OFAC Once Again Warns of Potential Liability of U.S. Parent Companies for Sanctions Violations Committed by Foreign Subsidiaries

On September 21, 2023, the U.S. Department of the Treasury’s Office of Foreign Assets Control (“OFAC”) announced a $9,618,477 settlement agreement with 3M Company (“3M”), a global manufacturing company based in Minnesota, regarding 54 apparent violations of OFAC’s Iran sanctions regulations.^[1]

As described below, these apparent violations relate to an agreement that a 3M subsidiary entered into in 2016 and conduct that occurred between 2016 and 2018.^[2] 3M voluntarily disclosed the matter to OFAC.

OFAC concluded that 3M’s subsidiary in Dubai, 3M Gulf Limited (“3M Gulf”), and subsidiary in Switzerland, 3M (East) AG (“3M East”), engaged in sales of reflective license plate sheeting to a German reseller which “3M knew or should have known would be resold to an arm of the [Law Enforcement Forces] of Iran.”^[3]

According to OFAC, even before 3M East signed the agreement with the German reseller, senior employees at 3M East and 3M Gulf were alerted that the end user in Iran was affiliated with Iran’s Law Enforcement Forces.^[4] Nevertheless, 3M East moved forward with signing the agreement and these employees “dismissed the need for further investigation” and “repeatedly misrepresented” the nature of the transactions in internal discussions.^[5] OFAC concluded—and treated as “aggravating factors”—that “3M Gulf senior managers willfully violated U.S. sanctions laws” and that numerous other 3M employees (e.g., Trade Compliance personnel) were “reckless” in “failing to properly evaluate the proposed sales” and “ignor[ing] ample evidence” of the violations.^[6] The enforcement action highlights that even where some transactions relating to a sanctioned jurisdiction are permitted, a company must perform appropriate diligence on the end user.^[7]

In announcing the settlement, OFAC emphasized that “parent companies are expected to oversee compliance with applicable U.S. sanctions laws within their subsidiaries, and to empower employees to alert headquarters trade compliance when business dealings need further review.”^[8] This is particularly relevant where the subsidiaries may have relationships with Iran or Cuba, as OFAC’s sanctions programs generally require foreign subsidiaries of U.S. companies to comply with the sanctions on those countries.^[9] This enforcement action builds on a string of enforcement actions that OFAC has brought against U.S. parent corporations for violations of the Iran sanctions regulations by their foreign subsidiaries.^[10]

While OFAC determined that the apparent violations were egregious, OFAC also found that there were a number of mitigating factors, including 3M’s remedial efforts to: 1) add Trade Compliance counsel; 2) terminate the employment of or formally reprimand six employees; 3) enhance sanctions compliance measures specific to the license plate business and enhance due diligence for any business involving a sanctioned country or region; and 4) enhance Trade Compliance training for all applicable employees.^[11]

This enforcement action underscores that it may be prudent for U.S. companies with global operations to review their sanctions compliance programs to ensure that those programs are appropriate for their risk profiles. There are five key areas that a company may consider:

Ensure Appropriate Sanctions Oversight of Foreign Subsidiaries

It is important for U.S. companies with global operations to review whether their foreign subsidiaries are taking appropriate measures to comply with U.S. sanctions. In a recent enforcement action against Construction Specialties Inc., OFAC highlighted “the importance for parent companies to ensure that they and their overseas subsidiaries implement appropriate compliance programs and procedures, routinely audit their overseas subsidiaries or ensure that independent auditing occurs, and otherwise exercise appropriate oversight over activities of those subsidiaries that may pose sanctions risks.”^[12]

Consider a Uniform Global Sanctions Policy

U.S. companies with global operations may consider adopting a uniform global sanctions policy applicable to all subsidiaries and affiliates, including non-U.S. subsidiaries and affiliates, that prohibits unlicensed transactions with sanctioned parties and/or involving comprehensively sanctioned jurisdictions. While this policy would sweep more broadly than is required by U.S. sanctions, many companies take this approach for risk-mitigation purposes given that interdependencies between U.S. operations and overseas operations could risk prohibited “facilitation” on the part of U.S. personnel. OFAC sanctions programs generally contain a prohibition on “facilitation” that prohibits a U.S. person from “facilitating” a transaction that they would be prohibited from taking themselves.^[13] In a 2021 enforcement action, OFAC highlighted that even the “approval of a contract, agreement, sale, or transaction by a U.S.-person manager between a foreign subsidiary and sanctioned entity may” violate the prohibition on “facilitation.”^[14] A uniform global sanctions policy can address the risk of a U.S. person engaging, even if inadvertently, in “facilitation” of a prohibited transaction.

