InfoBytes Blog
Filter
Subscribe to our InfoBytes Blog weekly newsletter and other publications for news affecting the financial services industry.
OFAC Imposes Additional Iranian Sanctions, List Includes Entities Involved in DDoS Attacks Against U.S. Financial Institutions
On September 14, the U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) announced it was imposing sanctions on 11 entities and individuals for supporting designated Iranian actors or for conducting malicious cyberattacks, including engaging in a series of distributed denial of service (DDoS) attacks against approximately 46 U.S. financial institutions. As reported in an indictment delivered by a federal grand jury in the Southern District of New York (see March 24, 2016 DOJ press release), the DDoS attacks—allegedly conducted by seven Iranian individuals between December 2011 and mid-2013—denied customers access to online bank accounts and collectively cost the affected financial institutions “tens of millions of dollars in remediation costs as they worked to neutralize and mitigate the attacks on their [computer] servers.” During a DDoS attack, a “malicious actor” gains remote control of a server through the installation of malicious software. Once compromised, the “malicious actor” can collect hundreds or thousands of these compromised devices (collectively known as a “botnet”), and, once control is achieved, will “direct the computers or servers comprising the botnet to carry out computer network attack[s] and computer network exploitation activity.” Three of the seven sanctioned individuals worked for a company that was added to OFAC’s updated SDN list on September 14 and oversaw a network of compromised computers that powered DDoS attacks. The other four individuals operated a second DDoS botnet on behalf of a different company listed on OFAC’s non-SDN list. Both Iranian-based private computer security companies perform work on behalf of the Iranian Government, including Iran’s Islamic Revolutionary Guard Corps. Pursuant to E.O. 13694, U.S. persons are prohibited from dealing with the designated entities and individuals, and “foreign financial institutions that facilitate significant transactions for, or persons that provide material or certain other support to, the entities and individuals designated today risk exposure to sanctions that could sever their access to the U.S. financial system or block their property and interests in property under U.S. jurisdiction.”
In addition, pursuant to E.O. 13382, OFAC sanctioned an Iranian-based engineering company for engaging in activities related to Iran’s ballistic missile program, which include providing “ financial, material, technological, or other support for, or goods or services in support of, the [Islamic Revolutionary Guard Corps].” Two Ukrainian-based companies were also sanctioned pursuant to E.O. 13224 for assisting previously sanctioned Iranian and Iraqi airlines in obtaining U.S.-origin aircraft, as well as crew and services.OFAC Settles Alleged Iran Sanction Violations with Singapore-Based Oilfield Services Company
On August 24, the U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) announced that it had reached a $415,350 settlement with a Singaporean oilfield services company for an alleged 55 violations of Iran sanctions regulations. OFAC asserted that the company “exported or attempted to export 55 orders of oil rig supplies from the [U.S.] to Singapore and the United Arab Emirates, and then re-exported or attempted to re-export these supplies to four separate oil rigs located in Iranian territorial waters” from approximately October 2011 through February 2013. OFAC alleged that each instance of this conduct, which the company did not voluntarily self-disclose, violated OFAC’s Iranian Transactions and Sanctions Regulations. Had the company not settled, OFAC determined that civil monetary penalties ranged from approximately $923,000 to $13.75 million. In establishing the penalty, OFAC considered that the company: (i) failed to act with an appropriate level of caution by exporting goods to oil rigs located in Iranian territorial waters; (ii) aided the development of Iran's energy resources; (iii) “is a large, sophisticated company with 14 offshore drilling rigs doing business throughout the world;” and (iv) “did not have an OFAC compliance program in place at the time of the transactions.” As for mitigating factors, OFAC determined that: (i) the company has no prior sanctions history with OFAC; (ii) the company took remedial action by implementing an OFAC compliance program; and (iii) the company cooperated with the investigation and entered into a tolling agreement with OFAC.
OFAC Settles Alleged Iran Sanction Violations with International Freight Forwarder
On August 17, the U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) announced it had reached a $518,063 civil settlement with a California-based international freight forwarder for alleged violations of sanctions against Iran. OFAC claimed that the company shipped “used and junked cars and parts” from the U.S. to Afghanistan, via Iran, on 140 separate occasions from approximately April 2010 through June 2012. OFAC alleged that each instance of this conduct, which the company “did not voluntarily self-disclose,” violated OFAC’s Iranian Transactions and Sanctions Regulations (ITSR). See 31 C.F.R. § 560.204.
