OFAC FCPA and OFAC Compliance Essentials By The FCPA Report The DOJ, SEC and OFAC continue to put resources into enforcement of trade regulations and the FCPA, pursuing new investigative techniques and legal theories in both areas across industries. Edward T. Kang and Jason Waite, partners at Alston & Bird, and Jim Finnerty, Senior Vice President and Associate Deputy Global Anti-Money Laundering Officer for TD Bank, shared their views on OFAC and FCPA compliance with The FCPA Report to help companies understand the trends and enhance their compliance programs. See also Risk-Based Solutions to Complying with Anti-Money Laundering, Export Controls, Economic Sanctions and the FCPA, The FCPA Report, Vol. 3, No. 2 (Jan. 22, 2014). FCPAR: We know that FCPA enforcement has grown dramatically over the past decade. [See Assessing the Year in FCPA Enforcement and Looking Ahead, The FCPA Report, Vol. 3, No. 2 (Jan. 22, 2014).] What about trade sanctions? Is the government being more aggressive there? Kang: The use of sanctions has become an increasingly muscular part of the U.S. foreign policy in the present administration. Enforcement of those restrictions has also become more aggressive, as demonstrated by recent settlements with BNP Paribas, Clearstream Banking and Weatherford International. Not only have the monetary penalties increased, but companies, particularly banks, have had to negotiate with an increasing number of regulators who have shown an interest in sanctions enforcement. Sanctions restrictions have traditionally been enforced by OFAC and the DOJ. In recent years, however, regulators in New York have also asserted jurisdiction in sanctions enforcement, where those cases involve the New York banking system. The District Attorney s Office for New York County and the New York Department of Financial Services have, for example, increasingly exercised their criminal, civil and supervisory authorities over New York banks and New York branches of foreign banks, to interject themselves in many of the large sanctions settlements involving banks and other financial institutions. At the same time, the extraterritoriality of sanctions enforcement has expanded, both by new regulations, as well as through the pursuit of aggressive, novel theories of liability. FCPAR: Are you seeing an increase in awareness among management, employees and boards of FCPA and trade sanctions issues?
Finnerty: First, please be aware that the views expressed here are my own, and do not reflect those of TD Bank. To answer the question absolutely for both areas. The DOJ s and SEC s increased prosecutions of FCPA matters certainly has caught the attention of companies. Also, foreign government prosecutions are now increasing and require understanding of those legal regimes. Like most compliance-related matters, the key is understanding potential risks often associated with third parties purportedly acting on behalf of the company and instituting appropriate controls, such as third-party selection and financial controls, effective control testing and auditing, training on potential risks and accurate reporting. Turning to sanctions, as Ted mentioned, U.S. enforcement actions certainly have increased and resulted in significant monetary penalties and business model or operational changes. And New York state authorities are more active. Those matters, and the increase in New York state enforcement actions, are discussed and result in assessments of risks and controls. FCPAR: What are the main regulations governing trade sanctions and who enforces them? Waite: U.S. sanctions regulations are promulgated and administered by OFAC of the U.S. Department of Treasury. OFAC acts under presidential national emergency powers, as well as authority granted by specific legislation, to impose controls on transactions and freeze assets under U.S. jurisdiction. The primary statutory underpinnings of OFAC s regulations are the Trading with the Enemy Act and the International Emergency Economic Powers Act. Sanctions regulations typically implement executive orders of the President which target foreign countries and regimes, terrorists, international narcotics traffickers, those engaged in activities related to the proliferation of weapons of mass destruction (WMDs), and other threats to the national security, foreign policy or economy of the United States. A key point to understand, and a key challenge in managing OFAC sanctions compliance, is that each sanctions program is based on its own specific orders and regulations. OFAC s sanctions regulations are found at 31 C.F.R. Part 500 to Part 598, and there are more than 30 individual sets of sanctions regulations, i.e., Part 515 (Cuba), Part 538 (Sudan), Part 542 (Syria), Part 589 (Ukraine), Part 595 (Terrorist Sanctions). Sanctions regulatory schemes can generally be characterized as either list-based sanctions or as full-scale embargoes. For example, the sanctions against Iran, Syria, Sudan and Cuba are full-scale embargoes under which most transactions with those countries by U.S. persons are prohibited, unless licensed by OFAC. In contrast, for example, the sanctions related to the situation in Ukraine, the Democratic Republic of Congo, Lebanon and a host of sanctions programs targeting terrorists,
