OFAC’s Updated Reporting Regulations and New Statute of Limitations Guidance

On August 8, 2024, new recordkeeping and reporting requirements imposed by the U.S. Department of the Treasury’s Office of Foreign Assets Control (“OFAC”) went into effect.[1] These recordkeeping requirements apply to all U.S. persons,[2] and are of particular relevance to financial institutions.[3] Additionally, OFAC issued guidance on July 22, 2024, regarding recent legislation that doubled the statute of limitations for sanctions violations from five to 10 years.[4] OFAC also noted that it intends to update its regulations to impose a 10-year recordkeeping requirement.

Amendments to OFAC’s Reporting Regulations

The Interim Final Rule (“IFR”) that took effect on August 8, 2024, included a number of notable updates to OFAC’s Reporting, Procedures and Penalties Regulations (the “Reporting Regulations”):

• Unblocking Reports: The Reporting Regulations have required U.S. persons to file reports of blocked property and only required an unblocking report “when specifically required by OFAC.” In effect, while the blocked report was mandatory, the unblocking report was only filed when specifically required by OFAC. The IFR added a requirement to file reports “when blocked property is unblocked or transferred, including pursuant to a valid order issued by a U.S. government agency or U.S. court[.]”[5] OFAC stated that this was intended to “ascertain the current status of blocked and unblocked property.” There are questions, however, about the scope of this reporting obligation. One banking trade association noted that it was unclear if this applied to property that was unblocked pursuant to an OFAC license and that this change could have the “potential to create significant confusion because banks only unblock property pursuant to a license or other official authorization from OFAC, a delisting, or the termination of a sanctions program.”[6]
• Compliance Release Requests: The Reporting Regulations have historically provided for a procedure for unblocking funds “believed to have been blocked due to mistaken identity” in which “[a]ny person who is a party to the transaction may request the release of funds which the party believes to have been blocked due to mistaken identity.”[7] This request would go to OFAC’s Compliance Division instead of the Licensing Division. The IFR makes two modifications to this process. First, the IFR expands types of transactions eligible for this application by including funds blocked due to “typographical or similar errors leading to blocking.” This is an expansion of the application of the scope. Second, it “narrow[s] the procedures so they are available only to the person that mistakenly blocked the property.” This eliminates the ability of the sending financial institution or the sender themself to utilize this process (though they may still submit a license application to OFAC’s Licensing Division).
• Instructions to Report Certain Transactions: The IFR adds a note to the OFAC regulations stating that OFAC may “instruct” a financial institution to report certain transactions before processing them. The note provides: “[i]f OFAC has reason to believe an account or transaction (or class of transactions) may involve the property or interests in property of a blocked person, OFAC may instruct the financial [institution] to report transactions that meet specified criteria and to notify OFAC prior to processing such transactions. Upon review, OFAC may determine that a reported transaction involves the property or interests in property of a blocked person and may take further action.”[8] This appears to describe, as one banking trade association noted, “OFAC’s practice of requiring banks to hold and report transactions at OFAC’s direction based on non-published information[.]”[9] However, the trade association noted that this practice “puts financial institutions in a difficult position” and “[i]nstitutions have been placed in this awkward position for several months as OFAC makes its determination regarding the transactions.”[10]
• Definition of “Transaction”: The Reporting Regulations require any U.S. person, including nonfinancial institutions, to file a report of “rejected transactions.”[11] A transaction is defined as “wire transfers, trade finance, transactions related to securities, checks, or foreign exchange, and sales or purchases of goods or services.”[12] This requirement had been updated in 2019 under an Interim Final Rule to require all U.S. persons (not just U.S. financial institutions, as had previously been the case) to file rejection reports with OFAC.[13] In response, a number of “commenters requested clarity on the scope and types of rejected transactions that need to be reported to OFAC by nonfinancial institutions.”[14] In “response to those comments,” the 2024 Interim Final Rule modifies “scope of the term ‘transaction’ . . . [by] clarifying that securities, checks, foreign exchange, and goods and services are not in and of themselves transactions, when not provided as part of a transaction.”[15] This attempts to narrow the scope of a “transaction” and provide additional clarity on the reporting expectations in this area, but it remains to be seen how much clarity this actually does provide.
• Filing through ORS: The IFR “generally require[s] filers to use the electronic OFAC Reporting System (ORS) for submission to OFAC of initial reports of blocked property and Annual Reports of Blocked Property” and “remove[s] options for mail submission.”[16]

Guidance on Statute of Limitations

On April 24, 2024, President Biden signed into law a national security omnibus that, among other things, increased the statute of limitations for civil and criminal sanctions violations from five to 10 years.[17]

