A recent conversation with a head of legal of a Fortune 500 technology company relating to the current challenges of complying with U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) restrictions brought to mind a couple of tips that are important for all senior legal and compliance professionals at companies with cross-border operations. Unlike certain other areas of the law that mandate reporting or disclosure, in general, disclosing violations to OFAC is voluntary, so that any decision on whether to disclose should be mindful of relevant considerations. Here are a couple of practical tips to consider in that process:

Tip #1: Not all attorneys advising on economic sanctions enforced by OFAC take the same approach to risk mitigation and having a trusted legal adviser that is well-suited for your needs can make a world of difference.

Some of these differences relate to attorneys' own risk-tolerance, industry expertise and corporate transactional versus enforcement experience. For instance, I have encountered some attorneys who have a low risk tolerance and advise disclosure to OFAC of virtually any and every apparent violation of OFAC. These attorneys believe in general that the downside risk of a potential enforcement action outweighs the upside of potentially avoiding the costs (legal, financial, reputational) involved in making such a disclosure. A very conservative approach such as this one probably will not be a good fit where your business and your management values risk-taking and believes that the company's success directly relates to the company's ability to take significant risks that others would not.

I also have worked with companies where industry expertise is critical because the manner in which OFAC risks manifest themselves is quite particular to their industry—for example, understanding how sanctioned country information appears in IATA codes in the airline or air cargo industries, or how export control mandatory reporting regulations for technology companies (enforced by the U.S. Department of Commerce) impact OFAC disclosure decisions.

Relying on advice from an attorney that does not know your business well enough to identify OFAC liabilities and practical remedies can result in missed opportunities to efficiently mitigate risk. Finding a good OFAC legal adviser “match” for you, your company and your current circumstances can make the difference between a bad, good or great outcome regarding OFAC liabilities that inherently lurk in cross-border commercial activities.

Tip #2: When thinking about OFAC voluntary disclosure, it is useful to examine both the—Why? and Why Not?—regarding such disclosure.

On the Why Not side, there are substantial reasons companies may opt not to disclose in a particular situation. For instance, any disclosure to the US government potentially exposes a company to more scrutiny than bargained for, such as in the form of informal or formal information requests, or even subpoenas. The financial costs of making a valid disclosure also are significant and frequently include internal investigation, interviews, document review and more. Governmental disclosures of possible wrongdoing also can hurt a company's reputation, with customers, partners and stakeholders, and potentially lead to shareholder derivative suits. And last, but not least, OFAC may never find out (surely, OFAC discovers only a small minority of total wrongdoing), which itself makes tempting the option of avoiding the pain associated with disclosure.

With such significant possible downsides, then, why do companies, both big and small, routinely voluntarily disclose violations to OFAC?

Often, legal requirements or commercial circumstances compel disclosure. Some legal issues relate to: US Securities and Exchange Commission (SEC) regulations that require public companies to disclose material information and certain activities relating to Iran; OFAC regulations requiring reporting of “blocked property” of sanctions targets; and financial auditors' need to review material corporate liabilities.

Commercial circumstances that may, as a practical matter, compel an OFAC disclosure include M&A diligence that uncovers an OFAC problem and a buyer's demand for disclosure; lenders' agreements containing standard OFAC representations and warranties that mandate disclosure; and third parties' (such as a financial institution) knowledge of the violation because of their involvement in the underlying commercial transaction.

Similarly, although not a mandatory criterion, a cost-benefit analysis of legal penalty mitigation (for example OFAC extends an automatic minimum 50% voluntary disclosure credit) and mitigation of reputational harm (disclosure versus exposure) are important factors to consider when weighing whether to voluntarily “out” yourself to OFAC.

Bonus Tip: Regardless of whether a voluntary disclosure will be made, a company will want to take certain actions such as:

• Remediation—stop the bleeding and fix the problem to mitigate against future violations and reduce potential exposure in case an enforcement action ensues. In the post-ZTE enforcement era, disciplinary actions for employees involved in wrongdoing is more important than ever.
• Communication of the fixes—management and employees, especially those who knew of the apparent violation, should be reassured, in order to mitigate against whistleblower exposure and to improve corporate culture and morale.
• Maintaining relevant records—OFAC's recordkeeping requirements provide helpful guidance on what documents you will want to preserve.

Working these few points into a compliance strategy will facilitate more effective management of the inevitable OFAC challenges that confront companies engaged in cross-border business.

Joanna Ritcey-Donohue is the founder of JRD Law PLLC in Washington, D.C.  JRD Law represents the largest and most sophisticated sovereign and multinational corporate clients in matters relating to complex cross-border risk, corporate governance and compliance legal counseling.