The U.S. Department of the Treasury’s Office of Foreign Assets Control’s (“OFAC”) last civil enforcement action for 2023 involved insurance company Privilege Underwriters Reciprocal Exchange (“PURE”), and was a stark reminder of the potential risks in dealing with sanctioned entities that aren’t identified on any OFAC sanctions lists but otherwise subject to the agency’s “50 Percent Rule.” This Rule extends relevant blocking sanctions and prohibitions to any entity that is owned 50 percent or more, in the aggregate, by persons identified on the Specially Designated Nationals and Blocked Persons (“SDN”) List, certain other OFAC sanctions lists, and/or other blocked persons. PURE’s alleged violations stemmed from insurance-related transactions with a Panamanian company that wasn’t identified on any OFAC sanctions lists or located in any comprehensively embargoed countries, but that happened to be wholly owned by designated Russian SDN Viktor Vekselberg.
In theory, more business dealings likely occur every year with entities blocked pursuant to the 50 Percent Rule than with persons actually identified on OFAC’s sanctions lists, as the latter can more easily be prevented simply by screening customers and counterparties against OFAC’s sanctions lists. There is no official list of entity’s subject to the Rule, and a lot more due diligence is require to identify them. However, since OFAC’s initial issuance of the 50 Percent Rule in February 2008, enforcement actions involving alleged violations of the Rule have been few and far between (approximately 1% of the total number of published civil enforcement actions).
Notwithstanding the limited number of enforcement actions, they do provide certain compliance considerations that I have examined in this article. But first, an overview of the Rule and a little bit of enforcement history.
Overview of OFAC’s 50 Percent Rule
The current rendition of OFAC’s 50 Percent Rule was issued in a guidance document on August 13, 2014, which has been incorporated into the regulations for all of its sanctions programs. It provides that “…any entity owned in the aggregate, directly or indirectly, 50 percent or more by one or more blocked persons is itself considered to be a blocked person…regardless of whether the entity itself is listed.” It applies to persons identified on the SDN List, blocked governments (e.g., Venezuela), and persons identified on several other OFAC sanctions lists (e.g., Sectoral Sanctions Identifications (“SSI”) List). Even the ownership interests of persons blocked under different OFAC sanctions programs are to be aggregated. Prior to its current rendition, there was the initial February 14, 2008 version of the Rule, which did not include the aggregation of ownership interests.
To illustrate application of the 50 Percent Rule, consider an entity that is owned 50% in the aggregate by two SDNs designated under Executive Order (“E.O.”) 14024, with the remaining 50% of shares held by an individual not subject to any OFAC sanctions programs. The entity will be deemed “constructively blocked” under E.O. 14024 by virtue of the Rule, even though the entity itself won’t be identified on any OFAC sanctions lists. Application of the rule can become more complicated with complex corporate ownership structures, but the principle remains the same.
When it applies as a result of an SDN or other blocked persons ownership interests, U.S. persons that come within the possession or control of the constructively blocked entity’s property interests will be required to block it and report to OFAC, and U.S. persons will be prohibited from engaging in virtually any transactions or dealings with that entity unless authorized by OFAC or statutorily exempt. If the 50 Percent Rule applies because of the ownership interests of a person identified on other applicable sanctions lists (e.g., SSI List), then those less restrictive prohibitions would be extended.
Enforcement History
A survey of OFAC’s civil penalties and settlements since the initial issuance of the 50 Percent Rule in February 2008 provides perspective on how little the agency has enforced the Rule. However, this doesn’t mean that the agency’s enforcement priorities won’t change, as OFAC’s enforcement response in PURE when compared to such actions in the past suggests that the agency may be taking a more hardline approach in its enforcement of the Rule.
Between February 2008 and December 2023, OFAC’s aggregate number of civil penalties and settlements totaled 368. No such actions, including Findings of Violation that are published and aggregated separately (where no monetary penalty is imposed), were imposed between February 2008 and August 2014 when the Rule was revised. OFAC’s aggregate number of civil penalties and settlements between then and December 2023 totaled 148, and only 4 such actions involved enforcement of the 50 Percent Rule (2.7%). The first such action didn’t occur until February 8, 2016, involving Barclays Bank Plc (“Barclays”), in relation to conduct under the initial rendition of the 50 Percent Rule.
Then came Standard Chartered Bank (“SCB”) on April 9, 2019, the Microsoft Corporation (“Microsoft”) on April 6, 2023, and then the PURE matter on December 21, 2023. In both the SCB and Microsoft actions, violations of OFAC’s 50 Percent Rule were alleged alongside direct dealings with SDNs and/or comprehensively sanctions jurisdictions, and the agency made little to no mention on how the target entity had failed to prevent dealings with parties subject to the Rule, or what they could have done differently. See also, OFAC Enforcement Indicates Sanctions List Screening Isn’t Enough, where we cover the Microsoft action in more detail.
