US Cos. With Foreign Affiliates Should Note OFAC Settlement

May 21, 2019Articles Law360

The U.S. Treasury Department's Office of Foreign Assets Control recently provided new guidance on what compliance measures it expects from U.S. companies with foreign affiliates. This guidance raised the bar on U.S. companies’ responsibility for the actions of their foreign affiliates.

OFAC reached a settlement with U.S.-based company Stanley Black & Decker Inc., or SB&D, and its Chinese subsidiary, Jiangsu Guoqiang Tools Co. Ltd., or GQ, on March 27, 2019, for GQ’s breach of U.S. sanctions. Pursuant to the settlement, SB&D agreed to pay $1.87 million for GQ’s export of products to Iran in violation of U.S. law.

In its settlement agreement, OFAC sets out explicit compliance commitments that it expects, which U.S. companies with foreign affiliates should use as guidance for their compliance programs.

SB&D acquired a controlling interest in GQ in 2013. SB&D discovered in its preacquisition diligence that GQ exports to Iran. Foreign subsidiaries of U.S. companies are generally prohibited from doing business with Iran under U.S. law, and any violation by the foreign subsidiary is deemed a violation by the U.S. company. SB&D made ceasing Iran sales a prerequisite condition of the closing of its deal with GQ.

After the acquisition, SB&D provided a series of trainings to GQ’s employees that specifically included OFAC sanctions training. Despite attesting in the acquisition agreement that it would not engage in transactions with Iran, and despite sanctions trainings, GQ continued to export goods to Iran behind SB&D’s back after closing. GQ exported or attempted to export 23 shipments to Iran. OFAC viewed each shipment as an individual violation.

SB&D disclosed the violations as soon as it discovered them and fully cooperated with OFAC’s investigation. OFAC, however, still viewed GQ’s willful violation and the continued economic benefit that Iran received as aggravating factors for SB&D.

OFAC makes it clear in the settlement agreement that a U.S. company’s obligations on sanctions compliance extend beyond closing of a transaction with a foreign affiliate. OFAC specifically notes SB&D’s failure to implement procedures to monitor or audit GQ’s operations to ensure that its Iran-related sales did not recur post-closing. The agency states that this case “highlights the importance for U.S. companies to conduct sanctions-related due diligence both prior and subsequent to mergers and acquisitions, and to take appropriate steps to audit, monitor and verify newly acquired subsidiaries and affiliates for OFAC compliance.”

U.S. sanctions are a strict liability regime. As such, a U.S. company’s good intentions regarding its foreign affiliate’s compliance will not protect it from violations. U.S. companies may be held liable for the activities of their foreign affiliates even where the U.S. company has no knowledge of the breach, and did not participate or facilitate it in any way.

OFAC included 26 compliance commitments in its settlement agreement that it expects to see from U.S. companies with foreign affiliates to ensure adequate sanctions compliance. These commitments fall under five overarching elements. U.S. companies should implement each of these elements as follows to ensure compliance:

  • Management Commitment: Ensure that senior management, including the CEO and general counsel, are committed to supporting the company’s compliance program; ensure that senior management promote a “culture of compliance” throughout the organization, provide adequate resources and ensure that management understands the seriousness of violations.
  • Risk Assessment: Conduct OFAC risk assessments frequently and in a manner that accounts for potential risks; develop a methodology to identify, analyze and address the particular risks identified; update risk assessments to account for root causes of apparent violations or systemic deficiencies.
  • Internal Controls: Design and implement written policies and procedures outlining the company’s sanctions compliance plan; maintain clear and effective internal methods to identify, escalate and report transactions and activity prohibited by OFAC regulations; clearly communicate the plan’s policies and procedures to all relevant staff; employ personnel to integrate the sanctions program.
  • Testing and Audit: Conduct periodic testing on specific elements of the program and address any weaknesses or deficiencies; upon learning of a confirmed negative testing or audit result, take immediate and effective action to identify and implement compensating controls until the root cause of the weakness can be determined and remediated.
  • Training: Ensure that the OFAC-related training program provides adequate information and instruction to employees and stakeholders; provide training with a scope that is appropriate for the products and services offered, clients and partner relationships maintained, and the geographic regions in which the company operates; include easily accessible resources and appropriate record keeping practices that are available to all relevant personnel.

Although each business may implement these elements differently, U.S. companies with foreign affiliates should adhere to the standards above.

It is particularly important for U.S. companies to periodically audit the activities of their foreign affiliates and verify their actions to ensure compliance. Even where affiliates are properly trained and have committed to adhering to U.S. law, it is still the responsibility of the U.S. company to ensure continued compliance. This is particularly important where the subsidiary has had any dealings with a sanctioned country in the past.

OFAC has established a trend in 2019 of punishing U.S. companies for the post-acquisition conduct of their foreign subsidiaries. Earlier this year, it imposed penalties against Kollmorgen Corporation for the post-closing sanctions violations of its Turkish affiliate despite extensive preacquisition diligence and compliance measures.

OFAC has also made it clear that it is not afraid to issue hefty penalties. It announced two settlements in April totaling more than $650 million with a U.K.-based bank, OFAC’s largest settlement amount in the last five years. The settlements were the sixth and seventh issued this year, the same number of settlements the agency issued in all of 2018.

These cases demonstrate the importance of establishing a comprehensive compliance program that includes not only predeal diligence, training and internal controls, but also post-closing followup due diligence, risk assessment, testing and auditing, as well as a strong commitment to compliance by management. OFAC expressly states that in the event of a violation, it will take into account the existence, nature and adequacy of a company’s OFAC compliance program in determining its enforcement actions and penalties.

Through the SB&D settlement, OFAC is putting U.S. companies on notice that it expects this type of robust monitoring and compliance with respect to foreign affiliates. The agency is clearly getting more aggressive with enforcement actions, both in terms of frequency and penalty amounts, so compliance has never been more critical.

Reprinted with permission from Law360(c) 2019 Portfolio Media. Further duplication without permission is prohibited. All rights reserved.