As always, I tend to repeat myself.  However, one important point needs to be repeated — DOJ is in the midst of launching an aggressive sanctions and export control program against corporations and individuals.  DOJ has warned everyone, repeated this message in various speeches and, most importantly, assigned the resources — 25 new federal prosecutors to enforce sanctions and export controls — to back up its enforcement program.

The new model for sanctions corporate enforcement will look like FCPA enforcement — a partnership between the criminal DOJ prosecutors and civil enforcement: the SEC in the case of FCPA enforcement; and OFAC or Bureau of Industry and Security for sanctions and export control enforcement.

The past year, 2023, reflected this coming wave of prosecution against companies.  DOJ recovered a total of $629 million from British American Tobacco, which included OFAC and other regulatory agencies in the penalty mix.  OFAC had a total of 17 enforcement actions, totaling approximately $1.5 billion in civil penalties.  Meanwhile, BIS recovered $300 million from Seagate for a blatantly willful violation of the Huawei export restrictions.

As expected, DOJ’s criminal prosecutors focused on Russia and Iran sanctions violations, bringing a total of 32 cases against individuals and companies.  This trend is likely to continue into 2024 with a possible increase in focus on China and North Korea sanctions and export restrictions.

The British American Tobacco prosecution focused on a sham joint venture arrangement to retain BAT’s illegal ownership interest in the sale of cigarettes to North Korean customers.  These transactions were disguised through a series of sham companies and third parties.

The second significant criminal prosecution was the Binance cryptocurrency criminal enforcement action against the company and its CEO. Binance plead guilty to violations of the Bank Secrecy Act, failure to register as a money transmitter and the international Emergency Economic Powers Act, and agreed to pay $4.3 billion, and appointment of a compliance monitor for three years.

Binance operated a large virtual currency exchange for customers.  Binance maintained no compliance controls and therefore freely embraced customers from prohibited countries and banned by OFAC.  Binance violated multiple sanctions programs and committed over 1.6 million transactions that violated OFAC regulations.  OFAC imposed a civil penalty of over $968 million.

From the OFAC perspective,  there were a number of important enforcement actions that highlighted important sanctions compliance issues.  The important themes underscored the risks of third-party evasion of sanctions violations, the importance of sanctions compliance focus in acquisitions, the need for geo-blocking and IP address analysis and finally, the importance of robust internal controls to ensure that organizations identify, monitor and effectively resolve red flags.

In a number of the OFAC enforcement actions, the organizations earned significant discounts from civil penalties as a result of the entity’s voluntary disclosure to OFAC of the potential violations.

For global companies attempting to comply with U.S.-based sanctions programs, OFAC’s enforcement action against Murad reinforced the significant risks of sanctions violations and deployment of compliance resources.  Murad, a U.S. cosmetics company, was acquired by Unilever and then illegally exported goods to Iran in 62 separate transactions, and agreed to pay $3.3 million to resolve these violations.  OFAC also prosecuted one of the Murad executives and imposed a penalty of $175k.

In describing the violations, OFAC noted problems created by the fact that the Murad staff reported to UK trade compliance staff, which lacked an adequate understanding of OFAC violations.” In an important warning, OFAC noted that “in some circumstances, placement of a U.S. entity under the compliance structure of a non-U.S.-entity that may lack familiarity with U.S. sanctions laws could prevent prompt identification of and response to potentially prohibited conduct.”

The implications of OFAC’s observation and expectation is significant. Global companies have to assign separate compliance staff with U.S.-based expertise to ensure that sanctions risk are adequately identified, resolved and monitored.