Economic sanctions are touted as a powerful tool in the fight against terrorism, rogue regimes, and transnational criminal organizations. Each round of new sanctions is accompanied by bold assertions of the positive effect the sanctions will have on national security. Critics, on the other hand, contend economic sanctions will cause unintended consequences by harming U.S. business interests or damaging economic relationships with foreign nations. But a more fundamental question goes unanswered: Is the cost to U.S. business justified by the benefits of sanctions? In other words, are U.S. economic sanctions programs effective in achieving their stated goals?
OFAC Sanctions—A Little Background
The Office of Foreign Assets Control (OFAC) administers economic sanctions programs focused on rogue regimes, terrorist organizations, and other bad actors that pose a threat to U.S national security and foreign policy objectives. While country-based sanctions programs (such as those imposed against Iran, Cuba, and North Korea) receive attention in the headlines, other programs targeting individuals and entities involved in criminal transactions are imposed with less fanfare. Collectively, these individuals and entities make up the Specially Designated Nationals and Blocked Persons List (the SDN List). The SDN List identifies more than 5,000 individuals and entities blocked under one OFAC sanctions program or another. SDN designations are consequential. With rare exceptions, all U.S. persons are prohibited from engaging in any transactions with SDN individuals or entities. Additionally, the property and interests in property of any designated person must be blocked if it comes into the United States or into the possession or control of a U.S. person. See, e.g., the Foreign Narcotics Kingpin Designation Act, 31 C.F.R. Part 598.206. The penalties for violation are heavy indeed. The maximum civil penalty for an OFAC violation under the International Emergency Economic Powers Act (IEEPA) is currently $289,238 (or twice the amount of the underlying transaction, whichever is greater). 82 Fed. Reg. 10434 (Feb. 10, 2017). The Kingpin Act has an even higher maximum penalty of $1,437,153 per violation. 31 CFR 598.701. In 2017, OFAC issued penalties or reached settlements with 15 such entities for a total of more than $119 million. The SDN List is designed to cut off known bad actors and their criminal networks from access to U.S. financial markets, thus crippling their ability to reap the rewards of their criminal actions and to continuing funding their unlawful activities. The effectiveness of these designations, however, depends not on the U.S. government, but on U.S. financial institutions and U.S. businesses in their role as gatekeepers, preventing SDNs from moving funds, making investments, and purchasing goods and services. Paradoxically, it is these gatekeepers—not the blocked parties on the SDN List—that are the targets of OFAC enforcement actions and penalties. Exacerbating the situation, OFAC sanctions are enforced according to a strict liability standard. Thus, while the highest penalties are reserved for companies that willfully or recklessly commit violations, companies that commit even inadvertent violations are at substantial risk. For example, Richemont North America (d.b.a. Cartier) reached a settlement for $334,800 for engaging in four transactions violating the Kingpin Act by unknowingly selling jewelry to an SDN. See OFAC Enforcement Information for Sept. 26, 2017. In another OFAC enforcement action, Honda Canada Finance, Inc. (HCFI) agreed to pay $87,255 to settle its potential civil liability for approving and financing lease agreements between an unaffiliated Honda dealership in Canada and the Embassy of Cuba after its compliance program failed to flag transactions with Cuba. OFAC Enforcement Information for June 8, 2017.
Do SDN Designations Work?
From the U.S. government perspective, it is not surprising that penalties for violations of OFAC blocking actions are severe; U.S. national security is at stake. On the other hand, it is equally true that there is a great deal at stake for businesses that face liability for even unintentional violations. Given the high stakes all around, one might expect an abundance of data proving the effectiveness of sanctions programs that have been administered by OFAC since 1950. However, this does not appear to be the case. See Examining the Effectiveness of the Kingpin Designation Act in the Western Hemisphere: Hearing Before the H. Comm. on Foreign Affairs, Subcomm. on the W. Hemisphere, 115th Cong. 2 (2017) (statement of Eric L. Olson, Deputy Director, Latin American Program, Senior Advisor, Mexico Institute, Woodrow Wilson International Center for Scholars: Witness unaware of any public report or comprehensive review of the effectiveness of the program and policy behind the Foreign Narcotics Kingpin Sanctions Regulations). In 2001, the Judicial Review Commission on Foreign Assets Control conducted a limited review of OFAC sanctions programs under a directive to examine the constitutionality of the Kingpin Act. The Commission submitted a report to Congress recommending that Congress amend licensing procedures to be more responsive to the legitimate needs of U.S. persons affected by blocking actions; that OFAC promulgate regulations to establish “safe harbors”; and that OFAC establish a dialogue with the U.S. business community affected by sanctions laws. These recommendations have not been implemented. Administrative History Note, Judicial Review Commission on Foreign Asset Control, Organization Authority Record, National Archives. The failure to address these recommendations represents a lost opportunity to measure the costs and benefits of sanctions programs.
