Over an eight-year period ending in 2018, Murad, a U.S. cosmetics company, illegally exported goods and services to Iran in 62 separate transactions worth approximately $11 million.  Murad was acquired by Unilever United States (“Unilever”) in 2015.  Once discovered, Unilever voluntarily disclosed the conduct to OFAC.

The fallout from Murad’s long-running conspiracy: Unilever paid $3.3 million to OFAC for its Iran Sanctions violations.  Interestingly, OFAC prosecuted a former senior executive (“Executive-1”) from Murad and settled with Executive-1 for $175k.  Executive-1 committed three separate violations as the manager of Murad during the period between June 2016 and September 2017.  Executive-1 did not voluntarily disclose his/her conduct.

OFAC credited Murad for voluntarily disclosing the conduct but found that the conduct was an “egregious” violation under its penalty assessment factors.

The Conspiracy and Unilever’s Acquisition

The conspiracy was hatched in December 2009, when Executive-1, other Murad executives and the CEO of an Iran distributor entered into an exclusive agreement to sell Murad’s products in the middle East, including Iran.  Executive-1 signed the distribution agreement, and Murad began exporting its products to Iran through the distributor while Murad had a pending application before OFAC for a specific license.

In May 2015, Executtive-1 signed a new distribution agreement with the same Iran distributor’s CEO for a related UAE-based company to become Murad’s sole distributor in the Middle East.  Iran was not specifically mentioned as an authorized territory, but Murad and Executive-1 “should have understood” that the UAE distributor would continue to export products to Iran.

In July 2015, Unilever agreed to acquire Murad.  The transaction closed on September 1, 2015.  During this interim period, Murad submitted another application to OFAC for a specific license to export its products to Iran.  Murad continued to export products to Iran even though it never received a specific license to do so.  Murad also provided support to the UAE distributor to open and operate a Murad-branded store in Tehran, Iran.

Murad never disclosed to Unilever its prior and ongoing business activities involving Iran.  Unilever did not discover the conduct during its pre-acquisition due diligence of Murad.  Unilever never discovered that Murad maintained a website for its Iran business activities under the web address – “Murad.ir”  The Murad website in Iran was active from September 1, 2012, until December 5, 2018, more than three years after Unilever acquired Murad.

Unilever discovered Murad’s business activities in Iran on October 20, 2015, six weeks after the acquisition closed, when a Unilever US employee received an email sent from the UAE distributor’s CEO to a senior Murad executive, explaining the time it took for Murad’s products to reach Tehran from the United States. The next day, Unilever’s general counsel directed Executive-1 to instruct the UAE distributor to cease all exports of Murad’s products to Iran. Executive-1 issued that instruction.  Prior to doing that, however, Executive-1 alerted another Murad executive of the need to ensure that the UAE distributor would not ever state that any Murad senior executive approved the export of Murad’s products to Iran.

Subsequently in January 2016, Executive-1 inquired of Unilever’s counsel whether there were any changes to the Iran Sanctions Program following the Joint Comprehensive Plan of Action.  Unilever’s counsel advised Executive-1 that no relevant prohibitions had changed.

Despite learning the then-current legal situation, Murad senior executives, including Executive-1, continued to work with the UAE distributor to export Murad’s products to Iran. In early 2017, in response to a specific inquiry from an Iranian salesman, Executive-1 asked a senior executive to revise Murad’s marketing materials to maximize the sales of its products.

Murad’s last export to Iran occurred on January 24, 2018.  After receiving an inquiry from Murad’s bank about specific payments involving Iran, Unilever again instructed Murad to advise the UAE distributor that it could not sell its products to Iran. Murad then placed an internal hold on all shipments to the UAE distributor.

Sanctions Compliance Deficiencies

OFAC cited several deficiencies in Murad’s compliance efforts, including the absence of a specific sanctions compliance program, high-level executive participation in illegal conduct, and the absence of any compliance structure in relation to the specific sanctions risks Murad faced.

Interestingly, OFAC cited specifically Murad’s reporting line on sanctions compliance issues to personnel in Unilever’s division in the United Kingdom.  Notably, OFAC cited the fact that the United Kingdom staff “lacked an adequate understanding of OFAC sanctions.”

Executive-1’s specific violations stemmed from his/her execution of the distribution agreements in 2015 and 2018 that resulted in the sale of Murad goods to Iran.

Lessons Learned

In describing the lessons learned, OFAC noted that firms with potential sanctions exposure should implement measures to ensure that senior management both commit to and maintain a culture of compliance throughout the company.  To this end, OFAC stated that senior executives with managerial responsibilities should “take particular care” to ensure awareness of applicable prohibitions by employees and refrain from [themselves] and prevent sanctions violations.

To reinforce an organization’s commitment to sanctions compliance, OFAC specifically cited that, “in some circumstances, placement of a U.S. entity under the compliance structure of a non-U.S.-entity that may lack familiarity with U.S. sanctions laws could prevent prompt identification of and response to potentially prohibited conduct.

Finally, OFAC noted that the Murad case underscored the importance of pre- and post-acquisition due diligence and integration to identify and promptly remediate compliance deficiencies. In particular, OFAC stated that once an acquisition closes, companies should closely oversee their new business to identify potential sanctions issues.  Compliance reminders by themselves may be inadequate to prevent a sanctions violation.