OFAC Reaches Settlement with e.l.f. Cosmetics, Inc. for North Korea Sanctions Violations Resulting from Inadequate Supply Chain Due Diligence

On January 31, 2019, the U.S. Treasury Department’s Office of Foreign Assets Control (“OFAC”) announced a $996,080 settlement agreement with California-based e.l.f. Cosmetics, Inc. (“ELF”), to settle its potential civil liability for 156 apparent violations of OFAC’s sanctions regulations targeting North Korea.[1] The case involved the alleged importation of 156 shipments of false eyelash kits from two China-based suppliers containing materials sourced by those suppliers from North Korea. The apparent violations appear to have resulted from ELF’s “either non-existent or inadequate” OFAC compliance program.[2] 

This action is significant because it highlights OFAC’s willingness to pursue enforcement actions against companies for failing to perform sufficient supply chain due diligence. OFAC did not note any specific red flags or other information that suggested that ELF’s Chinese suppliers were incorporating North Korean materials. As a result, this action is a reminder of OFAC’s willingness to apply a strict liability standard in certain circumstances. 

OFAC’s decision to pursue this action is consistent with the advisory, North Korea Sanctions & Enforcement Actions Advisory: Risks for Businesses with Supply Chain Links to North Korea, it issued jointly with the U.S. Department of State and the U.S. Department of Homeland Security’s Customs and Border Protection and Immigration and Customs Enforcement on July 23, 2018 (the “Advisory”).[3] The Advisory highlighted the risks of companies inadvertently sourcing goods, services, and technology from North Korea and of having North Korean citizens or nationals as laborers in their supply chains. The agencies described their expectation that companies be aware of the deceptive practices employed by North Korea in order to implement effective due diligence policies, procedures, and internal controls to ensure compliance.   

As OFAC explained, this action highlights the risks for companies that do not conduct “full-spectrum supply chain due diligence” when sourcing products from overseas, “particularly in a region in which [North Korea] as well as other comprehensively sanctioned countries or regions, is known to export goods.” Below, we describe the settlement, OFAC’s penalty calculation, and lessons learned.

The Apparent Violations

OFAC determined that ELF appears to have violated § 510.201(c)1[4] of the North Korea Sanctions Regulations (the “NKSR”) by importing 156 shipments of false eyelash kits from two China-based suppliers that contained materials sourced from North Korea. ELF imported the false eyelash kits between on or about April 1, 2012 and on or about January 28, 2017. The total value of the shipments was $4,427,019.26. 

According to OFAC, throughout the relevant period, ELF’s diligence focused on quality assurance issues and the company appears not to have exercised appropriate sanctions-related supply chain due diligence, despite the fact that it imported products from a “region a region that poses a high risk to the effectiveness of the NKSR.” According to OFAC, ELF failed to recognize, over a period of almost five years, that approximately 80 percent of the false eyelash kits supplied by its Chinese suppliers contained materials from North Korea.

Factors Affecting OFAC’s Penalty Determination

OFAC determined that ELF voluntarily self-disclosed the apparent violations and that the apparent violations constitute a non-egregious case. The statutory maximum civil monetary penalty amount for the apparent violations was $40,833,633, and the base penalty amount was $2,213,510. The settlement amount reflected OFAC’s consideration of the following facts and circumstances pursuant to OFAC’s Economic Sanctions Enforcement Guidelines.[5]

OFAC determined the following to be aggravating factors:

• “[T]he apparent violations may have resulted in U.S.-origin funds coming under the control of the [North Korean] government, in direct conflict with the program objective of the NKSR”;
• “ELF is a large and commercially sophisticated company that engages in a substantial volume of international trade”; and
• “ELF’s OFAC compliance program was either non-existent or inadequate throughout the time period in which the apparent violations occurred, and appears not to have exercised sufficient supply chain due diligence while sourcing products from a region that poses a high risk to the effectiveness of the NKSR”.[6]

OFAC determined the following to be mitigating factors:

• “ELF’s personnel do not appear to have had actual knowledge of the conduct that led to the apparent violations”;
• “ELF has not received a Penalty Notice or Finding of Violation from OFAC in the five years preceding the earliest date of the transactions giving rise to the apparent violations”;
• “the apparent violations do not appear to constitute a significant part of ELF’s business activities”; and
• “ELF cooperated with OFAC by immediately disclosing the apparent violations, signing a tolling agreement, and submitting a complete and satisfactory response to OFAC’s request for additional information”.

