6 minute read | April.22.2020
The Department of the Treasury’s Office of Foreign Assets Control recently took two actions to address the impact of Covid-19. First, OFAC issued a fact sheet that consolidates existing authorizations and guidance permitting humanitarian, agricultural, and medical aid to six jurisdictions subject to sanctions. Second, OFAC encouraged companies facing compliance challenges due to Covid-19 to shift resources to higher-risk areas, noting that it would take this move into consideration if it leads to a violation during the pandemic. Companies facing compliance challenges may wish to consider such a shift, while documenting their risk-based rationale for doing so.
Humanitarian fact sheet
Last week, OFAC issued a fact sheet regarding the provision of Covid-19-related assistance under its Iran, Cuba, North Korea, Syria, Ukraine/Russia, and Venezuela sanctions regimes. The fact sheet made no changes to existing laws and guidance, but consolidated existing licenses, exemptions, authorizations, and related FAQs relevant to humanitarian aid and medical equipment for these regimes. The fact sheet should prove to be a valuable resource for financial institutions and other organizations confronting a wave of transactions to provide personal protective equipment to sanctions-targeted jurisdictions wracked by Covid-19, while complying with OFAC regulations.
Background
OFAC walks a fine line between denying resources to rogue governments while, to the greatest degree possible, facilitating the flow of funds and humanitarian goods and services to their citizens through legitimate, transparent channels. The result is a general prohibition on dealings involving a jurisdiction, with a long list of exemptions (activities the sanctions laws do not purport to reach), exceptions (activities that are permitted despite the general prohibition), and related recordkeeping and reporting requirements. For example, there are over 70 exceptions — referred to by OFAC as “licenses” — in the Cuban sanctions regulations alone. Whether a certain transaction falls within one of the many exceptions or exemptions is fact-specific and variable.
But the main tool financial institutions use for sanctions compliance, often referred to as screening or filtering, is blunt, and consists of word-recognition software run against transactional or customer data to find transactions that might involve a sanctions-targeted person or jurisdiction. It takes people to review whatever transactions the software turns up, performing due diligence to get information from the parties involved and wading through tens or hundreds of licenses — spread out over 35 separate parts of the Code of Federal Regulation and multiple pages on OFAC’s website, and augmented through separate guidance and FAQs. A financial institution may reasonably conclude that the fees received for processing the payment — coupled with the risks of coming to the wrong conclusion regarding compliance — do not justify such a time- and resource-intensive undertaking. It can refuse to process any transaction identified by filtering, regardless of whether the transaction is permitted by a license. While sensible as a business decision, refusals complicate transactions that back humanitarian aid.
The new fact sheet
Fulfilling the policy goals of diverting funds from sanctions-targeted jurisdictions while permitting humanitarian aid has been a longstanding concern at OFAC. The Covid-19 pandemic has brought the issue to a head.
OFAC’s fact sheet serves two purposes: reiterating OFAC’s willingness to assist persons facing sanctions-related challenges in providing humanitarian aid, and consolidating existing laws and guidance to highlight the most relevant relief exceptions in order to fight the spread and impact of Covid-19 in Iran, Venezuela, North Korea, Syria, Cuba, and the Crimea region of Ukraine.
The Covid-19 fact sheet will be a useful resource, and particularly helpful when a financial institution’s screening software identifies a transaction involving a sanctions-targeted jurisdiction. Rather than sifting through the Code of Federal Regulations and OFAC’s website, financial institutions can now refer to a consolidated resource that, among other things, integrates more than 30 licenses, FAQs, and guidance pieces for Iran alone.
It is not clear whether the fact sheet alone will affect financial institutions’ risk assessments and decision making about whether to facilitate humanitarian aid to sanctions-targeted jurisdictions, and those that do should conduct a careful, fact-specific analysis and undertake appropriate due diligence to ensure transactions fall within the contours of available licenses. In addition, they are required to retain records of transactions conducted pursuant to an OFAC license for five years, and, depending on the license, may be required to submit reports to OFAC. Significant resources will still be required in order to process humanitarian transactions to sanctions-targeted jurisdictions in a safe and compliant manner. Moreover, the fact sheet does not eliminate potentially significant penalties for getting it wrong.
Companies engaging in aid-related transactions involving these six regimes should be mindful of concerns beyond OFAC. A transaction that falls within an OFAC license or exemption may still require analysis or approval requirements under other laws, such as the Export Administration Regulations administered by the Department of Commerce’s Bureau of Industry and Commerce. Similarly, fraud and corruption risks, which were already high for these jurisdictions, have only increased with the outbreak of Covid-19, and institutions engaged in aid transactions may wish to ensure their controls have been adjusted accordingly.
Covid-19 and OFAC compliance
OFAC acknowledged in a Monday statement that the Covid-19 pandemic is causing technical and resource challenges for financial institutions and other businesses, and urged them to get in touch if those challenges are affecting compliance with its requirements and deadlines. The statement signaled lenience for institutions and others that reallocate compliance resources based on risk, saying it will take risk-based resource shifts into consideration when determining how to respond to potential violations.
Financial institutions and other U.S. persons are generally required to submit what’s known as a “reject report” to OFAC within 10 business days of refusing to engage in a transaction for OFAC compliance reasons. Similarly, a U.S. persons must file a report with OFAC within 10 business days of “blocking” property of a sanctions-targeted individual or entity. Organizations that anticipate difficulty meeting these deadlines should promptly notify OFAC.
OFAC continues to issue administrative subpoenas during the Covid-19 pandemic, including when it becomes aware, through blocking and reject reports or otherwise, that a U.S. person potentially violated sanctions. Recipients are usually required to provide the requested information, which can be extensive, within 30 days. The subpoena typically directs financial institutions to provide “all information” regarding the processing of the transactions at issue, which usually must be collected from departments responsible for processing wire transfers. The volume of stimulus payments issued under the CARES Act — many with missing or incorrect recipient or account information — pose a significant challenge for wire departments seeking to provide information on a timely basis. Financial institutions may contact OFAC promptly to seek an extension of time, and explain the circumstances in detail. Well-substantiated extension requests are often granted.
OFAC’s statement encourages organizations facing compliance challenges as a result of Covid-19 to shift resources to areas of higher risk. That could mean greater focus on international customers and transactions rather than purely domestic ones, because OFAC targets non-U.S. persons and jurisdictions for sanctions. The statement also suggests that OFAC may be more lenient with violations that occur in low-risk areas as a result of resource shifting. Failure to shift sufficient resources to higher-risk areas could be viewed more harshly.
Decisions to shift resources should be documented so that institutions can demonstrate the reasons for doing so, should OFAC inquire. If an organization has conducted an OFAC risk assessment, as suggested by OFAC in its Framework for Compliance Commitments, it may wish to base its documented rationale on this risk assessment.
If you have questions about OFAC’s recent actions or related issues, please visit our Anti-Money Laundering and Bank Secrecy Act practice page or contact an Orrick attorney with whom you have worked in the past.