InfoBytes Blog
Filter
Subscribe to our InfoBytes Blog weekly newsletter and other publications for news affecting the financial services industry.
OFAC sanctions Russian government research institution connected to malware
On October 23, the U.S. Treasury Department’s Office of Foreign Assets Control announced sanctions pursuant to Section 224 of the Countering America’s Adversaries Through Sanctions Act against a Russian government research institution. According to OFAC, the institution knowingly, on behalf of the Government of the Russian Federation, engaged in significant activities that undermined cybersecurity. As a result, all property and interests in property of the sanctioned person, and any entities owned 50 percent or more by such person subject to U.S. jurisdiction, are blocked. U.S. persons are also generally prohibited from entering into transactions with the sanctioned persons. Additionally, non-U.S. persons who engage in certain transactions with the sanctioned person may also be exposed to sanctions.
OFAC sanctions Russian cybercriminals for $16.8 million crypto scam
On September 16, the U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) sanctioned two Russian nationals who were allegedly involved in phishing campaigns targeting virtual asset service providers in 2017 and 2018, resulting in losses of at least $16.8 million. Specifically, the Russian nationals spoofed web domains of legitimate virtual currency exchanges to steal customers’ login information and gain access to their real accounts. According to OFAC, they used a “variety of methods to exfiltrate their ill-gotten virtual currency” and subsequently laundered the money to a personal account, attempting to “conceal the nature and source of the funds by transferring them in a layered and sophisticated manner through multiple accounts and multiple virtual currency blockchains.” OFAC designated the individuals pursuant to Executive Order 13694, which targets “malicious cyber-enabled activities, including those related to the significant misappropriation of funds or personal identifiers for private financial gain.”
OFAC emphasized that anti-money laundering and countering the financing of terrorism regimes “pose a critical chokepoint in countering and deterring” this type of cybercriminal activity. As a result, all property and interests in property belonging to the designated individuals subject to U.S. jurisdiction are blocked, and “U.S. persons generally are prohibited from dealing with them.”
OFAC sanctions Russia-linked individuals for interfering in elections
On September 10, the U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) announced its decision to sanction four Russia-linked individuals for allegedly attempting to influence the U.S. electoral process. According to OFAC, these designations are intended to “promot[e] accountability for Kremlin-linked individuals seeking to undermine confidence in U.S. democratic processes.” Three of the designated individuals are employed by the Internet Research Agency (IRA), a Russian “troll factory,” which was previously designated by OFAC along with its Russian financier, for providing material support to IRA activities. The three designated individuals allegedly supported the IRA’s cryptocurrency accounts, which OFAC claimed are used to “fund activities in furtherance of their ongoing malign influence operations around the world.” As a result, all property and interests in property belonging to, or owned by, the identified individuals subject to U.S. jurisdiction are blocked, and “any entities 50 percent or more owned by one or more designated persons are also blocked.” U.S. persons are also generally prohibited from engaging in transactions with the designated individuals.
OFAC issues sanctions for supporting Russian financier
On July 15, the U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) announced sanctions pursuant to Executive Orders 13848, 13694, and 13661 against three individuals and five entities located in Sudan, Hong Kong, and Thailand, for allegedly enabling a Russian financier to evade U.S. sanctions. According to OFAC, the financier supported the Internet Research Agency (IRA), a Russian “troll farm” designated by OFAC in 2018, and is believed to be the financier behind Private Military Company, a “designated Russian Ministry of Defense proxy force.” OFAC alleged that this operation “advocated for the use of social media-enabled disinformation campaigns similar to those deployed by the IRA, and the staging of public executions to distract protestors seeking reforms.” Additionally, OFAC alleged that the individual and Thailand and Hong Kong-based entities “facilitated over 100 transactions exceeding $7.5 million that were sent in the interest of [the financier].” As a result, all property and interests in property belonging to, or owned by, the identified individuals and entities subject to U.S. jurisdiction are blocked, and “any entities that are owned, directly or indirectly, 50 percent or more by the designated entities, are also blocked.” U.S. persons are generally prohibited from dealing with any property or interests in property of blocked or designated persons.
OFAC extends two Ukraine-related general licenses
On March 20, the U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) announced it extended the expiration dates of two Ukraine-related general licenses (GLs) by issuing GL 13N, which supersedes GL 13M, and GL 15H, which supersedes GL 15G. Both GLs—which now expire July 22—authorize certain transactions necessary to divest or transfer debt, equity, or other holdings, or wind down operations or existing contracts with a Russian manufacturer previously sanctioned by OFAC in April 2018 (covered by InfoBytes here).
Visit here for continuing InfoBytes coverage of actions related to Ukraine.
OFAC sanctions additional Russian oil brokerage firm for doing business with Venezuela
On March 12, the U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) announced sanctions pursuant to Executive Order (E.O.) 13850 against a Russian oil brokerage firm for operating in the oil sector of the Venezuelan economy. According to OFAC, following the February 18 designation of a Swiss-incorporated, Russian-controlled oil brokerage and its board chairman and president (covered by InfoBytes here), cargoes of Venezuelan oil allocated to the designated company were charged to the newly sanctioned brokerage firm in order to evade U.S. sanctions. In connection with the designation, OFAC issued Venezuela General License 36A, which authorizes certain transactions and activities otherwise prohibited under E.O.s 13850 and 13857 that are required in order to wind down business with the company. Concurrently, OFAC issued amended FAQ 817 and FAQ 818 to address the significance of OFAC’s designation of the company, and whether there is a wind-down period. OFAC reiterated that “all property and interests in property of [the brokerage firm] that are in the United States or in the possession or control of U.S. persons, and of any entities that are owned, directly or indirectly, 50 percent or more by the designated individual and entity, are blocked and must be reported to OFAC.”
