Sanctions compliance & enforcement

March 2016  |  ROUNDTABLE  |  GLOBAL TRADE

Financier Worldwide Magazine

The sanctions compliance and enforcement landscape over the past few years has been dominated by issues surrounding the imposition of multilateral sanctions against Russia and Crimea, as well as the longstanding trade restrictions placed on Cuba and Iran. And while a significant number of sanctions regimes have been relaxed in recent times, the dynamic geopolitical landscapes in many countries ensures that complexities will remain for companies operating or considering operating in certain jurisdictions. Relevant commercial and compliance challenges need to be adequately assessed and addressed.

FW: How would you characterise recent developments in economic sanctions around the world? Which countries are in the spotlight?

Contini: One striking trend in recent sanctions developments is the unprecedented amount of collaboration between jurisdictions, especially the US and the EU. After Russia’s military intervention in Ukraine in February 2014 and annexation of Crimea in March 2014, the US and the EU moved swiftly to impose sanctions carrying some unique features that reflected cooperation between the two jurisdictions. For instance, most restricted parties’ sanctions programmes target politico-military actors while leaving the business class relatively untouched – but the US and EU designated some of Russia’s wealthiest oligarchs as restricted parties, causing these sanctions to have a real impact on US and EU companies engaged in mainstream commerce with Russia.

Barnhill: The past two years have seen several significant developments with respect to economic sanctions, including the imposition of multilateral sanctions against Russia and the Crimea region of Ukraine, and the easing of certain sanctions by the US against Cuba and, by many countries, including the US, against Iran. We have, of course, been seeing a great deal of attention on Iran following Implementation Day, and this attention is likely to continue, particularly for non-US entities for which certain opportunities may be available – though a number of restrictions still apply under US sanctions. In addition, we are continuing to see changes related to the loosening of certain US sanctions against Cuba. Most recently, there have been changes to the provisions in the Cuban Assets Control Regulations related to financing for certain permissible exports.

Mebane: Momentous is a word that could be used to describe the changes in economic sanctions that we have seen recently, with the easing of trade sanctions against Cuba and Iran – which are some of the longest-standing – and the establishment of the Joint Comprehensive Plan of Action (JCPOA) that allows the EU, UN and the US to lessen sanctions against Iran. We also realise that the dynamic geopolitical landscapes in other countries, such as Russia, Ukraine and Syria, present challenges for foreign businesses operating or considering operating in those countries. Although we have witnessed an evolution of trade restrictions within the last two years, these changes do not dissolve the complexities – particularly the compliance and commercial challenges that remain for companies.

Katsoulis: The last couple of years have been very active in terms of economic sanctions and we expect this trend to continue and most likely intensify in the future. Interestingly enough, we have seen a move from relatively straightforward sanctions – for example, an outright ban on trading with certain countries or persons – to more hybrid sanctions systems – for example, EU/US sanctions against Russia – that combine different types of measures, thereby making compliance increasingly challenging. Quite understandably, Russia, Cuba, Syria and Iran have been in the spotlight during the last year and should remain the centre of attention for government regulators and enforcement agencies, as well as private parties in the near future.

Smith: Over the past five years economic sanctions imposed by the US, the EU and the UN – among other jurisdictions and multilateral bodies – have become far more complicated and nuanced. Those implementing the sanctions have, in turn, become far more adept at targeting entities and persons for sanctions and enforcing against those who violate them. Iran has been a perennial focus, but sanctions have increasingly been used to address a range of foreign policy challenges such as unrest in the African Great Lakes, Libya and Syria. In the US case, sanctions have increasingly been used against non-geographic concerns such as transnational organised crime and, potentially soon, cyber crime.

Antonini: While still relevant, Russia has all but disappeared from the spotlight. All eyes are now on Iran. The international sanctions on Iran changed drastically on Saturday 16 January 2016. After months of anticipation and speculation, the International Atomic Energy Agency (IAEA) announced that it verified that Iran has fulfilled its commitments under the JCPOA. This triggered Implementation Day, the latest and perhaps most significant milestone contemplated by the agreement reached on 14 July 2015, and the day on which the international sanctions relief contemplated by the JCPOA came into effect.

Pride: Economic sanctions worldwide were relatively stable until 2003, when the sanctions regimes for Iraq were largely lifted. Prior to that time, the sanctions imposed on Iran, Iraq, Libya, North Korea and Sudan were the most comprehensive imposed worldwide. Since then, the sanctions regime has been lifted for Libya. Of late, there’s been a lot of press regarding Iran given that they have met the requirements of the nuclear pact and subsequently the nuclear-related UN sanctions and multilateral EU/US sanctions were lifted. Billions in long-frozen assets have been released and Iran now has freedom to sell its oil, and purchase goods in the international marketplace. The reality is that the US has not completely lifted its sanctions.

FW: In your opinion, what are the most pressing sanctions compliance and enforcement issues facing companies conducting international trade? To what extent are the risks and challenges increasing? Are any particular industries and sectors at greater risk than others?

Pride: The biggest sanctions compliance issues are the fact that companies are seeing headlines stating that the sanctions are lifted, when in fact they are not. Equally, we’ve seen a significant increase in enforcement. The $1.9bn in penalties for HSBC’s violation of the BSA and US sanctions is by far the largest penalty to date. The risks are only increasing in these turbulent times. There are no EU rules on enforcement; it’s all done at the national level. Recent trends for enforcement also include increased international cooperation.

