Questions & Answers from the Export Compliance: Best Practices in High Volume Screening Webinar held on Thursday, March 31st at 2:00 pm EDT

Transcription

1 Questions & Answers from the Export Compliance: Best Practices in High Volume Screening Webinar held on Thursday, March 31st at 2:00 pm EDT Panelists: Kishore Gundamraj, project manager - export compliance manager, Verizon Business Eric Kulisch, associate editor, American Shipper EKulisch@Shippers.com Nathan Pieri, SVP marketing & product management, Management Dynamics Solutions@ManagementDynamics.com John Priecko, president and managing partner, Trade Compliance Solutions jpriecko@comcast.net For additional information please feel free to our panelists. Question: How often do you re-screen the parties that have been previously cleared? Answer: There is no re-screening for transactions that are screened in real time and for catalogs, we do screen once every 6 months. Question: What about cases where a denied party is an individual. When screening a company it will not catch that. How do you screen for denied individuals who are involved in companies. Answer: Screening includes customers and individuals associated to that transaction. Question: Tell us what you are doing when we find RP Answer: We have an UI built in our system, where in we provide our business users additional information of the list that hit was found etc that would help them determine if it s a "true" hit or false positive. Question: To Kishore- which lists do you screen against and how did you make that decision? Answer: We screen around 128 lists that are provided by MDI (Management Dynamics Inc) that are available in our current version. Question: If we do RPL screening does it screen for all 175 lists available or some specific lists that we have access to while using MDI Trade Collaborator? Answer: Mohit, it screens against all Lists. Question: For Kishore - the lists are updated several times a week (seems like daily sometimes) - did I understand correctly that you screen the customer database every 6 months? Or do you do some combination - screen database completely every 6 months and screen the database against just the "changes" (the delta) to the lists when they occur? Thanks. Answer: That s a good point, currently we are screening all the names against the entire lists but the work is in progress to screen against the delta to reduce the interval. 1

2 Question: Question for Kishore - you've said that Verizon screens customers and employees. Does Verizon also screen other parties such as suppliers and banks? Answer: That periodic screening is only for Verizon employees and customers. However, in transactional screening we screen all parties associated to that transaction, customer and contracts associated to the customer (there is no exception). Question: Kishore, when and do you perform an EPCI screening? Do you perform EPCI profile due diligence prior to opportunities, orders etc...? Thanks Ken. Answer: Hi Ken - We do automated screening for transactions that come through systematically and currently these are from opportunity level. Question: I am a new trade compliance professional, so excuse me if this is a really basic question, but why would a company want to do transaction with a denied party? Answer: A company should not want to do a transaction with a denied party. The way that the software integrates with the order management system you receive all trade parties associated with a transaction and can screen them at multiple points within the fulfillment process. Our solution persists trade party names and continually rescreens upon a content update and/or schedule you define. Question: Do companies make case by case decisions as to whether or not to do business with denied entities? Answer: A company should never do business with a denied party. Our software allows users to research potential hits and make a determination if they are potentially doing business with a denied party. We track users and their decisions to provide complete accountability. Question: Are the penalties for transacting business with a party that becomes a denied entity? Answer: The easy answer is see slide 9 from the presentation and the related narration. The real answer is it depends. Is the violation knowing and/or willful? Was it an inadvertent mistake? Was it a single occurrence? What s the national security impact? Did the offender cooperate in the investigation? Answers to all those questions and others, as well as, is the violation under the EAR, ITAR, OFAC or some other list ultimately determines the consequences and penalties. If you would like to discuss this further, please don t hesitate to contact me. I hope you enjoyed and learned from the webinar. I welcome any feedback to improve and better deliver the message. Question: When you say manually, do you mean going website to website? In other words, if we used a software such as Visual Compliance to screen each shipment at the time of export are we meeting our compliance requirements? Answer: Many companies (typically smaller companies) will have a manual procedure for logging on to various websites, screening parties of interest, and in many cases updating a spreadsheet. This manual method is limited in the number of lists you can reasonably screen against and spreadsheets are notoriously bad audit trails. I really can't comment on how you are using Visual Compliance. Question: What factors should an organization consider when deciding on a vendor to buy screening software from? What are the key (most important) discriminators between the many providers? 2

