While OFAC’s enforcement actions and guidance points to important steps exporters must take when relying on third-party distributors and other intermediaries, the “reason to know” and affirmative obligations to monitor resale and distribution of products to ultimate users does not appear to be unreasonable or impractical.  In terms of best practices, these are issues that need to be addressed.

The supply chain and third-party risk appears to be a little trickier.  OFAC’s expectations are not clearly established but it is fairly easy to predict where OFAC will land on this issue. 

ELF Cosmetics

The most important precedent is the 2019 ELF Cosmetics case. On January 31, 2019, OFAC announced a $996,080 settlement with e.l.f. Cosmetics, Inc. (“ELF”), a California cosmetics company for violation of the North Korean Sanctions Regulations.  ELF violated the North Korea sanctions by importing 156 shipments of false eyelash kits from two suppliers in China that contained materials sourced by these suppliers from North Korea.  The total value of the illegal shipments was approximately $4.4 million.  ELF’s OFAC compliance program was non-existent or inadequate.

ELF’s violations and failure to act occurred as part of its supply chain risk management.  ELF failed to discover that approximately 80 percent of the false eyelash kits supplied by two of ELF’s China-based suppliers contained materials from North Korea.  ELF self-disclosed the apparent violations.

As noted by OFAC, ELF failed to exercise sufficient supply chain due diligence while sourcing products from a region that poses a high risk of connection to North Korea.  To remediate, ELF: (1) implemented supply chain audits that verify the country of origin of goods and services used in ELF products; (2) adopted new procedures to require suppliers to sign certificates of compliance stating that they will comply with all U.S. export controls and trade sanctions; (3) conducted an enhanced supplier audit that included verification of payment information related to production materials and review of supplier bank statements.

OFAC recognized that companies need to undertake basic supply chain due diligence when sourcing products from overseas, particularly in regions close to high-risk countries or regions.  In this respect, OFAC expects companies to undertake supply chain audits with country-of-origin verification, mandatory OFAC training for suppliers and routinely and frequently performing audits of suppliers.

At first glance, OFAC’s finding of liability in this case appears to be unfair because ELF did not know that its suppliers were sourcing materials from North Korea.  However, in the absence of it conducting supply chain audits or some monitoring activity, OFAC imposed liability for conduct analogous to hiding one’s head in the sand.  ELF made no attempt to uncover possible problems in its supply chain and therefore assumed the risk that its supply chain may include items from prohibited countries, especially when conducting business in geographic regions close to prohibited countries or regions.

Challenges in Verification and Compliance

Supply chain audits and compliance raises one significant challenge — how does a company secure compliance commitments from parties with whom the company may not be in privity?  in other words, companies may not have any leverage to request that vendors in a supply chain will comply with a request for verification or compliance commitment.

Companies are facing this challenge now and seeking to have compliance commitments flow down from the first level of suppliers with whom they directly interact.  This can be difficult depending on the business relationship, the level of transparency in the industry and the overall willingness for the second level supplier to provide to the first level supplier such compliance commitments and certifications.

In a perfect world, companies can secure country-of-origin verifications.  But this not a perfect solution since there are exceptions for low value goods, exemptions from trade agreements, and no guarantee that a chain of transactions includes a valid certification or any certification at all.  This is especially difficult in certain high-risk areas and regions where specific regulations may apply or in areas near high-risk jurisdictions or regions.

In time, and as demand grows for compliance, this situation may improve.  In some situations, importers are legally expected to request such certifications but again the reliability of such documentation and overall trade compliance in this area appears to be uneven. 

At a minimum, however, companies have to devote attention to regulating and monitoring its supply chain.  This is an issue that carries with it significant consequences beyond sanctions compliance.  Stakeholders are demanding that companies exercise proper oversight to ensure that human rights, slavery, child labor, safety and other significant issues are addressed.  Sanctions is just one of many important issues that companies have to respond to when managing their supply chain.