Mebane: Navigating the multijurisdictional considerations are some of the more challenging issues facing companies. This requires companies to adapt rapidly to address compliance gaps that could arise as a result of these matters. Regardless of where a company may be located, however, it is important to consider requirements to adhere to US sanctions. The enforcement scope of US regulators is far-reaching and may occur whenever a US person is involved. For example, the Office of Foreign Assets Control (OFAC) maintains sanctions that govern transactions occurring in US dollars, involve publically-listed companies in the US, or when US persons are involved. Lastly, those industries that are highly regulated, such as finance and banking, pharmaceutical, oil & gas, and telecommunications, are likely experiencing the most scrutiny for contemplated commercial activity involving sanctioned countries, which is not unique and remains a focus of companies operating within these areas and industries.

Antonini: There are two main issues which appear most pressing today. First and foremost is the changed situation with respect to Iran. The difficulty here is that several companies think that now all is allowed with Iran. This could not be further from the truth. While it is true that the bulk of EU sanctions have now been lifted, there are still certain EU human rights related sanctions that remain in place, and several entities remain listed in the EU. The impact of this should not be underestimated. Furthermore, with respect to the US, the lifting of the sanctions is not as far reaching as in the EU, and several restrictions remain in place. This is especially so for US companies, which are still mostly not allowed to deal with Iran. With respect to foreign US subsidiaries, the situation is also very tricky. While not impossible for them to deal with Iran, it nevertheless presents difficulties. The second issue is the recently announced increased focus on enforcement of financial sanctions in the UK. The sector that appears most at risk is the financial sector, especially with respect to Iran.

Smith: The pace of change makes keeping up with sanctions difficult. The increasing number of enforcement agencies – and their increasing vehemence in enforcement – makes the risk of not keeping up substantial. To take the US as an example – which has the most robust and well-tuned sanctions system in the world – the number of sanctions programmes the US has increased by nearly 300 percent since 2000. The number of blacklisted entities has more than doubled in that period, and the speed with which entities are put on and taken off the blacklist has meant that there are thousands of changes every year. Add this challenge to the fact that federal, state and local agencies throughout the US have begun to enforce sanctions violations, and the result has been a raft of over-compliance, de-risking and broader confusion about the best way forward for almost any institution with international exposure.

Katsoulis: There are a number of challenges that companies typically face in their efforts to comply with sanctions regulations. These include ensuring compliance with multijurisdictional laws and requirements, which often differ in scope, balancing the compliance requirements against the need to generate revenue as quickly as possible, especially during difficult economic times, and conducting thorough due diligence processes on potential business partners or transactions in certain countries, where language barriers, lack of available online resources or applicable data privacy regulations create problems. As sanctions laws become increasingly complicated, so do these challenges and the compliance risks they pose for companies.

Contini: Paradoxically, the relaxation of US sanctions against Iran and Cuba presents new compliance challenges. Based on how these developments are being reported in the press, one might get the impression that these countries are now totally open for business. As a consequence, many companies are experiencing significant internal expectations and pressure to move as quickly as possible and not to fall behind the competition. In such an environment, business personnel often want to go into these markets full-speed ahead and may be resistant to calls for restraint from lawyers or compliance personnel. However, both Iran and Cuba are still subjects of comprehensive US trade embargoes, and the new authorisations issued by the OFAC and Bureau of Industry and Security (BIS) contain specific requirements that must be satisfied.

Barnhill: Two areas that come to mind are conducting comprehensive screening and due diligence, and ensuring that personnel know and understand the effect of US sanctions regulations on their activities, particularly the restrictions related to facilitation. With respect to comprehensive screening, companies can face challenges in tracing the ownership of the parties with whom they do business for purposes of determining whether any of those entities may be subject to sanctions under the 50 percent rule applied under US sanctions programmes. This can be particularly challenging in certain regions, where ownership information may not be easily accessible. Additionally, the restrictions under US sanctions on facilitation remain an important compliance issue facing companies and, in particular, global companies which have subsidiaries outside the US for which the compliance or legal functions are centralised in the US or companies located outside the US with US employees.

FW: Have you observed any significant movement in terms of recent enforcement trends? How aggressively are regulators pursuing companies alleged to have violated sanctions rules? Can you highlight any recent examples?

Antonini: In the UK, the government late last year announced the establishment of the Office for Financial Sanctions Implementation (OFSI), a new governmental body that will be responsible for the enforcement of financial sanctions in the UK. This signals a willingness of the UK government to be tougher on the enforcement of financial sanctions, especially as it has referred to the enforcement system in the US. The UK government has also announced that it intends to legislate to increase penalties for violations of financial sanctions.

Katsoulis: We have not observed any significant changes in the enforcement of sanctions laws globally. We routinely receive inquiries from certain government enforcement agencies in relation to specific products, shipments or countries – typically in relation to Iran and most recently Russia – but we have not noticed any significant change in this respect. That said, there is certainly a practice – especially by US enforcement agencies – of actively enforcing sanctions against certain countries, in particular Iran, Cuba, Syria and Sudan, as evidenced by the multiple enforcement cases during the last three years, some of which have resulted in record fines, especially for the banking sector.

Barnhill: By all accounts, it appears that OFAC is continuing to aggressively pursue companies and individuals who violate US sanctions. OFAC regularly publishes notices of enforcement actions and civil settlements for violations of US sanctions. The penalties associated with these enforcement actions vary from the tens of thousands of dollars to the millions. In January 2016, OFAC announced that it reached a civil settlement valued at $140,400 with a California company and its UK subsidiary related to violations of the Cuban Assets Control Regulations arising from activities by the UK subsidiary. Additionally, in February 2016, OFAC issued a Finding of Violation to a US company related to facilitating the export of goods to Sudan by coordinating and supervising shipments of goods from Egypt to Sudan. While that case did not involve a monetary penalty, it does send a message that OFAC is continuing to take a broad view of its jurisdiction and is paying attention to those situations in which companies may not be involved directly in a transaction but facilitate that transaction in some way.

