OFAC Issues New Regulations Addressing Non-Public “Tailored Actions” and Lengthening Recordkeeping Requirements

The U.S. Treasury Department’s Office of Foreign Assets Control (“OFAC”) recently issued new regulations that will have significant impacts on the compliance obligations of persons subject to U.S. jurisdiction, and particularly financial institutions. First, OFAC issued a Final Rule that describes the types of non-public “tailored actions” it can take. While OFAC has taken such actions before, this rule provides greater regulatory clarity regarding such actions and may signal that OFAC intends to utilize them more regularly. Second, consistent with the statutory extension of the statute of limitations for sanctions violations, OFAC issued an Interim Final Rule that extends the recordkeeping requirement from five to 10 years.

The rules, taken together with OFAC’s earlier updates to its recordkeeping requirements,[1] reflect notable updates to OFAC’s regulations that will have significant impacts on companies, which will have to update their compliance systems and procedures to take account of these new requirements. 

Final Rule Regarding OFAC’s Authority to Issue Non-Public “Tailored Actions”

On September 13, 2024 OFAC issued a final rule (the “Final Rule”) to “clarify its processes for issuing orders.”[2] Notably, the Final Rule provides a description of the type of “tailored actions” that OFAC may take in a non-public manner.

OFAC updated its regulations across its sanctions programs by adding the following note:

In certain cases, OFAC may issue an order to: identify as blocked specific property or interests in property of a person designated or otherwise blocked pursuant to this section; block specific property or interests in property of a person pending investigation; or block or impose other prohibitions with respect to specific property or interests in property less than full blocking sanctions. Notice of such orders will be provided: by publication in the Federal Register; in writing to persons OFAC may assess to have an interest in the property; or by issuing an order or directive in writing to financial institutions or other transaction intermediaries, and requiring the recipient of the order or directive to promptly disclose it to affected persons with whom the recipient maintains direct commercial relationships. Inquiries regarding any such order should be directed to OFAC's Compliance Division at 202-622-2490.[3]

OFAC notes that it generally exercises its blocking authority by placing persons on the Specially Designated Nationals List (“SDN List”) but adds that, “in certain cases, OFAC may exercise its authority in narrower ways.” While OFAC has issued such directives to financial institutions before as a matter of practice, the Final Rule articulates how OFAC may seek to use its authority going forward. The Final Rule notes the various type of non-public orders that OFAC may impose on a financial institution or other persons:

• “OFAC may identify specific property in which OFAC determines a blocked person has an interest and issue an order to financial institutions or other persons in possession or control of such property to block such property.”
• “OFAC may identify property or interests in property of a person who is not blocked, but whom OFAC is investigating for potential designation. To ensure that this property or interest in property is not transferred before OFAC designates the person, OFAC may issue an order to financial institutions or other persons in possession or control of such property or interest in property to block it pending investigation.”[4]
• “OFAC may block or impose other prohibitions with respect to specific property or interests in property less than full blocking sanctions. For example, OFAC may consider designating a person but determine U.S. national security or foreign policy interests are better served by prohibitions that may be narrower than blocking the entirety of the person’s property and interests in property. In such cases, OFAC would determine that a person meets the criteria for designation but would take action less than blocking the entirety of a person’s property and interests in property. This action may take various forms, including an order to the financial institutions or other persons in possession or control of the specific property or interests in property or a directive imposing non-blocking restrictions.”

While listing a blocked person on the SDN list “provides the public with constructive notice of the action,” OFAC notes that these “more tailored action[s] . . . may not always require notice of the action through publication in the Federal Register, and it may be more appropriate to provide actual notice specifically to a person affected by the prohibition.” OFAC notes that it could provide this notice “directly” or “indirectly through financial institutions or other transaction intermediaries, who would be required to notify the affected persons with whom the recipient maintains direct commercial relationships.” OFAC notes that “requiring a transaction intermediary to disclose a blocking order may be the most efficient and effective means of providing notice because a transaction intermediary maintains direct commercial relationships through which affected persons may inquire about the status of their funds.”

In effect, OFAC is making clear that it intends to utilize its authority to issue non-public orders to financial institutions to block certain property and then may require the financial institution to notify the targeted person with whom it has direct commercial relationships. While OFAC has utilized certain non-public orders in the past, the Final Rule reflects a regulatory articulation of those authorities and perhaps an effort to put them on a stronger legal footing.[5]

This regulatory development is particularly notable in concert with OFAC’s recent update of its reporting regulations through a rule that took effect in August 2024.[6] There, OFAC added a note to its regulations stating that OFAC may “instruct” a financial institution to report certain transactions before processing them. The note provides: “[i]f OFAC has reason to believe an account or transaction (or class of transactions) may involve the property or interests in property of a blocked person, OFAC may instruct the financial [institution] to report transactions that meet specified criteria and to notify OFAC prior to processing such transactions. Upon review, OFAC may determine that a reported transaction involves the property or interests in property of a blocked person and may take further action.”

