The Long Arm: OFAC Settlement Underscores Sanctions Compliance Requirements That Reach Beyond the US Dollar

On August 27, 2021, the US Department of the Treasury (Treasury) announced that it had reached a settlement agreement (the Settlement Agreement) with Romanian bank First Bank SA (First Bank) and its US parent company, JC Flowers & Co. (JC Flowers), resulting from financial services First Bank provided to parties located in Iran and Syria. Specifically, JC Flowers and First Bank agreed to pay Treasury more than $850,000 to settle civil penalties associated with 98 commercial transactions that may have violated Treasury's Office of Foreign Assets Control (OFAC)'s Iran and Syria sanctions programs. According to Treasury, these apparent violations resulted from "First Bank's lack of understanding of the scope of U.S. sanctions regulations applicable to financial institutions without a physical presence in the United States." In one regard, First Bank’s “lack of understanding” was typical of what is seen in many other OFAC settlement agreements with foreign banks operating outside the US: First Bank processed trade finance transactions involving Iran and Syria in apparent violation of OFAC’s regulations because the payments were US-dollar denominated and transited the US financial system. What makes this settlement agreement notable is that OFAC also cited a number of Euro-denominated payments involving Iranian parties as apparent violations. This was because First Bank processed the payments after JC Flowers acquired a majority stake in the bank. Thus, even though the payments fell outside the US financial system, they were still prohibited by US sanctions because the bank is owned by a US person.

Accordingly, the settlement serves as a reminder to both non-US banks and other non-US companies that US sanctions reach outside the United States in many dimensions, and there are no shorthand compliance measures that can guarantee protection from US sanctions (such as the common misimpression that avoiding US dollars is sufficient to avoid US sanctions).

What Were First Bank’s Violations?

In 2019, First Bank’s regulator, the National Bank of Romania, identified potential sanctions violations involving a US dollar transaction that First Bank had processed for a shipment of timber from Romania to Syria. First Bank then conducted a review of its operations for the proceeding five years, identifying two general categories of sanctions violations. First, First Bank processed US dollar payments for individuals and entities located in Iran and Syria. Second, following First Bank's acquisition by JC Flowers, the Romanian bank processed payments to Iran as a foreign subsidiary of a US Company.

Processing US Dollar Payments for Individuals or Entities Located in Iran and Syria

Iran. From March 2016 to December 2018, First Bank processed 34 outgoing payments totaling $991,246 through US financial institutions where the end user of the related commercial transaction was in Iran and the payments were made on behalf of Iranian customers, in violation of OFAC's Iranian Transactions and Sanctions Regulations (ITSR).

Syria. From July 2016 to December 2018, First Bank processed 36 outgoing payments totaling $1,061,104 through US financial institutions in which the underlying transaction documentation suggested the importers were located in Syria, in violation of OFAC's Syrian Sanctions Regulations (SySR).

Euro-Denominated Payments to Iran as a Foreign Subsidiary of a US Company

Between October 2018 and March 2018, First Bank processed 28 Euro-denominated payments totaling $1,536,840 outside the US financial system involving Iranian parties and interests. Although US sanctions programs generally do not apply where there is no "US Nexus" (i.e., such as a connection to the US financial system, US economy, or a US person), these transactions took place following JC Flowers' majority ownership interest acquisition of First Bank in June 2018. As a result, First Bank was prohibited from engaging in any activities that would be similarly banned for "US persons" under the ITSR.

Sanctions Compliance Implications

For non-US companies, the Settlement Agreement signals a few key aspects of sanctions compliance outside of the United States:

• US companies must conduct careful sanctions-related due diligence both before and after acquisitions, and monitor newly acquired subsidiaries for OFAC compliance. In June 2018, JC Flowers acquired a majority ownership in First Bank. Had JC Flowers identified First Bank's prior OFAC sanctions violations, the investor could have taken steps to offset purchase costs to account for liability risks related to prior sanctions violations and mitigate compliance concerns in connection with future sanctions violations. This case is one of a number of recent examples of sanctions cases that arose after non-US companies were acquired by US parents, triggering sanctions jurisdiction where the company was previously engaged in activities with sanctioned countries or persons.
• Parent companies must take ultimate responsibility for group-wide sanctions compliance, including with respect to changes of ownership implications. The Settlement Agreement is based, in part, on First Bank and JC Flower's civil liability for First Bank's processing of 28 payments involving Iranian parties and interests, despite that these payments were Euro-denominated, and occurred completely outside of the US financial system. While not an acceptable excuse from OFAC’s perspective, it is imaginable that First Bank’s local Romanian employees may not have appreciated that Iranian-related payments may violate OFAC regulations even when denominated in non-US dollars. A US parent company, however, must have an understanding of the sanctions implications created for all its subsidiaries and affiliates due to the parent being a US person. Of course, the US parent also should ensure each of its subsidiaries and affiliates has implemented an adequate, risk-based sanctions compliance program.
• A robust sanctions compliance program can avoid significant costs and burden down the line, even for companies majority-owned and -operated outside of the United States. Between March 2016 and December 2018, First Bank processed 70 transactions on behalf of Iranian or Syrian parties. Although First Bank was foreign-owned when it processed the majority of these payments, the transactions transited through US financial institutions, thus triggering OFAC's jurisdiction. According to OFAC’s press release announcing the settlement, the relevant trade finance and shipping documents noted Iranian and Syrian parties involved in the transaction (as either customers or importers) yet the employees processed the payments, evidently without management review as required by the bank’s policy regarding transactions with a US sanctions nexus. These transactions may have been avoided with rather basic procedures and training at a relatively minor expense compared to OFAC’s penalty.

Conclusion

The Settlement Agreement highlights the critical importance of risk-based sanctions compliance programs for non-US companies and the need for due diligence both before and after acquisitions.

For questions about US export control and sanctions law, international trade, or broader national security issues, please reach out to the authors or any of their colleagues in Arnold & Porter's National Security or White Collar Defense & Investigations practice groups.

© Arnold & Porter Kaye Scholer LLP 2021 All Rights Reserved. This Advisory is intended to be a general summary of the law and does not constitute legal advice. You should consult with counsel to determine applicable legal requirements in a specific fact situation.