Contini: In 2009, a $536m fine imposed against a foreign financial institution for violations of the US sanctions was the largest sanctions penalty in history. Now, that case barely registers in the top 10, and foreign financial institutions have become a regular target of sanctions enforcement actions and penalties. $536m starts to look like small change when compared to $1.45bn in 2015, $2.29bn in 2012, and $8.96bn in 2014. Part of the reason for this impressive increase in penalties is that it’s not just OFAC imposing these fines. Other federal and state agencies are getting in on the game. For instance, the $8.9bn fine included a $2.24bn payment to the New York Department of Financial Services and a $508m payment to the Federal Reserve.

Mebane: Given the recent global focus on sanctions compliance by regulators, the movement we have seen with respect to the embargoes has been coupled with increased enforcement. In 2015, Schlumberger Ltd agreed to plead guilty and pay a $237m penalty for conspiracy to violate trade sanctions with Iran and Sudan. This monetary penalty is the largest seen related to violations of the International Emergency Economic Powers Act (IEEPA). The US Justice and Commerce Departments reported that a US-based subsidiary of Schlumberger violated IEEPA, which bans most trade with Iran and Sudan, by providing oilfield services through foreign subsidiaries between 2004 and 2010. The US nexus was established when employees based outside of the US sent communications to persons based within the US justifying the services in Iran and Sudan.

Pride: Enforcement has always been a relatively predictable arena. When enforcement uncovers violations in a company, that entire industry tends to be subject to higher scrutiny. When the HSBC violation was announced, it was appropriate for everyone in the banking industry to look into their own operations and identify where they have possible violations because the enforcement agents aren’t far behind.

Smith: While the pace of sanctions enforcement in the US has fallen off slightly over the past year or so, this was a function in part of the unsustainable pace and severity of some of the penalties seen in the past 24 months, punctuated by a nearly $9bn fine against BNP Paribas, as well as the normal lifecycle of enforcement agencies, many of which have been undergoing personnel changes at senior levels. Despite this, the trends remain clear: all agencies have continued to aggressively enforce against companies that have violated sanctions rules.

FW: What penalties might a company face if it is found guilty of breaching sanctions?

Smith: In the US, sanctions regulations at the federal level are governed by criminal statutes. As such, wilful violation can lead to imprisonment. Much more common, however, are civil penalties which can run to the billions of dollars, and substantial follow-on costs associated with reputational risk, loss or suspension of operating licences, and the requirement to hire a long-term monitor to assure compliance going forward. The situation in the EU is more complicated because sanctions are promulgated in Brussels but implemented in the member states. As such, there is a patchwork of authorities and comparatively limited enforcement action across the Union, even in more active jurisdictions like the UK and Germany.

Mebane: Responding to a sanctioned country violation or regulatory inquiry is very invasive to a company’s operations and requires, among other things, payment of attorneys’ fees, employees’ participation in witness interviews, and comprehensive data preservation and collection efforts. And, a company could face severe penalties if found guilty of breaching sanctions regulations, including criminal and civil prosecutions, significant monetary fines, debarment, monitoring by an independent third party and reputational damage.

Pride: In the US, penalties can be criminal and administrative. Under the Export Administration Regulations (EAR) criminal penalties can reach 20 years imprisonment for individuals and $1m per violation, or five times the value of the exports. This can add up quickly if there are multiple violations. Civil penalties can reach $250,000 per violation and violators may also be subject to denial of their export privileges. A denial of export privileges prohibits a person from participating in any way in any transaction subject to the EAR. Furthermore, it is unlawful for other businesses and individuals to participate in any way in an export transaction subject to the EAR with a denied person. Other potential sanctions include debarment from US government procurements.

Antonini: The penalties that a company may face will largely depend on the enforcing jurisdiction. In the US this can amount to significant fines ranging from thousands to several billion dollars. Individuals, such as directors and managers, may even get prison sentences. In the UK, fines can also be high, but generally will not be higher than a couple million pounds. Prison sentences are also possible in the UK, but are not as common as in the US. However, this may change in the near future.

Barnhill: Companies face substantial penalties in connection with violations of US sanctions. Penalties vary based on whether a violation is civil or criminal, as well as by the relevant sanctions programme. For criminal violations of the IEEPA, fines of up to $1m per violation and imprisonment for up to 20 years can apply. Civil penalties for violations of IEEPA can be of up to $250,000 or twice the value of the transaction that was the basis of the violation. For violations of the Trading with the Enemy Act, which currently applies to the Cuban sanctions only, civil penalties of up to $65,000 for each violation may apply.

Contini: For most of the US sanctions programmes, civil penalties can reach up to $250,000 per violation or twice the value of the transaction, whichever is greater, or for wilful violations, up to $1m per violation or, for individuals, 20 years’ imprisonment, or both. The US government may also revoke a company’s export privileges. In many cases, however, a company’s greatest concern is the reputational harm that may accompany a sanctions violation. OFAC and BIS publish information on enforcement cases on their websites, which serves in part to ‘name and shame’ the violators.

