Penalty Case Shows Importance of Risk-Based Controls to Ensure Subsidiary Compliance
The Office of Foreign Assets Control states that a recent enforcement case demonstrates the importance of implementing risk-based controls, such as regular audits, to ensure subsidiaries are complying with their obligations under OFAC’s sanctions regulations. The case also highlights the need to perform follow-up due diligence on acquisitions of foreign entities known to engage in transactions with sanctioned persons and jurisdictions.
An OFAC press release states that despite warnings before and after its acquisition by a U.S. company, a German company continued to complete and collect on orders with Cuban nationals under pre-acquisition contracts. Upon discovering this the U.S. company submitted a voluntary self-disclosure to OFAC and asserted that all of the German company’s open Cuba transactions had been canceled. However, the U.S. company subsequently found following an anonymous report to its ethics helpline that the German company’s former owners, who had stayed on as manager-employees after the acquisition, had continued the Cuba business by creating a scheme that concealed it from the U.S. company. In total, the German company committed 304 violations of the Cuban Assets Control Regulations with a value of about $3.4 million.
OFAC states that the statutory maximum civil monetary penalty in this matter is $20.0 million, the base penalty amount is $10.0 million, and the penalty assessed was $5.5 million. OFAC found the following to be aggravating factors: (1) the willful conduct of the German company’s management, (2) the use of written procedures to engage in a pattern of violative conduct, (3) significant harm to the sanctions program objective of maintaining a comprehensive embargo on Cuba, and (4) the size and sophistication of the German company and the fact that it is a subsidiary of a large internationally active company.
On the other hand, OFAC determined that the U.S. company’s cooperation, including filing a thorough voluntary self-disclosure, providing prompt responses to requests for information, and performing a thorough internal investigation, was a mitigating factor.