Sanctions compliance & enforcement
March 2021 | ROUNDTABLE | GLOBAL TRADE
Financier Worldwide Magazine
March 2021 Issue
Companies across the globe face an increasingly volatile sanctions landscape in 2021. Key challenges include keeping pace with myriad changes to sanctions regimes, as well as responding to evolving Office of Foreign Assets Control (OFAC) guidance under a new US administration. In an uncertain market, compliance teams must navigate a complex web of restrictions, ensure compliance and avoid conflict with enforcement authorities.
FW: Could you outline some of the major sanctions compliance and enforcement issues companies are facing in the current market? How aggressively are regulators punishing companies which violate the rules?
Bentley: The most notable issues for 2021 will likely be further US sanctions targeting China’s actions regarding Hong Kong, Xinjiang, the semiconductor industry, and evasion of sanctions against Iran and North Korea. We may also see new US sanctions against Russia, and new US and European Union (EU) actions addressing Turkey and the country’s financial sector. US agencies continue their global leadership with enforcement actions. The US Treasury Department’s Office of Foreign Assets Control (OFAC) has traditionally targeted financial institutions, oil and gas companies, diverse manufacturers, including of medical devices, and logistics companies. However, starting in 2018, OFAC communicated publicly a desire to start pursuing a wider range of industries, which the agency’s subsequent actions have since borne out.
Fisch: Perhaps the greatest sanctions compliance challenge facing the market right now stems from the newest US sanctions programme: restrictions on transactions involving publicly traded securities of more than 40 major Chinese companies that to date the US Department of Defense (DOD) has designated as “Communist Chinese military companies”. While OFAC has issued guidance to help clarify the scope of the restrictions, several questions remain unanswered. The combination of a target as substantial as China, an industry as complex as the securities industry, a new and untested model of sanctions, and a number of open questions about the government’s implementation expectations has created a fair amount of uncertainty. Uncertainty invariably leads to significant challenges for compliance teams at financial institutions and elsewhere seeking to comply with the new restrictions. Many will be watching how the Biden administration approaches these sanctions.
Catrain: From a European perspective, I would consider three key developments that corporates need to pay special attention. First, the adoption and expansion of horizontal sanctions regimes which do not have a geographic element and will expand the scope of the screening. Second, how to apply the ownership and control test and the presumption that making available funds or economic resources to a non-designated person which is more than 50 percent owned or controlled, directly or indirectly, by a designated person will amount to making funds available to a designated person. The presumption may be rebutted where facts support the conclusion that funds or economic resources will not be channelled to, used by, or be for the benefit of a designated person. Third, the UK has adopted its own autonomous sanctions regime which requires corporates with UK activities to comply with an additional sanctions regime.
Harrison: The major issue for companies in the current market is keeping pace with change in regulatory activity. And, while there has been a slowdown in enforcement action in 2020, we expect a catchup in 2021. Keeping pace with sanctions developments and new requirements is an extreme challenge for businesses across all industries. Despite the global pandemic, the past 12 months have been characterised by a huge increase in the number of changes published. This includes OFAC’s administrative update of 490 North Korea-related targets, a full review and update of the UK’s Afghanistan asset freeze list and changes to Syria-related designations enacted by the EU, and, subsequently, the UK. But, while we have seen increasing regulatory requirements, punishment for non-compliance has slowed. For example, OFAC enforcement action dropped from 26 cases totalling $1.3bn in 2019, to 16 cases totalling $23m in 2020. We could therefore see enforcement action accelerate in 2021 as it catches up to regulatory change.
Lee: By far, the biggest sanctions compliance issue facing companies today is keeping up with the rapidly increasing pace of changes to the various sanctions regimes, as well as new presidential executive orders and OFAC guidance. As just one recent example, on 14 December 2020, the US imposed sanctions on the Republic of Turkey’s Presidency of Defense Industries (SSB), the country’s defence procurement agency, and four senior officials at the agency, for knowingly engaging in a “significant transaction” with Rosoboronexport (ROE), Russia’s main arms export entity, in procuring the S-400 surface-to-air missile system. Considering Turkey’s status as a NATO ally and the presence of US forces in Turkey, the Biden administration will almost certainly face pressures to articulate its view regarding the bilateral relationship going forward. In addition, in the last days of the Trump administration, there were a number of developments in sanctions, including a new executive order on cloud computing services. It will be a challenge to keep up with whether, how and when the Biden administration will choose to continue implementing these programmes and regulations.