Katsoulis: In practice, much depends on the circumstances of each case: which countries, parties and products were involved, what was the end-use of the products concerned, was it a wilful or negligent violation, had the company committed any prior violations, does the company have a trade compliance programme in place, had training been provided to the employees concerned, was a voluntary self-disclosure submitted, and so on. Historically, US penalties have been at a higher level than those of most other countries around the world but other jurisdictions are slowly catching up.

FW: What advice can you offer to companies if they become subject to a regulatory enquiry or investigation? How should they go about defending allegations of breaching sanctions laws?

Mebane: First, it is imperative for a company to gain control of the situation itself and ensure, to the extent you can, that the alleged conduct is not continuing to take place. Second, determine who should conduct the internal investigation. Depending upon the severity of the allegations, most companies should consider an independent investigation directed by the company’s audit committee or other board committee that has these governance responsibilities. Third, ensure that the resources engaged are experienced within the relevant jurisdictions of the alleged misconduct and maintain the requisite experience to effectively and efficiently respond to the scope of the inquiry. Lastly, it is important to highlight that these steps are certainly not comprehensive; rather, they are guiding principles to help establish a framework for companies responding to these types of matters.

Antonini: It is important for companies that are subject to a regulatory enquiry or investigation to cooperate fully with the authority in question. If real violations are identified before a regulatory enquiry or investigation takes place, it may be wise to make a voluntary disclosure. If, however, this only comes up during an enquiry or investigation, the company should address this head on, and try to settle with the authority in question. If there is no breach, but there is an enquiry or investigation, it is important to show that all the necessary due diligence was taken, that the correct checks are in place, and that there are regular training programmes. In case there has been a breach, these may also be mitigating elements.

Contini: Of course, companies should certainly consider all of the relevant facts and circumstances before responding or agreeing to a request from the US government related to possible sanctions violations. In general, however, it is beneficial to the company to cooperate with any US government investigation of possible sanctions violations, as the potential penalties are high and the US government has tremendous discretion in applying them. This includes considering signing an agreement tolling, which means suspending, the five-year statute of limitations while the enforcement action is open.

Katsoulis: There are a few steps that companies should take. Engage your legal department early on in the process, collect and secure all relevant documents and talk to all employees or third parties that may be involved. Determine whether you need to engage external legal counsel, and involve your marketing or corporate communications department, depending on the seriousness of the case and the likelihood that this could be made public. Ultimately, the best defence against any suspected breach is to demonstrate that the company understands the relevant risks, has put in place an effective compliance programme to mitigate such risks, consistently conducts an appropriate level of transactional due diligence, and has implemented a robust auditing and record-keeping process.

Pride: The most effective way to defend against allegations of breaching sanctions laws is by having a robust trade compliance programme. Clerical errors can happen and are defensible if you have a compliance programme. Lack of a corporate compliance statement, policies and procedures will put a company at risk for penalties. Companies with an effective compliance programme can voluntarily disclose sanction violations without further action if they can prove that the appropriate controls are in place to prevent future violations.

Smith: The situation across jurisdictions differs. In the EU, for instance, there are arguably 28 different strategies, depending on which of the EU’s 28 states is pursuing an action. The situation in the US is clearer, even with the advent of enforcement from non-federal authorities. OFAC remains the preeminent agency in this regard and its enforcement guidelines make it clear that if enquiries or investigations have begun, substantial benefits exist for voluntary self-disclosure (VSD). Though there are considerations to analyse, VSD can be the difference between a formal finding of a violation and not, and between a minimal imposed penalty and a substantial one, including the potential referral of the matter for criminal proceedings to the US Department of Justice.

Barnhill: One important first step is to work with counsel – internal, external or both – to ensure that you have a complete understanding of the underlying facts and circumstances giving rise to the enquiry or investigation. This includes gathering relevant documents, speaking with involved personnel, and implementing appropriate corrective actions. Companies may also face additional challenges in connection with government investigations following the issuance by the US Department of Justice of the Yates Memorandum in September 2015, which changed the landscape for companies seeking to gain cooperation credit in connection with civil and criminal investigations by US government authorities.

FW: In your experience, what are the key requirements of a robust, company-wide sanctions compliance programme? What initial steps should companies take to ensure they are not dealing with prohibited entities, or supplying, shipping or insuring prohibited goods?

Katsoulis: Any compliance programme should be tailored to the company’s culture, products and business operations and take into account any specific regional or local legal requirements. As a minimum, any such programme should include several elements. These include active senior management commitment, effective policies and procedures that are communicated to all employees in the same way, transactional screening and controls, and product classification and licensing. They also include regular training to employees and third parties, risk-based auditing, as well as escalation and disclosure process. In simple terms, the ‘know your products and your customers’ principle should play a key role in the day-to-day activities of any company and the message from senior management should be that compliance cannot be sacrificed in the interest of revenue. Companies should therefore invest time and resources to review their product portfolio, business partners and logistics routes, establish the appropriate IT systems to support any compliance requirements, educate their employees and conduct periodic reviews.

Barnhill: Comprehensive screening of all business partners, including customers and suppliers, is an indispensable part of any robust sanctions compliance programme. Companies need to do their due diligence so that they can be comfortable that they are not dealing with any prohibited entities or sanctioned destinations. This includes gathering information about ultimate ownership of such business partners, so that companies can be more confident they are not dealing with an entity that is subject to US sanctions because it is owned 50 percent or more by one or more sanctioned persons or entities.

