Sanctions Update│July 16, 2019 │PDF
This analysis was first appeared as a guest piece in Money Laundering Watch, published by the law firm of Ballard Spahr LLP. View the original here.
OFAC’s Expanded Sanctions Reporting Rules
The expanded reporting rules apply to financial institutions, businesses, nonprofits, individuals, and foreign entities owned by U.S. persons. Foreign banks reliant on U.S. correspondent services should also take note.
On June 21, 2019, the Office of Foreign Assets Control (OFAC) issued an interim final rule (the “IFR”) amending provisions of the Reporting, Procedures, and Penalties Regulations applicable to OFAC-administered sanctions programs at 31 C.F.R. Part 501. The IFR became effective upon publication in the Federal Register on June 21. OFAC has requested public comments, which are due by July 22, 2019.
In addition to effectuating technical and conforming amendments, the IFR revises Trading With the Enemy Act (TWEA) penalties and amends reporting requirements and procedures applicable to initial and annual blocked property reports, unblocked property reports, and the unblocking of funds due to mistaken identity. Additionally, the IFR revises reporting requirements applicable to “rejected transactions.” The rejected transactions amendment is the most substantial of the revisions, and is the focus of this update.
“Rejected Transactions” Reporting: Additional Compliance Obligations for Financial Institutions; New Compliance Obligations for Businesses, Nonprofits, Individuals, and Foreign Entities Owned or Controlled by U.S. Persons
The most consequential revision made by the IFR is at 31 C.F.R. § 501.64, now titled Reports on rejected transactions. Previously titled Reports by U.S. financial on rejected funds transfers, pre-amendment § 501.604 was effective from August 1, 2016 to June 20, 2019. OFAC stated in the IFR that, by amending § 501.604, it was “clarifying the breadth of the existing requirement for reporting on rejected funds transactions.” But as the title change indicates, the June 21 amendment did more than clarify. The revised rule effectuated two significant changes. First, rejected transaction reporting requirements now apply to all “U.S. persons,” rather than only to financial institutions. Second, reportable “rejected transactions” are no longer limited to “funds transfers.”
- In Addition to Financial Institutions, U.S. Business Organizations, Nonprofits, and Individuals, As Well As Foreign Entities Under U.S. Ownership or Control, Must Report Rejected Transactions. As of June 21,“[a]ny U.S. person (or person subject to U.S. jurisdiction), including a financial institution, that rejects a transaction” that, while not blocked, would nevertheless violate sanctions regulations if processed or engaged in, must report the rejected transaction to OFAC within 10 business days. This language significantly expands rejected transactions reporting obligations to parties and activities within and outside of the United States, as follows.
- All “U.S. Persons” Must Report. Under pre-amendment § 501.604 only U.S. “financial institutions” were required to report rejected “funds transfers.” As of June 21, all “U.S. persons” must report. The change is expansive. Across OFAC-administered sanctions programs, the term “U.S. persons” means U.S. citizens and lawful permanent residents (wherever located); entities organized under the laws of a U.S. jurisdiction (and their foreign branches); and, any foreign person in the United States. (See, e.g., Iranian Transactions and Sanctions Regulations at 31 C.F.R. § 560.314; Ukraine Related Sanctions Regulations at 31 C.F.R. § 589.312).
- Foreign Entities Owned or Controlled by U.S. Persons Must Report. Amended § 501.604 also requires foreign persons “subject to U.S. jurisdiction” to report rejected transactions to OFAC. The term “persons subject to U.S. jurisdiction” is generally understood to include foreign corporations, partnerships, associations, and other organizations owned or controlled by U.S. individuals, companies, and other “U.S. persons.” (See, for example, Cuban Assets Control Regulations at 31 C.F.R. §515.329).
It has been generally understood that foreign subsidiaries of U.S. companies have been required to comply with OFAC sanctions regulations when specifically required to do so by a particular sanctions program. The default rule is that foreign subsidiaries of U.S. companies are not required to comply. (See, e.g., OFAC FAQs, No. 11). If, as its text suggests, amended § 501.604 incorporates the definition of “person subject to U.S. jurisdiction” contained elsewhere in OFAC sanctions regulations or otherwise requires reporting by U.S.-owned or controlled foreign entities, the amended rule effectuates a substantive change to sanctions regulations, beyond reporting. Foreign entities owned or controlled by U.S. persons are now required by rule to not only report rejected transactions, but to reject transactions in the first instance (as may have been extrapolated ad hoc from prior OFAC enforcement action). Thus, for example, a French company owned or controlled by U.S. persons would be required to reject and report a sanctions-prohibited transaction benefitting a party in a country subject to comprehensive sanctions (namely Cuba and Iran at the present time).
