Even the mighty can fall – Apple agreed to pay OFAC $467k for violations of the Foreign Narcotics Kingpin Sanctions regulations.

In 2008, Apple entered into an applications development agreement with SIS, a Slovenian company.  SIS and its director and majority owner, Savo Stjepanovic, were designated under the Foreign Narcotics Kingpin Designation Act and added to the Specially Designated Nationals List (“SDN List”).

Apple’s screening tool failed to identify SIS and Stjepanovic.  According to Apple, its screening tool failed to match different upper case and lower case letters that appeared in Apple’s system and the SDN List.  Specifically, Apple claimed that its screening software failed to match the upper case name “SIS DOO” with the lower case name “Sis d.o.o.”   The term “d.o.o.” is a standard corporate suffix in Slovenia identifying a limited liability company.

Two months after OFAC’s designation of Stjepanovic, Apple facilitated the transfer of a portion of SIS’s applications to a second software company, which several months later, transferred the ownership of SIS’s remaining applications to a third company.  The owner of the company substituted its banking information for payments.  Apple failed to re-screen the parties to these transactions. 

Apple acknowledged that the address in its system matched the address listed in the SDN designation.  Apple also incorrectly listed Stjepanovic as an “account administrator” rather than as a “developer,” and only screened developers rather than account administrators.

Apple hosted a number of applications in its Application Store, and allowed downloads and sales of the blocked SIS applications, received payments from the Application Store users who downloaded the locked SIS applications, permitted SIS to transfer and sells its applications to two other developers, and remitted to SIS each month the revenues produced by the locked SIS applications.

Apple discovered the violations in February 2017 when it upgraded its sanctions screening tool.  Apple’s finance team immediately suspended payments to the SIS account.  However, it took Apple multiple months to suspend payments to a third party that processed payments for SIS.

In total, Apple made 47 payments to SIS in violation of OFAC sanctions.  Apple collected about $1.2 million over 54 months from customers who downloaded SIS applications.

Apple voluntarily disclosed the matter and promptly cooperated with OFAC requests for documents and further information.

To remediate the violations, Apple enhanced its compliance program and internal controls by increasing the role of the Global Export and Sanctions Compliance Senior Manager in the escalation and review process.  Apple also re-configured its primary sanctions screening tool and instituted mandatory training for all employees on export and sanctions regulations.