FW: Could you highlight any recent, notable examples of sanctions breaches and related penalties, that should serve as a warning to others?
Fisch: OFAC continues to place greater focus on enforcement against non-financial institutions and foreign companies whose activities are subject to US jurisdiction. Among its most recent enforcement cases, in January 2021, OFAC announced a settlement with an Indonesian paper products manufacturer for exporting goods to North Korea. Although the exportations did not involve a US exporter or US-origin goods, the apparent violation that was the basis of the settlement was that the Indonesian company caused US banks to clear wire transfers related to these shipments when it directed payments to its US dollar bank account at a non-US bank. This is one of a very limited number of cases in which OFAC has targeted the non-US exporter – instead of a financial institution – for payments through the US and signals OFAC’s enforcement focus is on all players in a transaction.
Lee: On 30 December 2020, OFAC announced a settlement with BitGo, Inc., a technology company that implements security and scalability platforms for digital assets and offers non-custodial secure digital wallet management services. BitGo agreed to remit $98,830 to settle its potential civil liability for 183 apparent violations of multiple sanctions programmes. The apparent violations were processed between 10 March 2015 and 11 December 2019 on behalf of persons located in the Crimea region of Ukraine, Cuba, Iran, Sudan or Syria that were using BitGo’s non-custodial secure digital wallet management service. This settlement action illustrates the compliance and enforcement risk in the digital assets sector. This enforcement case also demonstrates that OFAC penalties and violations can occur in several different economic sectors and across a number of different platforms.
Harrison: The biggest enforcement action to come from OFAC in 2020 was against Swiss telecom company SITA, which was fined $7.8m – three times the value of the money it made providing software and services to sanctioned parties. The recent settlement with crypto firm BitGo is another interesting example, as it marks OFAC’s first ever enforcement action against a digital asset company. BitGo was fined $98, 830 for processing transactions from users located in comprehensively sanctioned jurisdictions, including Crimea, Cuba, Iran, Sudan and Syria. Both of these cases signal an increase in regulatory scrutiny outside of traditional financial services – including crypto and digital transactions, and software and IT provision – highlighting the importance of all companies having a robust sanctions compliance programme.
Bentley: Three OFAC enforcement actions in 2020 stood out in particular. First, a settlement between OFAC and Swiss IT firm SITA served as a warning that non-US technology companies must carefully assess any routing of transactions with sanctioned countries or parties through US-based servers. Second, an OFAC enforcement action against Amazon put companies on notice that they must take risk-based steps to ensure that their sanctions screening systems are properly configured to capture customer data quality issues, such as common misspellings. Companies must also engage in routine testing of screening systems to identify deficiencies. Third, OFAC announced its first enforcement action against a US digital currency company, BitGo Inc. OFAC found that BitGo had used customer IP address data to track customers for security purposes but failed to use this information to ensure sanctions compliance regarding a customer’s country of domicile.
FW: What do you consider to be the key elements of an effective sanctions compliance programme?
Bentley: The ‘OFAC Compliance Framework’, published on 2 May 2019, remains the key roadmap for any company evaluating its sanctions compliance programme. The OFAC Framework sets out five key elements: commitment by senior management, risk assessments, internal controls, testing and auditing, and training. Of these elements, arguably the concept of risk assessments can be the most nebulous and difficult to define. When issuing the framework in May 2019, OFAC noted that there is no ‘one-size-fits-all’ risk assessment. Yet the OFAC Compliance Framework also states that such risk assessments should incorporate a holistic review of an entire organisation, including customers, supply chain, products and services, and how such items fit into other financial or commercial products, services and systems.
Harrison: High-quality and timely data is the lifeblood of an effective sanctions compliance programme, ensuring businesses have all the information they need to identify exposure to sanctions risk and take decisions more quickly. Compliance teams need to ensure they have more comprehensive content sets, including visibility over ownership structures, in order to remain compliant with the OFAC 50 percent rule and its EU equivalent. Nevertheless, a stringent screening process alone is not enough; effective risk assessment is critical for sanctions compliance, and for that, organisations need to have clearly defined internal controls in place. Every person in an organisation should understand when to escalate an issue to conduct a deep dive – and the role they have to play in fighting financial crime.