3 Answer: The top 3 to consider are breadth and accuracy of content provided. How many RPS lists do they cover, what is mechanism and frequency that they provide updates? Also focus on the priority that is put on making the screening algorithm efficient, leaving you with minimal false positives to clean up. The last is workflow. You want a tool that is straightforward and streamlined in how you interact with it. Question: Which is better, a contract based on individual screening transactions or one for a set cost with no restrictions on the number of transactions? Answer: It depends on how consistent your volumes are. If you have varying volumes you may be better off with a transaction based contract. However if you're volumes are very high (millions) you should consider a set cost and look for volume discounts. Question: What's the best value to set the screening software fuzzy logic at? Answer: Tuning an engine is really about understanding an organization's risk profile, industry and trade parties. You cannot make generalizations about optimizing the fuzzy logic. Question: Explain why manual screening is no longer a viable method of restricted parties screening? Answer: Many companies (typically smaller companies) will have a manual procedure for logging on to various websites, screening parties of interest, and in many cases updating a spreadsheet. This manual method is limited in the number of lists you can reasonably screen against and spreadsheets are notoriously bad audit trails. Question: What's the presenters assessment of the consolidated US Government screening solution that's now available online? Answer: The consolidated list that's now posted only includes a portion of the lists that need to be checked and is US centric. It alone is not sufficient to ensure you or your organization is not doing business with a restricted party. There are literal dozens of other lists including the United Nations and many others around the world that also need to be considered. Question: Question at the end of slide 12 regarding what periodically means or translates to day-to-day in the workplace. Answer: The answer here is it depends. See slide 8 and the related narration from the webinar for some of what needs to be considered in determining how many times is enough. Question: What about OFAC checks within the US only? Answer: I m not sure what you are looking for or asking here. What about them? OFAC checks (i.e. RPS screening of the OFAC related lists) are just as important as screening other US lists. The negative consequences are pretty much the same across the board. See slide 9 from the webinar and the associated narration. If you would like to discuss this further, please don t hesitate to contact me. I hope you enjoyed and learned from the webinar. I welcome any feedback to improve and better deliver the message. Question: What are best practices for e-commerce service providers who handle internet & distribution services for various companies? We currently use a 3rd party provider to screen all international customer orders. I consider this a competitive advantage that we offer this service to our clients. 3

4 Answer: We see a real convergence of compliance and logistics processes and would consider this to be a competitive advantage. Question: Should you screen clients whom you will handle distribution services? Answer: You should screen all parties to a transaction. Question: It seems the screening responsibilities are not stressed for people who ship goods over the internet or they are left to fend for themselves. Most are not aware of this screening. What is your take on this scenario? Answer: The parcel carriers have a responsibility to screen, but in the end, you are correct. Every exporter should know their responsibilities under the law. Question: What is the purpose of screening employees? We currently screen based on E-Verify controls, but not for export compliance. Answer: Many organizations have policies related to conducting background checks and periodically screening employees. One are that is getting quite a lot of attention lately is in the area of Deemed Exports and whether you could be "exporting" knowledge to a foreign national. Question: What is an exporter's responsibility if they sell to reputable distributors and don't know who the end user/customer is? Answer: If your organization is the US Principal Party in Interest, then you are ultimately responsible. The other consideration is what s your appropriate level of due diligence to ensure you and your distributor are appropriately screening? How do you know the distributor is screening? Have you asked? How far do you need to go to ensure compliance? The answer to that question depends on the circumstances and if you are aware of any red flags. My advice: Ask questions until you are comfortable with your distributor s trade compliance program? Have or can they prove to you they have a comprehensive effort that complies with the letter and spirit of the law? How much exposure, risk and liability are you willing to take on without knowing the ultimate end-use and end-user of your products or services? What s your relationship with your distributors? Do you trust them? Again, what proof do you have they are screening? If you would like to discuss this further, please don t hesitate to contact me. I hope you enjoyed and learned from the webinar. I welcome any feedback to improve and better deliver the message. Question: Can you say what the percentage hit rate is either on your periodic screening or daily screening? Answer: Based on the settings we are using, it is about 3%. Question: What is the key to determining which customers you should pre-screen prior to having discussions with them as most of customers are well known to us? Answer: Why aren t you periodically screening all of your customers? Does knowing them somehow guarantee they are not on a list or have not been added to one? What is your level of comfort and your organization s level of exposure, liability and risk? Are you or they willing to take a chance? See slide 8 and the associated narration from the webinar. My advice is to always screen at the appropriate phase points and periodically from start to finish throughout the transaction to ensure you are not doing 4

