The U.S. Department of the Treasury’s Office of Foreign Assets Control (“OFAC”) has released a $7.45 million penalty against State Street Bank and Trust Company and its non-bank, fintech subsidiary Charles River Systems for 38 apparent violations of the Ukraine/Russia-Related Sanctions Regulations, which occurred between December 2016 and May 2020.

State Street is a global financial services and bank holding company headquartered in Boston, and is regarded as the largest custodian bank in the world. In 2018, State Street acquired U.S.-based Charles River Systems––a provider of investment management and trading software––for $2.6 billion. Charles River’s software enables investment managers to communicate trade information with their brokers.

This settlement highlights the often overlooked risks that highly regulated entities, such as banks,  may assume when acquiring businesses in less regulated spaces.

State Street & Charles River’s Sanctions Violations

According to OFAC, Charles River ran afoul of the Ukraine/Russia sanctions regime by engaging in at least 38 dealings in new debt which were prohibited by Directive 1 of Executive Order (E.O.) 13662. Enacted in 2014, E.O. 13662 established strict limitations on the issuance of new debt to entities within the Russian financial services sector. Initially, U.S. persons were prohibited from dealing in new debt of longer than 90 days maturity to covered entities. Later amendments to E.O. 13662 further reduced the maturity limit to 30 days, and finally to 14 days.

The problematic dealings in new debt occurred after entities subject to Sectoral Sanctions (SSI entities) failed to remit timely invoice payments to Charles River. In 2008, Charles River established relationships with five subsidiaries of two SSI entities, VTB Bank and Sberbank. Charles River issued monthly invoices to these entities for use of its services. The act of issuing an invoice constitutes a “dealing in new debt” under E.O. 13662, and therefore invoices issued by U.S. persons to SSI entities must comply with E.O. 13662’s temporal restrictions on new debt.

Shortly after the imposition of E.O. 13662 in 2014, Charles River observed that invoice payments made by an SSI entity client through another U.S. financial institution were being delayed due to sanctions concerns. This escalated in 2016, when a U.S. financial institution outright rejected invoice payments from an SSI entity to Charles River due to their non-compliance with E.O. 13662’s debt maturity restrictions. Specifically, the institution rejected the payment due to the length of time between the invoice date and the date of the associated payment. According to OFAC, this financial institution directly explained its reasoning to Charles River, and provided it with related sanctions guidance.

Instead of adopting its banking partners’ guidance, Charles River took steps to circumvent the E.O. 13662. In December 2016, Charles River staff contacted its SSI entity customers regarding their outstanding invoices and related sanctions issues. At least one SSI entity customer requested that Charles River simply redate the outstanding invoices, to create the appearance that they matured in less than 30 days, and therefore complied with applicable sanctions. From 2016 until 2020, Charles River engaged in a pattern of altering non-compliant invoice dates to prevent U.S. financial institutions from rejecting those payments, amounting to 38 apparent violations of E.O. 13662.

Lessons Learned from State Street’s OFAC Settlement

OFAC’s settlement with State Street contains several important, topline takeaways for compliance professionals:

First and most obvious is that any request to alter records, in this case modifying invoice dates, should be treated with extreme suspicion. In a functional compliance program, such a request should trigger immediate alarm bells––which is to say nothing of the fact that the requests in this case came from SSI entities already deserving of heightened scrutiny.

Second, any staff member interacting with entities subject to sanctions should be trained such that, in the event that an SSI entity asks them to alter records, they know to seek legal review before taking action. Strong internal controls are necessary to ensure that employees cannot accidentally or carelessly run afoul of U.S. sanctions. Further, relevant Charles River staff should have had sufficient sanctions literacy to identify the importance of the issues raised by its banking partner and echo those concerns internally, but that did not happen.

Third, State Street’s OFAC settlement highlights the importance of prompt voluntary disclosure of apparent sanctions violations. The settlement notes that State Street notified OFAC of the apparent violations five months after concluding that Charles River’s conduct could constitute a violation of E.O. 13662. Five months was not sufficiently prompt for OFAC, which led to a determination that the violations were egregious and not voluntarily self-disclosed.

The Importance of M&A Due Diligence for Highly Regulated Entities

OFAC’s settlement with State Street also serves as a cautionary tale for highly regulated entities vis-à-vis M&A due diligence.

State Street, as a banking institution, is subject to strict regulatory oversight and must have a sophisticated compliance program to account for the myriad sanctions and other risks that banks face, such as the ever-present risk of enforcement. In contrast, Charles River––a relatively small, non-bank fintech business––is unlikely to have the same level of compliance awareness. Had State Street undertaken a more fulsome pre-acquisition due diligence review, it may have uncovered the many gaps in Charles River’s OFAC compliance protocols and the sanctions skeletons hiding in its proverbial closet.

It may be safest for highly regulated entities to adopt a posture of assuming that less regulated M&A targets do not have adequate OFAC compliance programs until proven otherwise. Best case scenario, one is pleasantly surprised to learn that an M&A target already takes OFAC compliance seriously; worst case scenario, the acquirer is well-positioned to make prompt voluntary disclosures and necessary reforms, or in extreme cases, back out of the acquisition altogether.

As State Street learned with its $7.45 million penalty in this case, acquirers assume the risks attendant to their acquisition and its business. Rigorous pre-merger due diligence, including a review of potential sanctions concerns, is a critical step in effectively identifying and remediating those risks.