The extensive extraterritorial reach of U.S. economic sanctions and export controls often surprises lawyers and compliance professionals outside the United States (“foreign legal advisors”). Some have come to appreciate the scope of these regimes through their clients’ direct experiences, while others have grown attentive out of self-interest—particularly following the sweeping expansion of these rules since Russia’s full-scale invasion of Ukraine in February 2022. For clients engaged in cross-border commerce, exposure to U.S. sanctions and export control laws (collectively referred to here as “U.S. sanctions”) is not hypothetical—it is a real and often elevated risk. The degree of risk will ultimately depend on the specifics of the client’s business operations, in consideration of U.S. sanctions legal authorities and their administration.

This article provides a primer for foreign legal advisors in identifying potential U.S. sanctions risk areas in their clients’ business activities, along with key considerations for effectively addressing them and any issues that may arise. It begins with a brief overview of U.S. sanctions laws, regulations, and the agencies that enforce them.

Introduction to U.S. Sanctions and Relevant Agencies

U.S. Department of the Treasury’s Office of Foreign Assets Control (“OFAC”)—administers and enforces U.S. economic sanctions laws and regulations. As further explained in my prior article, Navigating U.S. Economic Sanctions, these legal authorities generally prohibit U.S. persons from engaging in broadly defined categories of transactions with sanctioned targets, unless authorized by OFAC or statutorily exempt. The extent of such prohibitions can range from virtually any transaction (e.g., no dealings with Iran/Cuba or with persons identified on OFAC’s Specially Designated Nationals and Blocked Persons (“SDN”) List), to more limited restrictions (e.g., no dealings in new equity or debt of a specified tenor of an entity subject to respective OFAC directive). However, as further illustrated below, these prohibitions generally extend to non-U.S. persons whose activities “cause” a U.S. person to engage in prohibited transactions (i.e., a “U.S.-nexus” is present). There are also so-called “secondary sanctions” authorities—also explored in a prior article—which enable the imposition of sanctions on non-U.S. persons for engaging in defined categories of transactions with sanctioned targets, but where there isn’t necessarily a U.S.-nexus present.

For purposes of OFAC’s regulations, the term U.S. person includes any U.S. citizen, lawful permanent resident (i.e., green card holder), entities organized under the laws of the U.S. (including their foreign branches), or any person in the U.S. (i.e., physically present). Note that OFAC’s regulations in relation to Iran and Cuba extend their comprehensive prohibitions to foreign owned or controlled subsidiaries of U.S. persons.

U.S. Department of Commerce’s Bureau of Industry and Security (“BIS”)—administers and enforces the Export Administration Regulations (“EAR”). In short, items (i.e., commodities, software, technology) subject to the EAR may require a BIS license for their export, reexport, or transfer (in-country) depending on the receiving parties to the transaction, especially the intended end-user, end-user, and/or destination. All U.S.-origin items, wherever located, are subject to the EAR. However, foreign-made items that incorporate or involve certain controlled U.S.-origin content, or that are produced involved certain specified U.S. technology or software, may also be subject to the EAR depending on their intended end-user, end-use, or destination. While about 95% of all items exported from the U.S. do not require a license, the analysis of whether an item subject to the EAR generally begins with assessing whether it is controlled because it is identified on the EAR’s Commerce Control List (“CCL”) under a corresponding Export Control Classification Number (“ECCN”), or else it is considered “EAR99,” which consists of low-technology or consumer goods (as opposed to being more dual-use in nature). Note that EAR99 items may still be considered controlled depending on their intended end-use, end-user, or destination, especially where countries subject to the EAR’s embargo controls (e.g., Russia, Iran, etc.) are involved.

