The settlement: $91,172.29 (what’s with the pennies?). The base penalty: $364,689. For over 6500 violations of the Cuban Assets Control Regulations (CACR) – voluntarily self-disclosed and non-egregious, which reduced the penalty from the maximum of $600,601,408 to 1/2 the value of each transaction. As OFAC says, this action relates to “payments related to guests traveling for reasons outside of OFAC’s authorized categories as well as a failure to keep certain required records associated with Cuba-related transactions.”
What Airbnb Payments did
Pursuant to communications with OFAC, Airbnb Payments conducted a forensic review based on an approved and statistically significant sampling of “Stays” (i.e., traveler lodging provided by Airbnb, Inc. “Hosts”) and “Experiences” (i.e., traveler activities provided by Airbnb, Inc. Hosts) transactions involving Cuba. By extrapolating the results of that sampling review to the total transactions processed by Airbnb Payments between September 28, 2015 and March 1, 2020, it was determined that Airbnb Payments processed payments related to 3,464 extrapolated Stays transactions in Cuba by Airbnb, Inc. “Guests” traveling for reasons outside of OFAC’s 12 authorized categories.1 The extrapolated average transaction amount processed for each such Stay was $139.52. Airbnb Payments also processed payments related to 3,076 extrapolated Experiences transactions where Airbnb Payments failed to keep records in accordance with the OFAC’s regulations. The extrapolated average transaction amount processed for each such Experience was $78.40. Airbnb Payments also processed payments related to 44 confirmed transactions involving non-U.S. persons engaging in Cuba travel transactions on Airbnb, Inc.’s platform prior to OFAC issuing a specific license to Airbnb, Inc. to engage in such conduct. The average transaction amount processed for those transactions was $111.09. As a result, Airbnb Payments processed payments on behalf of customers on Airbnb, Inc.’s platform in apparent violation of the Cuban Assets Control Regulations (CACR), 31 C.F.R. § 515.201 and § 515.572(b) (the “Apparent Violations”).
These Apparent Violations occurred primarily because Airbnb, Inc. launched its Cuba business in April 2015, which would eventually extend to a global customer base, without fully addressing the complexities of operating a Cuba-related sanctions compliance program for internet-based travel services. As Airbnb, Inc. launched its services in Cuba following regulatory changes announced by the U.S. Government in January 2015, the scaling up of its services in Cuba appears to have outpaced the company’s ability to manage the associated sanctions risks via its technology platforms, leading to some of the Apparent Violations. For example, when Airbnb, Inc. first launched in Cuba, Airbnb Payments used a manual process to screen Hosts and Guests for potential sanctions issues until Airbnb Payments was able to implement a customized Internet Protocol blocking system designed to permit Cubans to act as Hosts on Airbnb, Inc.’s platform while simultaneously preventing Cubans from transacting as Guests on the platform. Similarly, the recordkeeping Apparent Violations related to the Experience transactions were primarily due to technical defects involving an older version of the Airbnb, Inc. mobile application that remained operational for Cuba-related travel. The older version of the application did not maintain complete functionality for Guests to make an attestation regarding their reason for travel to Cuba.
Airbnb Payments ultimately discovered the Apparent Violations after proactively initiating a comprehensive review of its sanctions compliance program. Airbnb Payments then voluntarily reported to OFAC the results of its review and lookback and implemented subsequent remedial measures designed to strengthen its sanctions compliance program and prevent recurrences. Additionally, throughout its engagement with OFAC, Airbnb Payments fully cooperated with OFAC, including by responding to multiple requests for information and agreeing to toll the statute of limitations.
And the footnote about permitted Cuba-related travel:
Travel-related transactions are permitted by general or specific licenses for certain travel related to the 12 categories of activities identified in § 515.560(a). Those travel-related transactions permitted by general license, subject to specified criteria and conditions, include: family visits; official business of the U.S. government, foreign governments, and certain intergovernmental organizations; journalistic activity; professional research; educational activities; religious activities; athletic competitions by amateur or semi-professional athletes or athletic teams; support for the Cuban people; humanitarian projects; activities of private foundations or research or educational institutes; exportation, importation, or transmission of information or information materials; and certain authorized export transactions. For additional information, please see Frequently Asked Questions 695-722.
Aggravating and Mitigating Factors in OFAC’s Calculus
OFAC determined the following to be aggravating factors:
(1) Airbnb Payments’ apparent violations took place following a change in foreign policy with respect to Cuba in 2015 and associated modifications to the CACR that maintained certain specified restrictions. Airbnb Payments’ apparent violations with respect to Stays and Experiences, which related to the restrictions that were maintained as part of the CACR changes, undermined U.S. foreign policy towards Cuba at the time the violations occurred; and
(2) Airbnb Payments is a large and sophisticated U.S.-based technology company.
OFAC determined the following to be mitigating factors:
(1) Airbnb Payments has not received a penalty notice or Finding of Violation from OFAC in the five years preceding the earliest date of the transactions giving rise to the Apparent Violations;
(2) By proactively initiating a comprehensive review of its sanctions compliance program, and voluntarily reporting its findings to OFAC, Airbnb Payments provided substantial cooperation in connection with OFAC’s investigation into these Apparent Violations; and
(3) Airbnb Payments has represented that it undertook significant remedial measures to address its sanctions compliance deficiencies and as part of its settlement with OFAC has agreed to implement additional sanctions compliance commitments designed to minimize the risk of recurrence of similar conduct in the future, including:
o An IP blocking regime to account for issues related to permitting individuals located in Cuba to act as Hosts on Airbnb, Inc.’s platform, while simultaneously preventing such persons from transacting as Guests on the platform;
o The collection of country of residence and payment instrument information, in order determine whether users are nationals or residents of Cuba;
o The screening of Hosts in Cuba to ensure that no Hosts are Cuban government officials or communist party members, and also conducting manual checks to ensure that no listings are associated with the Cuba Restricted List;
o Requiring Guests that book a Stay or Experience to complete an attestation prior to completing a reservation; and
o Requiring that users listing a property in Cuba as a Host on Airbnb, Inc.’s platform to certify that the user is an independent entrepreneur.
The lesson to learn
This action highlights the risks associated with entering new commercial markets, particularly one that has elevated sanctions risks such as Cuba, without fully anticipating the complexities of legally operating in a U.S.-sanctioned jurisdiction and fully implementing appropriate sanctions compliance controls. A failure to fully implement appropriate risk-based sanctions compliance measures into a company’s infrastructure at the time of a new product launch or entry into a new business line — particularly one involving internet-based services — could lead to apparent violations of OFAC regulations. Moreover, financial institutions that are processing transactions for companies that operate worldwide, including transactions involving individuals and entities ordinarily resident in, or doing business in, countries subject to U.S. sanctions, should understand the sanctions risks associated with those services and should take steps necessary to mitigate those risks. Finally, this case also highlights the importance of proactively identifying sanctions compliance deficiencies and implementing appropriate remedial measures, as well as the benefits of voluntary self-disclosure and cooperation with OFAC.