Breach: When Compliance Fails Handling OFAC Enforcement and Investigations

1. Breach: When Compliance FailsHandling OFAC Enforcement and Investigations Presented by: Erich C. Ferrari, Ferrari Legal, P.C.

2. Enforcement and Investigations • When compliance fails, where do you go next? • Investigations • Voluntary Self Disclosures • Administrative Subpoenas • Enforcement • Penalties • Pre-Penalty Notices

3. Recent Cases Dealing With OFAC Enforcement and Investigations • Innospec: disclosure gone wrong? • OFAC Voluntary Self Disclosure (VSD) used in criminal prosecution • Pinnacle Aircraft Parts: too overprotective? • Legal advice leads to failure to appropriately answer administrative subpoena • What’s a lawyer/compliance officer to do?

4. OFAC Investigations • Investigations can be triggered by: • Self-disclosures • License history or determination requests • Referrals from CBP, ICE, FBI, BIS, IRS-CI • Open source research • Anonymous tips • Suspicious Activity Reports (SARs) • Blocking and reject reports

5. OFAC Investigations • All of the major U.S. banks use “interdict software” to check every wire transfer and accountholder against OFAC’s SDN list and the countries against which we have sanctions. • When a bank gets a “hit,” it suspends the payment until it makes a decision as to whether the hit is positive or false. (Examples: BahruddinHaqqani; Tehran; Khartoum; Bandar Abbas) • The bank may call OFAC’s “hotline” for guidance (800-540-6322).

6. OFAC Investigations • When a bank blocks or rejects a transaction pursuant to OFAC sanctions, it is required to report it to OFAC within 10 days. OFAC receives 8000+ of these per year. • OFAC then reviews every reported transaction and flags those where it appears that a U.S. person may have been violating U.S. sanctions (roughly 10 percent). • Most of the reported transactions involve parties outside the United States, and therefore are unlikely to trigger an OFAC investigation.

7. OFAC Investigations • Roughly 10 percent of the transactions do involve a U.S. person engaging in potentially prohibited conduct. The payment might be destined for or originated by someone with a U.S. address, or at a U.S. bank account. Or the payment could reference a U.S. person. • In each of those instances, OFAC issues an administrative subpoena to the U.S. person, asking for an explanation of the payment and the U.S. person’s role in it.

8. OFAC Investigations • Statutes give OFAC broad administrative subpoena authority, including penalties for failure to respond • OFAC issues more than 1,000 administrative subpoenas per year • More than half of OFAC’s administrative subpoenas are pursuant to the Iranian Transactions Regulations

9. OFAC Investigations • If the transactions date years back in time, OFAC will ask the possible violator to sign a tolling agreement. • This enables OFAC to complete a thorough investigation without older violations becoming ineligible for penalty due to the five-year statute of limitations. • Refusal to sign a tolling agreement is not considered an aggravating factor. • However, entering into a tolling agreement is a basis for mitigating the enforcement response.

10. OFAC Investigations • Investigations conclude in one of the following ways: • No action, if there was no violation after all. • A Cautionary Letter, urging greater care next time. • A referral to criminal investigators if it appears the violations may have been criminal in nature. • A finding of violation. • A settlement. • A civil monetary penalty.

11. Voluntary Self Disclosures Self-initiated notice before or at the same time as OFAC or any other federal, state or local government agency or official discovers the apparent or substantially similar violation • “Substantially similar” apparent violations are part of a series of similar apparent violations or are related to the same pattern or practice of conduct

12. Voluntary Self Disclosures • To disclose or not to disclose, that is the question • Telling on yourself: managing your client’s reaction/expectations • Fools rush in: thoroughly consider the matter • Exemptions, general licenses, interpretative guidance • Err on the side of disclosure

13. Voluntary Self Disclosures • Once the decision is made to disclose, act quickly, • Supplement later if you need to • Two bites at the apple: Corollary to Federal Criminal Sentencing: • Departures/Variance vs. VSD/Pre-Penalty Notice Response • Advocacy: State your position—USE THE (en)FORCE(ment guidelines)

14. Voluntary Self Disclosures • You’ve made the decision now move! • Race to the courthouse analogy whoever gets there first wins • Make sure to provide enough information • One sentence is not enough. • Supplement, Supplement, and Supplement • You made the leap now pull the parachute string

15. Penalties • IEEPA Enhancement Act - October 16, 2007(P.L. 110-96, 121 Stat 1011 ) • IEEPA Penalty Increase to Greater of: • $250,000 or • 2X Transaction Amount • Retroactive Application

16. Enforcement Guidelines • Interim final rule published 9/8/08 • Final rule published 11/9/09 Goals • Flexibility to achieve appropriate results • Predictability/equity in results

17. Enforcement Guidelines • 13 factors OFAC considers in determining the appropriate administrative action in response to an apparent violation • More holistic approach • General factors replace aggravating/mitigating factors • New penalty calculation process • New PPN process