U.S. Department of State’s Directorate of Defense Trade Controls (“DDTC”)—administers and enforces the International Traffic in Arms Regulations (“ITAR”). The ITAR is more specific to defense-related articles that are identified in its U.S. Munitions List (“USML”), as well as defense-related services. Exports, reexports, and in-country transfers of such defense-related articles and services are subject to the ITAR’s licensing requirements. The ITAR can also extend to foreign-made defense articles that incorporate U.S.-origin controlled components, software, or technical data. If it is unclear whether an item is ITAR or EAR controlled, a Commodity Jurisdiction request can be made to DDTC to clarify whether the item falls under the EAR or ITAR.

U.S. Department of Justice (“DOJ”)—prosecutes criminal violations of the foregoing laws and regulations administered by OFAC, BIS, and DDTC, where a willful/intentional violation is alleged to have occurred.

Client Risks and Issues

Assessing U.S. Sanctions Risks

Your client operates internationally, either by exporting goods and services and/or importing them, and confidently asserts that they don’t do business with the United States. However, when it comes to determining U.S. sanctions exposure, the devil is in the details. Even absent direct dealings with the U.S., a client’s activities may still implicate U.S. sanctions laws. As a starting point, here are several key questions that can help assess potential exposure in their operations (this list is illustrative, not exhaustive):

• Do your client’s customers, supply chains, intermediaries, or counter-parties involve: (1) countries subject to comprehensive U.S. embargoes (i.e., Iran, Syria, occupied regions of Ukraine, Cuba, North Korea); (2) countries that are heavily targeted by U.S. sanctions programs (e.g., Russia, China, Venezuela, Afghanistan, Burma); or (3) countries/regions that are higher-risk of diversion to the foregoing destinations (e.g., U.A.E., Turkey, Hong Kong)?

• Does your client trade in items that may be subject to the EAR? Recall that even foreign made items may be subject to the EAR.

• Does your client trade in articles (including technical data/software) and related services that may be controlled under the ITAR? Again here, even foreign made defense-related items may be controlled because of U.S.-origin parts and components.

• Do your client’s business operations involve any U.S. persons, even indirectly? This especially includes but is not necessarily limited to: (1) the involvement of U.S. person employees/agents outside of the United States; (2) the involvement of U.S. financial institutions, including their foreign branches, which is made more likely where payments are remitted in U.S. Dollars; and/or (3) U.S. suppliers of goods or services.

• Does your client have limited visibility into: (1) the end-users, end-uses, or ultimate destination of its export transactions; (2) the identity and locations of its upstream suppliers; and/or (3) intermediaries facilitating transactions?

• Is your client in the process of, or has already engaged in, a mergers and/or acquisition process, especially where U.S. entities or assets are involved?

Each affirmative response increases the likelihood that your client’s business activities fall within the scope of U.S. sanctions regulations—and that further assessment is warranted. Once risk areas are identified, the next step is to develop and implement a tailored compliance program designed to mitigate those risks. Such a program may include:

• Restricted party screening protocols to prevent engaging in transactions with sanctioned targets;
• Tailored training for company personnel to help identify red flags and respond appropriately; and
• ECCN  and USML classification protocols to ensure the company is aware of any BIS or DDTC compliance requirements.

Fortunately, OFAC, BIS, DDTC, and DOJ regularly publish compliance-related guidance to assist businesses in formulating and administering their U.S. sanctions compliance programs. Working with experienced counsel and compliance professionals can further help benchmark these efforts against industry best practices and regulatory expectations.

Issues that May Arise Under U.S. Sanctions

You or your client may suspect they have already engaged in conduct that potentially violated U.S. sanctions or may have exposed themselves to the risk of “secondary sanctions.” In a more serious scenario, you may learn that your client has been designated on a restricted party list maintained by a U.S. sanctions authority such as OFAC, BIS, or DDTC. Alternatively—and more ideally—your client may proactively seek guidance before engaging in a transaction that could implicate U.S. sanctions laws. The typical issues that arise in these contexts, along with key considerations for addressing them, include the following:

• Prohibited Causation—Your client’s conduct may have caused a violation of U.S. economic sanctions programs administered by OFAC. A common example involves an intermediary U.S. bank processing payment between two non-U.S. persons and their non-U.S. banks, especially where the payment was in U.S. dollars.

