SETTLEMENT AGREEMENT
This settlement agreement (the “Agreement”) between the U.S. Department of the Treasury’s Office of Foreign Assets Control (“OFAC”) and Keysight Technologies Inc. (“Keysight” as successor entity to Anite Finland OY or “Anite”) (“Respondent”).
I. PARTIES
OFAC administers and enforces economic sanctions against targeted foreign countries, regimes, terrorists, international narcotics traffickers, and proliferators of weapons of mass destruction, among others. OFAC acts under Presidential national emergency authorities, as well as authority granted by specific legislation, to impose controls on transactions and freeze assets under U.S. jurisdiction.
Keysight is a diversified test and measurement company located in Santa Rosa, California. It acquired Anite in August 2015. Anite, a Finland-based company, was a subsidiary of Keysight when the apparent violations described below occurred but has since been merged into Keysight and no longer exists as a distinct entity.
II. APPARENT VIOLATIONS
Keysight submitted a voluntary self-disclosure on behalf of Anite to OFAC. OFAC opened an investigation into Anite’s activities and requested additional information and documentation from Keysight. OFAC’s review of Keysight’s submissions identified conduct by Anite that appears to have violated the Iranian Transactions and Sanctions Regulations, 31 C.F.R. part 560 (“ITSR”). Specifically, from approximately January 2016 to June 2016, Anite appears to have violated § 560.205 of the ITSR when it engaged in six exports of goods intended for Iran with U.S.-origin content controlled pursuant to the Export Administration Regulations, 15 C.F.R. §§ 730-774 (“EAR”) valued at $331,089 (the “Apparent Violations”). The Apparent Violations were voluntarily self-disclosed to OFAC and constitute an egregious case.
III. FACTUAL STATEMENT
Internal correspondence disclosed by Keysight shows that prior to acquisition, Anite had business with Sudan, Syria, and Iran, particularly for the benefit of the South African telecommunications company MTN Group's subsidiaries in Iran and Syria Prior to its acquisition by Keysight, Anite communicated that it would cease all existing and future business with Sudan, Syria, and Iran. Approximately one month after acquiring Anite, on or about September 14, 2015, Keysight informed Anite that sales to Sudan, Syria, and Iran should no longer occur. Keysight thereafter reiterated its instructions to Anite regarding the prohibitions on unauthorized trade with Sudan, Syria and Iran.
Anite’s Vice President for Europe, Middle East and Africa (“Vice President EMEA”) passed this information onto Anite’s Regional Director for the Middle East in the U.A.E. (“Regional Director ME”) and two other employees in the Anite Middle East office noting, “I need to advice [sic] you NOT to sell into any of [Syria, Sudan or Iran].”
In his email to the three Anite Middle East employees, the Vice President EMEA copied the controller for Anite’s network test business responsible for financial analysis and reporting. Later that same day, the Regional Director ME responded to the Vice President EMEA in an email copying two of his colleagues expressing a reluctance to terminate Anite’s ongoing Iranian business.
The Regional Director ME’s response to the Vice President EMEA’s email suggested his resistance to the idea of terminating sales in Iran and with other U.S.-sanctioned countries. Evidence of this resistance continued over text message later that same evening in an exchange between the Regional Director ME and the other two employees that were copied to the reply email to the Vice President EMEA. In the text message exchange, the Regional Director ME and his two colleagues agreed that to preserve their credibility in the local market, they would by ensuring that no mention of Iran or locations in Iran would appear in correspondence.
However, Anite’s Middle East employees were not always successful in preventing mentions of Iran in their correspondence. On January 12, 2016, sent an email to the Vice President EMEA and the Regional Director ME regarding the negotiation of a sale between Anite and a Pakistani telecommunications company, and mentioned that the Pakistani company knew about [the] . . . Iran Pricing” that Anite was providing for its products.
Less than two hours after receiving the email, the Regional Director ME and the business partner who sent the email exchanged communications via text message and noted they should not mention Iran in their emails and have references to Iran deleted. The Regional Director ME also expressed fear that he would lose his job or end up in jail. In his next email reply to the message regarding the Pakistani negotiations, the Regional Director ME changed the reference to “Iran Pricing” to “UAE package Pricing,” and informed the Vice President EMEA of this change stating, “for safety sake I have removed all country names.”
Keysight disclosed to OFAC six orders of Anite products to intermediate parties located in the U.A.E. from January 2016 to June 2016 that Anite arranged while knowing that these purchasers intended to convey the products to end users in Iran. Keysight’s disclosure determined that the six orders were ultimately sent to Iran. Keysight determined that certain Anite employees responsible for the transactions “were aware of the applicability to their activities of both Keysight compliance policies and U.S. export controls and economic sanctions regulations.”
Each of the six orders disclosed contained export-controlled U.S.-origin content subject to the EAR. The end-user for all six orders was MTN Irancell, a joint venture between the South African company MTN Group and a consortium controlled by the Government of Iran.
