In 2007, Congress significantly increased the arsenal of the Office of Foreign Assets Control (OFAC) for combatting violations of U.S. economic sanctions. Companies that engage in international transactions—and thus risk doing business with a potentially sanctioned country, entity or individual—should take heed of the trends that have emerged since that arsenal went live in 2009. Most importantly, it is critical that upon learning of a violation, a company retain counsel, conduct an investigation and self- report to OFAC as soon as practicable.

The U.S. economic sanctions penalty scheme

The economic sanctions that OFAC enforces prohibit U.S. companies from transacting with nations subject to U.S. sanctions (such as Iran, Cuba and North Korea) or specifically designated persons or entities who engage in narcotics trafficking, international terrorism, the proliferation of weapons of mass destruction and other prohibited activities. Penalties for violations of those sanctions were historically capped at $11,000. In 2007 (effective 2009), that statutory maximum increased to $250,000 per violation or twice the value of the underlying transaction. Under the new regime, the penalty amount depends on whether the transaction is deemed egregious (i.e., willful or reckless), as well as other factors set forth on OFAC's Enforcement Guidelines. Voluntary disclosure of violations to OFAC automatically halves the penalties whether or not the violation is deemed egregious.

Enforcement trends

In the four full years since OFAC instituted the enhanced penalties (2009-2012), the number of penalties imposed has averaged 23 per year as compared to approximately 200 per year in 2005 to 2008. Even excluding the many individual Cuba travel violations in the earlier period, the total number of penalties levied during that time significantly exceeds those imposed during the past four years. Meanwhile, the sums involved have climbed sharply. In 2008, just before the enhanced penalties became effective, total penalties (references to penalties include settlements) were approximately $3.5 million for 108 matters. By contrast, in 2009, the penalties were nearly $774 million for 27 matters, and in 2012, they exceeded $1.1 billion for 16 matters.

The penalty increase has primarily impacted financial institutions. Between 2005 and 2008, with the exception of $40 million paid by ABN AMRO Bank in 2006, the largest penalty payment by a financial institution for violating U.S. sanctions was $200,000. Since 2009, HSBC, Standard Chartered Bank, Barclays, ING Bank, Credit Suisse and Lloyds TSB Bank all agreed to make payments greater than $100 million, with ING paying the largest OFAC settlement ($619 million) in 2012. Notably, these penalties were all part of global settlements that included the Department of Justice and other law enforcement agencies.

Penalties paid by financial institutions never accounted for more than 26 percent of the total penalty dollars and ranged between 2 percent and 9 percent of the total number of penalties per year between 2005 and 2008 (excluding ABN AMRO's $40 million penalty in 2006). Yet financial institutions have accounted for 85 percent to 99.5 percent of the total penalty dollars in the past four years, and 11 percent to 38 percent of the total number of penalties. The recent shift in focus to financial institutions suggested by these figures combined with the decrease in the number of penalties implies a corresponding shift away from individuals (and particularly the Cuba travel prohibitions) and, at least at first glance, nonfinancial companies.

The penalties in the past four years also highlight the weight OFAC gives to each of the factors set forth in its Enforcement Guidelines. Although not exclusive, several of the factors figure more prominently in the analysis as to the severity of the sanction. First and foremost is the awareness of senior management of the unlawful activity, which, when present, essentially assures a finding of egregiousness. Another significant factor is the size and sophistication of the entity in question, which is directly tied to the existence of a compliance program. From OFAC's standpoint, the more sophisticated the entity, the less excusable the violation largely because entities should have economic sanctions compliance programs commensurate with their size, resources and sophistication and capture violations before they occur. Lastly, the question of if and how a company reported its violation, cooperated with OFAC in its investigation and altered its behavior in meaningful ways will be essential to the potential mitigation of civil liability. Self-reporting halves the penalty but also sets the tone and may carry additional weight in the mitigation analysis. Once reported, a company should cooperate fully and take all reasonable affirmative steps to prevent future violations. Indeed, there is some suggestion in the settlements that the failure to self-report once senior management is aware of the violations—even if that awareness arises from an after-the-fact investigation—may be sufficient for the transaction to be deemed willful or reckless.

Conclusion

A review of the penalties during the past four years demonstrates that though there have been fewer overall penalties imposed, the amount of those penalties has skyrocketed. Although financial institutions have felt the brunt of the increased penalties, and the decline in the number of penalties imposed suggests a shift in OFAC's focus away from individuals and nonfinancial companies, any company that engages in international transactions would be well advised to implement a robust compliance program that comports with the size and sophistication of the organization. And, of course, if a violation does occur, the need for immediate action coupled with self-reporting cannot be overstated.