Legal Considerations: A thorough investigation of the relevant transactions is required to determine whether a U.S. nexus exists and whether any applicable OFAC sanctions programs were implicated. If potentially prohibited conduct is identified, the client should consider submitting a voluntary self-disclosure (“VSD”) to OFAC and/or the U.S. Department of Justice (“DOJ”). Timely and complete VSDs can significantly reduce potential enforcement consequences, as it demonstrates good faith and enhances cooperation credit. OFAC may respond with a reduced civil penalty—or even a “no action” determination—while DOJ may offer a non-prosecution agreement where criminal exposure exists.

• Items subject to the EAR or ITAR-related transactions—Your client believes they may have exported, reexported, or transferred domestically items that may be subject to the EAR or controlled under ITAR because of their U.S.-origin status, involving a problematic end-user, end-use, or destination.

Legal Considerations: The first step is to determine whether the relevant items were indeed subject to the EAR or controlled under the ITAR’s USML, including where a foreign-made item is involved and it incorporated U.S.-origin parts/components. Once jurisdiction of the item(s) is established, a classification and legal analysis must be conducted to determine whether a BIS or DDTC license was required for the relevant export, reexport, or transfer. If it appears that a license was required but not obtained, a violation of the EAR or ITAR may have occurred. In that case, a VSD should be considered to BIS, DDTC, and/or DOJ to mitigate any potential enforcement response. As there can also be overlapping jurisdiction between BIS and OFAC, especially as to comprehensively embargoed countries and regions, there may be prohibited causation issues as well to consider.

• OFAC-related Blocking or Rejection—Your client learns that a payment has been blocked (i.e., “frozen”) or rejected by a financial institution.

Legal Considerations: The first step is to confirm whether the payment (or any other relevant property interests) has indeed been blocked or merely delayed as the financial institution assesses its compliance obligations. If the property interest has indeed been blocked pursuant to OFAC sanctions programs, then the financial institution would have been legally required—under OFAC’s Reporting, Procedures and Penalties Regulations, 31 C.F.R. Part 501—to report the blocked property interests to OFAC. To seek release of the blocked funds, a specific license application must be submitted to OFAC pursuant to the applicable sanctions regulations.

Importantly, a blocking report submitted by a financial institution may alert OFAC to a potential sanctions violation by one or more parties to the underlying transaction. Accordingly, the parties involved should conduct a thorough internal investigation and assess their potential legal exposure. Depending on the findings, it may be appropriate to consider a VSD to mitigate enforcement risk—though timing is critical, and enforcement credit may be diminished if OFAC has already been alerted through the blocking report.

If a transaction was rejected by a financial institution for purported compliance with OFAC sanctions programs, then a report would have likely been made to OFAC for compliance with the relevant reporting requirements of Part 501. Such reports also place OFAC on notice of transactions that may have been prohibited. In such cases, the parties involved should promptly assess their conduct for compliance gaps or violations, and consider whether any VSD may be pertinent.

• Secondary Sanctions— Your client raises concerns about transactions that may expose them to the risk of so-called “secondary sanctions” or that could be viewed as contrary to U.S. foreign policy or national security interests.

Legal Considerations: The first step is to investigate the conduct at issue and assess under relevant legal authorities the degree to which the subject person is exposed to potential secondary sanctions (and note that potential violations OFAC sanctions programs may also have taken place if a U.S. nexus was present in any transactions). If any relvant designation criteria appears applicable under the complex-web of such legal authorities, there may be informal channels through which counsel can engage with relevant agencies (e.g., OFAC, State Department) to request a hold or reconsideration of any prospective designation.

• End-Use Check—Your client is subject to an upcoming end-use check by officials of a U.S. embassy or consulate—typically conducted to verify that items subject to U.S. export control jurisdiction are being used by the authorized end-user for the approved end-use.