As is its standard practice, OFAC did not disclose how it weighed these aggravating and mitigating factors in reaching the settlement amount.  In addition, although OFAC referred to ELF “immediately disclosing the apparent violations,” OFAC did not indicate how ELF became aware of the existence of North Korean materials in the false eyelash kits imported from China.

OFAC also noted ELF’s representation that the company had terminated the conduct that led to the apparent violations and ELF had adopted several remedial measure to minimize the risk of future violations:

• “Implement[ing] supply chain audits that verify the country of origin of goods and services used in ELF’s products”;
• “Adopt[ing] new procedures to require suppliers to sign certificates of compliance stating that they will comply with all U.S. export controls and trade sanctions”;
• “Conduct[ing] an enhanced supplier audit that included verification of payment information related to production materials and the review of supplier bank statements;
• “[Holding] mandatory training on U.S. sanctions regulations for employees and suppliers in China and implemented additional mandatory trainings for new employees, as well as, regular refresher training for current employees and suppliers based in China”; and
• “Engag[ing] outside counsel to provide additional training for key employees in the United States and in China regarding U.S. sanctions regulations and other relevant U.S. laws and regulations”.[7]

Implications

This case highlights the importance of companies that import into the United States having adequate OFAC compliance programs, including “full-spectrum supply chain due diligence.”[8] Non-U.S. companies that export to the United States could also face OFAC liability if they knowingly export products to the United States that were sourced in North Korea or incorporate North Korean materials or components.

As made clear in the Advisory, the U.S. government expects companies to closely examine their entire supply chains for North Korean goods, services, technologies, and labor and to adopt appropriate ongoing due diligence practices. While appropriate due diligence practices will vary based on the size and nature of a business, the Advisory states that well-documented due diligence policies and practices may be considered mitigating factors when the U.S. government determines the appropriate enforcement response.[9]  

OFAC reiterated this expectation in its settlement announcement, stating that OFAC “encourages companies to develop, implement, and maintain a risk-based approach to sanctions compliance and to implement processes and procedures to identify and mitigate areas of risks. Such steps could include, but are not limited to, implementing supply chain audits with country-of-origin verification; conducting mandatory OFAC sanctions training for suppliers; and routinely and frequently performing audits of suppliers.”[10]

We will continue to monitor sanctions developments and look forward to providing you with further updates.

*       *       *

[1]       See U.S. Dep’t of the Treasury, OFAC, “Enforcement Information for January 31, 2019,” available here (“OFAC Web Notice”).  In settling these apparent violations, ELF did not admit liability.

[2]      Id.

[3]     U.S Dep’t of Treasury, Dep’t of State, and Dep’t of Homeland Sec., North Korea Sanctions & Enforcement Actions Advisory: Risks for Businesses with Supply Chain Links to North Korea (Jul. 23, 2018), available here.

[4]     See 31 C.F.R. part 510.  This reflects the NKSR as written during the time period of the transactions (2012-2017). OFAC amended and reissued the NKSR effective March 5, 2018.

[5]      See 31 C.F.R. part 501, app. A. “General Factors Affecting Administrative Action.”

[6]     OFAC Web Notice at 1-2.

[7]    Id. at 2.

[8]   Id.

[9]     U.S. Dep’t of the Treasury, supra note 3, at 4.

[10]      OFAC Web Notice at 2.