The Office of Financial Assets Control, which enforces U.S. sanctions around the world, is one of the most powerful U.S. agencies fighting financial crimes.
One of the most powerful agencies in the United States鈥� international fight against terrorism, drug trafficking, and money laundering is the (OFAC), the regulatory body that enforces U.S. sanctions around the world.
The main way OFAC exercises its power is by carefully monitoring international business activity and prosecuting or fining financial institutions and companies that it determines are in violation of U.S. policy.
In theory, organizations that find themselves in violation of any U.S. sanctions are encouraged 鈥� though not explicitly required 鈥� to report the violation to OFAC. This makes self-reporting to OFAC an organizational judgment call, one complicated by the fact that OFAC is not shy about handing out hefty penalties to violators, especially if they don鈥檛 self-report. In 2019, for example, and a total of $2.2 billion for violating multiple sanctions; and in 2020, OFAC has taken 18 actions totaling more than $18 million.
Another concern for multinationals is that OFAC鈥檚 former focus on financial institutions has expanded to include more investigations into corporate malfeasance, especially in the tech sector, which has prompted many international corporations to re-evaluate their anti-money laundering (AML) screening protocols with OFAC鈥檚 long reach and heavy hand in mind.
Holding executives accountable
At this year鈥檚 national conference for the聽ACAMS), held virtually in September, in a session entitled, The Latest on Sanctions: Enforcement Actions and Emerging Trends, panelists discussed OFAC鈥檚 impact on multinational organizations.
, a compliance expert for Accuity, kicked off the discussion by pointing out that in addition to aggressively pursuing companies for sanctions violations, OFAC has also become much more inclined to hold individual executives accountable. 鈥淭his should be made clear to everyone, because it is likely to set a precedent,鈥� Gaudel said. There are personal risks for 鈥渂usiness executives who engage in willful sanction violations,鈥� he warned, because penalties for individuals can reach $20 million and 30 years in prison.
This year, two-thirds of the organizations OFAC has taken action against have been corporations, not financial institutions, Gaudel noted. 鈥淭his is important because it clearly sends the message that sanctions compliance is for every company, not only for banks.鈥�
A more aggressive OFAC
When it comes to sanctions, the larger issue facing many multinational corporations is their relationship to the United States. 鈥淭he U.S. financial system is the largest in the world, and is also the biggest risk you have as an international institution,鈥� said panelist , co-head of Morrison & Foerster鈥檚 National Security Practice and a former OFAC regulator. In many ways, the U.S. exerts its power around the world through sanctions, and 鈥淥FAC has been incredibly aggressive about enforcing U.S. nexus through the U.S. financial system,鈥� Smith added. This means that financial institutions or companies that don鈥檛 even do business in the U.S. 鈥� but may have some connection to a U.S. entity through their supply chain 鈥� can be considered by OFAC to be part of the U.S. financial system, and therefore subject to prosecution.
Another way that OFAC has expanded its reach is by expanding the definition of a 鈥淯.S. person鈥� to include almost any foreign person or entity that has even the remotest connection to the U.S. financial system.
鈥淎 lot of foreign entities are triggering U.S. jurisdiction for things they might not have expected,鈥� said Melissa Duffy, a partner at Dechert. 鈥淔or example, if you鈥檙e using a U.S. server or some sort of U.S. web platform or software-as-service that is being hosted in the U.S., but your business is otherwise outside the U.S. 鈥� that鈥檚 another way that, through the tech sector, OFAC can exercise jurisdiction over foreign persons.鈥�
Self-report or not?
Not surprisingly, and increasingly aggressive tactics are prompting many organizations to reconsider whether and when to report sanctions violations to OFAC. Reporting is technically voluntary, and usually results in leniency; however, self-reporting can also backfire and result in a fine. Still, according to Accuity鈥檚 Gaudel, organizations that choose not to report a sanctions violation to OFAC are, if caught, penalized an average of 10-times more than those who self-report.
Still, there are circumstances where a company may reasonably choose not to report an apparent sanctions violation to OFAC, especially if it is a minor, one-time occurrence, but such decisions should be considered carefully, said MoFo鈥檚 Smith. 鈥淐ompanies that have committed an apparent violation but choose not to report it are taking a real risk, not only with the penalty they may receive, but also with their reputation,鈥� he explained, adding that in such cases, 鈥測ou are far more likely to get hammered by a more significant penalty, as well as a tarnished reputation that will be publicly disclosed.鈥�
According to Dechert鈥檚 Duffy, OFAC has developed a particular interest in tech companies that process payments as part of their business. 鈥淥FAC is reaching a lot of companies that you don鈥檛 think of primarily as a payment company, but the payment activity is an important part of what they do,鈥� she explained. And because 鈥淯.S. person status鈥� can be triggered by almost any financial association with any business, Duffy said, extremely thorough screening protocols are paramount.
鈥淵ou need to focus not just on your customers, but on all third parties that are feeding into your digital services platform,鈥� Duffy said. 鈥淭his includes parties that are uploading content onto your platform, or parties that you may be engaging to support your digital service, as well as your customers鈥� customers 鈥� people who are buying their digital services or content.鈥�
Potential sanctions violations can lurk in the unlikeliest places, the panel agreed, so thorough due diligence in AML compliance can pay huge dividends.treasury