Substantial Expansion of Scope of Reportable Rejected Transactions
Pre-amendment § 501.604 required financial institutions to report to OFAC rejected “funds transfers.” As of June 21, the scope of reportable rejected transactions extends well beyond “funds transfers.” Under amended 501.604, “the term transaction includes transactions related to wire transfers, trade finance, securities, checks, foreign exchange, and goods or services.”
The definition of “transaction” is even broader than it might first appear. First, the transactions enumerated in the definition are illustrative, not exhaustive. Second, the definition covers transactions both in and “related to” the enumerated transactions. Third, with the exception of “wire transfers” (and perhaps to a lesser extent “foreign exchange”), the listed transaction types can be construed to encompass a vast range of activities. For example, “trade finance” might include receivables financing, documentary credits, and open account financing; transactions related to “securities” arguably include activities beyond the purchase and sale of “securities” (a term broadly defined under U.S. law, namely the Securities Act of 1933); and, transactions in and related to “goods or services” conceivably subsume most, if not all, transactions.
Rejected Transactions Reports Now Require Greater Detail
OFAC’s revision to the rejected transactions regulation requires reporting parties to state with greater specificity the legal basis for rejecting transactions. Prior to the June 21 amendment, financial institutions were required to “state the basis for” rejecting funds transfers. As of June 21, reporting parties are required to state in reports the “legal authority or authorities under which the transaction was rejected,” such as references to specific OFAC-administered sanctions programs or provisions of OFAC sanctions regulations. As discussed below, the specificity required by the amended rule should be considered in assessing the compliance burden imposed by the IFR.
In addition, reports of rejected transactions must include, among other information:
- a description of the transaction;
- the identities of parties “participating in transaction” including “customers, beneficiaries, originators, letter of credit applicants, and their banks”;
- names of intermediary, correspondent, issuing, and advising or confirming banks;
- a description of the property “that is the subject of the transaction”;
- account or reference numbers;
- the identities of “associated sanctions targets” (g., sanctioned parties who are not direct or disclosed parties to a transaction);
- the actual known or estimated value of the transaction;
- a “narrative description” of the “value of a shipment” related to “rejected trade documents” (g., letters of credit); and,
- copies of transaction documentation, such as bills of lading, invoices, or “other relevant documentation received in connection with the transaction.”
Parties newly required to report rejected transactions to OFAC should take steps to align their documentation and recordkeeping practices with amended § 501.604.
Revised Rejected Transactions Form
OFAC has revised its rejected transactions form, the use of which remains voluntary. The revised form, titled Report on Rejected Transaction, retains its pre-revision form number TD-F 93.07, and is available at the Treasury Department’s website. Parties that choose to not use the rejected transactions form must nevertheless provide all information required by amended § 501.604. OFAC has estimated that the time required to complete a report of a rejected transaction is one half hour (0.5 hours). This estimate appears to be optimistic, or perhaps assumes that reports will be completed only by highly experienced filers or automation. As discussed below, parties submitting comments on the IFR should address its associated compliance burdens.
FOIA and Public Disclosure: Legal and Non-Legal Considerations
Reporting and licensing submissions made to OFAC are subject to the Freedom of Information Act (FOIA), and amended § 501.604 contains new language clarifying FOIA’s applicability. Information provided to OFAC in and with reports of rejected transactions (along with reports pertaining to blocked property and specific license applications) will generally be released by OFAC upon the receipt of a “valid” FOIA request, “unless OFAC determines that such information should be withheld in accordance with an applicable FOIA exemption.” (See, e.g., 31 C.F.R. §§ 501.603 (blocked and unblocked property), 501.604, and 501.801 (licensing)).
Parties submitting reports (or licensing applications) to OFAC, as well as those mentioned in reports (such as foreign intermediary banks), should be mindful that information about their specific transactions, customers, and business generally is subject to public access. They should bear in mind also that the public disclosure of information can create reputational and other commercial risks, or collateral legal risks, such as where reports submitted to OFAC contain information having evidentiary or other value to third parties (e.g., businesses, individuals, or enforcement authorities other than OFAC).
Issues for Foreign Banks Reliant on U.S. Correspondent Services, De-Risking Context
Given the importance of correspondent (or intermediary) banking to trade and other cross-border transactions, foreign banks that rely on U.S. correspondent services have an indirect interest in understanding OFAC’s amended rejected transactions rule. For example, foreign banks that appear in rejected transaction reports that yield information about sanctions violations (including sanctions evasion) or other financial crimes should understand that such information is now more likely to be readily available to OFAC (and, potentially, to other enforcement authorities, such as the Financial Crimes Enforcement Network (FinCEN, also a part of the Treasury Department)).