Catrain: As noted in the EU compliance guidance, the scope and extent of a compliance programme depends on the size and commercial activities of the company, the strategic nature of the company’s items, geographic presence of clients and the complexity of internal export processes. In other words, a compliance programme must be tailormade for each company. The following elements set out in the EU guidance are very useful. First, the commitment of top-level management to compliance. Second, organisational structure, responsibilities and resources. Third, training and awareness raising, in a rapidly changing area of law, and corporates need to have user friendly tools to be up to date. Fourth, screening processes and procedures. Fifth, internal reviews. Finally, record-keeping. For a compliance programme to be effective, it is necessary that all of these, as well as other elements depending on the sector and jurisdiction covered, are duly combined.
Lee: Traditionally, the key elements of an effective sanctions compliance programme include effective policies and procedures, training, reporting mechanisms and investigations, third-party due diligence, tone from the top, compliance independence and resources, incentives and disciplinary measures, and periodic testing and review. In addition, it is important to be able to demonstrate that the compliance programme is ‘well designed’ according to the individual characteristics of the company, whether it is being applied earnestly and in good faith, and most important, whether the programme actually works in practice. It can be a disadvantage to have a ‘cadillac-level’ compliance programme if your company is not following it. In that case, you have demonstrated to OFAC that you certainly do know what the OFAC compliance requirements are, but OFAC may conclude that in not following them, you have engaged in intentional violations. It can be much better to have a simpler compliance programme that is followed by everyone in your organisation.
Fisch: OFAC issued guidance in May 2019 strongly encouraging US companies and foreign entities subject to US jurisdiction to implement a risk-based sanctions compliance programme incorporating five essential components: management commitment, risk assessment, internal controls, testing and auditing, and training. While all of these elements are clearly important, the cornerstone of an effective sanctions compliance programme is an adequate assessment of direct and indirect sanctions risks, including customers, products, services, supply chain, intermediaries, counterparties, transactions and geographic locations. This assessment of risk informs the level of due diligence and risk-mitigating controls that should be applied to a relationship or transaction. Strong corporate governance and a culture of compliance are also paramount to the success of a sanctions compliance programme. That includes appropriate funding of a compliance organisation and empowerment by the board of directors and senior management to effectively carry out its functions.
FW: What strategies can companies deploy to ensure they are not dealing with prohibited entities or supplying restricted goods?
Harrison: These days, complying with the regulations on sanctions against foreign entities requires much more than just checking a list of restricted companies and individuals. Businesses need to conduct comprehensive due diligence across all of their customers and third-party business partners, to ensure they are not dealing with sanctioned parties. As we have seen with the recent US EAR 744 regulation, trade compliance and import and export controls is another area that demands increased attention, as it becomes a major channel for providing capital and restricted goods to sanctioned parties. As the regulators turn their focus to the maritime trade and shipping sectors, including the banks that finance world trade and the insurers that insure cargoes, companies need to ensure they are not inadvertently facilitating illicit trade.
Catrain: Companies need robust compliance procedures. Particular attention should be given to dealing with red flags which require understanding the specific detail of the relevant law. How that law applies to the particular situation – and the corresponding derogations and licences – is vital to determine and assess risk.
Lee: A well-designed and implemented screening process is critical to ensuring that a company is not dealing with prohibited entities. It is equally important that the appropriate prohibited parties lists are included, but also that inapplicable lists be excluded so as not to ‘muddy the waters’ with irrelevant screening results. Also, it is very important for a company to adopt an appropriately-adjusted screening algorithm to capture near matches. Furthermore, it is also important to have a comprehensive compliance programme that also considers the restrictions imposed by the Bureau of Industry and Security of the US Commerce Department. This agency publishes the Entity List and other lists that restrict or prohibit the export of certain goods and technology to certain countries, individuals and companies. Failure to incorporate this aspect of screening in your compliance programme can be a costly mistake.
Fisch: Managing sanctions risks can present challenges, especially for internationally active companies, in light of the complexity of cross-border transactions and the wide range of evasion tactics used by sanctioned jurisdictions and targets. A key element of an effective sanctions compliance programme is that it should be tailored to the specific sanctions risks a company faces. Appropriate due diligence and sanctions screening, at on-boarding and periodically throughout the relationship, on parties, goods and services, and jurisdictions involved, can help mitigate these risks. Developing a strong understanding of sanctions evasion tactics and typical red flags, along with periodic training on these issues to relevant staff, can also help guard against inadvertent dealings with sanctioned parties.
