So, what happened?
Between November 2012 and December 2015, Whitford and its owned or controlled foreign subsidiaries appear to have violated the Iranian Transactions and Sanctions Regulations, 31 C.F.R. part 560 (ITSR), 74 times when (1) Whitford’s foreign subsidiaries exported goods to Iran and engaged in trade-related transactions with Iran1; and (2) U.S.-person employees of Whitford facilitated the Iran-related business2 (collectively referred to hereafter as the “Apparent Violations”).
Whitford’s foreign subsidiaries, Whitford S.r.l. in Italy (“Whitford-Italy”) and Whitford Yuzey Kaplamalari Sanayi ve Ticaret Limited Sirketi in Turkey (“Whitford-Turkey”), historically sold coatings to Iran. After changes to OFAC’s Iran sanctions program in 2012 that prohibited U.S.-owned or -controlled foreign entities from knowingly engaging in transactions with Iran, Whitford-Italy and Whitford-Turkey continued to sell coatings to Iran. Whitford failed to comply with the new prohibitions arising from changes to the Iran sanctions program.
According to Whitford, when it realized in 2013 that Whitford-Turkey’s sales to Iran may be problematic, its Regulatory Affairs Manager (who did not specialize in sanctions compliance) incorrectly advised that Whitford’s foreign subsidiaries could legally continue selling to Iran so long as there were no direct connections between a Whitford subsidiary and Iran. After receiving this advice, Whitford’s Managing Director for Europe (a U.S. person who oversaw both Whitford-Italy and Whitford-Turkey), along with managers from both entities, developed a plan to continue selling to Iran by instructing that sales to Iran go indirectly through third-party distributors and documents related to those sales avoid referencing Iran. By adopting this plan, from approximately February 2014 through December 2015, Whitford, Whitford-Turkey, and Whitford-Italy engaged in additional Apparent Violations by selling to Iran, making payments to and receiving payments from their Iranian sales agent, and engaging in prohibited facilitation of transactions with Iran.
According to Whitford, when it became aware of Iran General License H, “Authorizing Certain Transactions Relating to Foreign Entities Owned or Controlled by a United States Person,” (issued in January 2016) and realized that its foreign subsidiaries’ transactions with Iran likely violated U.S. sanctions law, Whitford hired outside counsel to conduct an investigation, submitted a disclosure to OFAC, substantially cooperated with OFAC’s investigation, and took significant corrective actions, as further described below.
The base penalty for these 74 voluntarily self-disclosed, non-egregious violations was $1,526,508 (although OFAC loves to tell us that the statutory maximum fine was $19,953,513).
OFAC’s math – aggravating factors:
(1) With a lengthy history of foreign subsidiary sales to Iran, Whitford acted recklessly by failing to implement compliance policies commensurate with selling to a high-risk jurisdiction such as Iran and taking affirmative steps to help its foreign subsidiaries to continue selling to Iran, using indirect channels, after being warned that foreign subsidiary sales to Iran were problematic;
(2) Whitford, including its Managing Director for Europe (a U.S. person) and other senior managers, had actual knowledge of the conduct associated with the Apparent Violations and also facilitated transactions with Iran by developing a plan to continue its Iran-related business through indirect channels; and
(3) Whitford conferred an economic benefit to Iran of $3.05 million through 74 transactions over the course of approximately three years.
and mitigating factors:
(1) Whitford substantially cooperated with OFAC’s investigation by providing data analysis of the Apparent Violations, submitting detailed information in a well-organized manner, and entering into multiple tolling agreements to extend the statute of limitations.
Additionally, Whitford, through outside counsel, conducted an internal investigation without receiving an administrative subpoena and identified and disclosed the transactions that led to the Apparent Violations;
(2) Whitford has not received a penalty notice or Finding of Violation from OFAC in the five years preceding the earliest transaction giving rise to the Apparent Violations; and
(3) Whitford undertook significant remedial measures, including:
Hiring outside counsel to investigate and advise the company on sanctions matters;
Appointing an independent external compliance monitor, responsible for auditing Whitford’s compliance with U.S. sanctions and export controls, who reports directly to the Board of Directors;
Appointing an internal compliance monitor, with responsibility for executing implementation of the recommendations made by an external compliance monitor, including the corrective actions;
Making changes to Whitford’s leadership, including requesting and receiving the resignation of the Chief Executive Officer (formerly the Managing Director for Europe who was part of the plan to continue selling goods to Iran) from the Board of Directors, and appointing a new, independent member to the Board of Directors to provide additional compliance perspective and scrutiny;
Establishing annual and quarterly reporting requirements related to U.S. sanctions compliance, including certification requirements for Managing Directors at each of the company’s subsidiaries, the Chief Executive Officer, the internal compliance monitor, external compliance monitor, and the General Counsel;
Adopting a Code of Conduct that applies to Whitford and all its subsidiaries and provides an ethical and legal framework for business practices and conduct to which all Whitford employees must adhere, and includes a commitment to complying with trade compliance laws in all countries in which Whitford does business;
Adopting a new, global sanctions and export controls compliance policy that utilizes an export compliance program manual; and
Providing export controls and sanctions compliance training and establishing a central repository for compliance and training materials.
And the lesson we should take away?
This case demonstrates the importance of companies dedicating sufficient resources to U.S. sanctions compliance, staying abreast of changes to sanctions regulations, and understanding the full scope of sanctions prohibitions, especially when operating in higher risk jurisdictions. U.S. companies with foreign operations – particularly those with a history of trading with Iran – may face a myriad of sanctions risks. Sanctions compliance personnel at U.S. companies should have the appropriate technical knowledge and expertise, based on the company’s risk exposure.
As highlighted in this case, failing to develop, implement, and routinely update a sanctions compliance program can result in apparent violations. Sanctions programs and the corresponding regulations, like the ITSR, may change based on U.S. national security objectives. Failure to dedicate sufficient resources to monitor, apply, and ensure ongoing compliance with new sanctions laws may result in potential exposure to civil monetary penalties, including for activities related to foreign subsidiaries.
Sure… but let’s also remember that, while these things may seem obvious to us (especially those of us who have worked in the financial services sector), the Framework document which stresses these elements was only published in 2019. So, not knowing or making a huge effort to figure out how to properly comply is not surprising, even if disappointing.
Similarly, taking management to task as an aggravating factor for their knowledge of the violations is a little unfair. They were relying on their Regulatory Affairs Manager as an expert, and shouldn’t have been expect to know any better.
That being said, the take-away is apt. The Framework document, when talking about management commitment, discusses how management must properly resource the compliance function. That means not just getting enough people, but the right ones – with experience and expertise. It also means developing a proper program (which they approve), and investing in what is necessary to institute proper controls (e.g. technology). The Regulatory Affair Manager should have been aware of the changes to the sanctions regime, and should have been knowledgable enough to know that there was no way to continue that business with Iranian clients.
Mind you, they still might have gotten tripped up over managing their foreign subsidiaries (see last year’s actions againts Stanley Black & Decker, AppliChem GmbH and Kollmorgen Corp), but that’s a whole other story..