OFAC Undeterred
Notwithstanding the absence of data in its favor, OFAC asks more and more of its private-sector gatekeepers. OFAC administers 28 active sanctions programs that have continually grown, targeting specific industries and activities, while at the same time becoming more expansive. This growth places increasingly costly compliance burdens on U.S. businesses. And the costs are enormous, as much as billions of dollars per year. See, e.g., Hui Chen & Eugene Soltes, “Why Compliance Programs Fail—and How to Fix Them,” Harvard Business Review (March-April 2018); “Uncovering the True Cost of Anti-Money Laundering & KYC Compliance,” A LexisNexis Risk Solutions Report Study on Financial Institutions Across Six Markets in Asia (2016); Laura Noonan, “Banks Face Regulatory Pushback over Surging Compliance and Regulatory Costs,” Financial Times (May 28, 2015). From a national security perspective, this burden might make theoretical sense. The problem is the absence of concrete data justifying the burden by showing that sanctions actually improve national security. In light of this absence of data, shouldn’t some consideration be given to the question of how much of a burden businesses should be asked to bear? Apparently not. In addition to increasing the breadth and depth of its sanctions programs, OFAC has further increased the burden on businesses by means of an agency rule known as the 50 Percent Rule. Under this rule, U.S. businesses are required to determine whether any potential transaction involves entities owned 50 percent or more by a blocked party—even if the blocked party itself is not otherwise involved in the transaction. In other words, OFAC requires U.S. businesses to ferret out the hidden entities and block transactions with them even where OFAC has not been able to detect and sanction those entities. OFAC’s justification for the 50 Percent Rule is that sanctioned individuals—particularly sophisticated ones—often hide behind front companies with complex and anonymous ownership structures. This is no doubt true. But shouldn’t OFAC be the one to identify entities hiding behind front companies? If OFAC can’t figure it out, why should this investigative burden shift to private businesses, particularly small ones? While the 50 Percent Rule might make theoretical sense to the government, as a practical matter, most businesses do not have the resources to uncover the ownership structures of all their customers and business partners. Even large multinational institutions struggle to appropriately integrate compliance practices that identify beneficial ownership and properly screen upstream owners. In 2014, OFAC issued its first (and to date, only) penalty for a violation of the 50 Percent Rule. Barclays Bank Plc (Barclays), a financial institution headquartered in the United Kingdom, agreed to pay nearly $2.5 million to settle potential violations for processing transactions of subsidiaries owned 50 Percent or more by an SDN. See OFAC Enforcement Information for Feb. 8, 2016.
What Can Be Done?
Even in the absence of any data driven justification for OFAC’s sanctions, the programs are here to stay. So too, likely, is the 50 Percent Rule. Thus, businesses will continue to face compliance challenges including whether to expend substantial resources trying to identify upstream ownership of their customers—or risk hefty OFAC penalties for inadvertent violations. We recommend that OFAC empirically examine the effectiveness of its programs, with a particular focus on the 50 Percent Rule. If, as the authors suspect, the results show that the 50 Percent Rule places a greater burden on U.S. business than is justified by the result, then OFAC should abandon the rule and create a safe harbor for businesses that act in good faith to comply with OFAC sanctions programs. In the end, the duty to protect the national security belongs to the government and is not delegable. The government, with its national security mandate, is in the best position to identify entities that pose a threat, and should, therefore, reclaim responsibility for sanctioning those entities. David L. Hall is a partner and Dana Stepnowsky is an associate at Wiggin and Dana.