5 business with a denied entity. It s a question of degree of risk and how much risk you and your employer are willing to take. In the current invigorated enforcement environment, I m not willing to hang it out at all. I have no interest in becoming a poster child here. If you would like to discuss this further, please don t hesitate to contact me. I hope you enjoyed and learned from the webinar. I welcome any feedback to improve and better deliver the message. Question: No one really answered what you should do if a listed party approaches your business. Is it incumbent on you to report them? Answer: Under both the EAR and ITAR, if you have knowledge of a violation, as a good US citizen why would you not report them? If you have knowledge of wrongdoing, don t you have an obligation under the law to do the right thing? Is doing the right thing reporting them or not reporting them? If you would like to discuss this further, please don t hesitate to contact me. I hope you enjoyed and learned from the webinar. I welcome any feedback to improve and better deliver the message. Question: Am I to understand that long-term suppliers, that may have terrorists sitting in "chairs" within their company, the importer is responsible for the screening and be penalized from the USG perspective? Thank You. Answer: What s the law say? You can t do business with a denied entity. So why would the importer not be responsible for screening their suppliers to the same degree and exporter, manufacturer or broker would be? Can you afford to have your name and your organization s name in the headlines for doing business with a terrorist? Could you or your organization afford to be on a denied entity list? Additionally, just because they are a long-term supplier, does that mean they could not have hired someone on a terrorist list? If you or the supplier doesn t screen employees, whose responsibility is it? Who do you think the US Government will approach if a terrorist who s on a list is involved? If you would like to discuss this further, please don t hesitate to contact me. I hope you enjoyed and learned from the webinar. I welcome any feedback to improve and better deliver the message. Question: What is average percentage hit rate? Answer: With engine tuning you can typically get the false positive rate below 2% and often times as low as 0.5%. The average hit rate (finding a denied party) varies company by company and the maturity of their compliance process. Question: How many lists are there? Do I need to screen all of them? Answer: Good questions. Do you mean how many lists does one or the other software provider have? Or do you mean how many total lists are out there? And by out there, do you mean in the US or globally? I m aware of one software provider who claims they have more than 240 lists globally. I frankly don t know how many total lists are out there. Further, the answer to that question also depends on how you define and/or break-up lists and how the person you are asking determines those as well. Unfortunately in most cases the answer to your question depends on who you ask. The easy answer to your second question is you screen as many lists as you need to screen based on the unique nature of your business and who you do business with. That begs the question I asked Nathan. How many lists are enough? His answer was it depends on your customer and what their needs are, what products and services they provide and who they transact business with. That s a pretty good response. 5

6 If you would like to discuss this further, please don t hesitate to contact me. I hope you enjoyed and learned from the webinar. I welcome any feedback to improve and better deliver the message. Question: For Nathan: Are your screening systems web based? Answer: Yes. All of our screening systems are Web-based. This means you do not have to buy servers or hardware or have much if any IT support for your compliance initiative. Question: What are some best practices around positive hit escalation where the screening system does not strictly block the transaction? Answer: If you have a potential hit, most of our customers will put the transaction on hold and work diligently to clear the party in question. Our workflow allows users by organization to work the issue and escalate to management as necessary. We provide a number of additional attributes, source list documentation and even pictures to help resolve the potential hit. Question: Is there a process that you are to follow if you are approached by a denied party? What is the best format to screen parties; Company Names and Contacts? Addresses? More detailed information or as general as possible? Answer: Your compliance officer will have a policy on how to handle business situations where you have been approached by a sanctioned party. With respect to screening, we recommend screening against both names and addresses. Often times the address will be a hit (as it is all too easy to use an alias). Question: So how do you manage the many lists available for screening and make sure you are doing a good screening process? Answer: We have a whole team of trade analysts that are responsible for sourcing and maintaining lists. And, we have a core team of software developers that build and tune our screening engines based on many years of domain expertise. Question: What is the function or how are you using Management Dynamics as your partners in the screening process? Answer: Management Dynamics is our vendor to screen the transactions; we are using their application Trade Engines for these automated screenings. Question: Question for the end of the session: Parties to be screened - Are companies required to screen their Customers or Vendors personnel or is it sufficient to screen the company you are contracting with as long as contract or POs identify the company is responsible for compliance? If so how do you a manage phone calls, etc. Answer: That s a great question, and in most cases screening the customer or vendor is sufficient. If the personnel's information is available, for example your contact at ABC company then it would be considered a best practice to screen that contact as well. When it comes to phone calls and interaction with personnel, it really depends on how sensitive the information you are communicating is. Question: Is it necessary to screen both domestic and foreign employees? Answer: This is a policy decision for your company's compliance officer. 6