terrorist organizations, WMD proliferators and narcotics traffickers, are what we refer to as list-based sanctions which impose asset blocking requirements and prohibitions on U.S. persons with respect to dealings with specifically targeted persons or entities. All sanctions programs impose restrictions and requirements on U.S. persons. Though the definition of U.S. person varies by program, it extends to U.S. companies, citizens and permanent residents, wherever located, persons in the United States, and, in the notable cases of Iran and Cuba, it extends to foreign subsidiaries of U.S. companies. OFAC s extraterritorial reach is long and the agency continues to pursue novel theories to extend that reach. FCPAR: What are some of the most at-risk industries when it comes to trade sanctions? Are there industry sweeps such as in FCPA enforcement? [See Top DOJ and SEC Officials Discuss FCPA Enforcement Priorities and Mechanics, The FCPA Report, Vol. 3, No. 7 (Apr. 2, 2014).] Kang: Although there are not the type of industry sweeps in sanctions enforcement that there have been in enforcement of the FCPA, there are certain industries that are more susceptible than others to violating sanctions restrictions. The banking and financial services industry, for example, is particularly at risk, as any payment, financing, or transfer of funds related to a sanctioned country or individual could potentially be considered a sanctions violation if a U.S. person was involved in that transaction. The energy and petrochemical sectors are also high-risk industries, given the concentration of exploration and production in sanctioned countries, including Iran and Syria. The defense, telecommunications, and pharmaceutical industries are also susceptible, as they tend to have more touchpoints in high-risk regions. However, it is important to note that any company that transacts business, at any point in the supply chain, with a sanctioned country or individual, is at risk of sanctions violations. FCPAR: How does the voluntary disclosure calculation differ between trade sanctions violations and anti-bribery violations? [See Audit Committee Responsibilities Before, During and After Internal Investigations: Remediating and Disclosing the Investigation to the Government and the Public (Part Four of Four), The FCPA Report, Vol. 3, No. 7 (Apr. 2, 2014) (discussing the voluntary disclosure calculus).] Waite: Despite significant differences, common themes in the disclosure process for both regimes include: Timely notification and follow up; Support of senior management; Retain, review and produce relevant records; Ensure that the problem has ceased; Investigate and determine the facts; Develop and implement corrective actions; Prepare complete and accurate account of potential violations; Agency commences investigation of disclosure; and Mitigation of civil penalties or considering in criminal charging decision (not guaranteed).
Voluntary disclosures of FCPA violations are made with a view towards the potential benefits outlined in the DOJ s Principles of Federal Prosecution of Business Organizations. The goal of such disclosures is generally to avoid indictment. Secondarily, reductions of the fines imposed are called for under the Sentencing Guidelines where a company makes a voluntary disclosure of wrongdoing, otherwise cooperates and accepts responsibility. Voluntary disclosure may also reduce a company s culpability score under the Sentencing Guidelines, which can result in additional reductions of the fines imposed. Meanwhile, the SEC has guidelines which consider voluntary disclosure among various cooperation factors taken into account by the Commission when deciding whether to pursue a case. In contrast to FCPA voluntary disclosures which rely upon general principles announced by the DOJ and SEC, OFAC s Economic Sanctions Enforcement Guidelines, 31 CFR Part 501, Appendix A (OFAC Guidelines), set forth specific requirements and procedures for voluntary self-disclosure to OFAC, as well as the benefits of the same. Another important difference is that OFAC s Guidelines and the OFAC voluntary selfdisclosure process specifically relate to civil enforcement and the imposition of civil penalties, which make up the majority of OFAC s penalty docket. In the case of a valid voluntary self-disclosure, OFAC s Guidelines expressly provide for a 50 percent reduction of civil penalties from the otherwise applicable base penalties. Under OFAC s guidelines, voluntary self-disclosure means a self-initiated notification to OFAC of an apparent violation of a statute, executive order, or regulation administered or enforced by OFAC, prior to or at the same time that OFAC, or any other government agency or official, discovers the apparent violation or another substantially similar apparent violation. OFAC s Guidelines further explain that a voluntary self-disclosure must include, or