Bentley: Companies should embrace four major strategies. First, it is essential for a company to maintain a strong line of sight regarding its supply chain setup and product portfolio, with particular risks being the presence of US-origin content, dual-use goods, and products considered controlled substances or critical high-technology goods. Second, a company must ensure a close collaboration between its legal and trade compliance functions. Very often legal will have detailed interactions with commercial colleagues preparing new product launches, and trade compliance needs to be involved upfront in such discussions. Third, engage in discussions with industry peers facing similar issues, such as organising an annual sanctions and export controls workshop with several companies, ensuring that legal and trade compliance personnel have opportunities to attend sanctions conferences. Finally, companies must ensure that appropriate technological solutions are implemented to better ensure sanctions compliance.
FW: To what extent are companies using technology to assist with sanctions compliance?
Fisch: Companies are increasingly using technology-based risk management solutions to assist with sanctions compliance, particularly to conduct sanctions screening and ongoing due diligence of customers and third parties. While some companies wholly outsource these compliance processes to third-party vendors, others use myriad search engines and research tools to supplement their screening, list management and due diligence processes. Companies also use tactics, such as geo-IP blocking, in an effort to prevent parties located in sanctioned countries from accessing their websites. Further, many companies use technology, such as vessel monitoring systems, to track vessels and detect attempts by companies to circumvent sanctions by manipulating vessel route data. To the extent a company outsources a part of its sanctions compliance programme, including to technology-based vendors, it is important to maintain oversight of those functions and ensure they are properly aligned with the company’s risk-based approach.
Bentley: Over the last five years, implementing a technological solution to assist with sanctions compliance has evolved from being a technological luxury option for larger multinationals, to an essential compliance system for any company conducting international business. Technological solutions integrated with a company’s enterprise resource planning (ERP) system typically focus on mitigating risk in the following areas. First, checking banks, customers and vendors against sanctioned party lists. Second, implementing automatic export blocks in the case of shipments to countries and territories subject to US comprehensive economic sanctions, such as Iran and Crimea. Third, managing export licensing requirements for shipments to countries subject to US, EU, UK or Swiss sanctions. Finally, establishing record-keeping and audit controls, not only for the purposes of sanctions and export licensing compliance, but also for participation in duty savings schemes under free trade agreements. These latter schemes can have a tremendous impact on a company’s bottom line.
Lee: In today’s environment, the sophisticated use of appropriate technology is a must. It is simply not possible to keep up with the designations and changes to the various prohibited parties lists in the US and abroad without incorporating sophisticated automated solutions as an integral part of your compliance programme. Most companies rely on third-party providers of information about sanctions targets that can provide additional information, including date of birth, photos and aliases, that can help to reduce the number of false positives. The most sophisticated companies also rely on artificial intelligence technology to assist in the resolution process. This is raising industry standards across the board, and OFAC is going to start expecting more rigorous and nuanced use of technology for all regulated companies.
Harrison: Given the high volume of designations around the globe, technology is an essential element of any sanctions compliance programme. Sophisticated screening software offers the ability to search across multiple datasets at the same time, saving both time and effort versus multiple manual searches. But the data technologies that deliver the information are equally important. With so many lists and formats, consolidated, structured data helps screening technologies to process information faster and return fewer false positives. Companies also need to consider delivery frequency. Ideally, data should be delivered several times a day, to ensure 24/7 coverage.
FW: In your opinion, do businesses need to do more to enhance their sanctions compliance framework? What advice would you offer on developing a strong, multinational sanctions programme for today’s complex regulatory landscape?
Lee: The most important thing businesses can do is review and adhere to the 2 May 2019 OFAC guidance regarding what constitutes an effective sanctions compliance programme. The document, titled ‘A Framework for OFAC Compliance Commitments’, is significant in that it represents the most detailed statement to date of OFAC’s views on the best practices that companies should follow to ensure compliance with US sanctions laws and regulations. As described by OFAC, the document is meant to serve as a roadmap for how to prevent sanctions violations from occurring in the first place and, when violations do occur, to provide greater transparency with respect to how OFAC will assess the adequacy of a company’s existing compliance programme in determining what penalty to impose. This document was published by OFAC after years of entreaties by the US regulated industry for more guidance on what exactly OFAC expects in a compliance programme. Failure to conform to these guidelines by OFAC will make it extremely difficult to persuade the agency to mitigate any civil penalties for even inadvertent violations.
