AGENCY: Office of Foreign Assets Control, Treasury.

ACTION: Final rule.

SUMMARY: The Office of Foreign Assets Control (OFAC) of the U.S. Department of the Treasury is issuing this final rule, “Economic Sanctions Enforcement Guidelines,” as enforcement guidance for persons subject to the requirements of U.S. sanctions statutes, Executive orders, and regulations. This rule was published as an interim final rule with request for comments on September 8, 2008. This final rule sets forth the Enforcement Guidelines that OFAC will follow in determining an appropriate enforcement response to apparent violations of U.S. economic sanctions programs that OFAC enforces. These Enforcement Guidelines are published as an Appendix to the Reporting, Procedures and Penalties Regulations.

DATES: This final rule is effective November 9, 2009.

…

[…]

Specific Responses to Comments

The comments received, OFAC's response to those comments, and OFAC's revisions to the Guidelines in response to the comments are summarized below.

1. Voluntary Self-disclosure

a. Third-Party Notifications. Many of the comments that addressed the definition of voluntary self-disclosure expressed concern about the interim final rule definition's exclusion of apparent violations where “a third party is required to notify OFAC of the apparent violation or a substantially similar apparent violation because a transaction was blocked or rejected by that third party (regardless of whether or when OFAC actually receives such notice from the third party and regardless of whether the Subject Person was aware of the third party's disclosure).” The comments argued that the definition should not exclude such self-initiated notifications to OFAC, and that OFAC should focus instead on the good faith of the party making the disclosure, regardless of whether another party was obligated to report the apparent violation. The comments argued that broadening the definition of voluntary self-disclosure will benefit OFAC by encouraging such disclosures and providing OFAC with additional information regarding apparent violations.

OFAC has considered these comments but believes that the recommended alternative approach would be difficult to administer in a meaningful manner. Accordingly, OFAC has determined to maintain the exclusion for apparent violations that a third party is required to and does report to OFAC as a result of the third party having blocked or rejected a transaction in accordance with OFAC's regulations. The purpose of mitigating the enforcement response in voluntary self-disclosure cases is to encourage the notification to OFAC of apparent violations of which OFAC would not otherwise have learned. In those cases where a third party is required to, and does, report an apparent violation to OFAC, OFAC is aware of the violation and there is no need to provide incentives for such notification. In addition, OFAC's administrative subpoena authority, 31 CFR 501.602, generally provides the basis for OFAC to require the production of whatever additional information it may require to assess its enforcement response to the apparent violation. In those cases, therefore, there is no need to further incentivize disclosure to OFAC. Moreover, OFAC believes that the “good faith” standard suggested in the comments would be administratively unworkable, as OFAC would be unable to ascertain the good or bad faith of Subject Persons making disclosures of apparent violations. A bright line rule generally defining a voluntary self-disclosure based on whether OFAC would otherwise have learned of the apparent violation is more readily administrable.

Consistent with the premise that in those cases where OFAC would otherwise not have learned of the apparent violation a notification to OFAC should be deemed a voluntary self-disclosure, and in response to the suggestion made in one comment, OFAC is amending this aspect of the definition of “voluntary self-disclosure” by deleting the words “whether or” from that part of the definition in the interim final rule that provided that notification to OFAC of an apparent violation would not be considered a voluntary self-disclosure “regardless of whether or when OFAC actually receives such notice from the third party * * *.” Thus, the final rule provides that such notifications shall not be considered voluntary self-disclosures “regardless of when OFAC receives such notice from the third party * * *.” The change is intended to make clear that in the event that a third party that is required to report an apparent violation to OFAC fails to do so, and the Subject Person notifies OFAC of the apparent violation in a manner otherwise consistent with a voluntary self-disclosure, the notification will be considered a voluntary self-disclosure. In those cases where the third party does notify OFAC before a final enforcement response to the apparent violation, the Subject Person's notification will not be considered a voluntary self-disclosure even if the Subject Person's notification precedes the third party's notification. This is consistent with the notion that voluntary self-disclosure does not apply where OFAC would have learned of the apparent violation in any event—in this case, from the subsequent required disclosure by the third party.

