Criminal Defense Lawyers

Preparing for Changes in OFAC Sanctions Programs

The U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) administers and enforces economic and trade sanctions programs against targeted foreign countries, terrorists, international narcotics traffickers, and those engaged in activities related to the proliferation of weapons of mass destruction – all done to protect America’s national security interests. As global threats evolve, OFAC regularly updates its sanctions programs, which can have significant impacts on international trade and business operations.

With OFAC sanctions rules constantly shifting, companies engaged in cross-border business must vigilantly monitor for changes and be prepared to quickly adapt their compliance programs. Failing to do so can result in stiff civil penalties and harm to business reputation.

Monitoring OFAC Announcements

The first critical step is to closely track OFAC’s website and subscribe to its email updates. OFAC announces upcoming changes to sanctions programs on its Recent Actions page, typically providing advance notice ranging from a couple weeks to several months. Examples of recent notices include:

• On August 15, 2023, OFAC announced it will retire the PIP, DEL, and SDALL.ZIP sanctions list file formats on or about the week of September 18, 2023. Companies relying on those formats must transition to using the new consolidated files.
• On May 19, 2023, OFAC announced it will add over 200 aircraft to the Russian Harmful Foreign Activities Sanctions Regulations program by late June 2023.

In addition to monitoring the Recent Actions page, companies should also sign up to receive OFAC’s email updates, such as the Weekly Highlights and the Sanctions Actions and Highlights reports.

Reviewing Changes to OFAC Regulations

Once an upcoming OFAC change is announced, compliance teams need to carefully review the details to determine the impacts. OFAC announces regulatory changes in the Federal Register and then updates the compiled regulations in 31 CFR Chapter V.

For example, when OFAC issued updates to the North Korean Sanctions Regulations in March 2023, compliance experts needed to study the new prohibitions, definitions, general licenses, and other details to update internal policies and procedures.

Updating Sanctions Lists

A critical task is to promptly update sanctions lists like the Specially Designated Nationals (SDN) list as soon as new versions are released by OFAC. The SDN list identifies individuals and entities subject to asset freezes and transaction blocks under various sanctions programs.

OFAC provides the SDN list in various formats including CSV, XML, and fixed width text. The agency recommends downloading the list a minimum of once per week. Some companies choose to download daily or even more frequently to minimize compliance risk.

In addition to the SDN list, OFAC publishes other non-SDN sanctions lists such as:

• The Foreign Sanctions Evaders (FSE) List
• The Sectoral Sanctions Identifications (SSI) List
• The Non-SDN Palestinian Legislative Council List (NS-PLC List)

OFAC provides all non-SDN lists bundled together in both CSV and fixed width text formats. Again, organizations need to download and update these lists frequently as changes occur.

Updating Compliance Systems

With new OFAC regulations and lists in hand, organizations must update their compliance systems and workflows accordingly. This includes:

• Updating automated screening systems against the latest OFAC lists
• Updating policies and procedures manuals to reflect new rules
• Retraining employees on new requirements
• Modifying business processes and forms to collect any new data required for compliance

Care must be taken that all systems are updated in a holistic, coordinated manner. For example, a manual screening procedure that relies on an outdated sanctions list leaves exposure.

Adjusting Business Operations

In some cases OFAC sanctions program changes will necessitate adjustments to business operations. Examples include:

• Halting business in newly embargoed countries
• Freezing transactions and assets of new SDN designees
• Avoiding newly prohibited business sectors and activities
• Altering trade routes and ports of call to comply with new rules

Firms should be prepared to act quickly to comply with OFAC mandates. Violations can lead to substantial civil penalties, criminal charges, and long-lasting harm to business reputation.

Seeking Licenses or Authorizations

In some instances, OFAC sanctions allow for companies to apply for special licenses to engage in activities that would otherwise be prohibited. For example, OFAC regulations contain general licenses authorizing certain limited transactions involving sanctioned countries or parties.

Where required business activities are not covered by general licenses, companies may apply for specific licenses from OFAC. This requires demonstrating why an exemption is warranted, such as for humanitarian reasons.

The licensing application process requires significant preparation and lead time. OFAC provides guidance on license applications on its Frequently Asked Questions page.

Conducting Internal Audits

On a periodic basis, organizations should conduct internal audits to verify OFAC compliance programs are updated and working as intended. Audits should include:

• Testing system screening against the latest OFAC lists
• Reviewing policies, procedures, and training materials to ensure they reflect current OFAC regulations
• Sampling transactions to verify screening and compliance with sanctions
• Interviewing staff on their understanding of OFAC requirements
• Assessing speed and accuracy of sanctions list updates
• Examining licenses and authorizations to confirm proper documentation
• Validating controls around freezing assets and blocking transactions
• Inspecting denied party screening processes
• Evaluating adequacy of recordkeeping for OFAC compliance
• Assessing coordination between OFAC compliance program elements
• Reviewing OFAC compliance audit trails and change logs
• Verifying timely and complete submission of required OFAC reports
• Testing backup and retention of OFAC compliance records

Internal audits should focus on high-risk areas and any identified gaps based on prior audits or changes in regulations. Audit results should be reported to senior management and corrective actions tracked.

Responding to Apparent Violations

If an internal audit identifies an apparent OFAC violation, it is critical to act quickly. OFAC expects organizations to voluntarily disclose potential violations promptly. Disclosure is considered a mitigating factor when OFAC determines civil penalties.

After reviewing the circumstances, organizations may need to make disclosures to OFAC, freeze assets, and block prohibited transactions. Legal counsel should be engaged early in the process.

Maintaining Consistent Vigilance

With OFAC sanctions programs constantly evolving, organizations must continually monitor for relevant changes and update their compliance programs accordingly. Resources should be dedicated for tracking OFAC announcements, updating sanctions lists, adjusting business operations, and conducting audits.

By maintaining consistent vigilance, companies can effectively navigate OFAC’s complex regulatory environment and minimize compliance risks.