Conduct Appropriate Sanctions Diligence in Mergers & Acquisitions

It is important for U.S. companies that are engaging in an acquisition to conduct careful sanctions diligence on the target and, after the completion of the transaction, ensure that the newly acquired entity has in place appropriate sanctions compliance measures. Although the 3M action did not stem from an acquisition, OFAC has brought several enforcement actions against U.S. companies for violations committed by recently acquired foreign subsidiaries. As we previously noted, OFAC expects the immediate adoption and implementation of appropriate controls when U.S. companies acquire non-U.S. companies with preexisting relationships with sanctioned persons or jurisdictions.^[15] Additionally, acquiring companies that discover potential sanctions violations by the acquired company during pre- or post-agreement diligence may wish to consider whether a voluntary self-disclosure to the Department of Justice and/or OFAC is appropriate. In recent months, the Department of Justice has highlighted that it is focused on corporate national security crime, including sanctions violations, and has emphasized that under new guidance an acquiring company can obtain a “declination” for voluntarily disclosing potential misconduct by the acquired company.^[16]

Establish Appropriate Whistleblower Procedures

As FinCEN develops its whistleblower program, companies with a global footprint may wish to evaluate the strength of their internal reporting mechanisms and examine whether those mechanisms cover potential violations by foreign subsidiaries.^[17] In the recent Construction Specialties enforcement action, OFAC emphasized the importance of establishing “mechanisms by which employees can confidentially and without fear of reprisal report potential breaches of a company’s sanctions compliance policies, procedures, and internal controls” and noted that FinCEN “maintains a whistleblower incentive program for violations of OFAC-administered sanctions, in addition to violations of the Bank Secrecy Act.”^[18] Although FinCEN has not yet issued whistleblower regulations, OFAC emphasized that “FinCEN is currently accepting whistleblower tips.”^[19]

Investigate Potential Misconduct and Take Appropriate Remedial Measures

If a company identifies a potential sanctions violation, it may be prudent to conduct an internal investigation and undertake appropriate remedial measures. In the 3M settlement agreement, OFAC gave 3M credit for “perform[ing] a thorough investigation” and taking the “remedial measures” described above, which included “several changes both in personnel and policies.”^[20] Under OFAC’s Enforcement Guidelines, OFAC will consider the company’s “remedial response,” including the company’s efforts to “discover necessary information to ascertain the causes and extent” of the potential violation and whether the company “adopted new and more effective internal controls and procedures to prevent a recurrence of the apparent violation.”^[21] Additionally, a company may wish to submit a voluntary self-disclosure to OFAC and/or the Department of Justice if appropriate.

                                                                                                                         *       *       *

[1]       OFAC, OFAC Settles with 3M Company for $9,618,477 Related to Apparent Violations of the Iranian Transactions and Sanctions Regulations (Sept. 21, 2023), available here (“OFAC Web Notice”).

[2]       The settlement agreement was entered into “without any finding of fault” and “shall not in any way be construed as an admission by [3M] that [3M] engaged in the Apparent Violations.” OFAC, Settlement Agreement (Aug. 29, 2023), available here.

[3]       OFAC Web Notice at 3.

[4]       Id. at 2.

[5]       Id.

[6]       Id. at 3-4.

[7]       3M East signed the agreement in the months after the Joint Comprehensive Plan of Action went into effect and OFAC published General License H. The General License authorized foreign subsidiaries of U.S. companies to engage in certain transactions with Iran, but excluded transactions with Iranian military, paramilitary, intelligence or law enforcement agencies, or any entities affiliated with those groups. Id. at 1.

[8]       Id. at 5.