Notwithstanding the lack of compliance lessons in SCB and Microsoft, the Barclays and PURE matters have much more to offer in that regard. The alleged violations in both were based solely around OFAC’s 50 Percent Rule, where they engaged in transactions with an entity or entities that were owned 50 percent or more by a single SDN in violation of applicable regulations. Barclays apparently violated the Zimbabwe Sanctions Regulations (“ZSR”), 31 C.F.R. Part 541, and PURE the Ukraine-Russia-Related Sanctions Regulations (“URSR”), 31 C.F.R. Part 589. Although neither party self-disclosed their conduct, OFAC’s noted stance in each action for when enforcement of the 50 Percent Rule would be appropriate was markedly different, with a much less understanding position in PURE.
In Barclays, the U.K. bank had processed 159 transactions in violation of the ZSR through U.S. financial institutions, including its own New York branch, for or on behalf of three customers of Barclays Bank of Zimbabwe Limited (“BBZ”), that were owned 50 percent or more, directly or indirectly, by the Industrial Development Corporation of Zimbabwe (“IDCZ”). These transactions occurred after IDCZ became designated in July 2008, while those problematic customers had been initially onboarded in 2004. Barclays had relied on BBZ for electronic customer records to perform restricted party screening, and due to several limitations in including ultimate beneficial owner data of a customer in the system when it otherwise appeared in their paper file, as well as failing to heed numerous warning signs to update its controls to rectify this issue, continued to process transactions on behalf of those customers until September 2013.
Similarly in the PURE matter, the insurance firm had engaged in insurance-related transactions with Medallion, Inc. of Panama since 2010, which became constructively blocked as a result of Vekselberg’s designation in April 2018, and whereby transactions in violation of the URSR continued until July 2020. Although PURE had documents in its possession the entire time indicating that Medallion was wholly owned by Vekselberg, not only did it fail to upload them into its underwriting system where corporate ownership information was maintained, but also failed to incorporate such information into its sanctions screening program.
Whereas in Barclays OFAC specifically acknowledged the fact that the constructively blocked customers were not publicly identified or designated on any SDN List while the transactions were processed, and considered it a mitigating factor, in PURE it was not so forgiving. Also, in Barclays, the agency detailed specific circumstances in which an enforcement response for violations of the 50 Percent Rule would be appropriate, particularly for financial institutions. However, in PURE it didn’t do so and went on to list as an aggravating factor the company taking no subsequent due diligence or other measures to identify relevant compliance gaps after OFAC’s expansion of the 50 percent rule in 2014. These comparisons suggest a less merciful stance by OFAC moving forward for alleged violations of the Rule, at least where they’re not self-disclosed.
Compliance Considerations
As noted in the PURE action, it is important to have a risk-based sanctions compliance controls capable of capturing and incorporating all relevant available information on a customer to conduct responsive and regular screening in view of the 50 Percent Rule. When it comes to assessing such risks—i.e., exposure to transactions that may violate the Rule—many variables are generally considered that we won’t get into here. However, it is safe to say that if the nature of your business involves engaging in cross-border transactions and servicing clients in other countries, you’re at risk. As noted in the Barclay’s action, these risks are especially elevated when you have operations in countries with a significant presence of persons on OFAC sanctions lists.
Should your business have such risks, the first question that probably comes to mind is how far are you supposed to go in identifying customer or counterparties beneficial ownership information for screening purposes? Unfortunately, there is no straightforward answer, as U.S. sanctions are a strict liability area of law, where the subject person can be held liable even if they inadvertently violated relevant prohibitions. In an ideal world, the beneficial ownership of every entity you do business with would be obtained and screened, but you may not have the resources or risk-level to justify doing so. Nevertheless, what little enforcement history there is in relation to the 50 Percent Rule suggests that an enforcement response will be deemed warranted by OFAC where the subject organization has ownership information for its customers and/or counterparties—particularly where obtaining such information is an industry standard—but a failure to make use of such information in its restricted party screening efforts led to the alleged violations.
Financial institutions and insurance companies generally obtain such ownership details in the course of their business operations. For example, in PURE OFAC noted that the SDN was identified as Medallion’s sole shareholder in a form questionnaire that the company used to confirm that the insured properties were not used for commercial purposes, but not incorporated into its screening program. OFAC then indicated that such an omission would make an enforcement response “particularly appropriate.” This doesn’t mean that OFAC won’t pursue an enforcement action in other circumstances where the 50 Percent Rule is violated, but at a minimum suggests that for businesses where obtaining ownership details is industry standard, such information needs to be screened.
OFAC also remarked in the Barclays action that an enforcement response for its 50 Percent Rule would also be warranted where the information concerning the SDN ownership of the customer is publicly available and allows intermediary banks to identify and block such transactions (who likely reported to OFAC of the alleged violations). There are now many third-party vendor tools on the market that actively identify entities that may be constructively blocked for restricted party screening purposes. At risk businesses should consider such third-party tools for their overall sanctions compliance programs.
The author of this blog post is Kian Meshkat, an attorney specializing in U.S. economic sanctions and export controls matters. If you have any questions please contact him at [email protected].
