OFAC's Enforcement Action page is almost exclusively reserved for settlements and Civil Monetary Penalties… almost. There have been, since Mr. Watchlist has been publishing, only about 2 or 3 Findings of Violations published – all intended to teach regulated firms a lesson about regulatory expectations. In fact, according to OFAC's Fall Symposium, Findings of Violations are the least common result of an investigation…
So, one of BMO Harris' merger partners, Marshall & Illsley Bank (M&I), made 6 funds transfers totalling about $67,000 just prior to the merger that violated Iranian sanctions.
Here's the behavior – negligent rather than overt – that is the subject of the lesson OFAC wants us to learn:
Between February 3, 2011 and March 10, 2011, M&I Bank originated six funds transfers totaling$67,357 on behalf of its customer, a company specializing in carpets that included the word“Persian” in its name (the “Company”), for the purpose of paying an outstanding balance owedto an Iranian entity located in Iran for the purchase of Iranian-origin carpets. The Company hadbeen a customer of M&I Bank since 2009, at which time the importation of Iranian-origincarpets from Iran or a third country to the United States was authorized under a general license(formerly § 560.534 of the ITSR). M&I Bank stated that it added the Company to the bank’s“False Hit List” on May 29, 2009, after its OFAC interdiction software generated multiple alertsdue to the word “Persian” in the Company’s name. OFAC revoked the general license for theimportation of Iranian-origin carpets in § 560.534 of the ITSR effective September 29, 2010;however, M&I Bank did not remove the Company from the False Hit List or implement anyadditional measures to prevent or identify possible violations involving the Company.
On February 3, 2011, M&I Bank processed a funds transfer for the Company. A downstreamfinancial institution stopped the funds transfer and requested additional information from M&IBank regarding the transaction. An M&I Bank staff member subsequently obtained informationshowing that the Company had initiated the funds transfer to pay an Iranian national residing inthe United States for an outstanding balance owed to an Iranian entity located in Iran for thepurchase of Iranian-origin goods. The M&I Bank staff member failed to escalate the transactionto the Corporate Compliance Department, however. M&I Bank subsequently processed fiveadditional funds transfers on behalf of the Company that violated the ITSR.
And, in case you didn't get the hint, the Enforcement Information concludes with:
This enforcement action highlights the particular sanctions risks associated with failing toimplement proper procedures and controls to ensure that internal proprietary sanctions lists areproperly reviewed following changes to the SDN List and/or to the sanctions programsadministered by OFAC.
Not only did OFAC issue this Finding of Violation, they also published specific guidance about the use of these “false hits” lists (republished in its entirety):
False Hit Lists Guidance
U.S. persons are responsible for developing appropriate risk-based controls to enable compliancewith the regulations administered by the Office of Foreign Assets Control (OFAC). Sanctions-related screening is often a valuable tool in enhancing compliance controls. U.S. persons, includingfinancial institutions, frequently conduct sanctions screening of customer databases and/ortransactions (e.g., funds transfers, trade finance, and other products) as part of their complianceprogram, which can assist in detecting individuals or entities on OFAC’s List of SpeciallyDesignated Nationals and Blocked Persons (the “SDN List”) or prohibited transactions involvingcountries, regions, or activities subject to OFAC sanctions. U.S. persons may choose to utilizesanctions screening to enhance existing controls as part of a risk-based program designed to complywith the rules and regulations OFAC administers.
In the course of developing or maintaining a sanctions screening program, U.S. persons sometimesdevelop a “false hit list” comprised of individuals and entities whose characteristics trigger ascreening match to one or more entries on the SDN List or other sanctions criteria, but who, after athorough review, are determined not to be SDNs, blocked persons, or affiliated with a country,region, or activity subject to OFAC-administered sanctions. In the case of software screening tools,once an individual or entity is added to the false hit list, the screening software typically willsuppress an alert (or will otherwise bypass an alert) associated with the individual or entity, therebyeliminating any transaction hold on, or prompting further manual review of, such parties in theabsence of other alerts.
While false hit lists represent a common and legitimate practice, and are generally designed toreduce the volume of OFAC-related matches that a U.S. person has determined are false, it isimportant that each U.S. person implement policies and procedures designed to review, evaluate,and reassess the parties that are included on such lists.
Given the dynamic and changing environment of U.S. economic sanctions programs, thesemeasures could include:
-
Involving sanctions compliance personnel in developing guidelines for, and oversight of,the functioning of false hit lists, including periodic reviews;
-
In situations where additions or changes to an SDN List entry are similar to a false hit listentry, ensuring that alerts generated by screening hits in connection with the additions /changes to the SDN List are not automatically suppressed by the existing false hit list entry;
-
Amending the false hit list, as needed, in response to updates to OFAC’s sanctionsprograms (including, for example, the revocation of general licenses, the implementation ofnew sanctions programs and/or prohibitions, or enhanced restrictions on certain categoriesof transactions); and
-
For direct customers who have an entry on a false hit list, ensuring that any meaningfulchanges to the customer’s information (e.g., a change in ownership status, business activity,address, date of birth, place of business, etc.) trigger a review of the false hit list entry.
Links:
OFAC Guidance on False Hits Lists
Posted with BlogsyFiled under: Enforcement Actions, Iranian Sanctions, OFAC Updates
