In this new era of aggressive sanctions enforcement, companies have to understand the red lines that define where criminal and civil enforcement risk increase.  In contrast to the history of FCPA enforcement, DOJ and OFAC have provided helpful guidance to alert companies where risks are likely to increase.

Sanctions enforcement involves an off mix of civil and criminal line drawing.  On the civil side, OFAC has explained that sanctions violations can be found based on strict liability with aggravating factors that turn the actor’s state of mind. 

In addition, third party liability for distributors extends to situations where a principal company knew or reasonably should have known that products sold to a third party were intended for shipment to a prohibited entity or individual or to a prohibited country. 

Third party liability for violations occurring in a company’s supply chain  requires companies to break down its supply chain and learn the sourcing for all companies in its supply chain.  It is clear that a failure to examine and assess your supply chain can lead to civil liability.

In defining where criminal enforcement picks up on the culpability spectrum, DOJ and OFAC have defined potential criminal conduct based on the term “willful,” meaning when an actor knew that its conduct was wrong but did not necessarily know the specific law that her/she was violating.  Applying the “you know it when you see it” standard, companies have to weigh the evidence of surrounding circumstances to determine if an individual actor or actors  possessed the requisite intent. 

The determination will turn on the attribution of individual conduct to a company based on respondeat superior principles — that is, whether the conduct was committed in the course of an individual’s duties and in furtherance of a legitimate business purpose.

We do not have enough enforcement examples to track where the precise line falls between criminal and civil.  That is still to be defined by reviewing a meaningful record of DOJ enforcement actions against sanctions violations.  The situation is akin to the early days of aggressive FCPA enforcement where enforcement and settlement cases were reviewed for important precedent and explanations. 

DOJ’s record here is about to be defined and companies, commentators and trade compliance professionals will be reading tea leaves and looking for patterns.

In this current environment, companies will face a new calculus involving voluntary disclosures.  Whether it is export controls or sanctions violations, companies have to assess the evidence surrounding potential violation(s) and weigh whether to voluntarily disclose to the supervising agencies and the Justice Department.  In some cases, companies may have to disclose to both DOJ and the regulator, OFAC or BIS.  If the evidence suggests that one or more  actor(s) violated export controls or sanctions requirements, and that the that the actor(s) did so with knowledge that the conduct was illegal (or with deliberate indifference), the company should disclose to both DOJ and the applicable regulator (e.g. OFAC and/or BIS). 

The calculation is heavily weighted towards disclosure — companies that depend on export control licensing, for example, have to maintain a positive relationship with BIS.  In general, companies that engage in significant exports do not want to duck scrutiny or appear to be evading compliance with applicable regulatory regimes.  Regulated companies have too much to lose when they jeopardize the trust between themselves and their regulators. 

DOJ is “looking” to bring criminal cases for sanctions and export controls violations.  DOJ has trumpeted the hiring of 25 new prosecutors and its plan to aggressively prosecute companies for violations.  Given this stated intent, companies have to redouble their compliance program efforts and monitor trade activity to ensure that they are not caught in the initial wave of “example” criminal prosecutions.