OFAC, Canada, and the EU sanction Russian-backed officials for Crimean incursion
On January 29, the U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) announced that it took action against seven “Crimean Officials” backed by Russia, and a Russian railway company and its CEO. The announcement states that the officials unilaterally assumed governmental control of the Crimean Peninsula. OFAC designated the officials under Executive Order (E.O.) 13660, in partnership with Canada and the European Union (EU), which both also designated the officials “in a strong demonstration of the international community’s continued condemnation of Russia’s interference in Crimean politics.” According to the announcement, Secretary of the Treasury, Steven T. Mnuchin, asserts that he believes the coordinated designations by OFAC and the two nations may prevent the “illegitimate officials” from doing business internationally. The OFAC designations of the railway company and its CEO for operating in the Crimea Region of Ukraine under E.O. 13685, come shortly after the railway started a passenger route from Russia to the Crimean Peninsula in late December. As a result of the sanctions, “all property and interests in property of these individuals and entity that are in the United States or in the possession or control of U.S. persons must be blocked and reported to OFAC.” OFAC noted that its regulations “generally prohibit” U.S. persons from participating in transactions with the designated persons, and warned foreign persons that if they knowingly facilitate significant transactions for any of the designated persons, they may be designated themselves.
OFAC issues Ukraine-/Russia-related FAQs
On December 20, the U.S. Treasury Department's Office of Foreign Assets Control (OFAC), published a new Ukraine-/Russia-related FAQ. FAQ 815 explains that Section 7503 of the National Defense Authorization Act for Fiscal Year 2020, or the Protecting Europe’s Energy Security Act of 2019 became effective immediately upon the President signing it on December 20. This section—entitled “Imposition of sanctions with respect to provision of certain vessels for the construction of certain Russian energy export pipelines”—specifies that parties who have knowingly provided vessels engaged in deep sea pipe laying for the Nord Stream 2 or Turkstream pipelines must ensure that such vessels cease such activity as soon as safely possible in order to protect human life and “avoid any environmental or other significant damage.”
District Court voids OFAC fine of $2 million
On December 31, the U.S. District Court for the Northern District of Texas vacated a $2 million civil penalty imposed on a global petroleum company (company) by OFAC for the company’s purported violation of sanctions, ruling that the OFAC regulations did not provide “fair notice” to the company that its actions were prohibited. In May of 2014, OFAC issued sanctions regulations relating to Ukraine. Shortly afterwards, the company and a Russian oil company, with which it had a long-established business relationship, executed several contracts. Although the Russian company was not a blocked entity, its president, who signed the contracts, had been named a specially designated national (SDN). In July of 2014, OFAC issued a penalty notice with a $2 million penalty to the company, alleging that the contracts the company executed with the Russian company violated the Ukraine-related sanctions. The company immediately challenged the penalty notice and fine, asserting that at the time it entered into the subject transactions, the OFAC regulations on Ukraine were not clear, and it interpreted them to allow the transactions. The court agreed with the company, holding that the “text of the regulations does not provide fair notice of its interpretation” in accordance with the Due Process Clause, because “the text [of the regulation] does not ‘fairly address’ whether a U.S. entity receives a service from a SDN when that SDN performs a service enabling the U.S. person to contract with a non-blocked entity. Therefore, the court granted the company’s motion for summary judgment and vacated OFAC’s Penalty Notice.
OFAC announces sanctions against Russia-based organization for malware attacks on financial institutions
On December 5, the U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) announced sanctions pursuant to Executive Order 13694 against a Russia-based cybercriminal organization for allegedly developing and distributing malware that infected financial institutions and resulted in more than $100 million in theft. OFAC’s action targets 17 individuals and seven entities and is “intended to disrupt the massive phishing campaigns orchestrated by [the organization],” Treasury Secretary Steven T. Mnuchin stated. According to OFAC, the organization used the malware to infect computers and harvest login credentials from roughly 300 banks and financial institutions in over 40 countries, resulting in millions of dollars of damage to U.S. and international financial institutions and their customers. As a result of the sanctions, all property and interests in property of these persons subject to U.S. jurisdiction are blocked, along with “any entities 50 percent or more owned by one or more designated persons.” OFAC noted that its regulations “generally prohibit” U.S. persons from participating in transactions with designated persons, and warned that “foreign persons may be subject to secondary sanctions for knowingly facilitating a significant transaction or transactions with these designated persons.”
In a concurrent action announced the same day, the DOJ unsealed criminal charges—including those related to international computer hacking and bank fraud schemes—against two of the organization’s members. In addition, Treasury’s Financial Crimes Enforcement Network and the Cybersecurity and Infrastructure Security Agency released a report providing a technical analysis of the malware and related variants, emphasizing that because the malware continues to target the financial services sector, financial institutions should review and incorporate the report’s techniques, tactics, and procedures into existing network defense capabilities and planning.