Interestingly, different industry sectors all commented that this provision of the definition would unfairly target their industry. Thus, the banking industry commented that financial institutions are disproportionately affected by this exclusion, a trade group commented that this exclusion “define[s] the entire import-export sector out of” the definition, and the securities industry commented that as a result of this exclusion most filings by securities firms would not be considered voluntary self-disclosures. The fact that these different industries believe that the definition unfairly targets them weakens the force of the argument as to each. In any event, the argument does not address the underlying basis for the rule: The purpose of treating certain notifications as voluntary self-disclosures is to bring to OFAC's attention apparent violations of which it otherwise would not have learned.

OFAC stresses that the final rule provides (as did the interim final rule), that “[i]n cases involving substantial cooperation with OFAC but no voluntary self-disclosure as defined herein, including cases in which an apparent violation is reported to OFAC by a third party but the Subject Person provides substantial additional information regarding the apparent violation and/or other related violations, the base penalty amount generally will be reduced between 25 and 40 percent.” In addition, a Subject Person's cooperation with OFAC—including whether the Subject Person provided OFAC with all relevant information regarding an apparent violation (whether or not voluntarily self-disclosed), and whether the Subject Person researched and disclosed to OFAC relevant information regarding any other apparent violations caused by the same course of conduct—is a General Factor to be considered in assessing OFAC's enforcement response to the apparent violation. These provisions are intended to reward voluntary disclosures of all relevant information and address the concerns raised by the comments. The provisions make clear that a Subject Person's cooperation with OFAC can have a substantial impact on the nature of OFAC's enforcement response to an apparent violation, even in cases that do not meet the definition of “voluntary self-disclosure” set forth in the final rule.

Several comments noted that failure to treat self-initiated notifications to OFAC in the circumstances discussed above as voluntary self-disclosures causes unwarranted reputational harm to the institutions involved. OFAC does not believe that this concern provides a sufficient basis to alter the definition of voluntary self-disclosure discussed above. In response to this comment, OFAC has amended the final rule to expressly provide that, where appropriate, substantial cooperation by a Subject Person in OFAC's investigation will be publicly noted.

b. Material Completeness. Several comments also suggested that the definition's exclusion of disclosures that are materially incomplete is unfair because a party may not have had time to complete its investigation or access supplementary material before OFAC learns of an apparent violation from another source. The definition of voluntary self-disclosure set forth in the interim final rule, and retained in this final rule, excludes only those notifications where “the disclosure (when considered along with supplemental information provided by the Subject Person) is materially incomplete” (emphasis added). Similarly, the definition provides that “[i]n addition to notification, a voluntary self-disclosure must include, or be followed within a reasonable period of time by, a report of sufficient detail to afford a complete understanding of an apparent violation's circumstances, and should also be followed by responsiveness to any follow-up inquiries by OFAC.” (emphasis added). The definition thus expressly contemplates that a Subject Person may notify OFAC of an apparent violation before it has completed its investigation or accessed all of the supplementary material necessary for a complete disclosure. So long as that information is provided to OFAC within a reasonable period of time after the initial notification of the apparent violation, and assuming the other aspects of the definition are met, the disclosure would still constitute a voluntary self-disclosure. OFAC therefore concludes that this aspect of the definition already accommodates these comments and does not need to be changed.

c. Good Faith. OFAC likewise has considered and rejected the suggestion that the definition of voluntary self-disclosure not exclude disclosures that include false or misleading information or that are made without management authorization, when the disclosure is made in good faith. As noted above, the good faith standard is not readily administrable. OFAC believes that disclosures that contain false or misleading information should not receive the substantial benefit accorded to voluntary self-disclosures. In such cases, OFAC will consider the totality of the circumstances in determining whether the false or misleading information warrants negation of a finding of voluntary self-disclosure. When the Subject Person is an entity, disclosures made without the authorization of the entity's senior management do not reflect disclosure by the entity but rather by a third party. A finding of voluntary self-disclosure by the Subject Person is not warranted in whistleblower cases. Nor does OFAC believe that a whistleblower should be required to first notify the entity's senior management, as one comment suggested.