7 Question: RPS-On Demand does the screening continually. Why would any periodical screening be required? Answer: Periodic screening is valuable for companies that don't want to have their RPL update rescreening happen daily. These companies typically have massive volumes and would rather perform their screening periodically so they can better manage their workload on specified days or timeframes, rather than daily. Many of these are e-commerce companies that don't have a lot of repeat customers. Question: Our forwarder does a check prior to every shipment. Is this sufficient Answer: Many of our customers will screen prior to shipment at various points of the fulfillment process, e.g. Order received, order consolidated, and order ready to ship. Question: Kishore, what challenges have you encountered screening international employees, example concerning the EMEA privacy laws? Thanks Ken Answer: Currently we are screening only the domestic employees. Question: Nathan, when faced with various screening challenges like Entity creation, Order header and Web client access behind fire-wall, is there a way to configure different ways to of match score RPS engine tuning? Thanks Ken. Answer: Our RPS engines can have different configurations by organization. So it is possible that you could manage at the NetApp level and have. Question: Do recommend including a denied party screening print screen to be included in each export file? If so, do you recommend a print screen for each party of just the end user? Answer: This is a policy decision for your company's compliance officer. However, having the data available within a compliance solution that is accessible is generally enough. Question: How often should we screen our domestic customers bearing in mind we have 100,000's of them and the high costs involved in screening. Answer: With our solution, you pay per entity, not per transaction. So with Management Dynamics you can screening as many times as you like. Question: What is the best practice to screen US domestic customers i.e. quarterly, semi-annually, and weekly? Answer: I don't think there is a standard for this. In our pricing model, we encourage companies to screen frequently by pricing at the entity level and not by transaction. Question: Are RPLs published/available in Mandarin characters? Answer: Currently we are not capturing any RPL lists in Mandarin. Question: How do you handle Chinese or other language character sets? Answer: Other character sets (Arabic, Japanese, etc) are published with a transcribed English phrase so that screening can be performed using both the English and local language character sets. 7

8 Question: Kishore, what does RPL stand for? Answer: Restricted Party List Question: As a US multinational company who automatically screens exports from the US and has manual screening capabilities in Europe and Asia, what are best practices in taking our denied parties screening process global? My concerns include cost and receiving false positives in the US from Europe / Asia screening. Answer: A best practice would be to use one single solution to manage everything. If the solution has a multi-org structure, you can actually separate out the business data so that screening can be performed and managed independently. Also if you need to tune your screening algorithm for Europe and Asia so you have a lower false positive match rate that can also be done independent of how you have the US team setup. Question: Nathan - for high volume screening, what percentage hit rate do you either recommend to your customers or see them using predominately? Answer: Some of our larger deployments have tuned the engine to a fairly tight configuration. These customers are getting match rates of 0.5% and lower. Question: Does your hit identify the Federal Register notice or regulation that's involved so as to make it easier for the customer to resolve the hit? Answer: Yes, our match results will point you to a PDF document which has the actual FR Citation for the restricted party entity. Question: We have over 60 locations in the U.S. and most of these locations are exporting. Our belief is that export operations and screening should be centralized. Would you agree with that approach or is there a better approach? Answer: Absolutely. A best practice would be to use one single process or solution to manage everything centrally. Compliance and Risk should be controlled at a corporate level, and therefore all operations for RPS should flow through a central point of control and also be able to be monitored and audited. If you are using a software solution, then having one that has a multi-org structure will allow you to separate out the business data so that screening can be performed and managed independently. However a global manager can monitor and control how the system operates from a higher ORG. Question: What are best practices for denied parties screening for exports from a world area where some shipments are subject to the EAR and others are not. Answer: Here s my expanded answer. See slide 5 and the associated narration from the webinar. If you want to minimize your exposure, liability and risk, play it safe and keep you and your organization out of trouble, whether it s the EAR, ITAR, OFAC or other, screen all domestic and international transactions. In my view and experience that s clearly the most prudent approach. If you would like to discuss this further, please don t hesitate to contact me. I hope you enjoyed and learned from the webinar. I welcome any feedback to improve and better deliver the message. 8