Bentley: Businesses should ensure effective in-house monitoring of new sanctions and export control developments. For instance, developments over the December holidays included the US addition of a Military End User List to the Export Administration Regulations, the placement of 77 new entities by the US Department of Commerce Bureau of Industry and Security on the Entity List, and the establishment by the US Treasury Department of a Non-Specially Designated Nationals (SDN) Communist Chinese Military Companies List. The optimal way to manage these developments is by employing a specialised in-house trade legal counsel to advise the business – this is more cost-effective than relying on ad hoc legal advice from external counsel. This in-house legal counsel must be proactive in providing updates to the business and must be skilled in outlining potential commercial impacts.
Harrison: Compliance teams need to ensure that they have the fullest possible picture of their third parties. Too often we see businesses only looking at the immediate counterparty, not related parties, key controllers and ownership structures. Or they are using poor quality sanctions lists, scraped from regulators’ published lists without any additional due diligence. With the upcoming enforcement catchup, sanctions compliance is not the place to cut corners. Fuelling your sanctions or trade compliance programme with an incomplete data set means you could be inadvertently busting sanctions, running the risk of huge financial and reputational damage. If the full picture exists, regulators will have it and will expect businesses to have it too.
Fisch: Based on OFAC’s May 2019 guidance and the compliance commitments it has demanded in recent enforcement actions, it is clear that OFAC is striving to set clear, minimum sanctions compliance standards. These trends highlight the importance for companies that conduct business in or involving the US to assess whether their sanctions compliance programmes meet OFAC’s expectations and implement enhancements accordingly. Companies should keep in mind that the effectiveness of a compliance programme continues to be an important enforcement factor. While there is no ‘one-size-fits-all’ approach, a programme should be commensurate with a company’s risk profile. Strong risk assessment processes, customer and third-party due diligence, and corporate governance are paramount to a programme’s effectiveness. Depending on where a company operates, it may need to consider the impact of countermeasures from other jurisdictions, such as the updated EU blocking statute, that prohibit compliance with certain US sanctions.
FW: What are your expectations for sanctions regulation and enforcement over the coming months? Are there any particular trends you expect to unfold?
Bentley: I expect we will see several trends evolve in the course of 2021. First, OFAC will continue to diversify its sanctions enforcement beyond the financial services industry, which experienced many headline-grabbing fines over the last 15 years. One clue to the evolving enforcement priorities of OFAC can be found in the guidance documents which OFAC is increasingly publishing for particular industries. A recent example was the ‘Guidance to Address Illicit Shipping and Sanctions Evasion Practice’, following which OFAC did indeed pursue enforcement actions and sanctions listings against companies and vessels that had engaged in deceptive shipping practices with respect to Iran, North Korea and Syria. Second, we may see more OFAC enforcement actions against individuals.
Fisch: The US will likely continue to aggressively enforce sanctions against both financial and non-financial institutions. While OFAC only issued three enforcement actions against financial institutions in 2020, these low numbers are likely not an indication of enforcement slowing down, particularly given that such actions typically take years to resolve. Furthermore, while it is too early to tell, OFAC’s penalty against an individual in August 2020, a rare occurrence in the civil sanctions enforcement context, could be an indication of a renewed willingness by OFAC to pursue enforcement based on potential individual – not just corporate – liability. Finally, in line with broader regulatory and legislative developments, OFAC will likely increase its focus on cryptocurrencies and other digital assets, as seen in OFAC’s December 2020 settlement with a digital wallet service provider, the first action of its kind.
Harrison: As the UK completes its transition from EU sanctions legislation to autonomous sanctions, we are likely to see the Office of Financial Sanctions Implementation (OFSI) capitalise on the new flexibility and powers, to ensure the sanctions regime fully supports the UK’s foreign and security policy. We could also see a surge in large-scale enforcement from OFSI post-Brexit. The UK regulator made a bold statement in 2019 with the highest enforcement action to date, and we can expect a step up in action following the pandemic. Nevertheless, both sides of the Atlantic have indicated a more multilateral approach to sanctions, which will help ease some of the burden for compliance professionals. The Biden administration signals a return to multilateralism in the US. Meanwhile, the UK will likely continue to work on sanctions with key partners such as the US and the EU, as well as a wider range of partners, as it showed last year in collaborating with Canada on the global human rights sanction regime.