IV. TERMS OF SETTLEMENT
OFAC and Respondent agree as follows:
1. In consideration of the undertakings of Respondent in paragraph 2 below, OFAC agrees to release and forever discharge Respondent, without any finding of fault, from any and all civil liability in connection with the Apparent Violations arising under the legal authorities that OFAC administers.
2. In consideration of the undertakings of OFAC in paragraph 1 above, Respondent agrees and represents:
A. Within fifteen (15) days of the date Respondent receives the unsigned copy of this Agreement, to:
(i) sign, date, and send a digital copy of this agreement to Morgan Keilman at [email protected]. Respondent should retain a copy of the signed Agreement and a receipt or other evidence that shows the date that Respondent sent a digital copy of the signed Agreement to OFAC; and
(ii) pay or arrange for the payment to the U.S. Department of the Treasury the amount of $473,157. Respondent's payment must be made either by electronic funds transfer in accordance with the enclosed "Electronic Funds Transfer (EFT) Instructions," or by cashier's or certified check or money order payable to the "U.S. Treasury" and referencing ENF 49041. Unless otherwise arranged with the U.S. Department of the Treasury's Bureau of the Fiscal Service, Respondent must either: (1) indicate payment by electronic funds transfer, by checking the box on the signature page of this Agreement; or (2) enclose with this Agreement the payment by cashier's or certified check or money order.
B. To waive (i) any claim by or on behalf of Respondent, whether asserted or unasserted, against OFAC, the U.S. Department of the Treasury, or its officials and employees arising out of the facts giving rise to the enforcement matter that resulted in this Agreement, including but not limited to OFAC's investigation of the Apparent Violations, and (ii) any possible legal objection to this Agreement at any future date.
C. Compliance Commitments: Respondent has terminated the conduct described above and has established, and agrees to maintain for at least five years following the date this Agreement is executed, sanctions compliance measures that are designed to minimize the risk of recurrence of similar conduct in the future. Specifically, OFAC and Respondent understand that the following compliance commitments have been made:
a. Management Commitment:
i. Respondent commits that senior management has reviewed and approved Respondent's sanctions compliance program.
ii. Respondent commits to ensuring that its senior management, including senior leadership, executives, or the board of directors, are committed to supporting Respondent's sanctions compliance program.
iii. Respondent commits to ensuring that its compliance unit(s) are delegated sufficient authority and autonomy to deploy its policies and procedures a manner that effectively controls Respondent's in sanctions risk.
iv. Respondent commits to ensuring that its compliance unit(s) receive adequate resources including in the form of human capital, expertise, information technology, and other resources, as appropriate that are relative to Respondent's breadth of operations, target and secondary markets, and other factors affecting its overall risk profile.
v. Respondent commits to ensuring that Senior Management promotes a "culture of compliance" throughout the organization.
b. Risk Assessment:
i. Respondent represents that it conducts a sanctions risk assessment in a manner, and with a frequency, that adequately accounts for potential risks. Such risks could be posed by its clients and customers, products, services, supply chain, intermediaries, counter-parties, transactions, and geographic locations, depending on the nature of the organization. The risk assessment will be updated to account for the root causes of any apparent violations or systemic deficiencies identified by Respondent during the routine course of business.
ii. Respondent represents that it has developed a methodology to identify, analyze, and address the particular risks it identifies. The risk assessments will be updated to account for the conduct and root causes of any apparent violations or systemic deficiencies identified by Respondent during the routine course of business, for example, through a testing or audit function.
iii. Specifically with respect to the conduct outlined above, Respondent immediately took steps to ensure that there would be no further Anite transactions involving restricted countries. Respondent assessed past and pending transactions, implementing mechanisms to both halt current transactions and ensure that no further transactions involving restricted countries would occur.
c. Internal Controls:
i. The Respondent has designed and implemented written policies and procedures outlining its sanctions compliance plan. These policies and procedures are relevant to the organization, capture Respondent's day-to-day operations and procedures, are easy to follow, and designed to prevent employees from engaging in misconduct.
ii. The organization has implemented internal controls that adequately address the results of its sanctions risk assessment and profile. These internal controls should enable Respondent to clearly and effectively identify, interdict, escalate, and report to appropriate personnel within the organization transactions and activity that may be prohibited by OFAC. To the extent information technology solutions factor into Respondent's internal controls, Respondent has selected and calibrated the solutions in a manner that is appropriate to address Respondent's risk profile and compliance needs, and Respondent routinely tests the solutions to ensure effectiveness.
iii. Respondent commits to enforcing the policies and procedures it implements as part of its sanctions compliance internal controls through internal or external audits.
iv. Respondent commits to ensuring that its OFAC-related recordkeeping policies and procedures adequately account for its requirements pursuant to the sanctions programs administered by OFAC.
v. Respondent commits to ensuring that, upon learning of a weakness in its internal controls pertaining to sanctions compliance, it will take immediate and effective action, to the extent possible, to identify and implement compensating controls until the root cause of the weakness can be determined and remediated.
vi. Respondent has clearly communicated the sanctions compliance plan's policies and procedures to all relevant staff, including personnel within the sanctions compliance function, as well as relevant gatekeepers and business units operating in high-risk areas (e.g., customer acquisition, payments, sales, etc.) and to external parties performing sanctions compliance responsibilities on behalf of Respondent.
