Criminal Defense Lawyers

OFAC Sanctions Due Diligence in M&A Deals

OFAC Due Diligence in M&A Deals: What You Need to Know

When companies look to merge with or acquire other companies, they’ve gotta think about potential risks from sanctions enforced by the U.S. Treasury Department’s Office of Foreign Assets Control (OFAC). Even though it’s not legally required, doing OFAC due diligence is considered a best practice to lower sanctions risks in M&A deals. In this article, we’ll break down the key stuff about OFAC due diligence, including:

Background on OFAC Sanctions Programs

OFAC runs and enforces economic sanctions against certain foreign countries, regimes, terrorists, drug traffickers, and weapons dealers. U.S. companies and their foreign branches usually can’t do unauthorized business with sanctioned parties. Some of the main OFAC sanctions programs are against Cuba, Iran, North Korea, Syria, Venezuela, and individuals and groups on the Specially Designated Nationals (SDN) list.Breaking OFAC sanctions can lead to huge civil fines and reputational harm. Criminal penalties may also apply if violations are willful. That’s why OFAC due diligence is so important for companies in M&A deals.

Successor Liability Risk

In an M&A context, the acquiring company takes on certain legal liabilities from the target company. This is known as “successor liability.” For instance, if a target company broke OFAC sanctions before the acquisition, the acquiring company could be on the hook for those violations after the deal closes. The acquirer assumes successor liability for the target’s prior wrongdoings.To reduce successor liability risk, the acquiring company needs to do thorough OFAC due diligence on the target before the deal goes through. This allows the acquirer to spot any sanctions issues early and figure out the best way to fix or address them.

Conducting Risk-Based Due Diligence

OFAC recommends that companies take a risk-based approach to sanctions compliance programs and due diligence. This means assessing the specific sanctions risks of the target company and tailoring the due diligence scope accordingly.Here are some best practices for risk-based OFAC due diligence in M&A deals:

• Gather info to evaluate the target’s sanctions risk profile – countries, customers, suppliers, etc.
• Do more in-depth due diligence on identified high-risk areas.
• Review the target’s OFAC compliance program – policies, procedures, training, audits, etc.
• Analyze sample transaction data to spot any dealings with sanctioned parties.
• Interview key employees about sanctions compliance practices.
• Follow up on any red flags suggesting potential violations.

Taking a tailored, risk-based approach allows acquirers to efficiently focus due diligence efforts on the areas of greatest concern.

Remediating Due Diligence Findings

If the due diligence process uncovers potential OFAC issues at the target company, the acquirer should figure out the best way to fix or address those issues before closing the deal. Some options for remediating OFAC due diligence findings include:

• Requiring the target to end problematic contracts or relationships as a condition of the acquisition.
• Having the target conduct an internal investigation into apparent violations.
• Adjusting the valuation of the target company to account for sanctions-related liabilities.
• Structuring the deal to avoid acquiring certain high-risk assets or subsidiaries.
• Getting written representations, warranties, and covenants about OFAC compliance.
• Requiring the target to self-disclose identified issues to OFAC.

The right remediation steps will depend on the specific findings and risk tolerance. Consulting legal counsel is advisable to map out the best plan.

Self-Disclosure and Enforcement

If an acquiring company uncovers clear OFAC violations during due diligence, they may need to consider self-disclosing those violations to OFAC. Self-disclosure won’t eliminate penalties, but it can help get more favorable settlement terms.Recent OFAC enforcements highlight the risks of inadequate OFAC due diligence in M&A deals:

• In 2019, Stanley Black & Decker paid $1.9 million to settle 288 apparent violations related to a Chinese subsidiary it acquired. OFAC found Stanley failed to do due diligence on the subsidiary before acquisition.
• In 2020, BitGo Inc. paid $98,830 to settle 191 apparent violations caused by acquiring a company that processed cryptocurrency transactions with sanctioned parties. BitGo didn’t spot the sanctions risks during due diligence.

These cases show why proper due diligence and remediation is so important. Acquirers that inherit OFAC issues without due diligence are likely enforcement targets. When violations are found during due diligence, voluntary self-disclosure to OFAC should be strongly considered.According to OFAC’s guidelines, self-disclosure is a mitigating factor that can result in substantially lower penalties. Research indicates companies who voluntarily self-disclose generally get more favorable settlement terms compared to those that don’t.When self-disclosing, companies should provide violation details like:

• Description of the violations and relevant facts
• Explanation of how the violations happened
• Transaction data related to the violations
• Info about remedial measures taken

Thorough cooperation, remediation, and improved compliance controls can also help get reduced penalties after self-disclosure. However, the decision to self-disclose should be carefully weighed with guidance from knowledgeable counsel.Declining to disclose identified OFAC violations can greatly raise sanctions exposure and penalties if OFAC later discovers the issues itself.The U.S. Commerce Department has warned that failure to report export control violations will be considered an aggravating factor.In summary, while not guaranteed, voluntary self-disclosure gives companies the best shot at mitigating sanctions penalties and enforcement actions after finding violations during M&A due diligence.