Minimising sanctions risks in M&A

February 2021  |  FEATURE  |  MERGERS & ACQUISITIONS

Financier Worldwide Magazine

February 2021 Issue

In recent years, the risks of criminal and civil enforcement against companies for regulatory breaches have continued to proliferate, including in the M&A context. Even prior to the outbreak of COVID-19, the stakes were perhaps never higher for companies buying or selling a business; however, the pandemic has dramatically altered the business landscape and raised the risk level. One area where companies operating in the ‘new normal’ must seek to minimise their risk when pursuing an M&A deal is sanctions compliance.

When planning a merger or acquisition, one of the most important steps a company can take is to enlist the help of the compliance department as soon as possible, to aid in minimising or avoiding liabilities. Too often, compliance personnel are often not engaged early enough in the transaction process.

In addition, some acquirers are too quick to rely on generic, high-level due diligence that fails to drill deep enough into the risks presented by a particular target, including the markets in which it operates, the customers it does business with, and the kind of culture it has fostered – especially when it comes to winning new business.

In 2019, the US Treasury Department’s Office of Foreign Assets Control (OFAC) raised its expectations for conducting appropriate pre- and post-acquisition due diligence on target companies, especially those located outside the US. As a consequence, acquirers should plan to carry out comprehensive risk-based due diligence, quickly remediate compliance control gaps, and self-report in an accurate and timely fashion.

But since OFAC published its ‘Framework for OFAC Compliance Commitments’, the COVID-19 crisis emerged as an unforeseen challenge which presents new risks to many companies. Due to the crisis, many businesses have had to scale back their operations, manage a remote workforce and meet changing client demands. Precious resources have been reallocated and compliance departments have found themselves feeling the strain.

Although OFAC has indicated that it will take into account resource constraints imposed by COVID-19 when evaluating sanctions violations, the pressure on businesses to remain compliant with sanctions regulations has not significantly dropped. “OFAC expects companies to conduct a risk assessment of the threats or vulnerabilities in their business that could lead to non-compliance,” explains David Glynn, of counsel at Holland & Hart LLP. “Conducting such a risk-based review, documenting findings and implementing effective controls addressing each risk area may be the best way to ensure the company remains in the good graces of the regulators. However, when issues are identified, including shortfalls in a company’s compliance programme, self-reporting through OFAC’s voluntary self-disclosure process is a significant factor in maintaining a favourable relationship with the regulators,” he adds.

Another area of concern is successor liability under the Foreign Corrupt Practices Act (FCPA). “OFAC generally applies successor liability with respect to M&A,” notes Mr Glynn. “This, coupled with the understanding that OFAC violations are considered strict liability offences, means acquiring companies need to conduct sanctions due diligence to avoid issues post-acquisition. Specifically, the key areas of sanctions risk to be considered as part of the due diligence process are ongoing activities with sanctioned parties or in sanctioned countries, past activities with sanctioned parties or in sanctioned countries, activities with entities 50 percent or more owned by listed parties, the existence and adequacy of sanctions compliance policies and procedures, and the target’s internal sanctions expertise.”

For companies hoping to avoid sanctions and liabilities, outside experts are key to assessing the significance of the target’s responses to sanctions due diligence and quantifying the exposure. They can spot areas of significant sanctions risk presented by the target’s business and formulate measures to mitigate it. They can also prepare voluntary self-disclosures and work with OFAC personnel to negotiate a resolution to potential violations.

“If the acquisition target has existing sanctions liability, outside counsel can provide guidance on the advisability of a voluntary self-disclosure and assist in developing and implementing effective corrective actions and crafting a thorough and convincing disclosure report,” says Tahlia Townsend, a partner at Wiggin and Dana LLP. “Outside counsel can also act as a force multiplier to boost the internal resources needed to swiftly and effectively develop and implement compliance procedures for the acquired entity and audit compliance to those procedures on a regular basis, until it is clear that the parent’s compliance procedures have taken root at the acquired entity.”

Since regulatory compliance, including sanctions compliance, continues once a deal has completed, compliance officers must ensure that both companies’ corporate policies and procedures are successfully integrated. Post-acquisition due diligence must also be carried out. Once the deal has closed, the acquirer will have full access to the target company and its inner workings – access which may not have been available pre-transaction.

“A number of recent enforcement actions imposed significant penalties on US acquirers for failing to validate, post-acquisition, that acquired foreign entities had actually followed instructions not to engage in business with US sanctions targets,” warns Ms Townsend. “Simply flowing down the policy and holding remote training sessions is not enough to protect US parent companies from the risk that newly acquired foreign subsidiaries will engage in or continue business with targets of US sanctions.”

During the M&A process and beyond, acquirers need to ensure that sanctions risks are adequately addressed. Considering the challenges of COVID-19, they need to develop efficient, cost-effective, risk-based compliance processes capable of meeting regulatory demands.

© Financier Worldwide

BY

Richard Summerfield