On April 25, 2022, the U.S. Department of Treasury’s Office of Foreign Assets Control (“OFAC”) announced a settlement with Australian freight forwarding and logistics company Toll Holdings Limited (“Toll”). Toll agreed to remit more than $6 million to settle claims that it “originated or received payments through the U.S. financial system involving sanctioned jurisdictions and persons.”^[1]  Toll is not a U.S. entity, but was held responsible for violations of U.S. sanctions laws.  By originating or receiving payments through the U.S. financial system for transactions involving sanctioned persons or sanctioned jurisdictions, according to OFAC’s case, Toll caused the U.S. financial institutions to be engaging in prohibited activities with such sanctioned persons or jurisdictions.  Any person (including a non-U.S. person) found to “cause” a sanctions violation can itself be liable.  The Toll settlement represents the latest in a growing host of enforcement actions brought against non-U.S. persons for activity originating outside the United States, reinforcing a strong message to entities operating anywhere that OFAC is more than willing to extend its enforcement authority to foreign persons who cause U.S. persons or entities to violate sanctions laws.  This message comes at a time when the U.S. is leading a multi-jurisdictional effort to discover and pursue sanctions-evading activity across the globe.

1. The enforcement action
    
   1. The Violations
       

      The apparent violations underlying Toll’s settlement stem from almost 3,000 payments made in connection with sea, air, and rail shipments to, from, or through the comprehensively sanctioned jurisdictions of the Democratic People’s Republic of Korea, Iran, or Syria, and/or involving the property of a sanctioned person – specifically, an entity on OFAC’s Specially Designated Nationals and Blocked Persons List (“SDN List”). In processing payments connected to sanctioned jurisdictions and sanctioned persons in U.S. dollars, Toll caused U.S. financial institutions to violate U.S. sanctions laws by exporting financial services to sanctioned jurisdictions and transacting in the property or interests in property of sanctioned persons. Under settled OFAC authority, Toll could be held liable for civil penalties by OFAC, even though the actions of Toll, a foreign corporation operating outside the United States, would not usually fall within OFAC’s jurisdiction.

   2. The Cause
       

      OFAC alleged that Toll’s violations resulted from a lack of proper compliance controls, which OFAC partially attributed to Toll’s rapid expansion since 2007, when it began buying up a number of smaller freight forwarding companies. By 2017, Toll had almost 600 invoicing, data, payment, and other system applications spread across its various units. Although Toll had a compliance policy in place at this time, OFAC asserted that its compliance program and team were not equipped to handle the complexity of the company’s expanding operations. Toll allegedly did not properly address these compliance needs until after an unnamed bank threatened to terminate its relationship with the freight company based on its concerns that Toll was using its U.S. dollar account to transact with sanctioned jurisdictions or sanctioned persons.  According to the settlement announcement, by the time Toll introduced substantive compliance function reforms, however, 2,853 apparent violations had already occurred.  Even after implementing these reforms, an additional 105 payments were processed through the U.S. financial system causing violations of relevant sanctions regimes.

   3. The Penalty
       

      OFAC found Toll’s violations to be non-egregious, despite finding that “Toll acted with reckless disregard for U.S. economic sanctions laws” and that Toll “knew or had reason to know of the apparent violations.”^[2] As a result, while the statutory maximum penalty was over $826 million, Toll settled with OFAC for just over $6 million. OFAC found Toll’s voluntary self-disclosure and well-organized internal investigation, in addition to the extensive measures Toll has since taken to strengthen its compliance procedures, to be mitigating factors.

2. Why it matters
    

   This enforcement action is particularly notable because OFAC has, in the past five years and with increasing frequency, been bringing public enforcement actions against foreign companies for “causing” violations (i.e. where a non-U.S. person is sanctioned for causing a U.S. person or entity to commit a sanctions violation).  Many foreign institutions are aware of U.S. sanctions laws, but may fail to fully appreciate the myriad of ways to which they can be subject to restrictions under such laws and regulations.  The use of U.S. dollars to process transactions will typically involve the use of funds that, at some point, transit the U.S. financial system, even if a foreign company does not directly interact with a U.S. financial institution.  U.S. financial institutions are required to comply with all U.S. sanctions laws and by involving – directly or indirectly – a U.S. financial institution in a transaction, a foreign company subjects the entirety of the transaction to U.S. regulatory jurisdiction and scrutiny.  Particularly in instances where a U.S. nexus would not otherwise exist, foreign companies that utilize U.S. dollars or financing from U.S. persons become, themselves, subject to U.S. sanctions laws and the restrictions such laws impose. 

   This settlement agreement demonstrates OFAC’s increasing willingness to exercise its expansive jurisdiction over foreign corporations, including primarily extraterritorial transactions, in order to protect U.S. national security and global interests. The expanded use of its authority in this instance is consistent with recent actions OFAC took to sanction foreign companies deemed to have facilitated the evasion of sanctions against Russia and Belarus.^[3]

   Furthermore, the settlement reiterates the importance of having strong internal controls and compliance procedures, especially if a company engages in complex transactions involving international trade and commerce.  Global acquisitions are increasingly common, and integrating newly acquired assets into an existing, effective compliance program is integral to ensuring compliance with – or lawfully remaining outside the jurisdiction of – applicable sanctions laws.

3. compliance Considerations
    

   This settlement emphasizes that foreign companies should take care to ensure compliance with all applicable sanctions laws, particularly when a U.S. nexus exists to bring an otherwise extraterritorial transaction within the purview of OFAC’s jurisdiction.  While taking any action to evade or avoid sanctions restrictions is, itself, prohibited, it is a best practice to ensure that that transactions involving sanctioned persons or sanctioned jurisdictions either: will not cause a U.S. person to violate sanctions, or is compliant with all requisite authorizations.

   Global companies should consider closely examining their current compliance procedures to ensure that such procedures are up-to-date, effectively implemented, and without any gaps, as outlined in OFAC’s Framework for Compliance Commitments.^[4] All parties with which a company transacts should be screened against the relevant sanctions lists (which includes the UK and EU sanctions list, amongst others) and companies should consider enacting preventative measures, like hard controls. OFAC looks favorably upon such measures in enforcement proceedings and such controls can help avoid accidental sanctions violations.

   In addition, companies planning to acquire or merge with other entities may consider the impact of such a merger on their compliance procedures. Mergers and acquisitions often involve the integration of disparate technology systems and databases, creating new compliance issues that must be addressed.

   Finally, foreign companies should remain cognizant of all counterparties to its transactions, including financial intermediaries.  When a transaction involves a U.S. person as well as a sanctioned jurisdiction or sanctioned person, the transaction must be conducted in compliance with U.S. sanctions.  Any transaction involving a restricted counterparty should be properly assessed to ensure relevant compliance in order to preclude a scenario where the foreign company would find itself directly liable under U.S. sanctions for apparent violations of U.S. sanctions laws that could result in an enforcement action similar to the one brought against Toll.