If there is one issue that is repeated over and over (and over), it is third-party risks.  Over the last ten years, we have witnessed an explosion in anti-corruption enforcement around the world.  And with this enforcement focus, it was inevitable that third-party risk would become one of the core areas for ethics and compliance programs. Indeed, the importance of third-party risk is underscored by the very structure and content of the FCPA statute, which expressly prohibits bribes paid through third parties or intermediaries.

Economic sanctions enforcement is a fast-rising risk for global companies.  For many years, the Treasury Department’s Office of Foreign Asset Control (“OFAC”) focused primarily on financial institutions.  Over the last ten years, OFAC has stretched its enforcement eyes towards software, manufacturing, telecommunications and technology companies.

With this growth in sanctions enforcement, OFAC has embraced an aggressive view of third-party risks.  Like the FCPA, under OFAC’s regime, third parties are not permitted to do what the primary company cannot do.  As a result, we have witnessed a steady increase in OFAC enforcement actions against global companies for failing to ensure compliance by third-party agents, distributors and other intermediaries.

The seminal case addressing OFAC’s enforcement of third-party conduct is Epsilon Electronics, Inc. v. United States Department of the Treasury, Office of Foreign Assets Control, U.S. Court of Appeals for the District of Columbia Circuit, No. 16-5118, Decided May 26, 2017.  The Court of Appeals threw out a portion of OFAC’s $4 million civil penalty against Epsilon Electronics for violations of the Iranian Transactions and Sanctions Regulations (“ITSR”). However, the Court of Appeals upheld OFAC’s broad interpretation of the ITSR that a violation occurs if an exporter has reason to know its exports to a third country are intended to be re-exported to Iran. In this respect, the Court upheld OFAC’s interpretation of its regulations that OFAC does not need to prove that exported goods arrived in Iran to establish a violation of the ITSR. The Epsilon Electronics case underscores the importance of conducting due diligence on distributors and managing risks that the distributor may transship goods to prohibited countries, entities or individuals.

Section 560.204 of the ITSR prohibits the export, reexport, sale or supply, directly or indirectly from the United States, or by a United States person, wherever located, of any goods, technology or services to Iran or the Government of Iran, “including the exportation, reexportation, sale or supply of any goods, technology, or services to a person in a third country undertaken with knowledge or reason to know (emphasis added) that: (A) [s]uch goods, technology, or services are intended specifically for supply, transshipment, or reexportation, directly or indirectly, to Iran or the Government of Iran . . .” The Epsilon Electronics Court noted that a finding of liability under Section 560.204 does not require OFAC to prove that the goods at issue actually arrived in Iran. 

The tricky question here is how to define “reason to know.” OFAC has explained that “reason to know” can be established “through a variety of circumstantial evidence,” including “course of dealing, general knowledge of the industry or customer preferences, working relationships between the parties, or other criteria far too numerous to enumerate.”

In the Epsilon Electronics case, the Court of Appeals cited the following evidence from the third-party’s English-language website: (1) the third-party in Dubai distributed exclusively in Iran during much of the period at issue; (2) the third-party presented itself as an affiliate of its Tehran company; (3) the third-party’s website “Contact Us’ page listed only two addresses, one in Dubai and the other in Tehran, and the “About Us” page cited the third-party’s ten years of experience in Iran’s market and extensive distribution network in Iran including a long list of sales agents located in Iran.

In addition to the available website information, the Epsilon Electronics Court cited direct evidence that the third-party had actual knowledge of the third-party’s connections to Iran, including: (1) Epsilon Electronics copied images from the third-party’s website and placed them on its own website displaying them in a photo gallery labeled “Iran;” (2) a freight manifest listed a shipment from Epsilon Electronics’ address directly to the third-party’s address in Tehran. 

Interestingly, the Epsilon Electronics Court reversed OFAC’s finding of “reason to know” for the last five shipments of the total of thirty-nine shipments at issue.  Specifically, the Court found that OFAC ignored evidence of several email conversations between Epsilon’s sales team and the third-party’s manager that the goods were being sold out of the third-party’s store in Dubai.  OFAC argued that the conversations were not credible but provided no explanation for that determination.  As a result, the Court reversed OFAC’s ruling that the last five shipments violated the ISTR.