d. Regulatory Suggestion. One comment suggested that OFAC delete the word “suggestion” from that part of the definition of voluntary self-disclosure that excludes a disclosure that “is not self-initiated (including when the disclosure results from a suggestion or order of a federal or state agency or official),” on the ground that the term “suggestion” produces a subjective standard. While OFAC recognizes the concern expressed in the comment, in many instances federal or state regulators do not formally order institutions to report an apparent violation to OFAC. The use of the phrase “suggestion” in this context is intended to capture those instances in which a Subject Person's regulator, or another government agency or official, directs, instructs, tells, or otherwise suggests to the Subject Person that it notify OFAC of the apparent violation. In such cases, the notification to OFAC by the Subject Person is not properly considered self-initiated and OFAC likely would have learned of the apparent violation from the other government agency or official in the event that the Subject Person did not itself notify OFAC.

e. Timing of Notification. OFAC has also considered the comment that offered an alternative definition of voluntary self-disclosure that would have treated as a voluntary self-disclosure any notification to OFAC of an apparent violation prior to the time that OFAC issued a Pre-Penalty Notice, and suggested other changes to the definition. OFAC does not believe that the suggested changes are warranted. A Pre-Penalty Notice is typically issued once OFAC has completed an investigation into an apparent violation, and such investigation often involves the issuance of administrative subpoenas to the Subject Person. Affording voluntary self-disclosure credit to disclosures made after the issuance of such a subpoena would reward Subject Persons who did not disclose the apparent violation to OFAC until after OFAC had learned of it from other sources, and it would not accord with the purpose of mitigating the enforcement response in voluntary self-disclosure cases, which is to encourage the notification to OFAC of apparent violations of which OFAC would not otherwise have learned.

f. Suspicious Activity Report Filing. One comment asked that OFAC clarify that the filing of a Suspicious Activity Report (SAR) by a Subject Person pursuant to the Bank Secrecy Act has no impact on whether a subsequent notification to OFAC of an apparent violation, presumably based on the same transaction that is the subject of the SAR, constitutes a voluntary self-disclosure. The filing of a SAR does not itself preclude a determination of voluntary self-disclosure for a subsequent self-disclosure to OFAC of the same transaction, except to the extent that OFAC has learned of the apparent violation prior to the filing of the self-disclosure.

g. What to Report. One comment requested clarification regarding the circumstances in which the mere possibility that a violation exists should cause an institution to make a voluntary self-disclosure. The comment noted that the alleged uncertainty surrounding this creates a strong incentive for an institution to err on the side of reporting transactions that likely do not constitute a violation. OFAC does not believe that additional guidance is necessary or warranted. The Guidelines define an “apparent violation” as an actual or possible violation of U.S. economic sanctions laws, and they define a voluntary self-disclosure as a self-initiated notification to OFAC of an apparent violation (subject to the other provisions of the definition). The Subject Person determines whether to report an apparent violation to OFAC. Such a notification to OFAC need not constitute an admission that the conduct at issue actually constitutes a violation in order to be considered a voluntary self-disclosure. To the extent that the Guidelines as written provide an incentive for “over-reporting” to OFAC of possible violations, OFAC does not view that as a problem that needs to be addressed. To the contrary, OFAC would prefer that Subject Persons report a transaction or conduct that is ultimately determined to not be a violation, rather than that they elect not to report conduct that does constitute a violation.

h. Other OFAC Modifications. Finally, OFAC has made two additional changes to the definition of voluntary self-disclosure. The first change is to make clear that a self-initiated notification to OFAC that is made at the same time as another government agency learns of the apparent violation (through the Subject Person's disclosure to that other agency or otherwise) does qualify as a voluntary self-disclosure if the other aspects of the definition are met. This change is intended to cover voluntary self-disclosures made simultaneously to OFAC and another government agency. OFAC has thus substituted the phrase “prior to or at the same time” for the phrase “prior to” in the operative sentence of the definition, which now reads:

“Voluntary self-disclosure means self-initiated notification to OFAC of an apparent violation by a Subject Person that has committed, or otherwise participated in, an apparent violation of a statute, Executive order, or regulation administered or enforced by OFAC, prior to or at the same time that OFAC, or any other federal, state, or local government agency or official, discovers the apparent violation or another substantially similar apparent violation.”