be followed within a reasonable period of time by, a report of sufficient detail to afford a complete understanding of an apparent violation s circumstances, and should also be followed by responsiveness to any follow-up inquiries by OFAC. A voluntary self-disclosure to OFAC does not preclude that agency from referring a matter to the DOJ for criminal investigation and prosecution, so that risk must be evaluated by companies when considering disclosure to OFAC, but OFAC generally adheres to its guidelines and offers parties the mitigation benefit of disclosure in assessing civil penalties. As a practical matter, voluntary selfdisclosures to OFAC are more common. Companies regularly disclose apparent civil violations to OFAC because of that agency s strict liability view of civil enforcement. While a series of large multi-agency enforcement actions against banks demonstrates the potential gravity of OFAC enforcement and must be considered in the enforcement calculus, the fact remains that voluntary self-disclosure to OFAC often results in no penalty or a reasonable civil settlement calculated in accordance with
OFAC s Guidelines. In contrast, companies disclosing FCPA violations to the DOJ are more likely to be disclosing at least some amount of criminal culpability and seeking to avoid indictment. FCPAR: What are some of the similarities and differences in enforcement mechanisms employed by the DOJ, SEC and OFAC? Waite: Criminal enforcement of sanctions violations is DOJ enforcement, and is, therefore, very similar to FCPA enforcement, as DOJ takes into account the same types of considerations as to whether to charge a company. Where DOJ is involved, OFAC s civil enforcement response is generally reflected in a global settlement. For example, in 2014, criminal and civil settlements were reached in the case against BNP Paribas and in the case against Fokker Services. OFAC s Guidelines specifically recognize as a factor to be considered in determining appropriate civil or administrative sanctions enforcement actions taken by federal, state, or local agencies against the Subject Person for the apparent violation or similar apparent violations, including whether the settlement of alleged violations of OFAC regulations is part of a comprehensive settlement with other federal, state or local agencies. The active stance taken by other agencies in the enforcement of sanctions and related violations by banks, including the Department of Financial Services of the State of New York, the Federal Reserve Board of Governors, and the District Attorney s Office for New York County, is a significant difference between sanctions enforcement and FCPA enforcement. Sanctions enforcement cases are more likely to involve multiple parallel investigations by a panoply of U.S.-based regulators. Where violations are not found to be criminal or are not referred by OFAC to DOJ, enforcement proceedings at OFAC are administrative proceedings. They commence with the issuance of a pre-penalty notice which sets out the allegations, the maximum potential penalty, and the proposed penalty based on OFAC s application of its guidelines. A subject person may then submit a response to the pre-penalty notice presenting any and all arguments as to the alleged violations and the appropriateness of the penalty proposed. If OFAC determines that a penalty is appropriate after considering the response to the pre-penalty notice, it will issue a penalty notice with the final claimed penalty amount. Such a notice represents final agency action on the matter. As a practical matter, parties may settle a case with OFAC prior to the issuance of a pre-penalty notice or prior to the issuance of a penalty notice and most cases are resolved by settlement through negotiations with the agency. FCPAR: Is it advisable for companies to integrate trade sanctions compliance into an anti-corruption compliance program or vice versa? If so, what are the effective synergies in your clients compliance programs that integrate the mitigation of both FCPA and trade sanctions risk? [See Risk-Based Solutions to Complying with Anti-Money Laundering, Export Controls,
Economic Sanctions and the FCPA, The FCPA Report, Vol. 3, No. 2 (Jan. 22, 2014).] Waite: There are multiple overlaps in the compliance concerns arising under the FCPA and sanctions regulations. It can be efficient and effective for companies to integrate their compliance procedures for these two risk areas. As a general matter, in managing both of these compliance areas, it is imperative to know your customer. You want to understand enough about your customers that you can have some degree of confidence that they are not a sanctioned person, but also that they are not diverting goods or services to sanctioned countries or persons, and that they are not making improper payments to government officials to further their business. For example, it is relevant to a company s anti-corruption compliance concerns to know whether a U.A.E.