Regulators have sent numerous messages that companies who source from abroad need to subject their entire supply chain to extensive due diligence, based on state-of-the-art compliance measures to minimize supply chain risks. These include the issuance of an unusual briefing by the Departments of State, Treasury, and Homeland Security on the need for supply chain due diligence, a special advisory from the Department of Homeland Security on supply chain due diligence and compliance best practices, and a seven-figure Office of Foreign Assets Control (OFAC) penalty for a company not engaging in “full spectrum” supply chain due diligence. In addition, Customs has now fully implemented the supply-chain requirements of the Uyghur Forced Labor Prevention Act (UFLPA), which targets goods that are sourced in whole or in part from the Xinjiang Uyghur Autonomous Region within China. As a result, the amount of goods seized by Customs for forced labor, human trafficking, and UFLPA concerns has soared from around $3 million per year to well over $1 billion per year.

The message from the U.S. government is simple: companies that source from abroad need to take full responsibility for the ethical sourcing of their goods, and cannot hide behind claims that the goods were produced by independent companies. Further, with all imported goods subject to the scrutiny of U.S. Customs and Border Protection, which now has the enforcement resources to find, detain, and potentially reject goods suspected to be sourced in violation of these supply chain laws, companies sourcing from abroad need to be aware of the new enforcement paradigm, and to take steps to ensure that they are aware of how and where their goods are sourced, right down to the last sub-supplier.

It is clear that the U.S. government believes importers need to put significant resources into supply chain due diligence and compliance. One indicator of the expectations of the U.S. government in this regarding is provided by the OFAC $996,080 settlement with a Californian cosmetics company, e.l.f. Cosmetics, Inc. (ELF), for alleged violations of the North Korean Sanctions Regulations. This settlement occurred after ELF voluntarily reported the “unknowing” importation of 156 shipments of false eyelash kits from two suppliers in China that contained materials independently sourced by these suppliers from North Korea. According to the settlement announcement, the total value of the shipments originally sourced from North Korea was approximately $4.4 million.

OFAC determined that even though the apparent violations were self-disclosed, aggravating factors included that “ELF is a large and commercially sophisticated company that engages in a substantial volume of international trade” and that “ELF’s compliance program was either non-existent or inadequate throughout the time period in question.” In particular, OFAC was most concerned that while ELF was putting substantial efforts into international quality control, it was not putting equal efforts into its international regulatory compliance. As OFAC stated:

Throughout the time period in which the apparent violations occurred, ELF’s OFAC compliance program was either non-existent or inadequate. The company’s production review efforts focused on quality assurance issues pertaining to the production process, raw materials, and end products of the goods it purchased and/or imported. Until January 2017, ELF’s compliance program and its supplier audits failed to discover that approximately 80 percent of the false eyelash kits supplied by two of ELF’s China-based suppliers contained materials from the DPRK [North Korea].

OFAC made clear that the lack of compliance and due diligence was a major driver of the enforcement action. As OFAC states:

This enforcement action highlights the risks for companies that do not conduct full-spectrum supply chain due diligence when sourcing products from overseas, particularly in a region in which the DPRK, as well as other comprehensively sanctioned countries or regions, is known to export goods. OFAC encourages companies to develop, implement and maintain a risk-based approach to sanctions compliance and to implement processes and procedures to identify and mitigate areas of risks. Such steps could include, but are not limited to, implementing supply chain audits with country- of-origin verification; conducting mandatory OFAC sanctions training for suppliers; and routinely and frequently performing audits of suppliers.

Underscoring the importance that OFAC and other agencies are placing on supply chain due diligence and compliance, OFAC provides key details regarding the steps that ELF took to gain mitigating credit due to its compliance response. OFAC quoted the following steps approvingly in its announcement of the ELF penalty:

• Implemented supply chain audits that verify the country of origin of goods and services used in ELF’s products.
• Adopted new procedures to require suppliers to sign certificates of compliance stating that they will comply with all U.S. export controls and trade sanctions.
• Conducted an enhanced supplier audit that included verification of payment information related to production materials and the review of supplier bank statements.
• Engaged outside counsel to provide additional training for key employees in the United States and in China regarding U.S. sanctions regulations and other relevant U.S. laws and regulations; and
• Held mandatory training on U.S. sanctions regulations for employees and suppliers in China and implemented additional mandatory trainings for new employees, as well as regular refresher training for current employees and suppliers based in China.

