Like a lot of in-house lawyers, my first exposure to OFAC compliance came in the form of a letter notifying me that the company was the subject of an investigation for potential violations of U.S. sanctions laws and that big fines were likely if there were, in fact, such violations. From there, my education was quick. And painful. All in-house lawyers should have a basic understanding of what OFAC is, what it does, and why it matters to the companies they represent. Below is a primer on OFAC and U.S. sanctions laws.
What is OFAC?
Most in-house lawyers (like most Americans) know that there are economic sanctions in place that prohibit companies and individuals from doing business with or even traveling to certain countries. The most well-known sanction regime is that involving Cuba which has been in place since the 1960s. Unfortunately, that’s about as much as many Americans, including lawyers, know. So, let’s go to square one. To start, the U.S. sanctions programs are administered by the Treasury Department’s Office of Foreign Asset Control (“OFAC”). Sanctions are laws or executive orders prohibiting transactions with certain countries or certain individuals. Sanctions are different from export controls which are administered by several agencies, primarily the Department of Commerce’s Bureau of Industry and Security. Export controls prohibit the export and sale of certain goods, for example, technology with a dual commercial and military purpose or nuclear technology. Sanctions usually cover the gamut and prohibit any transactions with the prohibited country, entity, or person. For our purposes, we’ll discuss sanctions and leave export control for another day.
What are Sanctions?
Sanctions are policy tools that governments use to punish certain actors or drive certain behavior in line with national interests or goals. In light of the Russian invasion of Ukraine, for example, many countries enacted sanctions against the Russian government and banking system (and against individual Russians). Likewise, a number of countries choose not to follow along, causing tension in global markets and political circles. At the core, sanctions prohibit all transactions with a country, entity, or individual – such as sales of goods, travel, services, purchase of goods or services, and so on. Besides shutting down access to goods and markets, denying sanctions targets access to banking and financial systems (U.S., EU, Swiss, etc.) is a powerful penalty as well. Sanctions come in two flavors: comprehensive and targeted. Comprehensive sanctions involve a country or destination. I mentioned Cuba and Russia above, but North Korea, Syria, Iran, and several others make the OFAC comprehensive sanctions list.
Targeted sanctions prohibit U.S. businesses and citizens from dealing with specific individuals or entities.
The most familiar of targeted sanctions is the Special Designated Nationals (“SDN”) list. The SDN list rose to prominence out of the events of 9-11 as a way for the U.S. to punish terrorists, terrorist organizations, and those supporting or providing aid to terrorists. It also covers narco-traffickers, nuclear proliferation, and other “bad guys.” The SDN list is, as of March 2023, a list of over 20,000 names! This matters to in-house lawyers because U.S. businesses may not transact business with any person or entity on the list. So, knowing who is on the list and blocking transactions is a big task, one where the legal department and the finance department must work together closely.
How Do We Comply (and What Happens If We Don’t)?
As you can imagine, compliance can be difficult. First, in-house counsel must be aware of all the different (and applicable) sanctions programs that are in effect for U.S.-based companies. Moreover, even foreign subsidiaries can be pulled under U.S. sanctions regimes (e.g., Cuba sanctions) – which can come as a nasty shock to many legal departments that are focusing compliance solely on the business of the U.S. parent. Likewise, the SDN list applies to companies that are 50% or more owned (in aggregate) by individuals or entities on the list, i.e., you need to understand who the owners are of the businesses your company deals with.
Second, as noted, there are a lot of programs in-house counsel must be aware of. A partial list includes:
- The SDN list
- The Trading with the Enemy Act
- The Iran Threat Reduction and Syria Human Rights Act of 2012
- The Countering America’s Adversaries Through Sanctions Act of 2017
- The Foreign Narcotics Kingpin Designation Act
And many more, including regime-specific sanctions which do not prohibit transactions across the board with a specific country but rather with members of the ruling regime, certain state actors, and so forth.
Unfortunately, failing to comply can be an expensive proposition for businesses in violation of U.S. sanctions laws.
Penalties range from a few thousand per violation to millions of dollars and – in the right circumstances – imprisonment for up to 30 years. More specifically, breaking the Trading with the Enemy Act is about $90,000 per violation. Violating the International Emergency Economic Powers Act is about $308,000 per violation. And breaking the Foreign Narcotics Kingpin Designation Act costs about $1.5 million per violation. Some companies have paid total fines in the billions of dollars. If you need to get anyone’s attention about the importance of compliance, that last sentence may do the trick.
What Should In-House Counsel Be Doing Now?
If you’re not familiar with OFAC and the various sanctions regimes, then your head is probably spinning. The good news is that there is a checklist with several concrete steps you can take to ensure compliance:
- Understand the laws that apply to your business, i.e., which sanctions laws are most applicable to your company’s business dealings?
- Look at the OFAC website which has a host of helpful materials, including the Economics Sanctions Enforcement Guidelines, a guide on how OFAC evaluates potential violations and fines.
- Investigate software and other technology that can assist with compliance. With 20,000 names on the SDN list, you cannot “eyeball” transactions and hope to spot potential problems. You need technology.
- Ensure you have the right contractual provisions and due diligence practices in place.
- Partner with the finance team to share the burden and share ideas.
- Ensure your compliance program includes a module on OFAC and sanctions.
- Find outside counsel that can advise you on the intricacies of the various sanction regimes. Perhaps you will be the one legal department with sufficient internal expertise, but this is one area where experienced outside counsel is likely worth every penny.
***
Dealing with OFAC sanctions is a challenging job for any legal department. There is a lot to know, and it is easy for things to fall between the cracks. Like most things, start with a systematic review of the most likely problem areas and then build out your compliance plan from there. Fortunately, if your legal department subscribes to Practical Law, you have a host of shovel-ready tools about OFAC compliance at your disposal 24/7/365.
STERLING MILLER, HILGERS GRABEN PLLC
Sterling Miller is a three-time General Counsel who spent almost 25 years in-house. He has published five books and writes the award-winning legal blog, Ten Things You Need to Know as In-House Counsel. Sterling is a regular contributor to Thomson Reuters as well as a sought-after speaker. He regularly consults with legal departments and coaches in-house lawyers. Sterling received his J.D. from Washington University in St. Louis.