Lee: The big question is how the Biden administration will approach the use of sanctions as a tool to change the behaviour of rogue regimes and actors. Of interest is the statements by Janet Yellen, president Biden’s nominee for secretary of treasury, during her nomination hearing before the Senate Finance Committee. During that hearing, Ms Yellen stated that she would be ordering a review of US sanctions policy to ensure their efficacy. Also, just recently the Biden administration, in its National Security Directive on US global leadership to strengthen the international coronavirus (COVID-19) response, directed the secretaries of State, Treasury and Commerce, in consultation with the departments of health and international development, to promptly review existing US and multilateral financial and economic sanctions to evaluate whether they are unduly hindering responses to the COVID-19 pandemic. The early indications suggest that sanctions are going to be front-and-centre in the new administration.
Catrain: Corporates should consider that the EU’s new strategy to improve the implementation and enforcement of the EU sanctions regimes released in mid-January, intends to make sanctions more effective, harmonised and transparent, as well as to revamp the EU blocking regulation to address the extraterritorial impact of third-country sanctions. These elements, when developed, would greatly shape how EU persons and entities deal with sanctions compliance. Another important element to consider is the development of UK sanctions regimes now that the UK has left the EU and there is a real potential for divergence from the EU sanctions regimes. On the EU side, we would expect the first listings under the recently adopted human rights sanctions programme, and might see expanded sanctions against Turkey.
Guy Harrison is general manager of Dow Jones Risk & Compliance. Based in London, he is responsible for leading the strategic vision and growth plan for the risk & compliance business, which reached a new milestone of approximately $160m in annual revenues in fiscal 2020. He can be contacted on +44 (0)20 7365 0971 or by email: guy.harrison@dowjones.com.
Judith Alison Lee is a partner in Gibson, Dunn & Crutcher LLP’s Washington, DC office and co-chair of the firm’s international trade practice group. Ms Lee practices in the areas of international trade regulation, including US Patriot Act compliance, economic sanctions and embargoes, export controls and national security reviews (CFIUS). Ms Lee also advises on issues relating to virtual and digital currencies, blockchain technologies and distributed cryptoledgers. She can be contacted on +1 (202) 887 3591 or by email: jalee@gibsondunn.com.
As a partner in the trade practice, Lourdes Catrain has achieved milestone successes for clients on all areas of EU trade law and economic sanctions. She regularly advises companies on complex business dealings with countries subject to EU sanctions and together with the anti-corruption and white-collar crime teams conducts internal investigations and prepares voluntary disclosures to the member state authorities. She can be contacted on +32 2 505 0933 or by email: lourdes.catrain@hoganlovells.com.
Nicholas Bentley is senior legal counsel trade sanctions at Novartis. He is responsible for providing strategic and operational legal advice for all activities regarding sanctions. He also leads the cross-divisional legal trade sanctions team. Mr Bentley is based in Basel, Switzerland. He was admitted to the Ontario Bar in Canada. Mr Bentley holds a dual LL.B./Bachelor of Civil Law from McGill University in Montréal, where he specialised in international trade law and European Union law. He can be contacted on +41 79 690 98 19 or by email: nicholas.bentley@novartis.com.
Eytan Fisch is a partner in Skadden’s financial institutions regulation and enforcement group. He advises global financial institutions and multinational companies on compliance and enforcement matters, with a focus on economic sanctions, anti-money laundering, FinTech, blockchain and virtual currency matters. Prior to joining Skadden, he held a variety of senior positions at the US Department of the Treasury, including serving as the assistant director for policy in the Office of Foreign Assets Control (OFAC). He can be contacted on +1 (202) 371 7314 or by email: eytan.fisch@skadden.com.
© Financier Worldwide
THE PANELLISTS
Dow Jones Risk & Compliance
Gibson, Dunn & Crutcher LLP
Hogan Lovells International LLP
Novartis Pharma Services AG
Skadden, Arps, Slate, Meagher & Flom LLP