OFAC has also added the following sentence to the definition of voluntary self-disclosure:

“Notification of an apparent violation to another government agency (but not to OFAC) by a Subject Person, which is considered a voluntary self-disclosure by that agency, may be considered a voluntary self-disclosure by OFAC, based on a case-by-case assessment of the facts and circumstances.”

This is intended to clarify that OFAC may treat a voluntary self-disclosure to another government agency as a voluntary self-disclosure to OFAC when the circumstances so warrant.

2. Risk-Based Compliance

Six comments questioned whether OFAC intended to move away from the risk-based compliance approach reflected in the 2006 Economic Sanctions Enforcement Procedures for Banking Institutions, which, along with their appended risk matrices, were withdrawn by the interim final rule. In no way has OFAC moved away from considering an institution's risk-based compliance program in assessing the appropriate enforcement response to an apparent violation. The final rule clarifies this by making explicit reference to risk-based compliance in its discussion of General Factor E, which focuses on a Subject Person's compliance program, and by re-promulgating with minor edits and in consolidated form, as an annex to the final rule, the risk matrices that had originally been promulgated as an annex to the 2006 Enforcement Procedures. By these changes, OFAC intends to reflect that it will continue to apply the same risk-based principles it has been applying in assessing the overall adequacy of a Subject Person's compliance program.

Two comments argued that in the case of banks, OFAC's focus should be more narrowly focused on the bank's fault or the nature of its compliance program. OFAC has considered these comments, but believes that all of the General Factors are as applicable to banks as they are to other Subject Persons. Those Factors account for both fault and the nature and existence of a compliance program, but they also account for other criteria that are relevant to a determination of an appropriate enforcement response to an apparent violation. For example, the degree of harm caused by an apparent violation is as relevant and important a factor to consider in cases involving banks as it is in other cases. OFAC thus disagrees with the comment that asserted that less weight should be afforded to the harm to sanctions programs objectives and a greater emphasis placed on risk-based compliance. The harm to sanctions program objectives is as valid and relevant a consideration as an institution's risk-based compliance program, and the Final Guidelines appropriately account for consideration of both factors.

One comment expressed concern about the absence of a process to periodically evaluate an institution's violations in the context of its overall OFAC compliance program and OFAC compliance record. The Guidelines, however, expressly provide for consideration of both an institution's OFAC compliance program and its overall compliance record over time in a number of places. For example, the Guidelines provide for consideration of a Subject Person's compliance program in General Factor E, which, as noted above, has been clarified to make explicit reference to risk-based compliance. The Guidelines also provide that in considering the individual characteristics of a Subject Person (General Factor D), OFAC will consider “[t]he total volume of transactions undertaken by the Subject Person on an annual basis, with attention given to the apparent violations as compared with the total volume.” This provision of the Guidelines is intended to allow for the consideration of any apparent violation in the context of a Subject Person's overall compliance record.

Another comment addressing risk-based compliance asserted that the Guidelines reflect “OFAC's stated intention to apply penalties on every erroneous transaction.” The Guidelines do not so state; to the contrary, they expressly note that “OFAC will give careful consideration to the appropriateness of issuing a cautionary letter or Finding of Violation in lieu of the imposition of a civil monetary penalty.” Another comment suggested that OFAC should state that it will not assess penalties based on minor or isolated compliance deficiencies. OFAC believes that the process set forth in the Guidelines for determining its enforcement response to an apparent violation is appropriate and that it would not be appropriate to make broader, categorical statements of its enforcement policy based on the minor or isolated nature of an apparent violation. The General Factors already account for the consideration of the minor or isolated nature of an apparent violation in determining whether a civil monetary penalty is warranted.

3. Cooperation and Tolling Agreements

Five comments argued that OFAC should not consider whether a Subject Person agreed to waive the statute of limitations or enter into a tolling agreement in assessing the Subject Person's cooperation with OFAC. The comments argued that it was unfair and contrary to public policy to consider this as a factor. One comment suggested that the provision should either be dropped or its consideration limited to cases where late discovery by or notification to OFAC threatens resolution within the five year statute of limitations period and that tolling agreements should be limited to extending the period for no more than five years from discovery of the apparent violation by OFAC.

