On August 25, 2011, a major U.S. financial institution agreed to pay the U.S. Department of Treasury, Office of Foreign Assets Control (“OFAC”) $88.3 million to settle claims of violations of several U.S. economic sanctions programs. While OFAC settlements with financial institutions in recent years have involved larger penalty amounts, this August 2011 settlement is notable because of OFAC’s harsh—and subjective—view of the bank’s compliance program.

Background. OFAC has primary responsibility for implementing U.S. economic sanctions against specifically designated countries, governments, entities, and individuals. OFAC currently maintains approximately 20 different sanctions programs. Each of those programs bars varying types of conduct with the targeted parties including, in certain cases, transfers of funds through U.S. bank accounts.

As reported by OFAC, the alleged violations in this case involved, among other conduct, loans, transfers of gold bullion, and wire transfers that violated the Cuban Assets Control Regulations, 31 C.F.R. Part 515, the Iranian Transactions Regulations, 31 C.F.R. Part 560, the Sudanese Sanctions Regulations, 31 C.F.R. Part 538, the Former Liberian Regime of Charles Taylor Sanctions Regulations, 31 C.F.R. Part 593, the Weapons of Mass Destruction Proliferators Sanctions Regulations, 31 C.F.R. Part 544, the Global Terrorism Sanctions Regulations, 31 C.F.R. Part 594, and the Reporting, Procedures, and Penalties Regulations, 31 C.F.R. Part 501.

Key Points of Settlement. As summarized below, the settlement provides insight into OFAC's compliance expectations in several ways:

1. “Egregious” conduct. In OFAC's view, three categories of violations – involving Cuba, in support of a blocked Iranian vessel, and incomplete compliance with an administrative subpoena – were egregious under the agency’s Enforcement Guidelines. To quote the agency's press release, these violations “were egregious because of reckless acts or omissions” by the bank. This, coupled with the large amount and value of purportedly impermissibly wire transfers involving Cuba, is likely a primary basis for the large $88.3 million penalty.

OFAC's Enforcement Guidelines indicate that, when determining whether conduct is “egregious,” OFAC gives “substantial” weight to (i) whether the conduct is “willful or reckless,” and (ii) the party's “awareness of the conduct at issue.” 31 C.F.R. Part 501, App. A. at V(B)(1). We suspect that OFAC viewed the conduct here as “egregious” and “reckless” because, according to OFAC, the bank apparently failed to address compliance issues fully: as an example, OFAC claims that the bank determined that transfers in which Cuba or a Cuban national had interest were made through a correspondent account, but did not take “adequate steps” to prevent further transfers. OFAC's emphasis on reckless or willful conduct, and the agency’s assertion that the bank was aware of the underlying conduct, underscore the importance of a compliance program that both has the resources to act, and is able to act reasonably promptly when potential compliance issues are identified.

2. Ramifications of disclosure. In this matter, the bank voluntarily disclosed many potential violations. Yet the tone in OFAC's press release is generally critical of the bank for violations that were not voluntarily disclosed. Moreover, OFAC specifically criticizes the bank for a tardy (though still voluntary) disclosure. According to OFAC, that disclosure was decided upon in December 2009 but not submitted until March 2010, just prior to the bank receiving repayment of the loan that was the subject of the disclosure. Although OFAC ultimately credited the bank for this voluntary disclosure, the timing of that disclosure may have contributed negatively to OFAC's overall view of the bank’s conduct.

This serves as a reminder that there often is a benefit of making an initial notification to the agency in advance of the full disclosure. This also serves as reminder of OFAC’s very substantial discretion as to what is a timely filing of a disclosure: as noted in OFAC's Enforcement Guidelines, a voluntary self-disclosure “must include, or be followed within a reasonable period of time by, a report of sufficient detail to afford a complete understanding of an apparent violation’s circumstances.” (emphasis added). In this regard, OFAC maintains specific discretion under the regulations to minimize credit for a voluntary disclosure made (at least in the agency's view) in an inappropriate or untimely fashion.

3. Size of the penalty. The penalty amount—$88.3 million—is substantial. Yet the penalty is only a small percentage of the much larger penalties paid by Lloyds TSB ($350 million), Credit Suisse ($536 million), and Barclays ($298 million) over the past few years. In those cases, although the jurisdictional nexus between those banks and the United States was less clear than in the present case, the conduct was apparently more egregious because it involved what OFAC characterized as intentional misconduct in the form of stripping wire instructions. The difference in the size of the penalties is at least partly attributable to the amount of money involved in each matter. It also appears, however, that OFAC is distinguishing between “reckless” conduct and intentional misconduct.

4. Sources of information. As noted, many of the violations in this matter were voluntarily disclosed to OFAC. The press release also indicates that certain disclosures were based on information about the Cuba sanctions issues that was received from another U.S. financial institution (it is not clear whether OFAC received information from that other financial institution). The press release also states that, with respect to an administrative subpoena OFAC issued in this matter, the agency's inquiries were at least in part “based on communications with a third-party financial institution.”

It may not be the case here that another financial institution (or institutions) blew the proverbial whistle, but it appears that at least one other financial institution did provide information that OFAC used to pursue this matter. Such information sharing is a reminder that, particularly given the interconnectivity of the financial system, even routine reporting by financial institutions may help OFAC identify other enforcement targets.

5. Compliance oversight. As part of the settlement agreement, the bank agreed to provide ongoing information about its internal compliance policies and procedures. In particular, the bank agreed to provide the following: “any and all updates” to internal compliance procedures and policies; results of internal and external audits of compliance with OFAC sanctions programs; and explanation of remedial measures taken in response to such audits.

Prior OFAC settlements, such as those with Barclays and Lloyds, have stipulated compliance program reporting obligations for the settling parties. While prior agreements, such as Barclay's, required a periodic or annual review, the ongoing monitoring obligation in this settlement appears to be unusual, and could be a requirement that OFAC imposes more often in the future. (Although involving a different legal regime, requirements with similarly augmented government oversight have been imposed in recent Foreign Corrupt Practices Act settlements, most notably the April 2011 settlement between the Justice Department and Johnson & Johnson. See Getting Specific About FCPA Compliance, Law360, at: http://www.sheppardmullin.com/assets/attachments/973.pdf).

Conclusions. We think this settlement is particularly notable for the aggression with which OFAC pursued this matter. Based on the breadth of the settlement, OFAC seems to have engaged in a relatively comprehensive review of sanctions implications of the bank’s operations, going beyond those allegations that were voluntarily self-disclosed to use information from a third party. Moreover, as detailed above, OFAC adopted specific, negative views about the bank’s compliance program and approach and seems to have relied on those views to impose a very substantial penalty. The settlement is a valuable reminder that OFAC can and will enforce the U.S. sanctions laws aggressively, and all parties—especially financial institutions—need to be prepared.