Alerts

Mitigating OFAC Risks in Mergers and Acquisitions

February 3, 2020

This past year marked a watershed in highlighting the U.S. sanctions risks associated with mergers and acquisitions. Both in word and in deed, the U.S. Treasury Department’s Office of Foreign Assets Control (“OFAC”) served notice during 2019 that it expects acquirers to conduct appropriate pre-acquisition and post-acquisition due diligence on target companies, especially those located abroad. This Alert describes OFAC’s recent guidance and enforcement actions in the M&A context and identifies steps acquirers can take to mitigate sanctions risks.

OFAC’s Compliance Framework

In May 2019, OFAC for the first time published guidance outlining the key components of a sanctions compliance program, entitled “A Framework for OFAC Compliance Commitments” (“Framework”).[1] While not mandatory, OFAC “strongly encourages” U.S. firms and foreign firms subject to U.S. jurisdiction to employ a risk-based sanctions compliance program in accordance with the parameters set forth in the Framework.

The Framework specifically addresses M&A, noting that in recent years, M&A “appears to have presented numerous challenges with respect to OFAC sanctions.” The Framework recommends that a company’s sanctions compliance functions be incorporated into the M&A process and when integrating the combined entities post-acquisition.

More specifically, the Framework advises that, whether a firm is involved in an M&A deal as a participant or as an adviser, it should “engage[] in appropriate due diligence” to ensure that sanctions-related issues “are identified, escalated to the relevant senior levels, addressed prior to the conclusion of any transaction, and incorporated into the organization’s risk assessment process.”

Post-acquisition sanctions compliance efforts are also important. “After an M&A transaction is completed,” the Framework states, “the organization’s Audit and Testing function will be critical to identifying any additional sanctions-related issues.”

OFAC 2019 Enforcement Actions

The concerns with M&A voiced in the Framework have been echoed in OFAC’s enforcement activity. During 2019, OFAC brought a total of 26 enforcement actions and collected $1.3 billion in penalties, both all-time highs. Six of those actions arose in the M&A context, with penalties imposed either on the basis of pre-acquisition OFAC violations by the target that were not detected during due diligence or on the basis of post-acquisition violations.

Several common themes emerge from an analysis of these six enforcement actions.

First, in each case, the alleged violations were committed by a foreign-based target, underscoring that, as OFAC has warned, “Foreign acquisitions can pose unique sanctions risks, to which a U.S. person parent company should be alert at all stages of its relationship with the subsidiary.”[2] Activities of foreign firms can give rise to OFAC liability in several circumstances:

S. Ownership or Control. Although OFAC sanctions primarily target U.S. persons, some sanctions programs also apply by their terms to non-U.S. persons that are “owned or controlled” by a U.S. person.
Facilitation. Even where a foreign subsidiary itself may deal with an OFAC-prohibited person or country without running afoul of OFAC sanctions, the U.S. parent — as well as any individual U.S. citizens employed either by the parent or the foreign subsidiary — are not allowed to “facilitate” such a transaction in any way.
Secondary Sanctions. Under some sanctions programs, OFAC has authority to impose so-called “secondary sanctions” against foreign companies that do not have U.S. ownership. This is true, for example, of OFAC’s sanctions directed against Russian oligarchs and their companies.

Second, all six enforcement actions involved alleged violations of the Cuba sanctions program or the Iran sanctions program. That is not a coincidence. These are the most far-reaching of OFAC’s sanctions programs, particularly as they apply to foreign firms.

Cuba. OFAC’s Cuban Asset Control Regulations generally prohibit a “person subject to U.S. jurisdiction” — which includes a foreign company owned or controlled by a U.S. person — from engaging in transactions or dealings in any property in which Cuba or a Cuban national has an interest.[3]
Iran. OFAC’s Iranian Transactions and Sanctions Regulations not only generally prohibit U.S. persons from engaging in transactions or dealings with the government of Iran or persons ordinarily resident in Iran, but also prohibit a non-U.S. person owned or controlled by a U.S. person from “engaging in any transaction, directly or indirectly,” with the government of Iran or a person organized under the laws of Iran, ordinarily resident in Iran, or owned or controlled by such a person if the transaction would be prohibited if engaged in by a U.S. person.[4]