Smith: While it may seem trite, the rise of sanctions has underlined the necessity for robust due diligence for corporations. OFAC does not provide detailed guidance with respect to what sort of due diligence is sufficient. Indeed, OFAC civil violations are ‘strict liability’, which means that even if due diligence is best-in-class, an error is a violation. However, OFAC does say that the first step in determining what sort of compliance programme makes sense is a detailed risk assessment by the company to see what their exposures might be. Clearly, a company that is involved in few transactions and even fewer cross-border dealings will have less risk than a firm with substantial transaction flows, a significant portion of which are cross-border. Once that assessment is done, companies, usually working with outside consultants or lawyers, can assess the best means to limit their risks.

Antonini: It is vital for companies engaging in international trade to have a robust internal compliance system in place, which should be reviewed and reassessed on a regular basis. While having IT systems in place is, of course, essential, it is equally important to regularly train and inform staff of the compliance policy in place. This should be complemented with folders or handbooks with detailed instructions. A compliance officer should be available for staff to turn to with any questions they may have. Finally, it is crucial that the identity of customers is always verified, and companies should be especially diligent when screening new customers. Finally, extensive records should always be kept in order to be in a position to demonstrate that reasonable steps were taken to ensure compliance.

Pride: A robust trade compliance programme involves people, processes and systems. Your employees, customers and suppliers must be informed of the sanctions regimes and risks. Simple awareness can prevent a major lapse from occurring. Your new employee training should include an overview of sanction regimes. And your code of conduct should also explain the sanction regimes and the employee’s responsibility for complying with trade compliance. You should implement compliance policies and processes to train key personnel on the importance of complying with sanctions. Equally important is implementing systematic controls to identify transactions involving sanctioned countries and entities. The system should enable a review of all potentially sanctioned activities and then provide the ability to block or refuse sanctioned requests.

Contini: We have identified five essential ingredients of corporate compliance which apply to sanctions compliance programmes, in addition to other types of compliance programmes such as anti-bribery. The first is leadership at the highest levels of the company, which can be evidenced through measures such as a statement issued by the CEO to all employees setting out the company’s commitment to compliance with trade sanctions. Second is risk assessment, to set the foundation for a sanctions compliance programme that is tailored to the company’s key risk areas. Third is standards and controls, including screening processes and sanctions compliance clauses to include in agreements. Fourth is training and communication, such as a baseline training for all employees and more targeted training for personnel likely to encounter sanctions compliance issues. The final ingredient is monitoring, auditing and response, to keep the sanctions compliance programme up to date and responsive to the company’s current needs.

Mebane: Establishing and maintaining internal controls relevant to your business operations are vital for an effective compliance programme. Certain key, tactical principles provide for a strong sanctions compliance programme. First, assess a company’s exposure through a risk-relevant operational review that will allow you to identify opportunities for improvement in your sanctions compliance. Second, implement business relevant policies, procedures and systems that complement your company’s operational model and mitigate risk. Third, perform due diligence on key business partners that may pose the highest risk to your company to ensure there is no connection to a sanctioned party. Fourth, perform mock challenge or table top activities to develop an approach should your company encounter a potential sanctions violation. Finally, strive to ensure all relevant data is maintained pursuant to data retention requirements.

FW: How important is it for companies to enhance their internal checks and controls regarding economic sanctions? Generally speaking, should companies do more to regularly evaluate their supply chains and trade operations?

Contini: Even the best internal checks and controls may become outdated due to changes in a company’s business or compliance structure, a company’s commercial priorities, or the sanctions requirements themselves. When caught up in day-to-day compliance demands, it can be difficult to take a step back and reflect on whether the company’s trade sanctions checks and controls are still working the way they should. Gap assessments involving the review of current sanctions compliance policies, procedures and resources are a great tool to assess whether the company’s internal checks and controls sufficiently address the company’s current risk profile or whether they need to be updated or changed.

Barnhill: Regularly assessing a company’s compliance programme and incorporating updates is critical to ensuring that a compliance programme is successfully implemented. Compliance programme assessments can be accomplished in a variety of ways, depending on the organisation and risk areas of the particular company. Such assessments should be both substantive, to ensure that the compliance programme reflects any updates to the underlying regulations, and procedural, to ensure that personnel are aware of and follow the applicable corporate processes. A company can have an outstanding compliance programme on paper, but if it is not accessible to and regularly used by personnel, it will not be effective. Structuring a compliance programme so that personnel in all aspects of the business take ownership of their responsibilities related to sanctions compliance can be an important part of ensuring that compliance is fully incorporated into the fabric of the business.

Katsoulis: Sanctions laws change frequently, so it is important for companies to be kept up-to-date on any developments, evaluate any impact on their business and adapt their processes accordingly. Compliance with sanctions laws should be dynamic and never static. As a result, any internal procedures and controls should be regularly re-evaluated and adapted, as necessary. Trade and sanctions regulations may affect various departments and functions alignment within an organisation, which often surprises employees.

Mebane: Businesses must implement appropriate controls to address economic sanctions and take a risk-based approach when doing so, and the US government looks to multinational corporations to ensure its transactions do not involve a sanctioned entity. As a result, it is imperative that companies maintain a robust framework for detecting and preventing these types of engagements from occurring. This includes identifying operational areas that pose the most risk, understanding business partner organisational make-up and changes, maintaining data that will allow for risk analytics to be performed, and conducting periodic compliance assessments so that gaps can be quickly identified and effectively remediated.

Smith: It seems that sanctions authorities are increasingly looking at backend processes and systems of control in determining if a sanctions violation is a true breach and if a penalty is warranted. Looking at often-hidden aspects of businesses, or the non-customer facing aspects, is a key part of this effort, which makes it important for companies to focus as much attention on the sanctions compliance behind the scenes as it does on the forward facing aspects of its business.