The importance of global supply chain due diligence is even more important today, where there are increased requirements bearing on supply chain integrity. A well-designed supply chain integrity program will address all elements of supply chain risk, including forced labor, human trafficking, UFLPA, supply chain transparency requirements, conflict minerals, and other potentially applicable regulatory risks. While the steps that make sense for any given importer will vary, the key general compliance and due diligence items to consider include the following steps to consider for companies that source from abroad:

Step 1: Map Your Supply Chain

• You should map out your supply chain, including sub-suppliers (and their sub-suppliers), to ensure that you have identified potential risk points relating to potential sourcing from the XUAR or the use of forced labor or human trafficking. The review should cover the origin of the imported goods and any raw materials or components in the imported goods. Items to consider in your mapping exercise include:
  • Identifying transactions among entities along the supply chain tied to the specific imported goods.
  • Identifying locations and identities of entities in the supply chain, their sub-suppliers, and their business relationships.
• You should use publicly available resources to estimate the probability that raw materials or components originated in the XUAR or that indicate an enhanced probability that a supplier is using forced labor.
• You should be alert to red flags that could indicate the use of unauthorized sub-suppliers, such as the sourcing of raw materials or components that do not originate from the stated location or inputs from countries that are known to lack production capacity.
• You should require that suppliers regularly update you whenever they bring a new sub-supplier on board, so that you can keep your supply chain map current.

Step 2: Conduct Due Diligence on Key Suppliers

• Due diligence is a key component of global supply chain compliance. Key items to include in your supply-chain due diligence strategy include a detailed description of the supply chain for the imported good and its components, including ties to the supply chain map.
• Due diligence should include documentation regarding how: (1) the imported good was made from raw materials to finished good; (2) by what entities (and where), including all in-house manufacturing, sub-assembly operations, and outsourced production related to the imported good; (3) the roles of the entities involved at each stage of the supply chain; and (4) the relationship between the entities, including whether a supplier also is a manufacturer.
• For goods originating in China or that rely on Chinese parts and components, which are at higher risk, there should be due diligence conducted to show there are no links to the XUAR, to companies on the UFLPA Entity List, or other links to the use of labor linked to the XUAR.
• Although UFLPA concerns are at the forefront because they constitute the majority of Customs detentions, due diligence also should focus on general indicators of forced labor, including intimidation and threats, abuse of vulnerability, restriction of movement, isolation, abusive living and/or working conditions, and excessive hours do not exist or are fully remediated. Evidence may include the following:
  • The previously mentioned supply chain map.
  • Evidence to demonstrate how and to whom wages are paid at each supplier and sub-supplier.
  • Evidence regarding whether the worker comes from the XUAR and the worker’s residency status.
  • Evidence to demonstrate that production of the goods is consistent with the documented workers, including their number, the total materials produced, and the total volume of output.
  • Information relating to hours worked and the output of the relevant goods.
• Information showing the supplier and sub-suppliers have controls in place to ensure all workers are voluntarily recruited.
• Evidence demonstrating that any worker from the XUAR is working voluntarily and without threat of penalty, including credible evidence that each worker:
  • Was fully voluntarily recruited to work.
  • Was recruited and continued at the job without coercion.
  • Was recruited free of any forced labor indicator, including detention, threats of detention, detention or threats of detention of family members, or forced transfer of land to the government.
  • Was transported from the XUAR voluntarily and free of any forced labor indicator, including government surveillance or control of worker movements.
  • Was transferred to the entity in a voluntary fashion, free of any forced labor indicator, including government surveillance.
  • Was living and working in conditions free of any forced labor indicator, including government surveillance, reporting to the government, restriction of movement, or required indoctrination activities such as political, language, or cultural classes.