18. Enforcement Guidelines General Factors A. Willful or Reckless Violation of Law • Willfulness • Recklessness • Concealment • Pattern of conduct • Prior Notice • Management Involvement

19. Enforcement Guidelines General Factors B. Awareness of Conduct at Issue • Actual Knowledge • Reason to Know • Management Involvement

20. Enforcement Guidelines General Factors C. Harm to Sanctions Program Objectives • Economic or Other Benefit to the Sanctioned Individual, Entity, or Country • Implications for U.S. Policy • License Eligibility • Humanitarian Activity

21. Enforcement Guidelines General Factors D. Individual Characteristics • Individual vs. Entity • Commercial Sophistication • Size of Operations and Financial Condition • Volume of Transactions • Sanctions Violation History

22. Enforcement Guidelines General Factors E. Compliance Program • Existence and adequacy of OFAC compliance program • Views of regulators

23. Enforcement Guidelines General Factors F. Remedial Response • Conduct stopped? • Internal investigation into the causes and extent of the apparent violations? • Compliance program implemented/improved? • Thorough review to identify other possible violations?

24. Enforcement Guidelines General Factors G. Cooperation with OFAC • Voluntarily self-disclosure? • Provide all relevant information? • Provide information regarding other related violations? • Subpoena required? • Prompt response? • Tolling agreement?

25. Enforcement Guidelines General Factors H. Timing of Apparent Violation in Relation to Imposition of Sanctions I. Other Enforcement Action J. Future Compliance/Deterrence Effect K. Other Relevant Factors on a Case-by-Case Basis • Allows for ensuring response is proportionate to the nature of the violation

26. Enforcement Guidelines In light of the General Factors, what is most appropriate: * A Cautionary Letter? * A Finding of Violation? * A Civil Monetary Penalty?

27. Enforcement Guidelines A Cautionary Letter is sent if • it is not clear that a violation occurred, or • a Finding of Violation or a civil monetary penalty is not warranted under the circumstances, but the underlying conduct has raised some concerns

28. Enforcement Guidelines Finding of Violation • If OFAC determines that a violation occurred, considers it important to document the occurrence, and concludes the conduct warrants an administrative response but that a civil monetary penalty is not the most appropriate response, OFAC may issue a Finding of Violation. • It is a final agency determination unless OFAC later learns of additional related violations or other relevant facts. • Respondent has an opportunity to respond before the determination becomes final.

29. Enforcement Guidelines If OFAC determines that a civil monetary penalty is appropriate, it considers the case with the following characteristics in mind: • Was it a Voluntary Self-Disclosure? • Was it an Egregious Case?

30. Enforcement Guidelines Was it an Egregious Case? • Focus on General Factors A-D • Willful or reckless • Awareness of conduct • Harm to sanctions program objectives • Individual characteristics • Director or Deputy Director determination

31. Penalty Calculations If a Finding of Violation is not appropriate, the next step is to calculate the penalty.

32. Penalty Calculations

33. Penalty Calculations Adjustment for Relevant General Factors • Substantial Cooperation non VSD (25 - 40%) • First Violation (up to 25%) • Other General Factors • Each may be considered mitigating or aggravating, resulting in a higher or lower proposed penalty amount • Result is Proposed Penalty Amount

34. Penalty Process Pre-Penalty Notice After OFAC calculates the appropriate monetary penalty, it will issue a Pre-Penalty Notice (PPN). • Description of alleged violations • Specific regulations allegedly violated • Base category (which of the four boxes were selected) for penalty calculation and most relevant General Factors • Maximum penalty amount • Proposed penalty amount

35. Penalty Process Response to Pre-Penalty Notice Alleged violator may submit a written response to the PPN. • Agree to the proposed penalty, • Disagree that any penalty is warranted and specify why, or • Disagree with amount and explain why a lower amount would be more appropriate.

36. Enforcement Guidelines Penalty Notice • If OFAC receives no response within the time prescribed in the PPN, or if following the receipt of a response OFAC concludes that a civil monetary penalty is warranted, OFAC will issue a Penalty Notice (PN). • A PN is a final agency determination that a violation has occurred. • In the absence of a response to the PPN, the penalty amount in the PN generally will be the same as that in the PPN.

37. Penalty Process Settlements • A settlement typically does not constitute a final agency determination that a violation has occurred. • Settlement discussions may be initiated by OFAC, the alleged violator, or the alleged violator’s representative. • Settlement discussions can occur anytime before a PN is issued.

38. Penalty Process • OFAC posts a summary of all settlements and penalties on its website. • Updated at least monthly, sometimes more often.

39. Conclusion • Be cautious whatever approach you take • Enforcement and Investigations can be intimidating, but it is manageable • Think through everything carefully before you make your move.

40. Contact Information • If you have questions after the event, please contact me: • Phone: 202-280-6370 • Email: ferrari@ferrari-legal.com • Book: The Iranian Transactions Regulations Practice Guide • www.sanctionlaw.com THANK YOU!