Pride: Having systematic controls to prevent release to restricted persons, sanctioned and embargoed countries is very important, especially for companies with a high volume of transactions, a diverse product line or operations in countries with higher risk profiles. That said, we’ve seen many requests from sanctioned countries for consumer products. An end-to-end review of each supply chain within a company is essential to identify potential opportunities for sanction violations.

Antonini: Firms should never underestimate the importance of being aware of export issues when moving any information or goods to foreign partners or third parties, whether sensitive or not. The mere sharing of particular information by telephone or other electronic means with foreign partners may be sufficient to violate export controls. If firms do not tread carefully, they risk severe reputational damage, as well as administrative and even criminal sanctions, depending on the jurisdiction concerned. A further aspect that is often overlooked is that, regardless of whether violations of export controls are detected, such violations may very well be a deal breaker in possible future mergers or acquisitions.

FW: Would you urge companies to raise staff awareness and conduct sanctions training? What role can in-house counsel and the legal team play in this area?

Pride: We would absolutely urge companies to raise staff awareness and conduct sanctions training. A simple mistake can result in significant penalties, including restriction of export authorisation. In-house counsel can play a role in communicating the importance of sanctions awareness and training to senior management. Should a potential violation occur, it’s equally important to bring in external counsel that specialises in global trade compliance because corporate law does not teach the intricacies of global trade compliance.

Contini: Companies should aim to provide at least a baseline training to all staff, including training for new hires and periodic training for other staff. Staff in functions that are more likely to encounter sanctions compliance issues, such as salespeople with territories that cover sanctioned countries, should receive more targeted training. It may be appropriate for the legal team to conduct these more targeted trainings in live sessions, both to underscore the importance of the training and also to establish a point of contact between the business and those charged with compliance responsibilities.

Antonini: Today, companies cannot afford not to conduct sanctions and other export control training sessions. While this is an area that is often overlooked, it should be as important as for instance training and compliance with respect to competition law. In-house counsel should make management aware of the issue and the risks that surround it, which can be significant. In-house counsel can also be the central point within the company overseeing the sanctions training, making sure it is up to date, and being the go-to person for any inquiries of management and staff with respect to sanctions and other export controls.

Katsoulis: Sanctions laws are becoming increasingly complicated and may impact the activities of various departments within an organisation. Regular training is therefore a key part of any good compliance programme and its importance cannot be emphasised enough. Any such training must, however, be effective and not conducted just for the sake of training or in order to satisfy an internal procedure or requirement. Training should be simple, practical and tailored to the relevant region and the company’s products and operations, as well as to the recipient’s day-to-day duties in order to maximise its effectiveness.

Smith: Many enforcement agencies look at staff awareness and training in determining whether an offending company ‘gets it’ or not, and thus whether a significant penalty is due. Robust, in-person, and regularly updated and repeated training is imperative in order to receive the benefit that enforcement agencies may be willing to give. In house counsel – whether or not the compliance function reports through them – are an important piece of this effort. They are uniquely placed to speak to the legal risks associated with sanctions and they should play a fundamental role in helping to design sanctions compliance programmes and deliver them such that recipients understand not just what they need to do to stay in compliance, but why it is so important that they do so.

Mebane: Companies need to be compliant with international regulations. In order to facilitate this it is critical for employees to receive sanctions training. The training should clearly explain the appropriate and ethical conduct required when conducting business. You may consider providing online sanctions training to all employees and supplement that education with in-person compliance training for key employee groups such as finance and logistics, to highlight sanctions risk that they may face in their roles with the company. Typically, in-house counsel and compliance professionals provide this training; however, it is as important to have business leadership championing these efforts, as well as the overall compliance messaging.

Barnhill: Awareness of sanctions by personnel at all levels is a great first line of defence against potential violations. A company can have a great compliance programme, but if the personnel who are engaging in the business transactions don’t understand how it applies to them and why it’s important, the company won’t have an effective programme. Training that is targeted for different functional areas within the company can be the key to ensuring strong awareness.

FW: When evaluating potential business partners, suppliers or customers, what specific sanctions-related checks do companies need to make? Is it prudent to obtain suitable warranties to support their own due diligence?

Barnhill: Comprehensive screening is always important. This includes obtaining information, where available, regarding the ownership structure of those business partners, suppliers or customers. Obtaining warranties from business partners, suppliers and customers is also good practice. Even with warranties, it is also important for companies to ensure that they are thoroughly vetting and evaluating those parties, particularly if they engage in business activities in areas with risks of diversion to sanctioned destinations or they regularly sell items to distributors or resellers.

Contini: Companies should always follow their usual Know Your Customer or other due diligence processes, which often provide a good foundation for identifying sanctions concerns, and screen against all applicable restricted parties lists. Applying a risk-based approach, the company’s screening programme should consider shareholders – note that an entity owned by one or more Specially Designated Nationals (SDN) is itself treated as an SDN, even if it is not identified on the SDN List. However, these efforts may not always be enough, as some sanctions programmes impose restrictions on counterparties that might not be caught through standard due diligence and screening efforts.

Mebane: It is important to assess your industry’s risk landscape and company’s customers and other business partners to determine what may constitute an adequate compliance programme that mitigates risk. There is no single sanctions compliance approach that is relevant across all companies, but there are common principles companies should consider. First, evaluate the scope of international business activity to determine the likelihood of sanctioned country risk. Second, identify products, services or other business activity that could involve a sanctioned country. Third, be familiar with all third parties that may be involved in the activity related to providing the goods or services for which you are engaging. Finally, frequently screen new transactions and accounts for restricted or blocked persons and entities.