vii. Respondent has appointed personnel to integrate the sanctions compliance program's policies and procedures into Respondent's daily operations This process includes consultations with relevant business units, and confirms that Respondent's employees understand the policies and procedures.
viii. Specifically with respect to the conduct outlined above, Respondent implemented processes for screening Anite transactions for trade compliance to prevent future recurrences, including automated and manual screening of dealings involving entities in North Africa and the Middle East.
d. Testing and Audit:
i. The Respondent commits to ensuring that the testing or audit function is accountable to senior management, is independent of the audited activities and functions, and has sufficient authority, skills, expertise, resources, and authority within the organization.
ii. Respondent commits to ensuring that it employs testing or audit procedures appropriate to the level and sophistication of its sanctions compliance program and that this function, whether deployed internally or by an external party, reflects a comprehensive and objective assessment of Respondent’s OFAC-related risk assessment and internal controls.
iii. Respondent commits to ensuring that, upon learning of a confirmed negative testing result or audit finding pertaining to its sanctions compliance program, it will take immediate and effective action, to the extent possible, to identify and implement compensating controls until the root cause of the weakness can be determined and remediated.
e. Training:
i. Respondent commits to ensuring that its OFAC-related training program provides adequate information and instruction to employees and, as appropriate, stakeholders (for example, clients, suppliers, business partners and counterparties) in order to support Respondent's sanctions compliance efforts.
ii. Respondent commits to providing OFAC-related training with a scope that is appropriate for the products and services it offers; the customers, clients, and partner relationships it maintains; and the geographic regions in which it operates.
iii. Respondent commits to providing OFAC-related training with a frequency that is appropriate based on its OFAC risk assessment and risk profile and, at a minimum, at least once a year to all relevant employees.
iv. Respondent commits to ensuring that, upon learning of a confirmed negative testing result or audit finding, or other deficiency pertaining to its sanctions compliance program, it will take immediate and effective action to provide training to relevant personnel.
v. The Respondent's training program includes easily accessible resources and materials that are available to all applicable personnel.
vi. Specifically, with respect to the conduct outlined above, Respondent implemented immediate trade compliance and related controls training for sales personnel from Anite, who continue to be included in regular required trade control training.
f. Annual Certification:
i. On an annual basis, for a period of five years, starting from 180 days after the date the Agreement is executed, a senior-level executive or manager of Respondent will submit a certification confirming that Respondent has implemented and continued to maintain the sanctions compliance measures as committed above.
D. Should OFAC determine, in the reasonable exercise of its discretion, that Respondent appears to have materially breached its obligations or made any material misrepresentations under Subparagraph C (Compliance Commitments) above, OFAC shall provide written notice to Respondent of the alleged breach or misrepresentations and provide Respondent with 30 days from the date of Respondent's receipt of such notice, or longer as determined by OFAC, to determine that no material breach or misrepresentations has occurred or that any breach or misrepresentation has been cured.
E. In the event OFAC determines that a material breach of, or misrepresentation in, this Agreement has occurred due to a failure to perform the Compliance Commitments, OFAC will provide notice to Respondent of its determination and whether OFAC is re-opening its investigation. The statute of limitations applying to the Apparent Violations shall be deemed tolled until a date 180 days following Respondent's receipt of notice of OFAC's determination that a breach of, or misrepresentation in, this Agreement has occurred.
F. Should the Respondent engage in any violations of the sanctions laws and regulations administered by OFAC—including those that are either apparent or alleged—OFAC may consider Respondent's sanctions history, or its failure to employ an adequate sanctions compliance program or appropriate remedial measures, associated with this Agreement as a potential aggravating factor consistent with the Economic Sanctions Enforcement Guidelines, 31 C.F.R. part 501, Appendix A.
3. This Agreement shall not in any way be construed as an admission by Respondent that Respondent engaged in the Apparent Violations.
4. This Agreement has no bearing on any past, present, or future OFAC actions, including the imposition of civil monetary penalties, with respect to any activities by Respondent other than those set forth in the Apparent Violations.
5. OFAC may, in its sole discretion, post on OFAC's website this entire Agreement and issue a public statement about the factors of this Agreement, including the identity of any entities involved, the settlement amount, and a brief description of the Apparent Violations.
6. This Agreement consists of 9 pages and expresses the complete understanding of OFAC and Respondent regarding resolution of OFAC's enforcement matter involving the Apparent Violations. No other agreements, oral or written, exist between OFAC and Respondent regarding resolution of this matter.
This Agreement shall inure to the benefit of and be binding on each party, as well as its respective successors or assigns.
[SIGNATURES]
For consolidated commentary on the Keysight case, see Civil Enforcement Information - Keysight Technologies, Inc.. The information provided in the factual statement portion of the Settlement Agreement provides support for OFAC’s determination that the violations were “egregious.”
Treated as a "successor liability" case for categorization purposes; see enforcement action-related search criterion on the Research System interface.