Avoiding Common “Root Causes” of Failure When Developing an OFAC Compliance Policy

All financial institutions—and many other types of businesses—need to have OFAC compliance policies. The Office of Foreign Assets Control (OFAC) regulates transactions between U.S. and foreign entities, and OFAC’s regulations prohibit (or “block”) transactions involving many foreign nations, companies, and individuals. These regulations establish OFAC’s various sanctions programs, and violating OFAC sanctions can have severe consequences regardless of the circumstances involved.

However, to develop effective OFAC compliance policies, financial institutions and other businesses must not only address the applicable OFAC sanctions, but also OFAC’s guidance. OFAC has released several guidance documents—both in the form of informal publications and in the form of federal regulations (i.e., the Economic Sanctions Enforcement Guidelines and OFAC Risk Matrix in 31 C.F.R. Part 501). While following OFAC’s guidance is not sufficient on its own—OFAC itself has made this clear—it is a necessary step toward successful OFAC compliance management.

Put our highly experienced team on your side

Dr. Nick Oberheiden

Founder

Attorney-at-Law

Lynette S. Byrd

Former Department of Justice

Brian J. Kuester

Former U.S. Attorney
Former DA

John W. Sellers

Former Senior Trial Attorney
U.S. Department of Justice

Local Counsel

Joanne Fine DeLena

Former Assistant U.S. Attorney

Local Counsel

Joe Brown

Former U.S. Attorney & Former District Attorney

Local Trial & Defense Counsel

Amanda Marshall

Former U.S. Attorney

Local Counsel

Aaron L. Wiley

Former Federal Prosecutor

Local Counsel

Roger Bach

Former Special Agent (OIG)

Michael Koslow

Former Supervisory Special Agent (FBI)

Chris Quick

Former Special Agent (FBI & IRS-CI)

Ray Yuen

Former Supervisory Special Agent (FBI)

10 Common “Root Causes” of OFAC Compliance Failures

One of the most useful guidance documents that OFAC has released is A Framework for OFAC Compliance Commitments (the “Framework”). This document highlights five “essential components” of an effective compliance program according to OFAC. Even more notably, however, the Framework also includes a list of 10 “root causes” that commonly lead to OFAC enforcement actions.

Given that the agency has identified these as persistent issues, they should be priority areas for financial institutions and businesses seeking to avoid OFAC scrutiny in 2023. With this in mind, here is an overview of 10 “root causes of OFAC sanctions compliance program breakdowns or deficiencies” that organizations can—and should—avoid:

1. Failure to Adopt a Formal OFAC Compliance Policy

OFAC states in the Framework that its regulations “do not require a formal [sanctions compliance program (SCP)].” However, OFAC also states that it “encourages” organizations to adopt compliance policies and “employ a risk-based approach to sanctions compliance by developing, implementing, and routinely updating a sanctions compliance program.” In the “root causes” section of the Framework OFAC notes that not only is lack of a formal OFAC compliance policy a frequent cause of compliance failures, but it also states that it treats failure to adopt a formal policy as an aggravating factor during enforcement proceedings.

2. Misinterpreting or Misapplying OFAC’s Regulations

When developing OFAC compliance policies, it is imperative that financial institutions and other businesses rely on accurate interpretations of OFAC’s regulations. Misinterpreting or misapplying these regulations can lead to adopting misguided compliance policies—and following these policies can in turn lead to compliance failures. While the Framework, OFAC’s FAQs, and other publicly available resources provide some guidance, organizations must ultimately work with their counsel to ensure that they are interpreting and applying OFAC’s regulations appropriately.

3. Facilitating Transactions By Non-U.S. Persons

When done pursuant to an effective OFAC compliance policy, facilitating transactions by non-U.S. persons should not present enforcement risks. This is because financial institutions’ and businesses’ compliance policies should serve to prevent them from engaging in transactions that violate OFAC sanctions or other statutory or regulatory prohibitions. However, when an organization’s compliance policies fail to serve their intended purpose, facilitating transactions by non-U.S. persons can prove to be extremely costly.

4. Exporting and Re-Exporting to OFAC-Sanctioned Persons or Countries

Exporting and re-exporting goods, technology, and services are also transactions that can lead to OFAC enforcement action in the event of a compliance failure. Here, too, while there is nothing inherently unlawful about exporting or re-exporting, doing so in violation of OFAC’s sanctions can expose organizations to substantial penalties.

5. Processing Payments To or From OFAC-Sanctioned Persons or Countries

One of the fundamental purposes of an OFAC compliance policy is to prevent the processing of payments to or from OFAC-sanctioned persons or countries. “Persons” include individuals as well as corporate and governmental entities identified on OFAC’s SDN List and pursuant to other sanctions programs. When developing OFAC compliance policies, organizations should devote a significant amount of their effort to ensuring that they have mechanisms in place to prevent these transactions.

6. Relying on OFAC Sanctions Screening Software and Filters

Many organizations rely on software to help them manage OFAC sanctions compliance. While software can be a useful tool, it is not without limitations. As OFAC notes in the Framework, organizations have faced enforcement action when they have “failed to update their sanctions screening software to incorporate updates to the SDN List or SSI List, failed to include pertinent identifiers such as SWIFT Business Identifier Codes for designated, blocked, or sanctioned financial institutions, or did not account for alternative spellings of prohibited countries or parties.”

7. Inadequate Customer Due Diligence

Customer due diligence is a fundamental aspect of OFAC compliance as well. An OFAC compliance policy should include structured processes and procedures for conducting due diligence and ensuring that information uncovered during the due diligence process gets used appropriately.

8. De-Centralization of OFAC Compliance Functions and Inconsistent Application of Compliance Policies

OFAC also notes that de-centralization of OFAC compliance functions is a common factor leading to sanctions violations and other statutory and regulatory failures. The Framework’s discussion of common root causes of compliance failures indicates that, in many cases, de-centralization leads to “inefficiency or incapable oversight and audit function[s],” as well as inconsistent application of organizations’ OFAC Compliance policies.

9. Failure to Identify and Avoid Non-Standard Payment and Commercial Practices

Non-standard payment and commercial practices, both internal and external, should be viewed as potential compliance concerns as well. Here, OFAC suggests that organizations should assess whether payments and commercial practices are “consistent with industry norms and practices,” and that they should view any external non-standard practices as potential attempts to “evade or circumvent OFAC sanctions or conceal . . . activity.”

10. Inadequate Internal OFAC Compliance Training, Monitoring, and Enforcement

Finally, recognizing that individual employees “have played integral roles in causing or facilitating violations” of OFAC regulations in many cases, OFAC advises that all organizations should prioritize individual responsibility and culpability. This advisory ties into earlier sections of the Framework discussing OFAC’s “essential components” of compliance, which include internal controls, training, and testing and auditing—among others.