Smith: As a general rule, a company with any significant international exposure should probably think about investing in a screening solution. This can vary from low tech, in which a company would ask some of its personnel to run checks themselves using publicly-available sources, to very high tech, in which a company could develop sophisticated screening software and processes internally, or outsource it to one of the several well-known companies in the space.

Antonini: Warranties are important, but they are not sufficient for businesses to rely on. Companies should do their own due diligence and find out what they can about the companies they are dealing with, their management and shareholders. They should screen these against sanctions lists of the EU and the US. Depending on the country they are dealing with, they should be more or less vigilant. Dealing with an Iranian or Syrian company of course raises more red flags than dealing with a Canadian company.

Katsoulis: Typically, most companies tend to screen their business partners against various lists of denied or restricted parties, either manually or in an automated way. Sanctions laws have become so complicated that companies are also required to look into the ownership structure of their business partners in order to determine any connection with any denied or restricted party. This is also often done in connection with anti-bribery due diligence. Regardless of the methods and type of due diligence performed by a company, it is important to keep in mind that any evaluation of business partners should not be a ‘one-time’ exercise but instead be performed at regular intervals to account for changes in sanctions regulations.

Pride: All potential business partners, suppliers, customers and employees should be screened to ensure that their activities do not violate export sanctions. We had one example of a customer’s employee contacting eTrade to purchase company stocks only to be told that they were a national of a sanction country and could not buy company stock. That employee developed the company’s controlled technology and required an export licence to work.

FW: How should companies go about tracking and reacting to ongoing changes in international sanctions?

Smith: Most serious sanctions bodies – the US, the EU, the UN and the UK – have listservs to which companies can subscribe that pushes all changes to them the moment they become live. This is the only way to stay truly current. Unless there is robust training by the company, however, just staying informed will not be sufficient to ensure the company stays compliant. Retaining outside sanctions expertise has become increasingly important to allow companies to navigate the thicket of changing regulations and expectations.

Antonini: It is important that at least one individual within the company, for instance an in-house counsel, keeps close track of changes in international sanctions. This can be done by monitoring sanctions related legislation and announcements coming from the US and the EU. When there are changes in international sanctions, companies should re-evaluate their compliance programmes and determine whether these need to be amended or updated.

Katsoulis: The good news is that there is an abundance of freely available information and resources nowadays in relation to regulatory changes, so there’s no excuse for ignorance. In most cases, companies are made aware of upcoming changes through third party or government communications, attendance in government-sponsored or private seminars, notifications via professional social media, regular review of related government websites, or through the employees’ network of contacts. The challenge here is actually finding the time necessary to digest the information and properly evaluate its impact on ongoing or future company operations.

Mebane: Your compliance personnel must remain knowledgeable of sanctions regulations. They must anticipate ways in which a new market, customer or transaction could affect your company’s compliance with trade regulations and implement the appropriate remediation measures. They must also remain flexible to adapt to economic sanctions and how they may affect operations and business strategy going forward. Engaging in benchmarking discussions with other companies within your industry is a way to track ongoing changes to international sanctions. This type of interaction will also allow you to gauge and balance your company’s reaction to industry-specific sanctions risks.

Barnhill: An important first step is to closely monitor the information that is issued by agencies. This includes formal regulatory materials as well as informal guidance materials. When there are changes to the regulations, it is imperative that companies assess the scope of those changes and, in particular, the sanctions that may remain in place. Understanding what hasn’t changed with respect to the sanctions landscape is often just as important as understanding what has changed.

FW: How do you envisage the economic sanctions landscape unfolding over the coming 12 to 18 months? What trends and developments do you expect to see?

Katsoulis: We expect Iran to dominate the agenda as more companies will be interested in doing business there and regulators will be keen to enforce the applicable rules rigorously. Cuba, Russia and Syria will most likely continue to be targets of enforcement activity and the general expectation is that the number of enforcement cases and level of penalties for violations will continue to increase. As far as US companies are concerned, the Yates memo, which was issued by the US Department of Justice in September 2015, may influence potential disclosures as companies will seek to obtain the maximum benefits from any disclosure while balancing corporate vs. individual liability issues.

Pride: We expect the complexity of complying with sanctions regimes to become more complex. In the past, you would screen a transaction against a list of sanctioned countries. Recent sanctions were against regions within countries and blocking entire countries created significant order backlogs. Some recent sanctions require knowledge of any owner of the company that owns 50 percent or more of the company so they can be screened against sanctioned entity lists. It’s not getting any easier.

Barnhill: In the coming months, we will likely continue to see companies focusing on how they can best take advantage of the recent changes to US sanctions affecting Cuba and Iran. However, this likely will not happen overnight. Certain questions still remain regarding the extent of certain activities which are authorised as a result of the loosening of certain sanctions, and I expect we will see guidance being issued as companies try to understand and apply those changes to their business. Because broad restrictions continue to apply under these sanctions regimes, we may also see more companies seeking guidance or requesting specific authorisation to engage in certain activities.

Antonini: We expect to see an increase of businesses interested in dealing with Iran. The difficulty will lie in determining how far these companies can go. If they are purely non-US companies, it will be much easier for them to deal with Iran. Non-US entities controlled by US companies may be more reluctant, as they will face higher risks. US companies, finally, are not in position to deal with Iran. Another element that we expect to come to the forefront again once the dust surrounding Iran settles is that Russian sanctions will once again come in the spotlight. Russia is now strongly pushing for its sanctions to be removed. Especially in Europe, certain policymakers are also starting to call for an end to, or at least a re-evaluation of, Russian sanctions. The US is, however, more wary in this respect.