Legal Considerations: The first step is to identify the relevant transactions and evaluate whether any potential violations of U.S. export control laws or regulations—such as the EAR or ITAR—may have occurred. If there is reason to believe a violation has taken place, the client should consider submitting a VSD to the appropriate agency, especially while the timing and scope of the end-use check are being addressed. Failure to cooperate with an end-use check—or findings that raise grave compliance concerns—can lead to serious consequences, including the client’s addition to U.S. government restricted party lists, such as BIS’s Unverified List or Entity List, which can severely restrict the client’s ability to engage in future international trade.

• Licensing—Your client seeks to engage in transactions that may invoke the regulations administered by OFAC, BIS, and/or DDTC.

Legal Considerations: The first step is to assess whether the transaction would be prohibited under applicable laws and regulations and if there are any applicable OFAC general licenses, EAR license exceptions, and/or ITAR license exemptions available that would authorize the activity (“existing authorizations”), as part of the overall efforts for ensuring full compliance with such laws and regulations (e.g., for ITAR-related activities, registration with DDTC may also be required). Where no such existing authorizations are applicable and no statutory exemptions available (e.g., the informational materials exemption for OFAC sanctions programs), then a written license application must be submitted to the appropriate agency before the transaction can proceed. Failure to secure proper authorization can result in significant civil or criminal liability.

• Administrative Subpoena—Your client receives an administrative subpoena from OFAC or BIS in connection with a potential violation of U.S. sanctions or export control laws. (Note: criminal investigations are typically handled by the Department of Justice and are beyond the scope of this article.)

Legal Considerations: The subpoena must be carefully reviewed to determine the scope of the agency’s request. A timely response is required—generally within 30 days of issuance—under either OFAC’s Reporting, Procedures and Penalties Regulations, 31 C.F.R. Part 501, or the EAR, unless an extension is granted. The client may be a witness, subject, or target of a broader investigation into potential violations. As such, a parallel internal investigation should be initiated to assess the nature and extent of any potential exposure to civil liability. This analysis will be critical in developing a well-informed response strategy and, where appropriate, taking corrective measures or preparing for potential enforcement actions. A proactive, cooperative approach can help mitigate penalties in the event OFAC or BIS proceeds with civil enforcement.

• Designation—Your client is identified on a restricted party list administered by OFAC, BIS, and/or DDTC. All agencies have administrative processes in place for listed persons to petition their removal from the respective list.

Legal Considerations I have previously written about the removal process from BIS’s Entity List and Unverified List. The appeals process for removal from DDTC’s Debarred Parties List is published under 22 C.F.R. §§ 127.7(d) and 128.13. For removal from OFAC sanctions lists, the agency has an administrative removal process in place under 31 C.F.R. § 501.807. The delisting process can be lengthy, especially before OFAC.

In general, a delisting strategy should begin with a thorough investigation into the basis for the designation—including, where appropriate, submitting a request for the administrative record supporting the agency’s action. While this background information is critical for developing an effective approach, it is not necessarily a prerequisite to initiating the removal process. In some cases, circumstances may warrant the immediate commencement of a delisting petition while continuing to gather supporting evidence in parallel.

Understanding the rationale for the listing will help shape one or more of the three primary pathways to removal (which are not mutually exclusive), especially for OFAC designations that specifically reference these three pathways: (1) establishing there was an insufficient basis for the designation to begin with; (2) establishing the circumstances that resulted in the designation are no longer applicable; and/or (3) proposing remedial steps (e.g., corporate reorganization) that would negate the basis for the designation.

Where any of the foregoing issues have arisen—or where there is other conduct that could potentially trigger the application of U.S. sanctions laws and regulations (noting that the above list is not exhaustive)—such matters should be promptly addressed with the assistance of qualified legal counsel and subject-matter experts.  

---

The author of this blog post is Kian Meshkat, an attorney specializing in U.S. economic sanctions and export controls matters. If you have any questions please contact him at meshkat@meshkatlaw.com.