What Happened: 

On March 14, 2024, the US Department of the Treasury’s Office of Foreign Assets Control (OFAC) announced a settlement (the Settlement) with EFG International AG, a global private banking group based in Switzerland with many global subsidiaries (collectively, the Manager), regarding violations of OFAC rules alleged to have occurred as a result of the Manager’s buying, selling and, in many cases, merely holding US securities on behalf of persons sanctioned by OFAC. 

The Bottom Line:

In a compliance note (Tri-Seal Compliance Note: Obligations of foreign-based persons to comply with US sanctions and export control laws) (Compliance Note) issued on March 6, 2024 by OFAC, the US Department of Justice (DOJ) and the Bureau of Industry and Security (BIS) of the US Department of Commerce (collectively, the tri-seal agencies or simply tri-seal) provided key guidance on the legal exposure of non-US persons arising from US sanctions and export controls. Among other things, the Compliance Note explains that – even though foreign persons are generally not prohibited from dealing with blocked persons (as US persons would be) by virtue of OFAC sanctions – many of those sanction programs extend to foreign persons who “cause” US persons to violate sanctions. For further information on the Compliance Note, see our client alert here.

In the case of the Manager, OFAC applied the principles laid out in the Compliance Note and found that the Manager’s transacting in US securities for (and in some cases, merely by holding US securities on behalf of) blocked persons resulted in various US market participants unknowingly processing securities transactions on behalf of persons sanctioned by OFAC. As discussed further below, although the Settlement does not specifically identify these US market participants, it is likely that they included major US banking or securities firms and one or more centralized securities depositories.

Foreign financial institutions and other foreign firms should conduct on-going due diligence on their clients, and have in place appropriately responsive controls, as part of a risk-based sanctions compliance program.

The Full Story:

A brief word on US securities market structure

As the Settlement explains, the transactions that were ultimately sanctioned “were conducted through and held in omnibus accounts with U.S. custodians and other U.S. market participants.” To be clear, this is standard operating procedure in the United States where markets have been built for speed and efficiency. In US markets today, most publicly traded securities are held by a centralized depository (The Depository Trust Company (DTC)) or one of its affiliates on behalf of the ultimate beneficial owners. Large financial institutions are often direct participants in DTC, meaning they have accounts at DTC reflecting interests held in aggregate by a participating financial institution in particular issuers’ securities held through a depository. Smaller domestic and foreign financial institutions (including the Manager) generally do not have their own accounts at DTC; rather, they will have an “omnibus account” at a larger financial institution that is a DTC participant. Sometimes there are multiple intermediate financial institutions between the entity with the client account and the DTC participant.

When a client of the Manager buys or sells shares, those transactions often would show up as an increment or decrement to the Manager’s account at the DTC participant. Since all of the DTC participant’s (and its clients’) transactions are aggregated, a purchase by the Manager might show up as an increment to the DTC participant’s account if, for example, the DTC participant had no other transactions in that particular company on that day. However, the Manager’s purchase might not increase the DTC participant’s position at all if other accounts of the participant were selling shares and the aggregate of those sales exceeded the amount the Manager purchased. And, by design, the only person with information on exactly who is the beneficial owner of the shares being traded is only known at the top-most level.

DTC also plays a role in so-called “corporate actions,” which is when various transactions are initiated by the issuer (not the stockholder). Corporate actions can include dividend or interest payments. Under the DTC system, the payment of interest and dividends is automated: when an issuer declares and pays a dividend of a certain amount per share, it then deposits the gross amount due to the holders holding through DTC, DTC apportions it out to its participants in accordance with each one’s aggregate number of shares beneficially owned, those participants then apportion it out to the accounts of its direct holders in accordance with its number of shares beneficially owned, and so on. Corporate actions can also include non-cash transactions like stock splits, spin-offs, mergers and the like. In the case of dividends and interest payments, there is no action required of (or that can be taken by) the ultimate holder or any of the parties through which it holds the securities. For some other corporate actions, there may be an election that has to be made by the ultimate or intermediate holders, for example, electing to receive cash or stock in connection with a merger.