Pre-acquisition, a foreign company may have been legally doing business in Cuba or Iran, or with Cuban or Iranian nationals. But the moment the acquisition closes and the target becomes U.S.-owned, those same activities will now violate OFAC sanctions. In one of the 2019 enforcement actions, the U.S. acquirer allegedly did not inform its foreign subsidiary that its Cuba-related activities were now subject to U.S. law until 15 months after the acquisition.[5]

Third, in several cases, the U.S. acquirer learned during due diligence that the foreign target was doing business in Cuba or Iran, and took steps to ensure that the activity ceased post-closing. Nevertheless, personnel at the target continued to engage in Cuban or Iranian transactions despite the fact that such transactions, by virtue of its U.S. ownership, were now unlawful.

In OFAC’s words, these enforcement actions “highlight[] the importance for U.S. companies to conduct sanctions-related due diligence both prior and subsequent to mergers and acquisitions,” and “to take appropriate steps to audit, monitor, and verify newly acquired subsidiaries and affiliates for OFAC compliance.” In particular: “Testing of compliance procedures and timely auditing of subsidiaries can mitigate the risk of exposure to U.S. sanctions violations.”[6]

Risk Mitigation Measures

Now more than ever, it is vital for U.S. acquirers to consider sanctions risks and incorporate sanctions risk mitigation measures both in their pre-acquisition due diligence and in their post-acquisition integration of the target.

Pre-Acquisition Due Diligence

During due diligence, the acquirer should ascertain whether the target does any business in, or with, any OFAC-prohibited jurisdictions or persons on OFAC’s List of Specially Designated Nationals. OFAC currently has sanctions programs impacting 22 different countries, territories and regions, among the most notable of which are Cuba, Iran, Russia and Venezuela.[7] Not all OFAC programs broadly prohibit dealings in or with a particular country; some are narrowly targeted at particular government officials and agencies or particular persons or industry sectors. Even the more comprehensive sanctions programs contain exceptions and licenses for certain activities.

If the target is doing business with OFAC-prohibited parties, even if legally because it is a foreign firm not subject to OFAC sanctions, the acquirer must, if such activity would become illegal upon the closing, ensure that the business is shut down prior to the closing. If the target will continue to engage in such business post-closing (because the business does not involve Cuba or Iran and is otherwise legal for a non-U.S. person), steps should nonetheless be taken to “wall off” any U.S. persons from involvement in that business, as such involvement could constitute prohibited “facilitation” by U.S. persons.

The acquirer should understand the target’s sanctions-related obligations and whether the target has a sanctions compliance program, including whether it has written policies and procedures and whether it conducts screening of counterparties. Any written policies and procedures should be reviewed, and diligence performed as to the extent to which they have been actually implemented. This includes, among other things, whether appropriate personnel have been required to read and certify compliance with the policy, and have received sanctions-related training.

Having visibility into the target’s existing ownership structure and screening the names of the selling shareholders against OFAC’s list of prohibited persons is also essential to ensure that the acquisition transaction itself does not run afoul of U.S. sanctions.

Contractual Representations

Contractual representations from the seller are also important. Even though they do not obviate the risk of successor liability, contractual representations further evidence the acquirer’s efforts to ensure that the target is not engaged in prohibited dealings and that its shareholders, officers and directors are not prohibited persons. In some cases, an indemnity from the seller may be sought with respect to the financial consequences of prior violations in the event that the representations prove to be inaccurate.

Self-Reporting of Violations

If due diligence discloses that the target may have engaged in a violation of OFAC sanctions, the acquirer will need to ensure that the violations cease and take any appropriate remedial actions. Remedial actions could include an internal investigation, termination of contracts, disciplinary action against employees involved in the violation, and enhancements to compliance policies and procedures.

