With roughly 12,000 names now associated with the Specially Designated Nationals and Blocked Persons List (“SDN”),[1] layered sanctions on activities with Russia, and growing sanctions on China activities, U.S. sanctions have reached the forefront of U.S. government enforcement policy. On March 2, 2023,[2] the U.S. Department of the Treasury, Department of Commerce, and Department of Justice released a Joint Compliance Note, which is evidence that the three departments are coordinating to enforce U.S. sanctions and export controls, particularly those on Russia/Belarus activities. The Joint Compliance Notes provides that companies in the trade are primarily responsible for sanctions compliance:

“Effective compliance programs employ a risk-based approach to sanctions and export controls compliance by developing, implementing, and routinely updating a compliance program, depending on an organization’s size and sophistication, products and services, customers and counterparties, and geographic locations. Companies such as manufacturers, distributors, resellers, and freight forwarders are often in the best position to determine whether a particular dealing, transaction, or activity is consistent with industry norms and practices, and they should exercise heightened caution and conduct additional due diligence if they detect warning signs of potential sanctions or export violations.”

It is clear that enforcement of sanctions by Treasury’s Office of Foreign Asset Control (“OFAC”) commonly focuses on banks and financial institutions, but what about commercial players mentioned in the Joint Compliance Note? Like many other areas of federal government enforcement, OFAC tends to investigate where it knows it will get a hit – what I call low-hanging fruit – which are recent mergers or acquisitions where no risk assessment was conducted for sanctions compliance. OFAC is actively looking for mergers and acquisitions where sanctions violations were not part of the due diligence review. OFAC is searching beyond companies in the financial sector, as the agency’s recent actions have caught logistics companies, freight forwarders, oil and gas companies, and companies that offer digital platforms, software, and related services.

As of January 13, 2023,[3] OFAC penalties can range from $16,108 to $1,771,154 for each violation, depending on the statute and sanctions provision that was violated. Additionally, recordkeeping violations can range from $1,377 to $68,928, depending on the type of recordkeeping violation that was committed. As evidenced from past enforcement actions, mergers and acquisitions often have a combination of these violations. Here are some examples.

The Oil and Gas Industry is particularly implicated by recent sanctions on activities in Russia and Belarus, which evolved from prior sanctions on the Russia industry stemming from the country’s invasion of Crimea. On April 1, 2023, OFAC settled with S&P Global for $78,750 after it violated the prior Russia sanctions on oil and gas activities.[4] The genesis of the violations occurred in August 2016, when S&P Global acquired Petroleum Industry Research Associates, Inc. (“PIRA”), which was “a U.S. company that provided research and forecasting products and services to over 500 energy and commodity customers in 60 countries.” In the public enforcement release, OFAC warned other companies that “after merger and acquisition transactions are complete, companies should continue to closely oversee their new business elements in addition to their existing units to identify any additional sanctions-related issues and take appropriate preventative or remedial measures.”

International shipping and logistics providers, including freight forwarders and brokers, are not immune from OFAC’s enforcement actions, even if they are non-U.S. companies. On April 25, 2022, OFAC settled with Toll Holdings Limited (“Toll”) for roughly $6.1 million for violations of several sanction regimes, such as Iranian and Syrian sanctions.[5] Toll is an Australian freight forwarding and logistics company, and in 2007, it began to acquire a number of freight forwarding companies in the Asia-Pacific region, acquiring nearly 600 invoicing, data, payment, and other system applications spread across its various business units over the following decade. The violations arose when Toll was integrating the operations of these acquired companies, which did not have U.S.-focused compliance policies and were not required to be in compliance with U.S. sanctions before. The nexus to the U.S. sanctions was Toll’s use of U.S. financial institutions to process the payments for those transactions. Note that Toll was able to mitigate a $826.4 million penalty to $6.1 million (a rough difference of $820 million) by filing a voluntary self-disclosure.  As part of its compliance considerations in the enforcement publication, OFAC stated:

“This action further emphasizes the need for entities to identify and implement measures to mitigate sanctions risks when merging with or acquiring other enterprises. The need for such efforts can be particularly acute when expanding rapidly, including when disparate information technology systems and databases are being integrated across multiple entities. In such cases, the need to adequately resource compliance functions, including compliance personnel and sanctions-related technology and systems, is especially important.”

OFAC also targets services that include digital platforms and other software, as they can be used by sanctioned individuals or in sanctioned jurisdictions. As of March 30, 2023, Wells Fargo agreed to remit $30,000,000 to settle its penalty liability across multiple sanctions programs.[6] Across several years, Wells Fargo and its predecessor in Europe, Wachovia Bank, provided software that was used to process transactions with U.S.-sanctioned jurisdictions and persons. OFAC warned that this “emphasizes the necessity for comprehensive due diligence regarding potential sanctions risk when one entity acquires another through merger or acquisition.”

A reoccurring theme in OFAC’s enforcement of U.S. sanctions is the lack of due diligence in mergers and acquisitions, whether this lacking occurs in the stages of negotiation and review, or whether the errors emerge during integration of operations. Before merging with or acquiring another company, your due diligence audit should include a review for risk of violations of U.S. sanctions by an expert in the field.  During integration, the compliance operations of the entities should be in harmony. Maintaining an up-to-date screening system is crucial for proactively avoiding risk of violating U.S. sanctions. Transactions should be reviewed annually (or more often), and when errors are discovered, a well-crafted and timely voluntary self-disclosure can mitigate or shield a company from penalties. Outside trade counsel are effective tools during a due diligence review prior to a merger or acquisition, for assistance in integration of operations for compliance, and to mitigate risk of civil liability when violations occur.

[1] Specially Designated Nationals and Blocked Persons List, Released April 4, 2023 (https://www.treasury.gov/ofac/downloads/sdnlist.pdf).

[2] Department of Commerce, Department of the Treasury, and Department of Justice Tri-Seal Compliance Note: Cracking Down on Third-Party Intermediaries Used to Evade Russia-Related Sanctions and Export Controls, Released March 2, 2023 (https://www.bis.doc.gov/index.php/documents/enforcement/3240-tri-seal-compliance-note/file).

[3]Inflation Adjustment of Civil Monetary Penalties, Department of the Treasury,  88 FR 2229, (Jan. 13, 2023) (https://www.govinfo.gov/content/pkg/FR-2023-01-13/pdf/2023-00593.pdf).

[4] OFAC Settles with S&P Global, Inc. for $78,750 Related to Apparent Violations of the Ukraine-Related Sanctions Regulations in 2016 and 2017, U.S. Department of the Treasury, Enforcement Release April 1, 2023 (https://ofac.treasury.gov/media/921316/download?inline).

[5] OFAC Settles with Toll Holdings Limited for $6,131,855 Related to Apparent Violations of Multiple Sanctions Programs, U.S. Department of the Treasury, Enforcement Release April 25, 2022.  (https://home.treasury.gov/system/files/126/20220425_toll.pdf).

[6] OFAC Settles with Wells Fargo Bank, N.A. for $30,000,000 Related to Apparent Violations of Three Sanctions Program, U.S. Department of the Treasury, Enforcement Release March 30, 2023 (https://ofac.treasury.gov/media/931541/download?inline).