-based customer sells to governments in the region. It is relevant to the company s sanctions compliance concerns to know whether the same customer deals with Iran or Syria. In many companies it can be highly effective to integrate these anti-corruption and sanctions compliance concerns into a singular process to know the customer. Additionally, from a sanctions compliance perspective, it is integral to ensure that the company is not doing business with prohibited persons and entities. This is especially true as list-based sanctions proliferate, and the landscape becomes dotted with additional lists, including E.U. and other foreign restricted party lists, as well as additional U.S. lists restricting certain parties from receiving certain exports. Typically, companies mitigate this risk by conducting transaction screening. Screening programs can take different forms. In large companies, screening programs are often automated, utilize sophisticated software, and rely on subscription content intelligence-based lists that often go beyond merely the parties targeted by U.S. sanctions. Sophisticated screening programs can now be extended to identify various types of parties which may present greater corruption risk, such as politically exposed persons, World Bank-debarred firms and lists of persons wanted for criminal offenses. By adopting a broad screening program, companies can identify parties in their supply chain that present risk of sanctions violations as well as corruption risk. Internal protocols and tools for reviewing and resolving screening results can empower compliance personnel to make risk-based judgments about parties with which they are doing business. For example, where screening results indicate that a customer is not a prohibited person, but has been debarred from World Bank contracting or has been determined to be politically exposed, companies can launch second-level reviews or require additional information or assurances from the customer. [See The World Bank s Wide Reach and Its Growing Anti- Corruption Program, The FCPA Report, Vol. 3, No. 11 (May 28, 2014).] FCPAR: The FCPA has been interpreted to have a willful blindness standard and a company can be responsible for the actions
of third parties acting on its behalf in fact, bribes made by third parties have been the source of most of the recent enforcement actions. What is the knowledge standard for trade sanctions? Finnerty: Again, please remember these are my views alone, not those of TD Bank. This is a complex question given the broad array of sanctions regimes. In some contexts, willful blindness may well satisfy requirements for knowledge, intent or willfulness. But be careful the knowledge requirement is regime-specific and some may impose strict liability. For example, the Antiterrorism and Effective Death Penalty Act makes it unlawful to knowingly provide material support to a terrorist organization or unlawfully and willfully provide or collect funds with the intent that the funds be used for certain prohibited acts. Similarly, the Trading with the Enemy Act makes it unlawful to trade, or attempt to trade with knowledge or reasonable cause to believe that the other person is an enemy. Finally, the International Emergency Economic Powers Act makes it unlawful for a person to violate, attempt to violate, conspire to violate, or cause a violation. It provides for civil penalties on any person who commits an unlawful act and criminal penalties on a person who willfully commits, willfully attempts to commit, or willfully conspires to commit. Of course, other trade sanctions regimes also exist and some may impose strict liability. For example, OFAC regulations, which apply to all U.S. persons and prohibit all dealings with persons included on the Specially Designated Nationals List (SDN List), impose strict liability. Therefore, if an OFAC violation occurs, a company ultimately could be held responsible. Period. FCPAR: How can a company make sure that it is protecting itself against both risks in its compliance programs when onboarding a third party and monitoring it? Should it be including both issues in its risk assessment of the third party? Waite: Here again, with respect to third-party representatives and distributors, the overarching compliance concern is to know that third party and their business, and to secure assurances from that third party, and, in some cases, to regularly review or audit that third party. As a practical matter, the vetting of third parties is an information collection process. Many companies will require third-party representatives to answer detailed questionnaires about their relationships with government officials and sales to the government, as well as about their compliance and ethics commitments and record. This same interrogatory process can incorporate fact-finding with respect to the third party s dealings with prohibited parties and countries and handling of the reexport of U.S. controlled items where appropriate. Moreover, the agreement governing the conduct of third parties should incorporate not only anti-corruption representations and