OFAC has carefully considered these comments. The interim final rule addressed both waivers of the statute of limitations and tolling agreements. It is not OFAC's general practice to seek outright waivers of the statute of limitations, and the final rule eliminates any reference to statute of limitations waivers.

OFAC agrees that a Subject Person's refusal to enter into a tolling agreement should not be considered an aggravating factor in assessing a Subject Person's cooperation or otherwise. At the same time, a tolling agreement can be of significant value to OFAC, especially in cases where OFAC does not learn of an apparent violation at or near the time it occurs, in particularly complex cases, or in cases in which a Subject Person has requested and received additional time to respond to a request for information from OFAC. Accordingly, OFAC believes it appropriate to consider a Subject Person's entering into a tolling agreement in a positive light and as a basis for mitigating the enforcement response or lowering the penalty amount. The final rule thus clarifies that while a Subject Person's willingness to enter into a tolling agreement may be considered a mitigating factor, a Subject Person's unwillingness to enter into such an agreement will not be considered against the Subject Person.

4. Penalty Calculation

[…]

5. General Factors

A number of comments either identified additional proposed General Factors that OFAC should consider or suggested the deletion of General Factors as inappropriate for OFAC's consideration.

a. Compliance With Foreign Law. Two comments suggested that, in cases concerning conduct occurring outside the United States, OFAC should consider whether the conduct in question is permissible under the applicable law of another jurisdiction. OFAC does not agree that the permissibility of conduct under the applicable laws of another jurisdiction should be a factor in assessing an apparent violation of U.S. laws. In cases where the applicable laws of another jurisdiction require conduct prohibited by OFAC sanctions (or vice versa), OFAC will consider the conflict under General Factor K, which provides for the consideration of relevant factors on a case-by-case basis. OFAC notes that Subject Persons can seek a license from OFAC to engage in otherwise prohibited transactions and that the absence of such a license request will be considered in assessing an apparent violation where conflict of laws is raised by the Subject Person.

b. Reliance on Advice from OFAC. Three comments suggested that OFAC should explicitly state that good faith reliance on advice from the OFAC hotline (two comments) or on a reasoned analysis of OFAC regulations with the assistance of private counsel (one comment) should be considered in assessing an appropriate enforcement response. Subject Persons are encouraged to seek written guidance from OFAC on complex matters for the sake of clarity. Good faith reliance on substantiated advice received from the OFAC hotline or from counsel is subsumed within OFAC's consideration of whether a Subject Person willfully or recklessly violated the law.

c. Relevance of Future Compliance/Deterrence. One comment suggested that OFAC should eliminate General Factor J, which focuses on the impact that administrative action may have on promoting future compliance with U.S. economic sanctions by the Subject Person and similar Subject Persons, arguing that OFAC's enforcement response should focus solely on the Subject Person's culpability. OFAC rejects this argument, as the purpose of enforcement action includes raising awareness, increasing compliance, and deterring future violations, and not merely punishment of prior conduct.

d. Reason to Know. One comment suggested that OFAC should eliminate the “reason to know” provision of General Factor B, which focuses on the Subject Person's awareness of the conduct giving rise to the apparent violation. OFAC rejects this suggestion as it would invite Subject Persons to act with willful blindness. OFAC believes the “reason to know” formulation is consistent with general legal principles and appropriate for consideration.

e. Responsibility for Employees. One comment suggested that OFAC should make clear that actions of “rogue employees,” including supervisors or managers, will not be attributed to organizations so long as a reasonable compliance program was in place. OFAC rejects this suggestion. The actions of employees may be properly attributable to their organizations, depending on the facts and circumstances of the particular case. Among the factors OFAC will consider in determining whether such actions are attributable to an organization are the position of the employee in question, the nature of the conduct (including how long it lasted), who else was or should have been aware of the conduct, and the existence and nature of a compliance program intended to identify and stop such conduct.

f. Sanctions History. One comment suggested that cautionary letters, warning letters, and evaluative letters should not be considered when assessing a Subject Person's sanctions violations history. OFAC believes that such prior letters are appropriate to consider in determining an appropriate enforcement response. In addition, such letters evidence the Subject Person's awareness of OFAC sanctions generally. OFAC has amended the final rule to refer to “sanctions history” instead of “sanctions violations history” to make clear that consideration is not limited to prior formal determinations of sanctions violations.

