When it comes to OFAC sanctions violations, honesty is the best policy. Promptly and voluntarily disclosing violations upon their discovery can pay serious dividends.

So was the case for Nasdaq, Inc., which this week settled Iran sanctions violations in what could have been a $458 million OFAC penalty, for just $4.04 million, less than 1% of the applicable statutory maximum.  For those who view compliance as an investment, that is quite the return.

The violations in question go back to 2008 and relate to a one-time foreign subsidiary of U.S.-based Nasdaq, Nasdaq OMX Armenia OJSC, which owned and operated the Armenia Securities Exchange from 2008 until 2019. Nasdaq Armenia became a subsidiary of Nasdaq by way of a 2008 merger between Nasdaq and a Swedish firm, OMX Group.

In addition to ordinary securities exchange services, Nasdaq Armenia also offered access to overnight liquidity loans and foreign exchange services to Armenian financial institutions. Nasdaq Armenia’s role in facilitating these transactions was limited––the company did not lend any money itself, nor did it provide an exchange service where financial transfers occurred. Rather, Nasdaq Armenia offered a platform, matched lenders and borrowers, and provided transaction settlement information to the Central Bank of Armenia based on participants’ net obligations. The Central Bank used this information to settle payment orders between the relevant Armenian financial institutions. For its part, Nasdaq Armenia earned a mix of subscription, terminal, and transactional fees.

Nasdaq Armenia also offered foreign exchange services to Armenian banks. This service operated much like its credit resource platform; Nasdaq Armenia provided the platform and matched buyers with sellers, processing settlement orders through its account with the Central Bank. And again, no actual financial transfers occurred through Nasdaq’s platform––this was all done at and through the Central Bank.

One of the approximately 35 institutions credentialed to participate on Nasdaq Armenia’s platforms was Mellat Armenia, the Armenian subsidiary of Iran’s state-owned Bank Mellat. This would prove problematic.

In October 2007––a few months before a merger added the Armenia Securities Exchange to the Nasdaq group of companies––OFAC added Mellat Armenia to the list of Specially Designated Nationals and Blocked Persons. Later on, in October 2012, new Iran sanctions prohibited Nasdaq Armenia from providing services to Iranian government institutions, a list that naturally included Iran’s state-owned bank.

According to internal documents cited by OFAC in its settlement with Nasdaq, Nasdaq conducted a risk assessment in July 2012 which noted that its Armenian subsidiary provided services to Mellat Armenia. In its responses to the risk assessment questionnaire, Nasdaq Armenia noted that Mellat Armenia was owned by the government of Iran.

In other words, by the time that the sanctions took effect later that year, Nasdaq had notice that its foreign subsidiary serviced the Iranian government. This was made known to Nasdaq’s legal and compliance teams again in 2013, in another risk assessment questionnaire. OFAC charitably attributed this to an insufficient understanding of the law.

For the period from December 2012, when the sanctions took effect, until 2014, Nasdaq Armenia facilitated services to Mellat Armenia in the amount of $227,915,023. Because Nasdaq Armenia’s activities would be prohibited for its U.S.-based parent company, Nasdaq is liable for the violations.

In late 2014,  Nasdaq submitted an initial notice of voluntary disclosure with OFAC, to give notice of the apparent violations. The company also wound down its ownership stake in the Armenia Securities Exchange altogether. According to OFAC, Nasdaq Armenia earned just $16,000 in commission and fees from processing the transactions at issue, and in so doing, created a nine-figure sanctions liability.

$227.9 million is not a small amount of money, and facilitating transfers for the Iranian government in that amount could have cost Nasdaq a statutory maximum civil monetary penalty of $458,503,738. Highlighting the immense value of voluntary self-disclosure and cooperation, OFAC assessed a nominal (relatively speaking) fine of just $4.04 million.

Nasdaq mitigated its penalty so effectively for several reasons. The company voluntarily disclosed the apparent violations and fully cooperated with OFAC’s investigation. Nasdaq also made a laudable effort to shore up its sanctions compliance program––establishing a dedicated sanctions working group, implementing new trainings, enhancing its screening software, and undertaking reviews of its compliance programs. On top of that, Nasdaq also divested itself of its Armenian subsidiary.

The Nasdaq Armenia case serves as a cautionary example of the sanctions risks associated with cross-border mergers and acquisitions. Companies must integrate compliance functions directly into the M&A process, and for multinational entities especially, undertake routine sanctions risk assessments. Risk assessments are essential to gauge a foreign subsidiary’s sanctions risk, its internal awareness of sanctions compliance obligations, and the efficacy of its sanctions screening software.

Above all else, this case is a testament to the value of prompt voluntary disclosure of apparent sanctions violations. Nasdaq dodged a bullet––or at least 99% of one––by being forthcoming with regulators as soon as it learned of the problematic transactions. Clearly, that honesty paid off big time.