When the assessed penalty = the base penalty

There is a bit of mystery surrounding yesterday’s penalty against a Turkish trading company. First, there isn’t much information on the company to start with, which honestly could answer one of the bigger questions. But to be assessed the penalty, they must have a U.S. presence or tenuous connection to our jurisdiction. That is perhaps the most unclear part, but given its a trading company they could very well have a small office in New Jersey that handles a bunch of import/export. This is pure conjecture however.

What is striking about the penalty is that the entity was “assessed” the statutory maximum. I say assessed because it appears from the enforcement notice that the company did not settle nor did they cooperate with OFAC, a mistake on their part.

OFAC assesses penalties based on enforcement guidelines. If a violation has occured that OFAC wishes to pursue, they may issue a pre-penalty notice (“PPN”) to the alleged party, which most likely happened in this case. The party then has 30 days to respond in writing, state their case and attempt to settle with OFAC. Of course, OFAC can and will extend the time allotted for a settlement if you reach out to them in good faith. Generally, it is during the settlement process that companies are able to negotiate down the penalty amount. Likewise, if an institution settles with OFAC then OFAC will generally only issue a settlement and not a finding of violation that explicitly declares that the institution has violated sanctions. It’s always been my opinion that because OFAC posts settlement agreements, whether there was a direct FOV or simply a settlement then the cat is already out of the bag. But I think the objective of a settlement is a reduced fine and to show the public that you cooperated with OFAC, not squabbling over legal syntax. The entire process can be seen in 31 CFR part 501 Appendix A(iv)(c). If you haven’t gone over this part of the CFR, you are doing your compliance program a disservice.

In this case, it seems that the violator either made no attempt to settle, respond to the PPN or their attempt to settle was in such bad faith that a settlement was not possible. This is why the penalty was an assessment and not a settlement.

Another point found here is that the penalty was for the statutory maximum allowed under IEEPA. Yikes. I haven’t seen a case like that in a while.

Penalties are done on a sliding scale matrix. I pulled the figure below straight from part 501’s appendix. Essentially, on the horizontal, OFAC is looking to see if the penalty was egregious or resulted from reckless actions. In the most basic context, was this a simple mistake that yielded no harm to sanctions or was the transaction conducted by a sophisticated institution that was either acting recklessly, had knowledge of the action and resulted in harm to the sanctions program?


OFAC risk matrix


Some of the factors are the expected ones, and OFAC will take into consideration whether the compliance program was sophisticated at the level of the entity(i.e. a large bank needs to have a very good program), whether there was knowledge of the violation by senior management, what corrective actions were taken, how cooperative the institution was, etc. Winding up in the egregious category will result in the full penalty applicable for the program while the non-egregious side will result in a base penalty set forth in part (i)(b) of the appendix.

The other side of the scale is for voluntary-self disclosures. While the entire topic of penalties may be a multi-series post, so would tackling a voluntary self-disclosure. However, if you disclose a violation before OFAC finds out about it, you get to put a 50% off sticker on your settlement agreement. So if the base penalty would have been $100 , you are now looking at a $50 fine instead. This process has saved institutions millions of dollars and it is important to have a mechanism in your compliance program to detect any possible violations that may have slipped through the crack. It’s also obvious that by disclosing to OFAC, they will view this as cooperative and will help to reduce any penalty should they pursue that course of action. Disclosing after someone has already blocked a wire and reported it to OFAC will not count as a VSD.

But all this discussion is really academic in the case of the Finans penalty (a dollar to the first person who can teach me how to pronounce the full name of the company). It is quite evident that they not only were uncooperative, but actively sought to check every single box in the egregious and reckless category. As a result, each transaction cost them a quarter of a million dollars. It is very rare to see OFAC go so hard on a company, but these guys most likely deserved it.

Lessons to be learned? Cooperate? Have a program? OFAC will catch up?