Disclaimer: The contents of this article are intended to provide a general understanding of the subject matter. However, this article is not intended to provide legal or other professional advice, and should not be relied on as such. The U.S. Treasury’s Office of Foreign Assets Control (OFAC) has issued extensive guidance for financial institutions regarding what constitutes an effective OFAC compliance program. The document: A Framework for OFAC Compliance Commitments, gives detailed policy discussion notes that should help companies establish their training programs for dealing with OFAC issues. OFAC administers and enforces economic and trade sanctions based on U.S. foreign policy and national security goals against targeted foreign countries and regimes, terrorists, international narcotics traffickers, those engaged in activities related to the proliferation of weapons of mass destruction, and other threats to the national security, foreign policy or economy of the United States. The document represents the most detailed statement to date of OFAC’s views on the best practices that companies should follow to ensure compliance with U.S. sanctions laws and regulations. It is meant to serve as a guide to prevent sanctions violations from occurring in the first place. It also provides greater transparency with respect to how OFAC will assess the adequacy of a company’s existing compliance program when violations do occur. This will also help determine what penalty to impose as a last resort. Of course, the end goal of sanctions is to stop trade with sanctioned parties. The guidance reflects OFAC’s aggressive approach to enforcement.
Five Components of an Effective Sanctions and OFAC Compliance Program
OFAC in its compliance framework believes a company should generally take a risk-based approach tailored to that company’s particular profile. The detailed framework recognizes that there will be some variability from one organization to the next in terms of the particulars, they have set out five essential components for you to use to set up a strong sanctions compliance program.1. Management Commitment
Senior management needs to show commitment to supporting an organization’s Sanctions Compliance Program (SCP). This is a critical factor in determining the success of the program. Effective management support includes the provision of adequate resources to the compliance teams and support for compliance personnel’s authority within an organization. The term “senior management” may differ among various organizations, but typically the term should include senior leadership, executives, and/or the board of directors.2. Risk Assessment
Risks in sanctions compliance are potential threats or vulnerabilities that, if ignored or not properly handled, can lead to violations of OFAC’s regulations and negatively affect an organization’s reputation and business. OFAC recommends that organizations take a risk-based approach when designing or updating an SCP. One of the central pillars is for organizations to conduct a routine and ongoing risk assessment for the purposes of identifying potential OFAC issues they are likely to encounter. The results of a risk assessment are integral in informing the SCP’s policies, procedures, internal controls, and training in order to mitigate such risks. While there is no “one-size-fits-all” risk assessment, the exercise should generally consist of a holistic review of the organization from top-to-bottom and assess its touchpoints to the outside world. This process allows the organization to identify potential areas in which it may, directly or indirectly, engage with OFAC-prohibited persons, parties, countries, or regions. For example, an organization’s SCP may conduct an assessment of the following:- customers, supply chain, intermediaries, and counter-parties;
- the products and services it offers, including how and where such items fit into other financial or commercial products, services, networks, or systems; and
- the geographic locations of the organization, as well as its customers, supply chain, intermediaries, and counterparties.
- Risk assessments and sanctions-related due diligence is also important during mergers and acquisitions, particularly in scenarios involving non-U.S. companies or corporations.
3. Internal Controls
An effective sanctions and OFAC compliance program should include internal controls, including policies and procedures, in order to identify, interdict, escalate, report and keep records pertaining to activity that may be prohibited by the regulations and laws administered by OFAC. The purpose of internal controls is to outline clear expectations, define procedures and processes pertaining to OFAC compliance (including reporting and escalation chains), and minimize the risks identified by the organization’s risk assessments. Policies and procedures should be enforced, weaknesses should be identified and remediated, and internal and/or external audits and assessments of the program should be conducted on a periodic basis. Given the dynamic nature of U.S. economic and trade sanctions, a successful and effective SCP should be capable of adjusting rapidly to changes published by OFAC. These include the following:- updates to OFAC’s List of Specially Designated Nationals and Blocked Persons (the “SDN List”), the Sectoral Sanctions Identification List (“SSI List”), and other OFAC sanctions lists;
- new, amended, or updated sanctions programs or prohibitions imposed on targeted foreign countries, governments, regions, or persons, through the enactment of new legislation, the issuance of new Executive orders, regulations, or published OFAC guidance or other OFAC actions; and
- the issuance of general licenses.
4. Testing and Auditing
Audits assess the effectiveness of current processes and check for inconsistencies between these and day-to-day operations. A comprehensive and objective testing or audit function within an SCP ensures that an organization identifies program weaknesses and deficiencies, and it is the organization’s responsibility to enhance its program, including all program-related software, systems, and other technology, to remediate any identified compliance gaps. Such enhancements might include updating, improving, or recalibrating SCP elements to account for a changing risk assessment or sanctions environment. Testing and auditing can be conducted on a specific element of an SCP or at the enterprise-wide level.5. Training
An effective training program is an integral component of a successful SCP. The training program should be provided to all appropriate employees and personnel on a periodic basis (and at a minimum, annually) and generally should accomplish the following:- provide job-specific knowledge based on need;
- communicate the sanctions compliance responsibilities for each employee; and
- hold employees accountable for sanctions compliance training through assessments.
Ten Common Pitfalls of Sanctions Compliance Programs
In addition to spotlighting what it views as the components of an effective sanctions compliance program, OFAC also identifies in an appendix to its new framework common areas where sanctions compliance programs fall short. Derived from recent OFAC enforcement actions, this section of the framework is designed to alert U.S. and non-U.S. companies to common pitfalls that could cause a company to incur U.S. sanctions liability. OFAC identifies a total of 10 common causes of U.S. sanctions violations, including:- Lack of a formal OFAC sanctions compliance program;
- Misinterpreting, or failing to understand the applicability of, OFAC’s regulations;
- Facilitating transactions by non-U.S. persons;
- Exporting or re-exporting U.S.-origin goods, technology or services to OFAC-sanctioned persons or countries;
- Utilizing the U.S. financial system, or processing payments to or through U.S. financial institutions, for commercial transactions involving OFAC-sanctioned persons or countries;
- Sanctions screening software or filter faults;
- Improper due diligence on customers and clients;
- De-centralized compliance functions and inconsistent application of a sanctions compliance program;
- Utilizing non-standard payment or commercial practices; and
- Individual liability.
