You have to wonder how OFAC has the time to investigate and settle cases given its significant work implementing the Russia Sanctions Program.  But OFAC continues to demonstrate its commitment to aggressive enforcement. 

OFAC’s latest enforcement action focused on Toll Holdings Limited, a global logistics company that engaged in U.S. dollar transactions with prohibited entities.  Toll voluntarily disclosed the violations to OFAC but Toll was hit with a significant penalty — $6.1 million.

Toll is an international freight forwarding and logistics company based in Australia.  Toll agreed  to pay $6.1 million for 2,958 violations of multiple OFAC sanctions programs. Toll originated and received payments through U.S. banks involving sanctioned countries and individuals. Specifically, Toll arranged sea, air and rail shipment involving North Korea, Iran, Syria and Specially Designated Nationals (SDNs).

Between January 2013 and February 2019, Toll was involved in 2,958 payments in connection with shipments to and from North Korea, Iran, Syria and SDNs.  The payments totaled over $48 million and processed through four financial institutions in the US or foreign branches in the US.

The payments was divided among: 424 involved Mahan Airlines (327 of 424), Hafiz Darya Shipping Lines Company (97 of 424); and the remaining 2,534 transactions involved shipment to or from North Korea, Iran or Syria. These transactions involved 23 Toll entities in Asia, Europe, the Middle East and North America.

OFAC underscored the expansive global operations of Toll’s business operations. For example, Toll’s businesses would remit and receive payments in settlement of invoices for services performed by Toll for entities within its corporate structure, and Toll’s customers, agents, suppliers and other business partners.  Toll would frequently make or receive payments involving multiple shipments in a single invoice.  These invoices often contained transactions with sanctions countries or individuals as part of the overall charges.

Toll failed to adopt or implement policies and controls to prevent transactions involving OFAC-designated entities and individuals.  OFAC noted that Toll’s failure to implement reasonable compliance policies was the result of Toll’s rapid expansion without a commensurate increase in compliance resources.

Starting in 2007, Toll started to acquire a number of local or regional freight forwarding companies.  By 2017, Toll had almost 600 financial systems across its various business units.

Toll had a sanctions compliance policy but its personnel and associated controls did not keep up with the expanding risks stemming from its growing operations. By May 2015, Toll knew or had reason to know that various payments violated U.S. sanctions.

One of Toll’s banks restricted a subsidiary’s use of its U.S. dollar account after identifying a transaction involving Syria. To avoid potential bank blocking of a transaction, a Toll official instructed employee to avoid including the names of sanctioned jurisdictions on invoices going forward.  Subsequently, the bank raised concerns with Toll over compliance with U.S. sanctions.  Toll required documentation to demonstrate compliance with OFAC sanctions.

In July 2015, the CEO of one of Toll’s operating divisions emailed its employees reminding them of OFAC sanctions compliance.  Notwithstanding this communication, Toll’s primary bank continued to raise concerns about the efficacy of Toll’s controls. Toll’s compliance department repeatedly instructed business units to avoid transactions with prohibited countries, entities and individuals. But Toll failed to implement compliance policies and procedures to ensure compliance with sanctions.

In 2017, Toll introduced “hard controls” to disable country and location codes for ports and cities in sanctioned countries to prevent shipments to or from sanctioned countries.  Interestingly, of the 2,958 illegal payments, 2,853 occurred before Toll implemented these hard controls.

OFAC cited the fact that Toll acted with reckless disregard for OFAC’s sanctions over six year, notwithstanding Toll’s existing compliance initiative to comply with all applicable sanctions laws and multiple warnings from its bank.  After learning in May 2015 of potential violations of sanctions laws and regulations, Toll did not take immediate steps to address its continuing risks of transactions with prohibited entities. 

Toll received credit for voluntarily disclosing its conduct to OFAC and cooperated with the investigation by engaging a forensic accounting firm to analyze suspect financial transactions. To remedy its compliance deficiencies, Toll: (i) conducted a risk-mapping exercise to identify root causes of the violation; (ii) implemented an audit plan; (iii) restructured its compliance division; (iv) implemented a sanctions compliance division; (v) implemented “hard controls” in its freight management system; (vi) conducted risk-based screening of transactions, third parties and agents; (vii) ended all franchise relationships as part of a risk-mitigation strategy and adopted enhanced due diligence measures for on-boarding agents.

OFAC cited several significant themes under its “compliance considerations,” including the importance of instituting strong internal controls and procedures to govern payments involving affiliates, subsidiaries, agents or other counterparties; the risks posed by complex payment and invoicing arrangements; the need to respond promptly and fully to address compliance weaknesses when issues first arise and implement changes to address deficiencies in compliance programs, practices and procedures; and the need for entities to identify and implement measures to mitigate sanctions risks when merging or acquiring other companies.