In Part 1, I explained the twist that makes sanctions M&A risk different from FCPA M&A risk: when a U.S. company or U.S.-controlled fund takes ownership of a foreign business, that business can become subject to U.S. sanctions overnight, particularly under the Cuba and Iran programs, without changing a thing about how it operates. Part 2 covered cases involving inherited conduct and diligence misses. Part 3 covers the jurisdiction-trigger cases, in which a foreign target kept doing business with a sanctioned country after the closing and the U.S. owner paid for it, and then closes with a practical playbook for dealmakers.

AppliChem and Illinois Tool Works: Told to Stop, and It Didn’t

In early 2012, Illinois Tool Works acquired AppliChem, a German manufacturer of chemicals and reagents. Cuba sanctions applied to AppliChem from the day of closing because of U.S. ownership. ITW knew AppliChem had Cuban business, told its managers before closing that it would have to end, and sent them an explanation of ITW’s Cuba compliance guidelines right after. When ITW’s legal department learned in April 2012 that sales were continuing, it ordered that all Cuba business stop immediately, and AppliChem’s managers answered that open Cuban transactions had been cancelled.

They had not. According to OFAC, AppliChem’s managers built a system to hide the Cuba business from ITW. They used a code word, “Caribbean,” in place of Cuba, and hired outside vendors to prepare shipping paperwork so internal documents would never mention it. Employees described the arrangement as an open secret. In 2013 and again in 2015, employees reported the continuing Cuban sales to an ITW manager in Spain, who reminded local staff of policy and sought assurances but did not launch a real investigation. ITW self-reported in January 2013, OFAC issued a cautionary letter in 2015, and then, in January 2016, an anonymous hotline report revealed the real story. Between May 2012 and early 2016, AppliChem made 304 apparent violations, involving about $3.4 million of shipments. OFAC treated the case as egregious despite ITW’s disclosures and assessed a penalty of more than $5.5 million against AppliChem in February 2019.

Three things deserve emphasis. First, the acquirer did nearly everything on the standard checklist, a pre-closing warning, a post-closing policy memo, and a disclosure, and still ended up with an egregious finding. Second, the red flags that reached an ITW manager were not escalated, and OFAC treats a failure to act on information suggesting a violation as an aggravating fact. Third, OFAC specifically emphasized the importance of follow-up diligence after acquiring foreign companies known to have historic dealings with sanctioned countries.

Stanley Black & Decker and GQ: Pre-Closing Diligence, a Closing Condition, and Still Egregious

Stanley Black & Decker’s 2019 settlement is the closest thing to a model of what deal teams are expected to do, and it shows why OFAC still found the effort inadequate. SB&D began exploring a purchase of Jiangsu Guoqiang Tools, a Chinese power tool maker, in 2011. Its diligence found that GQ exported to Iran. SB&D made ending those sales a condition of closing, had GQ’s senior management sign written attestations that GQ would not deal with Iran, and, when it completed a 60 percent investment in May 2013, trained GQ employees and walked its export team through SB&D’s trade compliance procedures.

GQ’s exports to Iran continued anyway, through the end of 2014. GQ employees routed products through trading companies in China and the United Arab Emirates, prepared fictitious shipping documents, and told customers to leave any mention of Iran off business records. Senior managers and board members of GQ took part. There were 23 apparent violations, worth roughly $3.2 million. SB&D self-disclosed. OFAC still found an egregious case, calculating a base penalty of about $3.5 million and a statutory maximum of about $6.9 million, and settled for approximately $1.87 million, plus 26 detailed compliance commitments and five years of annual certifications.

What did OFAC fault? Not the diligence. Not the closing condition. Not the training. It faulted SB&D for failing to implement procedures to monitor or audit GQ’s operations to ensure that the Iran-related sales had in fact stopped and did not return. The Ropes & Gray analysis described the settlement as making explicit that the sanctions diligence obligations of an acquirer extend beyond closing. I agree with that reading, and it goes directly to the language of the 2019 Framework about the importance of audit and testing after an acquisition.

First Bank and J.C. Flowers: A Euro Payment That Was Not Outside U.S. Sanctions After All

The First Bank case shows the jurisdiction trigger in its purest form. In June 2018, the American private equity firm J.C. Flowers acquired a majority stake in First Bank, a Romanian bank. Some of First Bank’s sanctions problems were of the familiar kind: it processed dollar payments through U.S. banks for parties in Iran and Syria, 34 for Iran and 36 for Syria, which would have been violations whether or not a U.S. firm owned the bank.

But OFAC also cited 28 euro-denominated payments, worth about $1.5 million, involving Iranian parties, which the bank processed after J.C. Flowers’ purchase. These payments never touched the U.S. financial system. They would not have been U.S. sanctions violations at all had the bank remained under Romanian ownership. Because a U.S. person now owned the bank, Iran sanctions treated the bank as if it were a U.S. person, and the euro payments became violations.

OFAC and the parent agreed to a settlement of $862,318 in August 2021, relating to 98 transactions in all. Treasury considered the case voluntarily self-disclosed and non-egregious, but it also said the bank’s failure to understand how U.S. sanctions applied to a financial institution without a U.S. presence amounted to reckless disregard. The take-away for private equity and for banks is that deal diligence should ask not only whether the target has sanctioned activity, but also which of its activities, including activities that never touch a U.S. dollar, will become prohibited on the day of closing.