The acquirer will also want to consider whether the apparent violations should be voluntarily disclosed to the government. Both OFAC and the U.S. Department of Justice (“DOJ”) encourage self-reporting of sanctions violations. Under OFAC’s publicly issued Enforcement Guidelines, companies that voluntarily self-disclose a violation are eligible for a 50% reduction in the “base penalty” amount (which can be increased or decreased based on a variety of factors).[8]

For its part, the DOJ issued a revised sanctions enforcement policy late last year creating a presumption that a company that voluntarily self-discloses violations will receive a non-prosecution agreement and not be required to pay a fine. Among the circumstances where the policy applies is “[w]hen a company undertakes a merger or acquisition, uncovers misconduct by the merged or acquired entity through thorough and timely due diligence or, in appropriate instances, through post-acquisition audits or compliance integration efforts, and voluntarily self-discloses the misconduct and otherwise takes action consistent with this Policy.”[9]

Post-Acquisition Compliance

Finally, OFAC compliance does not cease upon the closing of the acquisition. Continued monitoring and auditing of the target’s business from a sanctions perspective is key. Consideration should be given to folding the target’s business into the acquirer’s existing sanctions compliance program. If not, the acquirer should ensure that the target has, or puts into place, its own appropriate risk-based sanctions compliance program.

As noted above, special attention should be paid to foreign targets that previously operated free from having to comply with OFAC sanctions. Their employees may have little or no awareness of OFAC’s restrictions and will have to be educated, trained and, if they previously did business in prohibited jurisdictions, monitored to make sure those activities are not resumed.

Non-Controlling Investments

Non-Controlling minority investments also pose OFAC risks. While such an investment would not result in the foreign firm itself generally being subject to OFAC sanctions, the U.S. investor and its personnel remain subject to the prohibition on “facilitation” and thus cannot be involved in transactions involving OFAC prohibited jurisdictions. Furthermore, while investing in a foreign company that does a relatively de minimis amount of business in Cuba or Iran (or another OFAC prohibited jurisdiction) would not necessarily violate OFAC sanctions, companies subject to U.S. jurisdiction face potential liability if they make investments for the purpose of facilitating the target’s business in a prohibited jurisdiction or in firms that conduct a disproportionate amount of their business in prohibited jurisdictions.

Authored by Gary Stein, Betty Santangelo, Peter H. White, Melissa G.R. Goldstein, Jennifer M. Opheim and Hannah M. Thibideau.

If you have any questions concerning this Alert, please contact your attorney at Schulte Roth & Zabel or one of the authors.

[1] U.S. Dep’t of Treasury, “A Framework for OFAC Compliance Commitments” (May 2, 2019), available here. SRZ’s prior Alert on the Framework, “OFAC Update: A Framework for Compliance and Recent Settlements,” is available here.

[2] U.S. Dep’t of Treasury, Enforcement Information for June 13, 2019 (Expedia Group, Inc.), available here.

[3] 31 C.F.R. Part 515, and in particular §§ 515.201 and 515.329.

[4] 31 C.F.R. Part 560, and in particular §§ 560.201, 560.204, 560.206 and 560.215.

[5] U.S. Dep’t of Treasury, Enforcement Information for June 13, 2019 (Expedia Group, Inc.), available here.

[6] U.S. Dep’t of Treasury, Enforcement Information for March 27, 2019 (Stanley Black & Decker, Inc.), available here (emphasis added).

[7] The jurisdictions affected include the Western Balkans, Belarus, Burundi, the Central African Republic, Crimea, Cuba, the Democratic Republic of the Congo, Iran, Iraq, Lebanon, Libya, Mali, Nicaragua, North Korea, Russia, Somalia, Sudan, South Sudan, Syria, Venezuela, Yemen and Zimbabwe.

[8] 31 C.F.R. Part 501, Appendix A (Economic Sanctions Enforcement Guidelines).

[9] U.S. Dep’t of Justice, “Export Control and Sanctions Enforcement Policy for Business Organizations” (Dec. 13, 2019), available here. SRZ’s prior Alert on the revised policy, “Sanctions Update: DOJ Revises Voluntary Self-Disclosure Policy for Export Control and Sanctions Violations,” is available here.

This communication is issued by Schulte Roth & Zabel LLP for informational purposes only and does not constitute legal advice or establish an attorney-client relationship. In some jurisdictions, this publication may be considered attorney advertising. ©2020 Schulte Roth & Zabel LLP.