Well, we are still waiting for the “big” FCPA enforcement actions.  Do not get me wrong – they are coming.  My suspicion is that they are being held up and calculated with a splash to announce the results of the White House’s Global Anti-Corruption Memorandum focusing on the anti-corruption effort as a national security priority.  The landscape is ready for a splash and DOJ is certainly at the center of any public relations announcement regarding the global battle against corruption.  So, let’s hold our collective breaths.

In the meantime, the Treasury Department’s Office of Foreign Asset Control (“OFAC”) continues to chug along with enforcement actions that underscore the risk to global companies and the need to elevate sanctions compliance as a priority.

OFAC has made its intent clear as can be. In May 2019, OFAC announced a comprehensive framework for sanctions compliance.  By its notice, OFAC placed all global companies on notice – design and implement a robust and effective sanctions compliance program or face the obvious consequences.  OFAC has always been direct about its intentions.  The compliance framework was clear as to the specific requirements for an effective sanctions compliance program.  From my perspective, few companies have taken OFAC’s warning seriously, and instead continued to operate with other risks at the forefront.  These companies will ultimately pay the price for their failure to  respond and to implement a robust sanctions compliance program.

Unlike DOJ and the slow pace of Senate confirmations and resulting slowdown in enforcement actions, OFAC has continued its enforcement program with little diversion and delay.  So far this year, OFAC has announced 19 enforcement actions, totaling almost $19 million in civil penalties. OFAC has established itself as a strong enforcement actor with expanding relationships with DOJ and related criminal enforcement actions for violations of relevant trade sanctions.

Global companies are slowly recognizing the need to design and implement effective sanctions compliance programs. The complexity of the sanctions regulations raises even more risks for companies committed to compliance.  While the framework announced by OFAC was precedent setting in many respects, companies have to pay heed to OFAC’s pronouncements, and its enforcement actions coordinated with DOJ deferred prosecution agreements. As a consequence, it is clear that global companies are struggling to catch up with various OFAC compliance program requirements, including the need for annual training programs, and basic accountability across a global organization. 

OFAC expects companies to design and implement effective controls akin to anti-corruption compliance requirements. Companies can no longer hide behind claims of lack of resources or understanding of complex sanctions regimes. OFAC provides robust compliance information and guidance through its website and specific enforcement actions.

Aside from a basic annual training requirement, OFAC has challenged companies in two distinct areas: managing third-party distributors and supply chains.  We have pointed out repeatedly the risks that companies face when relying on third-party distributors and the need to confirm that no products are resold to prohibited parties. OFAC has repeatedly stated that a company can be held liable for redistribution of its products to a prohibited country to or person if the company has “reason to know” that the product may end up in the hands of a prohibited person or country.  As a result, companies are required to take appropriate steps to prevent prohibited resale of products through contractual representations, confirmation of compliance, and verification through collection of end user statements and relevant shipping and transactional documentation and data.  This requires effort and commitment.

On the flip side, companies also face sanctions compliance challenges in opening up and reviewing their respective supply chains to determine if the vendor/supplier relationships include any prohibited parties or materials sourced from a prohibited country.  Again, this requires effort and commitment.  A company’s ability to obtain such transparency is complicated by the lack of privity between the company and its downstream suppliers. 

As a consequence, the company has to devote attention and seek leverage over its direct suppliers and push down through contracts and audit rights the ability to verify and understand its supply chain.  In this way, companies have to conduct supply chain audits regularly.  Luckily, this process produces immediate data that is helpful for compliance but usually is part of overall operations functions to manage a company’s overall supply chain. Since the disruptions caused by the COVID-19 pandemic, companies are obviously dedicating more resources and attention to this area, and compliance may be able to freeride (or freeload depending on your perspective) on the overall corporate attention to supply chain management.