[9]       Generally, OFAC sanctions apply to “all U.S. incorporated entities and their foreign branches,” but, under certain sanctions programs, “foreign subsidiaries owned or controlled by U.S. companies also must comply.” OFAC, FAQ 11 (Jan. 15, 2015), available here. Under the Iran sanctions program, “an entity that is owned or controlled by a United States person and established or maintained outside the United States is prohibited from knowingly engaging in any transaction, directly or indirectly, with the Government of Iran or any person subject to the jurisdiction of the Government of Iran that would be prohibited pursuant to this part if engaged in by a United States person or in the United States.” 31 C.F.R. § 560.215. Under the Cuba sanctions program, the prohibitions apply to any person subject to the jurisdiction of the United States, including “[a]ny corporation, partnership, association, or other organization, wherever organized or doing business, that is owned or controlled by” a U.S. person. 31 C.F.R. § 515.329.

[10]     See, e.g., Paul, Weiss, OFAC Takes Enforcement Action Against U.S. Parent Company for its Recently Acquired Chinese Subsidiary’s Iran Sanctions Violations (Apr. 1, 2019), available here; Paul, Weiss, In Unprecedented Move, OFAC Takes Enforcement Action Against U.S. Parent Company for Turkish Subsidiary’s Iran Sanctions Violations and Simultaneously Sanctions the Subsidiary’s Ex-Managing Director (Feb. 11, 2019), available here.

[11]     OFAC Web Notice at 4.

[12]     OFAC, OFAC Settles with Construction Specialties Inc. for $660,594 Related to Apparent Violations of the Iranian Transactions and Sanctions Regulations (Aug. 16, 2023), available here.

[13]     The definition of “facilitation” can vary across sanctions programs, but OFAC has taken the position that the involvement of a U.S. parent in a transaction can be “facilitation.” For example, in 2018 OFAC brought an enforcement action against a U.S. parent company that “review[ed] and approve[d]” transactions by its Hungarian subsidiary with a Specially Designated National in violation of the Belarus Sanctions Regulations. See OFAC, Settlement Agreement between the U.S. Department of the Treasury's Office of Foreign Assets Control and Zoltek Companies, Inc. (Dec. 20, 2018), available here. Similarly, in 2021 OFAC brought an enforcement action against a U.S. parent company whose U.S.-person employees “approved” contracts by its Romania-based subsidiary with a Russian company in violation of the Ukraine-Related Sanctions Regulations. See OFAC, OFAC Settles with Cameron International Corporation for Its Potential Civil Liability for Apparent Violations of Ukraine-Related Sanctions Regulations (Sept. 27, 2021), available here.

[14]     OFAC, OFAC Settles with Cameron International Corporation for Its Potential Civil Liability for Apparent Violations of Ukraine-Related Sanctions Regulations (Sept. 27, 2021), available here.

[15]     Paul, Weiss, OFAC Takes Enforcement Action Against U.S. Parent Company for its Recently Acquired Chinese Subsidiary’s Iran Sanctions Violations (Apr. 1, 2019), available here.

[16]     We recently discussed the Department of Justice’s guidance on voluntary self-disclosures in the context of mergers and acquisitions. See Paul, Weiss, DOJ Previews New Guidance on Voluntary Self-Disclosures in Mergers and Acquisitions While Signaling Continued Focus on Corporate National Security Crimes (Sept. 27, 2023), available here. See also Paul, Weiss, Recent DOJ Announcement Signals Continued Surge of Resources to Combat Corporate National Security Crime (Sept. 14, 2023), available here.

[17]     The whistleblower framework established by the Anti-Money Laundering Act and the Anti-Money Laundering Whistleblower Improvement Act provides financial incentives for individuals to report certain AML and sanctions violations to FinCEN, which is responsible for administering the program. While FinCEN has not yet issued whistleblower regulations, it has established an Office of the Whistleblower and has been “accepting whistleblower tips while we work towards the development of a more formal tip intake system.” See FinCEN, Prepared Remarks of FinCEN Acting Director Himamauli Das During NYU Law’s Program on Corporate Compliance and Enforcement (March 25, 2022), available here.

[18]     OFAC, OFAC Settles with Construction Specialties Inc. for $660,594 Related to Apparent Violations of the Iranian Transactions and Sanctions Regulations (Aug. 16, 2023), available here.

[19]     Id.

[20]     OFAC, OFAC Settles with 3M Company for $9,618,477 Related to Apparent Violations of the Iranian Transactions and Sanctions Regulations (Sept. 21, 2023), available here.

[21]     31 CFR Appendix A to Part 501, “Economic Sanctions Enforcement Guidelines.”