On April 6, 2023, the Department of Commerce's Bureau of Industry and Security ("BIS") and the Department of the Treasury's Office of Foreign Assets Control ("OFAC") entered into a settlement agreement with Microsoft Corporation resolving sanctions and export-control violations which had been investigated by both BIS and OFAC. The settlement involves a combined $3.3 million in civil penalties and offers instructive lessons for other technology companies regarding the risk of sanctions violations where online services are utilized by sanctioned persons or those in US-embargoed jurisdictions.
According to BIS, employees of Microsoft Rus LLC ("Microsoft Russia") caused Microsoft Ireland Operations Limited ("MIOL") to enter into or sell software licensing agreements with knowledge or reason to know that the transactions would allow the transfer or access to software subject to the Export Administration Regulations ("EAR") by United Shipbuilding Corporation Joint Stock Company ("United Shipbuilding Corporation") and FAU 'Glavgosekspertiza Rossii' without the required U.S. Government authorization. BIS emphasized that no license exceptions were available at the time and license applications to export, reexport, or transfer (in-country) to FAU 'Glavgosekspertiza Rossii' and United Shipbuilding Corporation were subject to a license review policy of a presumption of denial. After discovering the alleged violations, Microsoft filed a voluntary self-disclosure with BIS's Office of Export Enforcement.
Background
According to the OFAC press release, on seven occasions between December 28, 2016, and December 22, 2017, employees of Microsoft Russia caused MIOL to enter into or sell software licensing agreements that would allow the transfer or access to software subject to the EAR by FAU 'Glavgosekspertiza Rossii' and United Shipbuilding Corporation, both of which were on BIS's Entity List. FAU 'Glavgosekspertiza Rossii' is a Russian federal institution involved with construction projects, including the Kerch Bridge, which was built to connect Crimea to Russia after its 2014 invasion. United Shipbuilding Corporation is responsible for developing and building the Russian Navy's warships.
In the case of FAU 'Glavgosekspertiza Rossii', certain Russia-based employees of Microsoft Russia ordered software licenses through one of Microsoft's Open sales programs in the names of parties not on the Entity List. In the case of United Shipbuilding, an increased number of software licenses were added under non-listed affiliates' enterprise agreements.
Amid the addition of sanctions and export controls being placed on the United Shipbuilding Corporation and FAU 'Glavgosekspertiza Rossii', BIS alleged that certain Russia-based employees of Microsoft Russia had explicit email communications, both internal and/or with third party distributors, concerning the prohibited end-users' access to Microsoft software. In its investigation, BIS found that "[Microsoft] discussed circumventing restrictions" concerning FAU 'Glavgosekspertiza Rossii' and United Shipbuilding Corporation "by facilitating sales to affiliates of [FAU 'Glavgosekspertiza Rossii' and United Shipbuilding Corporation] that were not on the Entity List." BIS also found that the Microsoft Russia employees' objective was to allow these additional licenses to be used or accessed by United Shipbuilding Corporation and FAU 'Glavgosekspertiza Rossii' in circumvention of the company's sanctions and export controls policies and procedures.
In the BIS press release, which can be read here in full, Assistant Secretary for Export Enforcement Matthew S. Axelrod stated that "U.S. companies will be held accountable for the activities of their foreign subsidiaries," and that "As this coordinated resolution demonstrates, BIS and OFAC will work together to ensure that U.S. export control and sanctions laws are enforced effectively, wherever in the world the underlying conduct occurs."
Director of OFAC Andrea M. Gacki echoed Axelrod's comments, stating that "[t]his case demonstrates how BIS and OFAC authorities can complement one another to hold firms accountable and promote compliance with core national security obligations. It further underscores the risks technology companies may face when engaging through foreign subsidiaries, distributors, and resellers and the importance of maintaining effective controls."
The BIS order imposed an administrative penalty of $624,013 on Microsoft. As part of the BIS settlement, Microsoft admitted to the conduct set forth in a Proposed Charging Letter ("PCL") involving Microsoft's subsidiary Microsoft Russia. In addition to the BIS penalty, Microsoft entered into a corresponding settlement with OFAC whereby Microsoft agreed to a $2,980,265.86 civil penalty to resolve 1,339 apparent violations of OFAC sanctions regulations involving Ukraine/Russia, Cuba, Iran, and Syria. In light of the related OFAC action, Microsoft was given a $276,382 credit by BIS contingent upon Microsoft fulfilling its requirements under the OFAC settlement agreement, resulting in a combined overall penalty amount of $3,327,896.86.
Microsoft, in a separate press release, explained that "[i]t is Microsoft policy to comply with EAR, OFAC rules, and the international Wassenaar Arrangement and to proceed with the proper classification of its products and services (which results in the determination of an ECCN – Export Control Classification Number) so that Microsoft products can be easily and readily exported to non-embargoed destinations while maintaining a high level of compliance."
"The settlement amount reflects OFAC's determination that Microsoft's conduct was non-egregious and voluntarily self-disclosed," the Treasury concluded.
- The BIS Order, Settlement Agreement, and Proposed Charging Letter are available online here.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.