OFAC has also amended the final rule to note that, as a general matter, consideration of a Subject Person's sanctions history will be limited to the five years preceding the transaction giving rise to the apparent violation. As explained above, a five-year limitation has also been incorporated into the provision providing that in cases involving a Subject Person's first violation, the base penalty amount generally will be reduced up to 25 percent, so that “first violation” is understood as the first violation in the five years preceding the transaction giving rise to the apparent violation. In certain cases, however, such as those involving enforcement responses to substantially similar apparent violations, it may be appropriate to consider sanctions history outside the five-year period.

g. Transition Period for Foreign Acquisitions. One comment suggested that the Guidelines should provide a transition period for cases in which a Subject Person acquires an entity outside the United States not previously subject to OFAC requirements. OFAC does not believe that such a provision is warranted. U.S. persons acquiring entities outside the United States should consider OFAC compliance as part of their due diligence review of the acquisition.

6. Provision of Information to OFAC

Four comments focused on possible impediments to fully complying with an OFAC request for information. Three of these comments raised concerns about foreign laws that may prohibit the provision of requested information to OFAC. OFAC does not believe that these comments warrant a change to the text of the interim final rule. As discussed above with respect to conflict-of-laws situations, OFAC will give due consideration to applicable restrictions of foreign law regarding the provision of information to OFAC on a case-by-case basis. OFAC expects that Subject Persons will provide to OFAC a detailed explanation of any allegedly applicable foreign law and the steps undertaken by the Subject Person to avail themselves of all legal means to provide the requested information.

One comment raised concerns about information protected by the attorney-client privilege or the attorney work product doctrine. OFAC generally does not expect Subject Persons to provide privileged or protected information in response to a request for information or otherwise. OFAC does, however, expect Subject Persons who withhold responsive information on the grounds of the attorney-client or other privilege or the work product doctrine to properly invoke such privilege or protection and to identify such withheld information on a privilege log, in accordance with any instructions accompanying requests for information and ordinary legal practice. OFAC has clarified the provision of the Guidelines providing for penalties for failure to respond to a request for information by eliminating the reference to “failure to furnish the requested information” and instead referring to a “failure to comply” with a request for information. The revised language is intended to make clear that OFAC will not seek penalties in those cases where responsive information is withheld on the basis of an apparently applicable and properly invoked privilege.

7. Penalty/Finding of Violation Process

[…]

8. Other Comments

[…]

OFAC Edits

In addition to the changes made in response to public comments and the additional changes to the definition of voluntary self-disclosure described above, OFAC has made several other changes to the Guidelines. First, OFAC has clarified the base penalty amounts for transactions subject to the Trading With the Enemy Act (TWEA), which presently has a $65,000 statutory maximum penalty. In non-egregious cases involving apparent violations of TWEA, where the apparent violation is disclosed through a voluntary self-disclosure by the Subject Person (i.e., Box “1” on the penalty matrix), the base amount of the proposed civil penalty shall be capped at a maximum of $32,500 per violation. This correction is necessary to ensure that in such cases the base amount of the proposed civil penalty is no more than one-half the base penalty amount for a similar transaction that is not voluntarily self-disclosed.

OFAC is also clarifying that for non-egregious transactions under TWEA that are not voluntarily self-disclosed, the base amount of the civil penalty shall be capped at $65,000. The Guidelines already provide for this by capping base penalty amounts at the applicable statutory maximum; this change is intended simply to clarify this point. Similarly, OFAC is clarifying that, in egregious cases, the base penalty calculation will be based on the “applicable” statutory maximum, in an effort to signal that the base penalty in such cases will differ for transactions under IEEPA (where the statutory maximum equals the greater of $250,000 or an amount that is twice the value of the transaction), TWEA (where the statutory maximum equals $65,000), or other applicable statutes.

[...]