The alleged violations

In its announcement of the Settlement, OFAC described three separate sets of alleged violations:

First, OFAC alleged violations of the Cuba sanctions regulations. Interestingly, OFAC specifically included in the litany of transactions violating sanctions not only purchases and sales of US securities but also “corporate actions.” These corporate actions consisted of dividend and/or interest payments by the relevant securities issuer. Apparently, OFAC regards the payment of funds “through omnibus accounts at U.S. custodians or otherwise involving U.S. market participants … on behalf of clients who resided in Cuba or whose beneficial owners were Cuban nationals” as causing US persons to violate US sanctions because the Manager failed to prevent this payment. The securities related transactions and fund transfers totaled nearly $30 million. Notably, at least for the period between 2014 and 2018, and unlike the circumstances related to the next two groups of sanctions, it does not appear that the Manager recognized an issue or took any action prior to 2018 to prevent the blocked persons from profiting. It is not clear from OFAC’s description what steps were taken in 2018 and after with respect to the Cuba transactions.

Second, OFAC alleged violations of the drug kingpin sanctions regulations. In 2009, the Manager’s Singapore branch opened an investment account for a Chinese national whom OFAC later blocked in 2014 under Specially Designated Narcotics Trafficking Kingpin (SDNTK) regulations. Upon the designation, the Singapore branch imposed a restriction to prevent the processing of any payments to or from the client’s account and restricted trading in the account. However, neither the Manager nor its Singapore branch notified any of the US institutions holding the Manager’s accounts. As a result, in OFAC’s view, the Manager “caused” US-based firms to process nearly 150 corporate actions resulting in cash payments into accounts for the sanctioned individual (even though it appeared that payments were not made out of those accounts to the blocked person). In 2018, the Manager implemented additional controls and informed US counterparties of the underlying SDNTK interest.

Third, OFAC alleged violations of sanctions imposed by executive order after the Russian invasion of Ukraine (i.e., the Russian Harmful Foreign Activities Sanctions program). In 2023, OFAC blocked transactions with an individual who was a client of the Manager under the Russian Harmful Foreign Activities Sanctions. In this case, the Manager not only promptly recognized there was an issue and imposed an internal restriction on the client’s account, but also notified US counterparties and US custodians about securities positions that they held on behalf of the recently-designated client. Due to an undescribed error, the Manager failed to identify three impacted securities positions which led to the payment of dividends into the client’s account totaling $1,200.

Conclusion

OFAC calculated the maximum civil penalty that could be assessed as over $275 million. However, in light of various mitigating factors – attempts to restrict trading to prevent blocked clients from realizing any economic benefit of their positions, significant remedial actions, lack of recent prior violations and substantial cooperation – it assessed a reduced penalty of $3.7 million (with $1 million suspended pending satisfactory completion of certain other actions).

In connection with this settlement, OFAC made the following recommendations for foreign financial institutions with US omnibus accounts:

• “To mitigate this risk, foreign financial institutions … can screen their customers against OFAC’s List of Specially Designated Nationals and Blocked Persons (the “SDN List”) and otherwise conduct appropriate due diligence to identify customers or counterparties with a potential sanctions nexus. Routine screening of customer information, including names and locations, as well as ongoing risk-based due diligence, is particularly important in light of frequent updates to OFAC’s sanctions programs and additions to OFAC’s SDN List.”
• “Upon identifying a client subject to sanctions, omnibus accountholders should impose appropriate restrictions and controls, both to prevent benefits from going to sanctioned persons and to prevent affected U.S. firms, including U.S. custodians, from processing transactions for the sanctioned persons. Such steps could include ensuring prompt communication with the U.S. firms so that they can also impose controls, such as segregating and blocking affected securities or sub-accounts, as appropriate.”