Considering the stifling climate of de-risking, foreign banks seeking to avoid new or further withdrawals of correspondent banking relationships—whether driven by commercial or legal motives—should take steps to adapt recordkeeping and documentation practices to avoid disruptive actions by U.S. banks in response to rejected transaction reports.
Substantive and Compliance Burden Issues for Public Comment
Given the substantive scope and wide applicability of amended § 501.604, as well as some of its ambiguities, parties with interests in submitting comments on the IFR should formulate comments that invite clarification of the amended rules and provide practical input as to the burden of compliance with the IFR. Select issues for comment might include the following.
When Must a Transaction be Rejected and Reported by a Non-Financial Institution?
Amended § 501.604 provides a non-exhaustive list of potentially reportable rejected “transactions,” but the regulation does not elaborate on the meaning of “rejected.” In contrast, pre-amendment § 501.604 included examples of “rejected transfers,” such as “making unauthorized transfers from U.S. persons to Iran or the Government of Iran” or “crediting Iranian accounts on the books of a U.S. financial institution.” Moreover, under the prior § 501.604, the point at which a financial institution would have been in a position to “reject” a “funds transfer” was fairly clear (such as upon rejection of an instruction to process a prohibited funds transfer).
Amended § 501.604 is not as straightforward, and its language leaves open questions. For example, does a U.S. company have a reportable rejected transaction if it declines an unsolicited offer to sell U.S. goods to persons in Iran? Is the receipt and rejection by a U.S. company of an unsolicited offer a reportable rejected “transaction,” or does a “transaction” require the existence of a signed contract, or something more than an unsolicited (or solicited) offer? U.S. businesses, nonprofits, and individuals should seek clarification as to when a reportable rejected transaction comes into existence.
Compliance Burden; Administrative Law
Because amended § 501.604 and the other revisions made by the IFR involve information collection, the IFR (and associated reporting forms) are subject to the Paperwork Reduction Act of 1995 and review and approval by the Office of Management and Budget’s Office of Information and Regulatory Affairs (OIRA). As the revised rejected transactions rule creates additional compliance obligations for U.S. financial institutions and new compliance obligations for non-financial institution U.S. persons, the burden of compliance merits close attention. Among other issues, public comments should address the following issues.
Compliance Burden for U.S. Businesses, Nonprofits, and Foreign Entities “Subject to U.S. Jurisdiction”; Potential Conflicts of Law for Foreign Entities Owned or Controlled by U.S. Persons
Compliance burdens for non-financial institutions will vary, depending, for example, on industry, international engagement, size, and compliance infrastructure. U.S. businesses and non-profit organizations, as well as foreign entities owned or controlled by U.S. persons, should assess the upfront and continuing time and financial costs of compliance with the IFR, including for compliance education and training (internally or externally sourced), software, recordkeeping, and staffing.
In addition, foreign entities owned or controlled by U.S. persons, along with their U.S. owning or controlling parties, should assess if and how OFAC’s rejected transactions reporting requirement intersects or potentially conflicts with applicable laws of the foreign jurisdictions in which they are organized or operate.
Additional Compliance Burdens for U.S. Financial Institutions.
U.S. financial institutions (including the U.S. branches, agencies, and offices of foreign financial institutions) should consider whether their existing sanctions compliance software and systems are capable of capturing and feeding into reports to OFAC the information required by amended § 501.604. If not, financial institutions should consider the costs of compliance, such as for adapting or acquiring applications or software.
In addition, financial institutions should assess the extent to which their compliance or other responsible personnel are equipped to accurately identify specific OFAC sanctions programs or regulatory provisions in support of rejected transactions, as required by the amended rule. The compliance burdens associated with citing specific sanctions programs or regulations are also relevant to assessing OFAC’s amended rule on blocked property reporting, which is at 31 C.F.R. § 501.603 and states that “the term ‘SDN’ is generic and cannot be used to identify the legal authority for blocking property.”
Submission of Comments to OFAC and/or the OIRA
Comments on the substantive sanctions provisions of the IFR should be submitted to OFAC, by mail or through the Federal eRulmaking Portal, in accordance with the instructions provided in the IFR published in the Federal Register.
Comments on the compliance burdens associated with the IFR should be submitted to the OIRA as instructed in the IFR. OFAC has invited comments on the compliance justification and burdens associated with the IFR, including “the accuracy” of its “estimate of the burden of the collection of information” and the “estimated capital and start-up costs of the operation, maintenance, and/or purchase of services to provide information.”
For more information about this publication or at MassPoint Legal and Strategy Advisory PLLC’s related services, contact Hdeel Abdelhady at habdelhady@masspointpllc.com or +1.202.630.2512.