Taken together, these regulatory developments clarify that OFAC may (1) require financial institutions to “report” transactions that meet certain criteria and then (2) may issue non-public orders requiring the financial institution to block that property and notify the targeted person with whom it has direct commercial relationships.

Interim Final Rule – Ten-Year Recordkeeping Requirement

On September 11, 2024, OFAC issued an Interim Final Rule (the “IFR”) to amend its reporting, procedures and penalties regulations by extending its recordkeeping requirements.[7] The IFR will require all persons  engaging in transactions subject to U.S. sanctions or other U.S. jurisdictional nexus) to keep a full and accurate record of each transaction for a period of 10 years.[8] As discussed in previous alerts,[9] the IFR comes on the heels of OFAC’s indication in August 2024, that it anticipated publishing an interim final rule to extend the recordkeeping requirement to “match the new statute of limitations (“SOL”)” for sanctions violations.[10] The effective date of the IFR is March 12, 2025.

The extension of the recordkeeping requirement is likely to be burdensome for businesses with compliance infrastructures oriented around the five-year retention period. OFAC itself acknowledges this and in the IFR states that “[t]he recent increase in the recordkeeping period to 10 years from five years could impose a temporary incremental burden on recordkeepers while they update their recordkeeping practices and adjust storage requirements to maintain records for a longer period of time.”[11]

Companies will need to make any revisions to their recordkeeping practices required for compliance with the IFR by the March 12, 2024 effective date. OFAC is inviting written comments to the IFR, for submission on or before October 15, 2024, via the Federal eRulemaking Portal or email.

Conclusion

Financial institutions and other potentially affected persons subject to U.S. jurisdiction should consider making updates to their internal procedures and training by addressing the non-public “tailored actions” described by OFAC in its recent regulatory amendments. Likewise, all persons who may conduct transactions under OFAC’s sanctions programs should consider beginning the process now to change their recordkeeping procedures to conform to the new 10-year requirement that goes into effect on March 12, 2025. As discussed in our previous alert,[12] transitioning to the 10-year recordkeeping requirement could require significant changes, particularly for financial institutions with current systems and practices that account for shorter recordkeeping requirements under other regulatory regimes.[13]

The Paul, Weiss team remains available to assess the impact of these actions on your organization’s sanctions risk and compliance program.

*       *       *

[1]       See Paul, Weiss, OFAC’s Updated Reporting Regulations and New Statute of Limitations Guidance (Aug. 19, 2024), available here.

[2]       See 89 F.R. 75955, available here.

[3]       Emphasis added.

[4]       This procedure is distinct from OFAC’s practice of designating a person as blocked pending investigation and publishing that name in the Federal Register. Historically, OFAC’s regulations have stated the “names of persons whose property and interests in property are blocked pending investigation pursuant to this section also are published in the Federal Register and incorporated into the SDN List.” 31 CFR § 560.211.

[5]       In a comment responding to OFAC’s update to its recordkeeping rule, a banking trade association noted “OFAC’s practice of requiring banks to hold and report transactions at OFAC’s direction based on non-published information,” which “puts financial institutions in a difficult position” and “[i]nstitutions have been placed in this awkward position for several months as OFAC makes its determination regarding the transactions.” See Comment on FR Doc # 2024-10033 (Posted by OFAC) (Jun. 14, 2024), available here.

[6]       See Paul, Weiss, OFAC’s Updated Reporting Regulations and New Statute of Limitations Guidance (Aug. 19, 2024), available here.

[7]       See 89 F.R. 74832, available here.

[8]       The scope of this requirement (i.e., what universe of records is considered necessary to reflect transactions subject to U.S. sanctions) is not addressed in the IFR and would benefit from OFAC clarification.

[9]       See Paul, Weiss, Congress Raises Statute of Limitations for U.S. Sanctions Violations to 10 Years (Apr. 26, 2024), available here; see also Paul, Weiss at Note 3.

[10]     See Paul, Weiss at Note 3. On April 24, 2024, President Biden signed into law a national security omnibus that, among other things, increased the statute of limitations for civil and criminal sanctions (under the International Emergency Economic Powers Act and Trading with the Enemy Act) from five to 10 years. See Paul, Weiss, Congress Raises Statute of Limitations for U.S. Sanctions Violations to 10 Years (Apr. 26, 2024), available here.

[11]     See IFR at 74833.

[12]     See Paul, Weiss at Note 3.

[13]     See, e.g., 12 C.F.R. § 219.24 (2024) (the Federal Reserve Board requires financial institutions to retain financial records “for a period of five years.”), available here; 12 C.F.R. § 349.19 (2024) (the Federal Deposit Insurance Corporation requires insured depository institutions to keep financial records “for at least five years from the date the record is created.”), available here; 12 C.F.R. § 9.8 (2024) (the Office of the Comptroller of the Currency requires national banks to retain records of fiduciary accounts “for a period of three years from the later of the termination of the account or the termination of any litigation relating to the account.”), available here. Additionally, “[i]n general the BSA requires that a bank maintain most records for at least five years.” See Federal Financial Institutions Examination Council (FFIEC), BSA/AML Manual (2014), available here.