OFAC Action Highlights Need to Keep Sanctions Lists Updated
The Treasury Department’s Office of Foreign Assets Control has issued a finding of violation to a bank in connection with its predecessor’s processing of funds transfers in violation of U.S. sanctions against Iran. OFAC states that this enforcement action highlights the particular risks associated with failing to implement proper procedures and controls to ensure that internal proprietary sanctions lists are properly reviewed following changes to the SDN list and/or the sanctions programs administered by OFAC.
OFAC states that in 1999, at which time the importation of Iranian-origin carpets from Iran or a third country was authorized under a general license, a company specializing in carpets became a customer of the predecessor bank. Shortly thereafter the predecessor bank added the company to its “false hit list” after its OFAC interdiction software generated multiple alerts due to the word “Persian” in the company’s name.
OFAC revoked the general license for the importation of Iranian-origin carpets in September 2010 but the predecessor bank did not remove the company from its false hit list or implement any other measures to prevent or identify possible violations involving the company. The predecessor bank then originated six funds transfers on behalf of the company to pay an Iranian entity located in Iran for the purchase of Iranian-origin carpets. After the first transfer was halted by a downstream financial institution that requested further information, a predecessor bank staff member discovered the violative nature of the transaction but failed to escalate it to the corporate compliance department. As a result, five more similar transfers were processed.
OFAC states that its determination to issue a finding of violation (and, apparently, not to issue a penalty) to the bank that resulted from the merger of the predecessor bank and a third party reflects its assessment that the predecessor bank may have been unaware of the risks associated with a false hit list that was not reviewed and updated regularly. OFAC notes that staff-level personnel had actual knowledge of the conduct that led to two of the violations and, based on the company’s line of business, reason to know that the company may process additional violative transactions. In addition, the predecessor bank’s OFAC compliance program failed to include procedures for updating its internal sanctions list following changes to the sanctions programs administered by OFAC (other than updates to the SDN list). On the other hand, no managers or supervisors were aware of the conduct that led to the violations and the predecessor bank has not previously received a penalty notice or finding of violation from OFAC, took appropriate remedial action in response to the violations and substantially cooperated with OFAC during the investigation, including by identifying and reporting four of the violations.