OFAC Enforcement Action: Bank of China (UK)

As a result of an internal investigation triggered by a Sudanese customer’s request to process a payment, BOC UK conducted a lookback review to identify potential Sudan-related transactions. That review identified two customers of BOC UK who had engaged in Sudan-related transactions that BOC UK processed through the U.S. financial system.

One of the customers was an entity incorporated outside of Sudan that maintained a branch in Sudan that, in 2014, became the instructing party and account signatory to transactions processed by BOC UK on behalf of the entity. Written communications from that customer contained references to the location of the branch in Sudan. BOC UK also processed certain transactions to recipients which appeared to be in Sudan at the time. The other customer was a Sudanese subsidiary of an entity also incorporated outside of Sudan. The information provided by the subsidiary to BOC UK as part of the bank’s know-your-customer documentation identified the subsidiary as being registered in Sudan.

In relation to both customers, BOC UK’s internal customer database did not include reference to Sudanin the name or address fields of either customer. Accordingly, SWIFT messages processed for those customers by BOC UK through U.S. banks did not include any references to Sudan.

These compliance deficiencies resulted from BOC UK’s staff’s failure to appropriately evaluate and escalate potential transactions with underlying account and transactional documentation indicating ties to Sudan. Consequently, BOC UK processed 111 payments via U.S. correspondent banks between September 4, 2014 and February 24, 2016 totaling $40,599,184 in apparent violation of the Sudanese Sanctions Regulations (SSR), 31 C.F.R. § 538.205 (“Apparent Violations”).1

OFAC determined the following to be aggravating factors:

(1) BOC UK demonstrated a reckless disregard for U.S. sanctions requirements by processing transactions through the U.S. financial system for entities in Sudan despite having account and transactional information indicating the Sudanese connection to the accounts and in contravention of the bank’s existing policies and procedures.

(2) Certain personnel processing the transactions at BOC UK were aware that the payments were related to the entities in Sudan.

(3) For at least one and a half years, BOC UK conferred economic benefit to a then comprehensively sanctioned country by processing 111 outgoing payments totaling approximately $40.6 million.

(4) BOC UK is a commercially sophisticated financial institution that processes transactions internationally.

OFAC determined the following to be mitigating factors:

(1) BOC UK has no prior sanctions history, including having not received a Penalty Notice or Finding of Violation from OFAC in the five years preceding the earliest date of the transactions giving rise to the Apparent Violations.

(2) BOC UK self-identified, and then cooperated with OFAC’s investigation into, the Apparent Violations by conducting a lookback and by entering into a statute of limitations tolling agreement.

(3) BOC UK represented to OFAC it has undertaken several remedial measures since the identification of the Apparent Violations, including:

• establishing an executive level committee responsible for implementation of compliance policies and procedures, which ultimately reports to the Board of Directors;

• conducting an annual enterprise-wide sanctions risk assessment by business line, which incorporates monitoring of risks and internal audit testing and integrates input from external consultants;

• applying a centralized customer due diligence function firm-wide to strengthen internal controls;

• customizing firm-wide staff training on sanctions compliance based on the employee’s tenure and business line; and

• enhancing policies and procedures to better address U.S. sanctions regulations applicable in processing payments through the United States.