Had the company not settled, OFAC determined that civil monetary penalties ranged from approximately $1.5 million to $35 million. In establishing this range, OFAC alleged that the following were aggravating factors: (i) the company “demonstrated a reckless disregard for U.S. sanctions requirements by failing to exercise a minimal degree of caution or care in transshipping goods through Iran”; (ii) the company’s “President and co-owner knew and approved of the transshipments via Iran”; (iii) the company “provided an economic benefit to Iran through its pattern of conduct and the volume of transactions in which it engaged”; and (iv) the company is “sophisticated” and has “experience with U.S. export laws and OFAC regulations, particularly the ITSR.”
As for mitigating factors, OFAC alleged that: (i) the goods “did not appear to have an end use in Iran”; (ii) the company “has no prior OFAC sanctions history”; (iii) the company is a “small business,” and the alleged violations “constituted less than one percent of its total shipments” during the relevant time period; (iv) the company “had an OFAC compliance program in place” during the relevant time period; (v) the company “took remedial steps”; and (vi) the company “cooperated with OFAC’s investigation.”
OFAC Fines Global Risk Mitigation Firm for Violating Iranian Sanctions
On August 10, the Treasury’s Office of Foreign Assets Control (OFAC) announced it had reached a settlement with a global company that provides services in regulatory risk mitigation for alleged violations of OFAC sanctions against Iran. OFAC claimed that, beginning in 2012, on 44 separate occasions, the firm imported Iranian-origin services into the U.S., and on 28 different occasions, engaged in “transactions or dealings related to Iranian-origin services by approving and facilitating its foreign subsidiaries’ payments to providers of Iranian-origin services.” In establishing the penalty, OFAC considered that the firm failed to exercise a minimal degree of caution—and senior management allegedly knew or had reason to know the transactions related to services of Iranian-origin—and that the transactions giving rise to the apparent violations were not eligible for OFAC authorization and yielded economic benefits to Iran. Furthermore, OFAC claimed the “frequency and duration of the apparent violations constitute a pattern or practice of conduct,” and that the firm’s ineffective compliance program failed to recognize the risks of engaging in the aforementioned transactions. OFAC maintained the firm violated the Iranian Transactions and Sanctions Regulations, 31 C.F.R. part 560. OFAC also considered the company’s prior history of not being sanctioned; its significant remedial measures; and substantial cooperation with OFAC’s investigation.
The settlement requires the firm to pay more than $250,000 to settle the claims, which the firm did not voluntarily self-disclose to OFAC.
OFAC Fines International Technology Subsidiary More Than $12 Million for Violating Iranian Sanctions
On July 27, the Treasury’s Office of Foreign Assets Control (OFAC) announced it had reached a settlement with a subsidiary of a Singapore-based international technology group for alleged violations of OFAC sanctions against Iran. OFAC claimed that between August 25, 2010 and November 5, 2011, the subsidiary entered into contracts with multiple Iranian companies, engaged several third-party vendors to provide goods and services for the contracts, and caused “at least six separate financial institutions to engage in the unauthorized exportation or re-exportation of financial services from the [U.S.] to Iran.” Furthermore, the subsidiary made a statement to a non-U.S. financial institution in Singapore (the Bank) stating, “In consideration of [the Bank] agreeing to continue providing banking services in Singapore to our company, we . . . hereby undertake not to route any transactions related to Iran through [the Bank], whether in Singapore or elsewhere.” However, the subsidiary began originating USD funds transfers through the Bank related to Iranian business transactions. Moreover, its actions provided “significant economic benefit” to Iran and individuals on OFAC’s List of Specially Designated Nationals and Blocked Persons. Specifically, OFAC maintained the subsidiary violated the following sanctions programs: (i) the International Emergency Economic Powers Act and (ii) the Iranian Transactions and Sanctions Regulations, 31 C.F.R. part 560.
The settlement requires the company to pay more than $12 million to settle the claims, which the company did not voluntarily self-disclose to OFAC.
OFAC Settles with International Insurance Group over Charges of Violating Sanctions Programs
On June 26, the Treasury’s Office of Foreign Asset Control (OFAC) reached a settlement with an international financial services and insurance company based in New York for alleged violations of OFAC sanctions programs. OFAC claimed that the company “issued policies and insurance certificates, and/or processed claims and other insurance-related transactions that conferred economic benefit to sanctioned countries or persons and undermined the policy objectives of several U.S. economic sanctions programs.” Specifically, OFAC maintained the company violated the following sanctions programs: (i) Iranian Transactions and Sanctions Regulations, 31 C.F.R. Part 560 (ITSR); (ii) Weapons of Mass Destruction Proliferators Sanctions Regulations, 31 C.F.R. Part 544 (WMDPSR); (iii) Sudanese Sanctions Regulations, 31 C.F.R. Part 538 (SSR); and (iv) Cuban Assets Control Regulations, 31 C.F.R. Part 515 (CACR). The settlement requires the company to pay $148,698 to settle the claims, which the company voluntarily self-disclosed to OFAC.