In 2007, Congress significantly increased the arsenal of the Office of Foreign Assets Control (OFAC) for combatting violations of U.S. economic sanctions. Companies that engage in international transactions—and thus risk doing business with a potentially sanctioned country, entity or individual—should take heed of the trends that have emerged since that arsenal went live in 2009. Most importantly, it is critical that upon learning of a violation, a company retain counsel, conduct an investigation and self- report to OFAC as soon as practicable.

The U.S. economic sanctions penalty scheme

The economic sanctions that OFAC enforces prohibit U.S. companies from transacting with nations subject to U.S. sanctions (such as Iran, Cuba and North Korea) or specifically designated persons or entities who engage in narcotics trafficking, international terrorism, the proliferation of weapons of mass destruction and other prohibited activities. Penalties for violations of those sanctions were historically capped at $11,000. In 2007 (effective 2009), that statutory maximum increased to $250,000 per violation or twice the value of the underlying transaction. Under the new regime, the penalty amount depends on whether the transaction is deemed egregious (i.e., willful or reckless), as well as other factors set forth on OFAC's Enforcement Guidelines. Voluntary disclosure of violations to OFAC automatically halves the penalties whether or not the violation is deemed egregious.

Enforcement trends

In the four full years since OFAC instituted the enhanced penalties (2009-2012), the number of penalties imposed has averaged 23 per year as compared to approximately 200 per year in 2005 to 2008. Even excluding the many individual Cuba travel violations in the earlier period, the total number of penalties levied during that time significantly exceeds those imposed during the past four years. Meanwhile, the sums involved have climbed sharply. In 2008, just before the enhanced penalties became effective, total penalties (references to penalties include settlements) were approximately $3.5 million for 108 matters. By contrast, in 2009, the penalties were nearly $774 million for 27 matters, and in 2012, they exceeded $1.1 billion for 16 matters.

The penalty increase has primarily impacted financial institutions. Between 2005 and 2008, with the exception of $40 million paid by ABN AMRO Bank in 2006, the largest penalty payment by a financial institution for violating U.S. sanctions was $200,000. Since 2009, HSBC, Standard Chartered Bank, Barclays, ING Bank, Credit Suisse and Lloyds TSB Bank all agreed to make payments greater than $100 million, with ING paying the largest OFAC settlement ($619 million) in 2012. Notably, these penalties were all part of global settlements that included the Department of Justice and other law enforcement agencies.

Penalties paid by financial institutions never accounted for more than 26 percent of the total penalty dollars and ranged between 2 percent and 9 percent of the total number of penalties per year between 2005 and 2008 (excluding ABN AMRO's $40 million penalty in 2006). Yet financial institutions have accounted for 85 percent to 99.5 percent of the total penalty dollars in the past four years, and 11 percent to 38 percent of the total number of penalties. The recent shift in focus to financial institutions suggested by these figures combined with the decrease in the number of penalties implies a corresponding shift away from individuals (and particularly the Cuba travel prohibitions) and, at least at first glance, nonfinancial companies.

The penalties in the past four years also highlight the weight OFAC gives to each of the factors set forth in its Enforcement Guidelines. Although not exclusive, several of the factors figure more prominently in the analysis as to the severity of the sanction. First and foremost is the awareness of senior management of the unlawful activity, which, when present, essentially assures a finding of egregiousness. Another significant factor is the size and sophistication of the entity in question, which is directly tied to the existence of a compliance program. From OFAC's standpoint, the more sophisticated the entity, the less excusable the violation largely because entities should have economic sanctions compliance programs commensurate with their size, resources and sophistication and capture violations before they occur. Lastly, the question of if and how a company reported its violation, cooperated with OFAC in its investigation and altered its behavior in meaningful ways will be essential to the potential mitigation of civil liability. Self-reporting halves the penalty but also sets the tone and may carry additional weight in the mitigation analysis. Once reported, a company should cooperate fully and take all reasonable affirmative steps to prevent future violations. Indeed, there is some suggestion in the settlements that the failure to self-report once senior management is aware of the violations—even if that awareness arises from an after-the-fact investigation—may be sufficient for the transaction to be deemed willful or reckless.

Conclusion

A review of the penalties during the past four years demonstrates that though there have been fewer overall penalties imposed, the amount of those penalties has skyrocketed. Although financial institutions have felt the brunt of the increased penalties, and the decline in the number of penalties imposed suggests a shift in OFAC's focus away from individuals and nonfinancial companies, any company that engages in international transactions would be well advised to implement a robust compliance program that comports with the size and sophistication of the organization. And, of course, if a violation does occur, the need for immediate action coupled with self-reporting cannot be overstated.