OFAC’s Settlement With Airbnb Payments Highlights Risks for Companies, Financial Institutions Doing Business in Cuba and Other US-Sanctioned Jurisdictions

OFAC’s Settlement With Airbnb Payments Highlights Risks for Companies, Financial Institutions Doing Business in US-Sanctioned Jurisdictions

On January 3, 2022, the US Department of the Treasury’s Office of Foreign Assets Control (OFAC) announced a settlement with Airbnb Payments, Inc. (Airbnb Payments), a registered money services business and wholly owned subsidiary of Airbnb, Inc. (Airbnb). According to the announcement,¹ Airbnb Payments processed several thousand payments related to Airbnb customers’ travel to Cuba for reasons outside of the limited travel-related transactions permitted by OFAC’s Cuban Assets Control Regulations (CACR). According to OFAC, Airbnb Payments also failed to maintain required records documenting their customers’ travel experiences. As discussed below, this settlement agreement underscores that US companies entering or operating in high risk jurisdictions such as Cuba—and the financial institutions that process payments for such companies—must remain diligent to ensure that their compliance programs adequately account for regularly-evolving complexities in OFAC’s regulations. The settlement agreement also highlights the importance of proactive sanctions compliance. Notwithstanding the number of apparent violations, because Airbnb Payments voluntarily reported the activity to OFAC and implemented remedial measures, OFAC required the company to remit only $91,172.29—a small fraction of the statutory maximum civil penalty ($600,601,408).

Background

The United States imposed comprehensive economic sanctions on Cuba in the early 1960s, prohibiting the majority of financial transactions involving the country.² The CACR has been amended numerous times over the subsequent decades, with some administrations easing restrictions and others tightening them. The most significant easing of the CACR occurred under the Obama Administration. For example, in 2015 and 2016, the US eased restrictions on travel, remittances, trade, and the telecommunications and financial services sectors.³ These changes made it easier for more US dollars to flow into Cuba, with US persons permitted to send more money to their relatives, humanitarian projects, or emerging businesses in Cuba. The amendments also allowed US financial institutions to open correspondent accounts at financial institutions in Cuba.⁴

During this period, numerous US-based businesses began entering the Cuban market. Some of the businesses did not adequately appreciate that, notwithstanding the easing of certain restrictions, the CACR still prohibited many financial transactions involving Cuba. For example, travel to Cuba was not as open as commonly believed. The CACR permits travel-related transactions in connection with only 12 categories of travel⁵ and it requires US companies providing Cuba travel services to collect and maintain a certification from customers that they are authorized to travel under one of the authorized categories.⁶

Since the Obama Administration, permissible transactions with Cuba have been scaled back. The Trump Administration largely put an end to the so-called “Cuban thaw,” moving away from any attempt at engaging Cuba and instead tightening sanctions, including those restricting travel and remittances.⁷ The Biden Administration has, thus far, done little to change the US approach to Cuba, and the sanctions imposed by the Trump Administration are still largely in place.⁸, ⁹

Summary of Action

According to OFAC, between September 28, 2015 and March 1, 2020, Airbnb Payments estimated that it violated the CACR by (1) processing payments for an estimated 3,464 “stays” in Airbnb properties by guests who had not traveled to Cuba for any of the 12 reasons permitted by OFAC regulations; (2) failing to maintain records, as required by OFAC regulations, of an estimated 3,076 payments for Airbnb “experiences” hosted by locals in Cuba; and (3) processing an estimated 44 payments for “travel transactions” involving non-US persons on Airbnb’s website before OFAC had issued a specific license allowing Airbnb to do so.

OFAC asserted that the apparent violations occurred because (1) Airbnb entered the Cuban market without “fully addressing the complexities of operating a Cuba-related sanctions compliance program for internet-based travel services” for what would become a global customer base, and (2) “the scaling up of [Airbnb’s] services in Cuba appears to have outpaced the company’s ability to manage the associated sanctions risks via its technology platforms.”¹⁰

In explaining the relatively low civil monetary penalty that Airbnb Payments was required to pay, OFAC emphasized that the company received credit for proactively reviewing its own compliance program and voluntarily reporting the apparent violations it found, implementing significant remedial measures, having no prior OFAC penalties or findings of violation in the prior five years, and the fact that the apparent violations constituted “a non-egregious” case. That said, it is worth noting that OFAC found one aggravating factor to be the fact that “Airbnb Payments is a large and sophisticated U.S.-based technology company.”¹¹

Takeaway

The Airbnb Payments settlement offers two main lessons. First, companies expanding their operations—and particularly their internet operations—into any high-sanctions-risk area must do so with extreme caution, being careful not to expand the business-side of their operations without building up an appropriately robust sanctions compliance program as well. The compliance risk of any business expansion must first be adequately assessed and addressed. Otherwise companies run a risk of being penalized by OFAC, other regulatory agencies (e.g., for financial institutions, federal and state banking agencies), and, in some cases, the Department of Justice. 

Second, the relatively low civil monetary penalty in this case is a good reminder of the value of conducting internal self-assessments of sanctions compliance programs and, if necessary, voluntarily self-reporting any apparent violations.

*          *          *          *          * 

For questions about sanctions compliance please reach out to the authors or any of their colleagues in Arnold & Porter’s Financial Services or National Security Groups. 

© Arnold & Porter Kaye Scholer LLP 2022 All Rights Reserved. This Advisory is intended to be a general summary of the law and does not constitute legal advice. You should consult with counsel to determine applicable legal requirements in a specific fact situation.