For others to avoid these issues, OFAC suggested that “the best and most reliable approach for insuring global risks without violating U.S. sanctions law is to insert in global insurance policies an explicit exclusion for risks that would violate U.S. sanctions laws.”
OFAC Reaches $1.192 Billion Resolution with Chinese Telecommunication Equipment Corporation
On March 7, the Treasury’s Office of Foreign Asset Control (OFAC) announced a combined $1.192 billion resolution with other federal agencies against a Chinese telecommunications equipment corporation and its subsidiaries and affiliates to settle alleged violations of the Iranian Transactions and Sanctions Regulations. The resolution is pending approval of the company’s criminal plea in federal court. OFAC’s settlement agreement resolves its investigation into the company’s practice of “utilizing third-party companies to surreptitiously supply Iran with a substantial volume of U.S.-origin goods, including controlled goods appearing on the Commerce Control List.” As noted by Steven T. Mnuchin, Secretary of the Treasury, this “settlement is OFAC’s largest ever against a non-financial entity and sends a powerful message that Treasury will aggressively pursue any company that willfully violates U.S. economic sanctions laws and obstructs federal investigations of such violations.”
In addition to the monetary penalty, the company must maintain policies and procedures designed to minimize future risk of violations of U.S. economic sanctions and export control violations.
OFAC Settles With Non-U.S. Company for Apparent Violation of Iran Sanctions
On January 12, Treasury’s Office of Foreign Asset Control (OFAC) announced a $17,500 settlement agreement with Aban Offshoe Limited ("Aban") of Chennai, India, in connection with an alleged violation of Iranian Transactions and Sanctions Regulations. The alleged violation arises out of events that occurred in June 2008, when Aban's Singapore subsidiary allegedly placed an order for oil rig supplies from a vendor in the United States with the intended purpose of re-exporting these supplies from the United Arab Emirates to a jack-up oil drilling rig located in the South Pars Gas Fields in Iranian territorial waters. OFAC noted, among other things, that the alleged violation constitutes a non-egregious case, but that Aban did not voluntarily self-disclose the apparent violation.
OFAC Release Further Updates to Iran Sanctions Rules
On December 23, OFAC announced it has issued a final rule amending existing Iranian Transactions and Sanctions Regulations to expand the scope of medical devices and agricultural commodities generally authorized for export or re-export to Iran. The amendment also includes new or expanded authorizations relating to training, replacement parts, software and services for the operation, maintenance, and repair of medical devices, as well as certain items that are broken or subject to product recalls or other safety concerns. In addition, this amendment revises the definition of the terms “goods of Iranian origin” and “Iranian-origin goods.” OFAC concurrently published new and updated FAQs pertaining to the amendment.
OFAC Clarifies Iran Sanctions Snapback, Also Amends General License Regarding Foreign Flights to Iran
On December 15, OFAC updated the Frequently Asked Questions Relating to the Lifting of Certain U.S. Sanctions Under the Joint Comprehensive Plan of Action, clarifying two FAQs regarding the re-imposition of sanctions in the event of a “sanctions snapback.” Among other things, the revised guidance clarified that the U.S. will not retroactively impose sanctions for activity considered legitimate during the time of the transaction, but that activity would have to immediately halt because the agreement does not grandfather existing contracts. In addition, OFAC explained that the U.S. would provide non-Iranian foreigners a 180-day period to wind down operations that were authorized prior to a snapback. The FAQ-guidance also explained that if a snapback of sanctions were to result in the revocation of licenses, the U.S. government would provide a 180-day wind-down period for those deals, and non-Iranian foreigners could receive repayment from Iranians for goods and services provided prior to a snapback under the terms of an existing contract.
Separately, OFAC issued amended license General License J-1, regarding foreign flights to Iran, to also authorize flights that involve code-sharing agreements. A code-share is a marketing arrangement in which an airline places its designator code on a flight operated by another airline, and sells tickets for that flight. GL J-1 is effective as of December 15 and replaces and supersedes General License J in its entirety.