Key Holding and Key Logistics Colombia: The Recent One, and the Quiet One

The most recent case in this series is a July 2025 settlement with Key Holding, a Delaware logistics company. Key Holding acquired a Colombian logistics business, then known as Key Logistics Colombia, in December 2021. At the time of the acquisition, Key Holding had no sanctions compliance program covering its non-U.S. subsidiaries, and the Colombian business had no sanctions program of its own. It did not know that it was subject to the Cuba sanctions through its new U.S. owner.

From January 2022 through July 2023, the Colombian business handled the logistics for 36 freight shipments from Colombia to Cuba. Thirty-three involved foodstuffs that were not eligible for an OFAC license, and three involved safety-related oil well machinery parts, including shipments carried on a company majority-owned by the Cuban government. Key Holding’s U.S. parent did not find out until January 2024, when it was conducting diligence for a planned sale of the business, that is, when it was in the position of seller rather than acquirer. After discovery, Key Holding stopped accepting Cuba-related orders, issued its first group-wide trade sanctions and export controls policy on April 1, 2024, required company-wide training on April 16, and had its Colombian business use an automated platform to screen shipments by July 2024. OFAC called the violations voluntarily self-disclosed and not egregious, and settled for $608,825.

This case needs no fraud or concealment to explain it. It is a story of nobody telling a new subsidiary that U.S. law now applied, for two years. It also shows the irony of sanctions diligence: the buyer who discovers the problem during a later sale, when a future acquirer’s diligence team asks the question, finds out the hard way what the earlier acquisition should have asked.

A Companion Case: Berkshire Hathaway, IMC, and Iscar Turkey

I’ll add one case that fits the series theme but is not itself an acquisition case, so I want to be careful about how it is framed. In 2020, OFAC settled with Berkshire Hathaway for roughly $4.1 million relating to violations by Iscar Turkey, a wholly owned subsidiary of IMC International Metalworking Companies, a Berkshire-owned group based in the Netherlands. According to OFAC, Iscar Turkey made 144 shipments of cutting tools, worth about $383,000, to Turkish distributors, knowing the goods would be resold in Iran, including to Iranian government entities. OFAC treated it as egregious. Berkshire self-disclosed in 2017 after an anonymous tip, terminated the employees involved, and strengthened controls.

I include it because it illustrates the same principle as the acquisition cases from a different direction: once a foreign business is within a U.S.-owned group, the sanctions obligations attach to it and to the parent, and the parent is accountable for what the subsidiary does, whether or not the parent knew. It is a reminder that the risk does not end when integration does. It continues for as long as the group owns the business.

A Playbook for Dealmakers

Pulling these cases together, here is how I would build a sanctions M&A protocol.

Before signing, treat sanctions as a diligence workstream of its own, led by people who know the regulations. Look beyond what the target says. Review distributor, agent, and sales representative agreements, the customer list by geography, payment flows, and freight and logistics records. The Unicat sales agent agreement was in the data room. Ask which of the target’s existing activities become prohibited because of your ownership, as in First Bank, not only whether the target is already violating the law.

In the purchase agreement, go beyond standard compliance representations. Seek a specific indemnity that covers post-closing investigations, penalties, and remediation costs, with the buyer controlling the investigation and settlement, coverage for the period between signing and closing, and a survival period that reflects the ten-year enforcement window for sanctions violations. If the target has sanctioned business, make termination a closing condition, but do not treat the condition as the solution, as SB&D shows.

On day one, tell the target’s management in writing that U.S. sanctions now apply, identify the specific prohibited activities, and freeze pending orders. Silence is how Key Holding’s problem lasted two years.

In the first 100 days, extend your compliance program, with screening tools, training, escalation lines, and a hotline that reaches the group’s compliance officer. Replace certifications with testing. A quarterly certification from the managers who are hiding the business, as in Kollmorgen, adds nothing. Test actual transactions, shipping documents, and payments, and look for the patterns OFAC calls non-routine business practices, such as unusual intermediaries, code words, and outsourced document preparation.

Escalate every report. ITW’s manager in Spain heard twice that Cuba sales continued. Treat any employee or manager report that the old business continues as a trigger for a real investigation.

Know the clocks. Under DOJ’s National Security Division policy, the presumption of declination depends on a voluntary self-disclosure, generally within 180 days of closing, and remediation, generally within a year. Build your integration timeline around those dates. Preserve evidence, including personal devices and messaging applications, and understand local data protection law before you collect it, as the White Deer cooperation shows.

Finally, if you are a private equity sponsor or other institutional investor with limited operational control over portfolio companies, do not assume that limited control limits exposure. OFAC’s cases have not drawn that distinction.

Closing Thought

The FCPA taught deal lawyers to ask what bribes the target paid. Sanctions teach a harder question: what is the target doing today that becomes illegal the minute we own it, and how will we know whether it has stopped? Every case in this series is a case in which somebody either did not ask that question or asked it and did not verify the answer. Buying a sanctions violation is not always a mistake that diligence could have prevented. But it is always a mistake that post-closing testing can find sooner.