Step 3: Ensure Due Diligence and Compliance Extend to Sub-Suppliers

• Because both the UFLPA and forced labor liability under other regulations can arise from activities by sub-suppliers, it is essential to identify the provenance of each component of the imported good.
• Due to this possibility, supply-chain mapping should work through to the last sub-supplier. This requires working with suppliers to identify sub-suppliers who might not be known to your company.
• When possible, you should use unique identifiers to track raw materials and other inputs through the supply chain. This may require the use of tracking methodologies to deal with inputs from different suppliers that might be commingled.

Step 4: Develop Legal Protections

• Appropriate forced labor and UFLPA risk management requires adopting a layered approach to compliance. One of the layers of protection lies in the adoption of appropriate legal protections.
• A key first step is to develop a vendor code of conduct, which lays out the legal obligations that govern the relationship with suppliers as well as the contractual obligations to abide by all ethical sourcing contractual provisions.
• For supply chains that potentially have some kind of link to the XUAR, involve entities that use labor transferred from the XUAR under government labor programs or source parts and components that may do the same. The code of conduct should specifically address the risk of use of government labor schemes, such as pairing assistance, poverty alleviation, or other labor transfer programs that involve potential violations of the ULFPA. The vendor code of conduct should also cover the requirement not to use any companies on the UFLPA Entity List.
• As part of a layered approach to compliance, you should incorporate the code of conduct into all supplier contracts, whether through explicit contractual provisions in long-term agreements and purchase orders or through incorporation of the vendor code of conduct requirements by reference. These provisions should include not only the legal obligation to comply with forced labor and UFLPA regulations but also incorporate such compliance measures as allowing auditors and verification organizations necessary access to facilities.
• Your legal agreement with your suppliers should require that they flow down all forced labor, human trafficking, and UFLPA compliance requirements to all of their suppliers. The flow-down requirements should mirror the strength of your own code of conduct and should require that your direct supplier (1) ensure that sub-suppliers train employees on detecting forced labor, (2) conduct self-audits or obtain independent audits (including regarding recruitment of workers and use of government labor programs), (3) track and report on their performance of these compliance requirements, and (4) require and monitor subcontractor adherence to the code of conduct.

Step 5: Communicate and Train Across the Supply Chain

• You should provide training to employees or agents responsible for selecting suppliers, including regarding (1) the conduct of a forced labor/UFLPA risk assessment, (2) identifying the risks of forced labor identified by risk assessments, (3) the legal restrictions and consequences of importing into the United States goods produced with forced labor, (4) the presumption that goods made in the XUAR or by companies on the Entity List are made using forced labor, (5) the risks posed by products that incorporate goods using forced or UFLPA labor, (6) the risks of suppliers being included on future additions to the UFLPA Entity List, and (7) the requirements of the company’s code of conduct.
• You should communicate the applicable legal and contractual requirements to suppliers at all tiers of the supply chain.
• You should provide training regarding forced labor, human trafficking, and UFLPA issues to all of your key suppliers, while also providing such training to sub-suppliers or requiring such training from your own suppliers.

Step 6: Monitor Compliance & Remediate Compliance Missteps

• You should monitor supplier compliance with the code of conduct and all legal and contractual provisions requiring supply chain compliance.
• You should remediate any forced labor conditions or UFLPA violations and terminate the supplier relationship if remediation is not possible or is not timely completed.
• If indicators signifying the presence of forced labor in the supply chain are identified, or violations of the UFLPA, you should cease importing impacted goods prior to remediation. If you intend to continue sourcing inputs from the supplier, you must develop a corrective action plan that specifically addresses all indicators of forced labor or eliminate the UFLPA concerns.
• You should consider using, on a risk-adjusted basis, independent third-party verification regarding the effectiveness of an importer’s due diligence system. Third-party verification also can be helpful in periodically assessing the effectiveness of system components for ensuring that the supply chain is free of forced labor.

The consequences for importing goods that are the product of forced labor or human trafficking, or that violate the UFLPA, can be severe: detained goods at the border, potentially large penalties, reputational risks, and even threats to the company’s ability to import. By working through compliance and due diligence steps such as these, frequent importers can help identify and mitigate these regulatory risks. It is only by taking full responsibility for the entire supply chain, right down to the last sub-supplier, that importers can identify, manage, and mitigate their supply-chain risks and ensure the smooth functioning of their supply chains.