As we described in our prior memorandum,[18] the 10-year statute of limitations applies to all violations (criminal and civil) going forward, as well as to any violations that had not been time-barred by the date of the law’s enactment (i.e., April 24, 2024). Under well-settled principles, the new statute of limitations would not revive sanctions violations that were already time-barred,[19] which OFAC confirmed in guidance it issued on July 22, 2024.[20]

OFAC also noted that, while its regulations currently provide for a five-year recordkeeping requirement (codified at 31 CFR § 501.601), OFAC anticipates publishing an interim final rule with an opportunity to comment to extend the recordkeeping requirement to 10 years to “match the new statute of limitations.” OFAC foresees the final rule becoming effective six months after publication. If adopted, this will have significant implications for companies, including financial institutions, which will have to modify their systems and practices to account for a much longer retention period. This 10-year recordkeeping requirement may be considerably longer than the requirements financial institutions have under other regulatory regimes.[21]

Takeaways

U.S. companies, especially financial institutions, should carefully review OFAC’s updated Reporting Regulations. In a 2022 enforcement action, that was based in part on recordkeeping violations OFAC “highlight[ed] the importance of financial institutions’ properly maintaining blocked property and records, and filing accurate reporting to OFAC.”[22] Additionally, companies may wish to consider beginning to prepare for the anticipated 10-year recordkeeping obligation that OFAC has previewed.

*       *       *

[1]        See 31 C.F.R. Part 501; 89 Fed. Reg. 40372, available here.

[2]        In the context of the Cuban Assets Control Regulations (Part 515), these requirements apply to all persons subject to U.S. jurisdiction. Id.

[3]        The new requirements were published as an Interim Final Rule on May 10, and took effect on August 8. The IFR made updates to OFAC’s Reporting, Procedures and Penalties Regulations, codified at 31 C.F.R. Part 501. Id.

[4]        See Paul, Weiss, Congress Raises Statute of Limitations for U.S. Sanctions Violations to 10 Years (Apr. 26, 2024), available here.

[5]        IFR (emphasis added). Like blocking reports, these reports must be filed within 10 business days.

[6]        See Heather Trew, Letter to OFAC Director Bradley Smith RE: Interim Final Rule on Reporting, Procedures and Penalties Regulations, 89 Fed. Reg. 40372 (May 10, 2024); Docket Number OFAC-2024-0002; Federal Register Docket Number 2024-10033, American Bankers Association (Jun. 7, 2024), available here.

[7]        See IFR at Note 1.

[8]        Id.

[9]        See Comment on FR Doc # 2024-10033 (Posted by OFAC) (Jun. 14, 2024), available here.

[10]       Id.

[11]       See 31 C.F.R. 501.604, available here.

[12]       Id.

[13]       See Paul, Weiss, Economic Sanctions and Anti-Money Laundering Developments: 2019 Year in Review (Jan. 31, 2020), available here.

[14]       See IFR at Note 1.

[15]       Id. (emphasis added).

[16]       Id.

[17]       H.R. 815, 118th Cong. (2d Sess. 2024), available here.

[18]       See Paul, Weiss, Congress Raises Statue of Limitations for U.S. Sanctions Violations to 10 Years (Apr. 26, 2024), available here.  The statute of limitations increase to 10 years is applicable to sanctions programs administered under both the International Emergency Economic Powers Act and Trading with the Enemy Act of 1917.

[19]       Id.

[20]       U.S. Dep’t of Treasury, OFAC Guidance on Extension of Statute of Limitations (Jul. 22, 2024), available here.

[21]       See, e.g., 12 C.F.R. § 219.24 (2024) (the Federal Reserve Board requires financial institutions to retain financial records “for a period of five years.”), available here; 12 C.F.R. § 349.19 (2024) (the Federal Deposit Insurance Corporation requires insured depository institutions to keep financial records “for at least five years from the date the record is created.”), available here; 12 C.F.R. § 9.8 (2024) (the Office of the Comptroller of the Currency requires national banks to retain records of fiduciary accounts “for a period of three years from the later of the termination of the account or the termination of any litigation relating to the account.”), available here. Additionally, “[i]n general the BSA requires that a bank maintain most records for at least five years.” See, Federal Financial Institutions Examination Council (FFIEC), BSA/AML Manual (2014), available here.

[22]       U.S. Dep’t of Treasury, OFAC Issues a Finding of Violation to Nodus International Bank, Inc. for Violations of the Venezuelan Sanctions Regulations and the Reporting, Penalties and Procedures Regulations (Oct. 18, 2022), available here.