People often think that sanctions regulations are really for the financial sector. After all, they are referred to as “financial sanctions” as often, if not more so, than “economic sanctions.” And, in many countries, the primary sanctions regulator is the same as the one which oversees banks and other financial firms.

The greater public has, unfortunately, been lulled into a false sense of security by how enforcement of sanctions compliance failures is conducted across the globe – except in the United States and United Kingdom. Outside of those two countries, firms are only penalized if their system of controls to identify sanctions violations is found wanting during periodic reviews of their compliance programs.

In October 2018, the head of the U.K.’s sanctions regulator stated that they expect to mete out fines in the coming year based on the 122 reports of regulatory violations they have received. However, to date, there is currently no track record of enforcement based on investigation of actual breaches of the regulatory burdens.

That leaves the United States – the country with the longest, and most punitive, history of regulatory enforcement actions, the most aggressive and varied application of sanctions regulations, as well as the most expansive definition of legal jurisdiction. Fortunately, the Office of Foreign Assets Control (OFAC), the U.S. sanctions regulator, is also the most transparent about its requirements, expectations and the investigation and prosecution of sanctions violations.

The Long Arm of the U.S.

The U.S. claims legal jurisdiction broadly. In addition to “U.S. persons,” which are U.S. citizens and U.S.-incorporated firms, and foreign persons and operations of foreign firms located in the United States, the U.S. stakes a claim to take some manner of enforcement action when:

– Based on a 2017 enforcement action against 2 Singaporean firms, the U.S. currency is used to facilitate a prohibited transaction.

– Based on explicit wording in the regulatory framework for the U.S.’ Iranian sanctions, U.S.-origin goods are shipped to Iran.

– For elements of the Hizballah, Iran and Ukraine/Russia-related sanctions, a foreign person or organization is involved in (including advice, insurance and other facilitation) of transactions prohibited to U.S. persons.

In addition, U.S. sanctions programs generally provide the power to sanction those parties who, through their conduct of business with those already sanctioned, help lessen or delay the impact of sanctions restrictions and prohibitions. This was evidenced in late 2018 by the sanctioning of a Singaporean citizen and his companies who had facilitated trade involving North Korea, in contravention of OFAC and United Nations sanctions.

While the U.S. is not the only country to apply sanctions on foreign persons and organizations beyond what is agreed to on a multilateral basis by the United Nations or the European Union, its extraterritorial application of sanctions is, by far, the most far-ranging.

U.S. Regulatory Framework

Unlike the overwhelming majority of countries, to properly comply with the United States sanctions regime, one must master an array of legislation, regulation and guidance. While downloading a list of names of sanctioned parties and withholding any assets in which they have an ownership interest checks the box for most countries’ requirements, much of the U.S. regime’s nuances must be derived from descriptions of affected parties and types of commercial or financial  transactions. For example:

– In addition to any specifically-named parties, some securities issued or held by elements of the Venezuelan government are subject to restrictions or prohibitions.

– One is expected, due to the import and export restrictions placed on certain governments and countries, to identify references to geographic locations (including port facilities) in the affected countries in order to identify transactions that are potentially subject to compliance oversight.

Perhaps the most impactful of these regulatory expectations that are not explicitly provided by OFAC is the OFAC 50 Percent Rule. This regulatory guidance, which has been quoted in 3 enforcement actions since 2016, states that any organization which is at least 50 percent owned by 1 or more sanctioned parties is, itself, considered sanctioned. The European Union has also published a similar “ownership and control” guidance. Based on extensive, non-exhaustive research of publicly-available ownership and management control records, the number of additionally-sanctioned parties is between 3 and 4 times the size of the combined applicable U.S. and E.U. sanctions lists.

Same Sanctions, Different Day

The scope of foreign sanctions requirements, especially those of the United States, may appear daunting. However, one must contend with a pair of painful realities. While the cost of complying with another country’s regulatory requirements may feel like an unnecessary expense, it likely pales with the commercial impact of an enforcement action resulting from willful neglect of OFAC’s extraterritorial reach. Similarly, while one’s home regulator may currently seem inattentive with regards to oversight and enforcement, that can shift significantly in a blink of an eye, exposing one immediately to significant reputational and regulatory risk. Consider the regulatory responses in Hong Kong and Singapore in the wake of the 1MDB scandal as a prominent example.

When one reviews the outsized fines against European banks for their compliance failures, and the short-lived ban on exports to the Chinese telecommunications firm ZTE, perhaps, to paraphrase an old saw, an ounce of compliance prevention is worth a pound of enforcement action cure, even if the odds of catching the contagion seem remote.

Eric A. Sohn, CAMS, global market strategist and product director, Dow Jones Risk & Compliance, New York, NY, USA, eric.sohn@dowjones.com