Expedia Group, Inc. (“Expedia”) Settles Potential Civil Liability for Apparent Violations of the Cuban Assets Control Regulations: Expedia Group Inc., headquartered in Bellevue, Washington, on behalf of itself and its subsidiaries worldwide, has agreed to pay $325,406 to settle potential civil liability for assisting 2,221 persons with Cuba-related travel services prior to agency notice in apparent violation of the Cuban Assets Control Regulations, 31 C.F.R. part 515 (CACR). Specifically, between on or about April 22, 2011 and on or about October 16, 2014, Expedia dealt in property or interests in property of Cuba or Cuban nationals by assisting 2,221 persons — some of whom were Cuban nationals — with travel or travel-related services for travel within Cuba or between Cuba and locations outside the United States.
The apparent violations occurred because certain Expedia foreign subsidiaries lacked an understanding of and familiarity with U.S. economic sanctions laws and Expedia employees overlooked particular aspects of Expedia’s business that presented risks of noncompliance with sanctions. Specifically, electronically booked travel resulted from failures or gaps in Expedia’s technical implementations and other measures to avoid such apparent violations. With respect to at least one foreign subsidiary, Expedia failed to inform the subsidiary until approximately 15 months after Expedia acquired the subsidiary that it was subject to U.S. jurisdiction and law. Expedia was slow to integrate the subsidiary into the Expedia corporate family, including with respect to compliance with U.S. sanctions, and the subsidiary continued operating independently during the integration period.
The base penalty for the self-disclosed violations was $556,250. The Enforcement Information does not say if the violations were egregious, but notes that they occurred prior to agency notice. As explained in Monday’s post, the rules for Cuba-related penalties are different
The mitigating factors playing into the final penalty:
1. Expedia failed to exercise a minimal degree of caution or care in avoiding the conduct that led to the apparent violations. Moreover, based on the number of apparent violations, the length of time over which the apparent violations occurred, and the number of Expedia entities involved in the apparent violations, the apparent violations appear to have resulted from a pattern or practice of conduct.
2. The apparent violations harmed the sanctions program objectives of the CACR, based on the number of apparent violations and the length of time over which the apparent violations occurred.
3. Expedia is a sophisticated international travel service provider, providing global travel services to customers located worldwide.
And the mitigating factors:
1. Expedia has not received a penalty notice or Finding of Violation from OFAC in the five years preceding the earliest transaction giving rise to the apparent violations.
2. After discovering the apparent violations, Expedia implemented significant remedial measures to strengthen its U.S. economic sanctions compliance program throughout the Expedia corporate family, including domestic and foreign direct and indirect subsidiaries.
3. Expedia cooperated with OFAC’s investigation by submitting data analytics associated with the apparent violations, responding to OFAC’s requests for additional information, and entering to multiple tolling agreements.
And these were Expedia’s remediation steps:
Consistent with the settlement agreement with OFAC, Expedia has committed to enhancing its compliance procedures by ensuring that Expedia: (1) has a management team in place that is committed to compliance; (2) conducts regular risk assessments to ensure that Expedia’s internal controls appropriately mitigate its sanctions-related risks; (3) conducts regular testing and audits; and (4) provides ongoing sanctions compliance training throughout the Expedia corporate family. Additionally, Expedia has steadily increased its resources dedicated to compliance with U.S. sanctions, resulting in substantially more robust staffing and resources corporate-wide, and taken measures to increase compliance with U.S. sanctions, including enhanced screening methods and implementation of automated software restrictions.
And the lesson to be learned:
This case illustrates the benefits persons subject to the jurisdiction of the United States – including, with respect to OFAC’s Cuba sanctions, entities owned or controlled by U.S. persons – can realize by implementing corporate-wide compliance measures commensurate with their sanctions risks. U.S. companies can mitigate risk by conducting sanctions-related due diligence both prior and subsequent to mergers and acquisitions, and taking appropriate steps to audit, monitor, train, and verify newly acquired subsidiaries for OFAC compliance. U.S. foreign subsidiaries are subject to the CACR, and U.S. person parent companies may face potential exposure to civil monetary penalties vis-à-vis the actions of their foreign subsidiaries. Foreign acquisitions can pose unique sanctions risks, to which a U.S. person parent company should be alert at all stages of its relationship with the subsidiary.
Link: