Imagine telling your company’s Board of Directors that the company will have to knowingly violate the law. Further, you might note, the American Law Institute’s Principles of Corporate Governance state that, with very limited exceptions, a director who knowingly causes the corporation to disobey the law violates his duty of care. The protections of the Business Judgement Rule may not be available to a board member who, charged with navigating the Scylla and Charybdis of a conflict of laws, steers right into the shoals of noncompliance.

Beginning August 6, that will be the situation facing the thousands of companies that are subject to U.S. sanctions on Iran and to EU regulations blocking those sanctions. While it appears to be a stark choice, some nuances to the regulations may make navigating the narrow straights of the conflict of laws a less Odyssean and more practically manageable.

The Rock: U.S. Secondary Sanctions with Extraterritorial Applications

Beginning August 6, the United States will begin enforcing certain secondary sanctions applicable to Iran pursuant to the U.S. withdrawal from the Iran nuclear agreement known as the Joint Comprehensive Plan of Action (JCPOA). The United States will reimplement the rest of the secondary sanctions after November 4, 2018.

Secondary sanctions are those that apply to transactions with no U.S. nexus: where a non-U.S. company deals with Iran outside of the United States and not involving U.S. persons or the U.S. banking system. Non-U.S. companies that violate secondary sanctions are subject to being sanctioned themselves by the U.S. government. Non-U.S. financial institutions that violate secondary sanctions are subject to restrictions or prohibitions on U.S. correspondent or payable through accounts (read: restricting their access to the U.S. dollar).

The Hard Place: EU Blocking Resolution

On June 6, 2018 the European Commission adopted an amendment to its Blocking Regulation(originally propounded to block the effect of U.S. secondary sanctions on Cuba) to counteract the effects of the extraterritorial application of U.S. sanctions on Iran. Broadly, the resolution’s main provisions are as follows:

• Coverage. Natural and legal persons resident or organized in the EU that engage in international trade or commercial activities.
• Requirements. Covered persons affected by U.S. sanctions on Iran must report to the European commission.
• Prohibitions. Covered persons are prohibited from complying, directly or through a subsidiary or intermediary, actively or by deliberate omission.
• Rights of Action. EU persons have the right to recover any damages, including legal costs, where those damages arise from a covered person’s compliance with U.S. sanctions on Iran. Recovery could take the form of “seizure and sale of assets held by those persons or entities.” (EC No 2271/96, Art. 6)
• Penalties. Each EU Member State is tasked with deciding the penalties for breach of the blocking regulation. The regulation merely requires that sanctions be “effective, proportional and dissuasive.”

Shooting the Gap: EU Authorization to Comply with U.S. Law

Article 5 of the EU blocking resolution states that covered persons may be authorized by the committee to comply with U.S. sanctions on Iran where there is sufficient evidence that non-compliance would cause serious damage to a natural or legal person. The resolution does not state how companies go about applying for that authorization. However, our (rather persistent) calls to our contacts in the Commission offices (finally) yielded the following response:

The criteria for the application of the second paragraph of Article 5 will be laid down in a Commission Implementing Regulation that will also be published and will enter into force on 7 August.

It is not clear how long the application approval process may take or the likelihood of approval.

The process does provide companies at least a theoretical resolution to their conflict of laws dilemma. If a company applies for authorization to comply with U.S. regulations, then continues to comply with U.S. regulations, it may take a defensible position that potential prosecutions by the government or suits for damages from affected persons would be estopped by the company’s good faith efforts to comply with both applicable legal regimes.

However, application brings with it the same risk that a company notifying the Commission of its U.S. sanctions issues: it alerts authorities that that the company may be in violation of the blocking regulation. Further, where the Commission rejects a company’s application for authorization to comply with U.S. sanctions, that company may feel doubly threatened, as the Commission and, presumably, domestic regulators will be aware that the company has continued to comply with U.S. sanctions.

The Lesser of Two Evils: Risk Mitigation Where Risk Elimination is Impossible

According to Homer, Odysseus steered close to the monster Scylla, losing only a few sailors, rather than the whirlpool Charybdis, where he risked the loss of his entire ship. Companies may face a similar choice of which regulator is scarier, and that choice is clear. The penalties for violating the EU blocking regulation depend on the domestic application in each EU member state, but for many multinational companies, none of those potential penalties comes close to the devastation possible pursuant to U.S. secondary sanctions enforcement. The effect on a multinational business of being prohibited from any transaction with U.S. persons – no importing, no exporting, and, generally, no use of U.S. dollars – could be a death sentence. It could be equally injurious to a foreign financial institution with international customers to be cut off from access to the U.S. banking system.

For that reason, many companies will be tempted to honor the EU blocking regulations in the breach. However, on a case-by-case basis, companies may identify ways to manage the risks of doing business under both legal regimes based on the particular facts of their business arrangements.