Mebane: It is difficult to predict what our sanctions environment may look like in the next 12 to 18 months, especially as we witness sweeping changes to the geopolitical environment. For example, we will see initiatives to change the current embargoes depending upon which political party is elected president in the US. Moreover, conducting business internationally will not become less complex. However, given the historic activity we have seen over the last several months, especially with respect to Cuba and Iran, one could predict that those embargoes will continue to be modified in furtherance of commercial engagement. Companies evaluating business opportunities in a sanctioned country will continue to encounter difficulty determining market success.

Smith: While the situation was already complicated, ever since mid-January 2016 when sanctions on Iran were radically overhauled, in light of Tehran’s successful completion of its initial nuclear commitments under the nuclear deal it concluded with the international community in July 2015, we have seen a whole new level of complexity that will likely only continue over the next 12 to 18 months. Even apart from Iran, very complicated EU, US, Canadian, Australian and Norwegian sanctions programmes on Russia remain, and in the US programmes on Burma and Cuba have been fundamentally eased but there remain substantial challenges.

Contini: Further relaxation of the US embargo against Cuba seems inevitable. The embargo cannot be lifted entirely without action by Congress, which there has not yet been the political will to do. There are some hints that this could change, but I’m not exactly holding my breath on that happening in the next 12 to 18 months. What I think will happen, however, is a continuation of the pattern of periodic changes to OFAC’s and BIS’ regulations to issue new and expanded general licences and licence exceptions authorising new business activities in Cuba. In particular, it seems likely that the restrictions on travel to Cuba will continue to be eased. Depending on which party looks slated to win the next presidency, there could be a lot of pressure for President Obama to make these changes sooner rather than later.

Kerry Contini is of counsel in Baker & McKenzie LLP’s Outbound Trade Practice Group in Washington, DC. Ms Contini focuses her practice on export controls, trade sanctions, and anti-boycott laws. This includes advising US and multinational companies on trade compliance programmes, risk assessments, licensing, review of proposed transactions and enforcement matters. She works regularly with companies across a wide range of industries, including the pharmaceutical/medical device, oil and gas, and nuclear sectors. She can be contacted on +1 (202) 835 6100 or by email: kerry.contini@bakermckenzie.com.

Beth Pride, as president of BPE Global, brings over 25 years of operational expertise in global trade and international logistics to assist BPE Global clients to develop their global trade strategies. Ms Pride offers subject matter expertise in brokerage, import operations, export operations and the development and maintenance of global supply chain security programmes. She also has extensive experience in establishing global trade organisations, developing global trade strategy and implementing global trade automation solutions. She can be contacted on  +1 (415) 845 8976 or by email: beth@bpeglobal.com.

Megan Gajewski Barnhill counsels foreign and domestic clients on regulatory matters related to international business transactions. Specifically, Ms Barnhill advises clients on regulatory issues related to international trade, including US export controls, economic sanctions, anti-boycott, registration and reporting under the Foreign Agents Registration Act (FARA) and anti-corruption. She can be contacted on +1 (202) 508 6302 or by email: megan.gajewskibarnhill@bryancave.com.

Adam M. Smith is of counsel in the Washington, DC office of Gibson, Dunn & Crutcher LLP. As an experienced international lawyer, he focuses on international trade compliance and white-collar investigations, including federal and state economic sanctions enforcement, the Foreign Corrupt Practices Act, embargoes, and export controls. Mr Smith also frequently chairs the Treasury delegation to EU/G7 consultations regarding Russia sanctions and negotiated with EU institutions and member states to implement coordinated measures. He can be contacted on +1 (202) 887 3547 or by email: asmith@gibsondunn.com.

Adrian Mebane is vice president and deputy general counsel for The Hershey Company. Leading the company’s global Legal Risk Center of Excellence, he is responsible for addressing high impact risks in the global ethics and compliance, regulatory, litigation and intellectual property practice areas. Mr Mebane also works collaboratively with and is a trusted adviser to executive leadership, senior management, the audit and finance & risk management committees and the board of directors. He  can be contacted on +1 (717) 534 7673 or by email: amebane@hersheys.com.

Renato Antonini is a partner at Jones Day LLP where he focuses on EU trade and WTO laws relating to trade protection measures and dispute settlement. He has extensive experience in EU and Italian customs and export control law and has assisted clients in many EU and BRIC trade defence investigations, such as antidumping, antisubsidy and anticircumvention investigations. He also advises clients in tariff classification, customs valuation, dual-use goods and sanctions. He can be contacted on +32 2 645 14 19 or by email: rantonini@jonesday.com.

Konstantinos Katsoulis is a senior manager, global trade compliance at PerkinElmer where he is responsible for monitoring developments in global trade regulations, rulings, policies and guidelines. Mr Katsoulis provides training to senior and site management, business units and external partners, and acts as the primary liaison with regulatory and government authorities. He is also the primary escalation point for all trade regulatory issues globally, including investigation and legal assessment of potential violations of trade regulations. He can be contacted on +32 (0)2 717 79 17 or by email: konstantinos.katsoulis@perkinelmer.com.

© Financier Worldwide

THE PANELLISTS

Kerry B. Contini

Baker & McKenzie LLP

Beth Pride

BPE Global

Megan Gajewski Barnhill

Bryan Cave LLP

Adam M. Smith

Gibson, Dunn & Crutcher LLP

Adrian Mebane

The Hershey Company

Renato Antonini

Jones Day LLP

Konstantinos Katsoulis

PerkinElmer