Shutdown, what shutdown? With less than two weeks of a fully operating Treasury Department in 2019, the Office of Foreign Assets Control (OFAC) is off to a fast start (much faster than last year) in announcing the settlement of two enforcement cases. While the cases are different in many ways, they share a common theme: namely, the need for end-to-end visibility when implementing a global compliance program; merely relying on assurances from partners may not be enough.

Do you know who your suppliers' suppliers are?

First, on January 31, 2019, OFAC announced a nearly $1 million settlement with e.l.f. Cosmetics (ELF) for alleged violations of North Korean sanctions. According to OFAC, ELF imported more than $4 million worth of fake eyelashes from suppliers in China, over five years, that contained materials from North Korea. ELF "immediately" voluntarily disclosed the violation, which appears to have contributed to an assessed penalty far below the $40 million statutory maximum.

OFAC notes that ELF's supply chain oversight focused on issues pertaining to quality and production, but did not include sufficient due diligence regarding material sourcing. The company is now taking a number of steps highlighted by OFAC that go far beyond asking its first tier suppliers to avoid sanctioned countries—suppliers now have to prove it. In particular, ELF is not only requiring certificates of compliance for its suppliers' sources, but also conducting supply chain audits related to sourcing and demanding to review payment information and supplier bank statements to back up source certificates.

The case suggests that companies should consider reviewing their supply chain programs to be sure that supply chain managers and auditors are adequately trained on US trade sanctions, export controls, and other applicable trade regulations. Dealing with these issues only in supplier agreements or representations and warranties may prove insufficient in ensuring supplier compliance and avoiding investigations and enforcement actions.

Are you sure your foreign affiliates are following your compliance program?

Likewise, OFAC's second enforcement case of the year underscores that a company can never be too careful, even when dealing with an affiliate. In a February 7, 2019 announcement, OFAC detailed the extensive diligence efforts undertaken by US company Kollmorgan Corporation (Kollmorgan) in its 2013 acquisition of Turkish company Elsim Elektroteknik Sistemler Sanayi ve Ticaret Anonim Sirketi (Elsim). When Kollmorgan acquired control of Elsim, it was apparently aware that Elsim had Iran-related contracts and took a number of steps highlighted by OFAC to block future Iran work in compliance with US Iran sanctions (which prohibit foreign companies owned or controlled by US companies from doing most business with Iran).

Nevertheless, according to OFAC's announcement, management at Elsim willfully continued Iran business, even "fraudulently" certifying to Kollmorgan that Elsim had ceased all Iran work. The violations at issue were eventually uncovered thanks to an internal complaint filed by an Elsim employee on Kollmorgan's ethics hotline. Even after Kollmorgan began investigating the matter, Elsim employees allegedly took steps to obstruct the investigation.

As a result of the investigation, Kollmorgan took a number of steps to bolster compliance even further, including additional procedures designed to monitor Elsim's operations and employee training. While OFAC did impose an approximately $13,000 penalty on the company, it noted Kollmorgan's "extensive" compliance efforts and thorough voluntary disclosure, which likely contributed to the penalty falling far below the possible $1.5 million statutory maximum.

Like the ELF case, the Kollmorgan case highlights that global compliance requires adherence to the adage "trust, but verify." OFAC specifically noted that the Kollmorgan case highlights the importance of:

  1. performing heightened due diligence, particularly with regard to affiliates, subsidiaries, or counter-parties known to transact with OFAC sanctioned countries or persons, or that otherwise pose high-risks due to their geographic location, customers and/or suppliers, or products and services they offer; and
  2. implementing proactive controls when US persons, directly or indirectly, acquire companies with preexisting relationships with sanctioned persons and jurisdictions.

The Trump Administration has repeatedly indicated that it will take an aggressive approach towards enforcing many sanctions programs. If OFAC maintains the pace it has set in these two weeks, 2019 could indeed be a record year for enforcement cases.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.