When companies merge or acquire other companies, they can also inherit significant liability related to sanctions violations under the Office of Foreign Assets Control (OFAC). This is an important issue that companies need to carefully evaluate during due diligence in mergers and acquisitions. OFAC administers U.S. economic and trade sanctions programs. These programs restrict transactions and freeze assets under U.S. jurisdiction of targeted foreign countries, entities and individuals. OFAC also publishes the Specially Designated Nationals (SDN) list which identifies blocked persons and companies owned or controlled by them. U.S. persons, including companies, are generally prohibited from dealing with SDNs. In an M&A context, if the target company has engaged with SDNs or otherwise violated OFAC regulations, the acquiring company can face successor liability and inherit OFAC obligations after the deal closes. This liability can be severe, including massive fines and damage to reputation.

Key Issues in Inheriting OFAC Liability

Here are some of the key issues that can arise with inheriting OFAC liability in M&A deals:

• Ongoing violations by the target company related to dealings with SDNs or sanctioned countries
• Unpaid fines or penalties owed by the target company for prior OFAC violations
• "Dusting attacks" where bad actors have sent funds or assets to the target company in order to get them into the U.S. financial system
• Lack of an effective OFAC compliance program by the target company
• Use of shell or alter-ego companies by the target company to circumvent OFAC regulations

In many cases, OFAC violations by the target company can go undetected for years. Violations may only come to light during the due diligence process or long after the acquisition has closed. This underscores the need for robust OFAC due diligence in M&A.

Conducting OFAC Due Diligence

When evaluating a potential acquisition target, the buying company should conduct thorough OFAC due diligence. This involves investigating the target's historical dealings and relationships to identify any potential sanctions issues. Key aspects include:

• Reviewing the target's customer and vendor lists against the SDN list
• Analyzing the target's transactions involving sanctioned countries
• Assessing the target's OFAC compliance program, policies and procedures
• Interviewing the target's compliance personnel regarding OFAC issues
• Running automated scans to identify references to SDNs in the target's systems and documents

Ideally this due diligence should be done with the assistance of legal counsel to preserve attorney-client privilege. If the due diligence uncovers OFAC issues, the buyer can then take steps to mitigate risks, including negotiating representations and indemnities and requiring remediation by the target company.

Mitigating Successor OFAC Liability

If OFAC issues are identified, there are steps the parties can take to mitigate successor liability risks:

• Filing voluntary self-disclosures with OFAC for any uncovered violations and cooperating fully
• Requiring the target to remediate compliance issues pre-closing as a condition of the deal
• Negotiating appropriate reps and warranties regarding OFAC compliance
• Obtaining specific indemnities covering OFAC liabilities from the target company
• Structuring the deal to avoid inheriting certain OFAC liabilities (e.g. dropping problematic subsidiaries)
• Applying for an OFAC license to complete the transaction and remediate issues

Voluntary self-disclosure to OFAC and cooperation is critical. OFAC may issue a "no action" letter or more lenient treatment when violations are voluntarily disclosed. Parties may also seek a specific license from OFAC to complete a transaction and undertake remediation. According to OFAC, it intends to implement a favorable licensing policy for such cases after appropriate due diligence.

Practical Steps to Avoid Successor Liability

Here are some practical steps companies can take to avoid inheriting OFAC liability:

• Include OFAC due diligence as part of standard M&A due diligence procedures
• Engage legal counsel experienced with OFAC early in the process
• Perform detailed OFAC due diligence on any acquisition target
• Carefully review target customer and vendor lists against SDN list
• Review IP addresses and web traffic of target company for any hits on SDNs
• Put transaction on hold if unresolved OFAC issues are uncovered
• Require target company to remediate any OFAC deficiencies pre-closing
• Build robust OFAC representations, warranties and indemnities into deal agreements
• Consider carve-out structures to isolate and exclude problematic portions of a target business
• Weigh OFAC risks against deal value and structure deal appropriately

While inheriting OFAC liability can be a significant risk, companies can take proactive steps to conduct appropriate due diligence and structuring to avoid surprises. In some cases, uncovered issues may require walking away from a deal or adjusting the valuation.

Case Study Examples

Here are some real-world examples of successor OFAC liability issues arising in M&A deals:

ZTE Corporation

In March 2017, Chinese telecom firm ZTE Corporation agreed to pay $1.19 billion to settle OFAC charges for shipping U.S. equipment to Iran and North Korea in violation of sanctions. However, in 2018 the U.S. government imposed a denial order prohibiting U.S. companies from exporting goods to ZTE related to the violations. This threatened ZTE's survival and ability to continue operating globally. The case highlights the massive liabilities that OFAC sanctions can create.

Cobham Plc

In 2019, U.K. aerospace and defense contractor Cobham Plc agreed to pay over $87 million to settle OFAC violations. The violations related to Cobham's 2011 acquisition of Aeroflex/Metelics Corporation, which had dealings with Sudan and Syria. This case illustrates that OFAC liability can arise years after an acquisition closes.

Société Générale

In 2018, French bank Société Générale agreed to pay $1.3 billion to resolve OFAC violations arising from processing billions in transactions with Cuban, Iranian and Sudanese entities. The bank failed to disclose that it was acquiring an entity with pre-existing OFAC compliance issues during due diligence for a 2001 acquisition.

Key Takeaways

Inheriting OFAC liability is an important risk that companies must carefully evaluate in M&A deals. Robust OFAC due diligence, appropriate deal structuring, and representations and indemnities are key to mitigating this risk. Violations can result in massive fines and reputational damage long after a deal closes. Proactive steps like voluntary disclosure and remediation are critical. With proper precautions, buyers can avoid inheriting unwanted OFAC obligations in mergers and acquisitions.