id. at 2.
[26] Id.
[27] Id. at 3.
[28] Kollmorgen settlement, supra note 2, at 3.
[29] Id.
