In a once-sleepy corner of the U.S. Treasury Department, regulation of overseas conduct is going strong.

Last month two European banks filed record settlements with regulators, replete with embarrassing emails, and prayed that the story would quickly go away. The Barclays rate-manipulation scandal is still raging, while ING Bank’s $619 million fine for evading U.S. sanctions on Cuba and Iran truly lasted only a day. But ING is only the latest in a wave of sanction-busting deals that have cost European banks $2.5 billion since 2009. It punctuates a dramatic shift in the power of the Treasury Department’s Office of Foreign Assets Control, which in 2008 levied a total of $3.5 million in penalties. Until now, OFAC’s rise has been as unremarked in the press as it has been unexamined in court.

OFAC director Adam Szubin told Congress in 2007 that his agency’s fines needed to rise lest they be ignored as a cost of doing business. Congress promptly goosed the penalties under the International Emergency Economic Powers Act. (The IEEPA is the statute that authorizes all of the growing patchwork of U.S. sanctions, except for the Cuba embargo). But equally important, OFAC resolved to deter cheating on sanctions by making the most of its pre-existing authority.

In a series of collaborations with the Justice Department and the Manhattan District Attorney, OFAC has cracked down on evasive practices by European banks that routinely undermined U.S. foreign policy, especially with Iran. At the heart of most of the deferred prosecutions were claims that the banks engaged in a nervy practice known as “stripping”–routing funds from blacklisted nations through U.S. accounts while stripping them of identifying data.

Arguably, ING had the most damning facts but the strongest legal defense of the early settlers. According to the government’s factual statement, a “senior” ING in-house counsel emailed a compliance officer who raised questions in 2004 about the bank’s circumvention of Cuba sanctions: “[W]e have been dealing with Cuba … for a lot of years now and I’m pretty sure that we know what we are doing in avoiding any fines. So don’t worry and direct any future concerns to me so that we can discuss before stirring up the whole business.” As if this were not strong enough evidence of bad intent, the in-house counsel remarked that compliance was “killing the business away.”

But ING’s U.S. subsidiary kept its nose clean, and that gave the bank a potentially potent defense. True, under the amendments to IEEPA it’s a violation merely to cause a U.S. bank to commit a violation. However, most of ING”s conduct predated 2008 or involved Cuba. So how could the U.S. reach ING? The government’s main theory is that when a foreign bank routes a payment from (say) Iran into the U.S., it is illegally exporting a service to Iran. Some defense counsel regard this jurisdictional theory as aggressive. To them, OFAC is the Office that Forgot About Congress.

OFAC’s arguments have never been tested in court for three reasons (not counting foolish in-house counsel who make prosecutors’ jobs easy by writing smoking-gun emails). First, “trading with the enemy” is not something companies wish to be known for. Second, defendants fear that courts will defer to the government on national security. Third, and most importantly, OFAC wields a stick that amounts to a death penalty for a company with U.S. business ties. “If OFAC puts you on the Specially Designated Nationals list,” says Judith Lee of Gibson, Dunn & Crutcher, “you can’t sell a box of Chiclets to a U.S. company, and any U.S. property you have can be seized.” That’s even more draconian than the Foreign Corrupt Practices Act, where the ultimate penalty is merely debarment from U.S. government contracts.

In many ways, the regulation of economic sanctions has closely tracked the regulation of foreign corruption. Congress passed both the IEEPA and FCPA in 1977. Both became first-rank boardroom concerns during the 2000s, while the press was slow to notice. (It took the $1.6 billion Siemens deal of 2008 for the FCPA to get due coverage). And both have seen the regulatory hand extend overseas based on theories that companies have dared not test.

The expansion of regulators’ extraterritorial reach under the FCPA and OFAC’s statutes stands in stark contrast with the courts’ narrow construction of the overseas reach of U.S. laws under Morrison v. National Australia Bank. Some defense counsel think that the extraterritorial interpretation of OFAC’s statutes is vulnerable to judicial challenge, at least as to pre-2008 conduct. But banks with U.S. operations are in no position to fight back. For a bank without U.S. operations, a Morrison-style challenge to OFAC is not inconceivable, and would be fascinating to watch.

In the meantime, look for more big sanction-busting deals. That’s bad news for European banks, but good news for American foreign policy, and more business for a handful of well-positioned firms, like Sullivan & Cromwell, that excel at both litigation and bank regulation.

Largest Settlements (civil and criminal) under the IEEPA and Trading With the Enemy Act, to date:

• ING Bank N.V. (2012; $619 million in penalties; Sullivan & Cromwell of counsel)
• ABN Amro Bank N.V. (2010 and 2005; $580 million*; Sullivan & Cromwell, Davis Polk & Wardwell)
• Lloyds TSB Bank, plc (2009; $567 million; Sullivan & Cromwell, Linklaters)
• Credit Suisse AG (2009; $536 million; King & Spalding)
• Barclays Bank plc (2010; $298 million; Sullivan & Cromwell, Hogan Lovells)


*Includes undifferentiated money-laundering penalties.