warranties, but also U.S. sanctions representations and warranties. Lastly, periodic reviews of the third party s business conduct can easily take into account anticorruption and sanctions concerns. [See The FCPA Report s series on third-party contracts, A Guide to Anti-Corruption Representations in Third-Party Contracts: Nine Clauses to Include (Part One of Two), The FCPA Report, Vol. 3, No. 13 (Jun. 25, 2014); Clauses for High-Risk Situations and Enforcement Strategies (Part Two of Two), Vol. 3, No. 14 (Jul. 9, 2014).] FCPAR: M&A also brings with it significant corruption and trade sanction risk. Are there advisable ways to integrate corruption and trade sanction diligence when acquiring a target company? Kang: Although the M&A diligence that needs to be conducted with respect to anticorruption issues and sanctions issues are not identical, there are practical ways of merging that process that may create synergies and cost-efficiencies. First, the acquirer can require a target to complete a pre-acquisition questionnaire that addresses both anticorruption and sanctions issues. That questionnaire should be aimed at identifying the business units, employees and third-party relationships that require further diligence and more detailed information. For example, the acquirer may want to ask the target to identify all countries that it has transacted business with in the past five years. If the answer includes a country that is sanctioned or that is known to be a diversion point for goods or services destined to a sanctioned country or to otherwise have dealings with sanctioned countries, and/or if it includes countries considered at high-risk for corruption, the acquirer will want to follow up and examine the nature and extent of that business, whether it is ongoing, and what, if any, licenses were obtained to conduct business there. Second, the acquirer will want to ensure that one team is performing both the anticorruption and sanctions diligence. Therefore, not only should there be one core internal team at the acquirer overseeing both components of the diligence, but the acquirer will also want to retain one outside firm experienced in both FCPA and sanctions compliance to conduct both areas of diligence. To the extent that a forensic accounting firm is brought on to assist in reviewing accounting, transactional and other financial data, the acquirer will want to retain a firm that is well-versed in collecting and analyzing the type of data that is relevant in anti-corruption and sanctions matters. For example, in the anti-corruption context, that will include a review of accounting records to flag payments that have unusual designations (e.g., cultural fee or miscellaneous fee ) or unusual payments for hospitality, travel, entertainment, gifts, charitable donations and political contributions. In the sanctions context, that will include a review for transactions that may involve stripping, and a screening of all parties to transactions against the SDN List compiled and maintained by the Treasury Department, and analysis of potential diversion to prohibition countries or persons.
Lastly, the acquirer should ensure that the merger/acquisition agreement contains representations and warranties regarding compliance with both the anti-corruption and sanctions laws. FCPAR: What are some internal controls breakdowns that could lead to both FCPA and trade sanctions violations? Kang: A company s failure to have strong internal policies and procedures related to diligence on its customers, business partners and third parties is a common breakdown that can lead to both FCPA and sanctions violations. Being willfully blind to the FCPA violations committed by a third party can also result in liability for the company which contracted with that third party. Similarly, in the sanctions context, if, for example, a bank fails to conduct adequate diligence on a customer that was evading sanctions restrictions by altering or omitting instructions in payment messages related to sanctioned countries (a process known as stripping ), then the bank may be liable for sanctions violations. deferred prosecution agreements and three criminal plea agreements with Weatherford subsidiaries, and a total fine of over $252 million. The Weatherford settlement is the most significant resolution to date where FCPA and sanctions violations have been resolved concurrently. In that regard, it exhibits that there is a significant level of cooperation that is ongoing among the DOJ, SEC and OFAC. That is likely a signal that more inter-agency investigations and enforcement actions may be forthcoming. Companies should therefore be proactive and take steps to unify their anti-corruption and sanctions compliance programs. FCPAR: Does the Weatherford action shed light on how trade sanctions and bribery actions can inter-relate and how the government may treat them? Kang: The Weatherford settlement was a global resolution of long-running FCPA, export controls, and sanctions investigations that involved five different U.S. law enforcement agencies, including the DOJ, SEC and OFAC. The global settlement concluded with two