OFAC Is For Real

If you ask someone in the financial services industry to list the regulatory agencies that affect them, it is likely that the list wouldn't include the Office of Foreign Asset Control ("OFAC"). However, such an omission could be dangerous.

OFAC administers several programs, each of which imposes strict liability for compliance failures. OFAC's jurisdiction is established by several laws, including Trade with the Enemy, International Emergency Economic Powers Act, Terrorism Prevention Act, and Executive Order 12978, "Blocking Assets and Prohibiting Transactions with Significant Narcotic Traffickers."

The compliance concepts in OFAC's programs are relatively straightforward: find them, block or reject them, and report them. The hard part is carrying this out on a daily basis.

The critical step in OFAC compliance is identifying the transactions subject to the requirements. Depending on the nature of the transaction, the customer or destination, you must either block it, reject it, or process it. The safe thing to do is call OFAC.

Compliance involves maintaining an accurate and up-to-date list, identifying any deposit or item of value that is deposited or placed in the bank, blocking the transaction, and reporting it to OFAC. Whenever OFAC changes the list, the bank is charged with identifying and blocking transactions of individuals named on the updated list.

Rather than mail out lists, OFAC maintains its list on the internet - one more reason to have internet access in your bank. It should be someone's responsibility to "surf" the 'net periodically and update the bank's OFAC list.

Because OFAC compliance is based on strict liability, this is not a topic you can place on the back burner or handle when you have spare time. OFAC updates its list frequently and banks are required to comply with a revised list as soon as it is posted. Your compliance program is responsible for catching and blocking each transaction conducted by an organization or individual on OFAC's list.

As with IRS penalties, the OFAC penalty system is based on the violation, and does not take into account the circumstances in which it occurred. Penalties mount quickly and can go as high as $1 million. Personal fines can be levied up to $250,000. Worse yet, jail is a possibility - with no guarantees about cellmates!

OFAC maintains a toll-free phone number so that you will feel "free" to call them with questions. When someone gives you something for free, take them up on it. Call OFAC at (800) 540-6322 and ask away! Not worried because you're in a small town? Small town bankers who trust their customers are just what the crooks are looking for. We are aware of numerous situations that took place in small communities. Remember, crooks have maps, cars, and plenty of time. They'll find you.

BOL's OFAC Matrix

ACTION STEPS

Brief your CEO and Board on OFAC. Attach every official document from your regulatory agency and OFAC that you can find. Official documents help to carry the point. It's them talking instead of you.
When briefing the Board of Directors on OFAC compliance, toss in a few numbers to illustrate the severity of penalties. Reminding the Board that a fine could be as high as $1 million and that jail is a possibility usually captures a commitment to compliance.
Adopt an OFAC policy. This can be part of another policy, such as BSA and Suspicious Activity Reporting.
Designate an OFAC Compliance Officer, a person to handle the regular updating and distribution of the OFAC list.
Designate a back-up for your OFAC compliance officer so that person can take a vacation - or get sick. After all, OFAC never does.
Train everyone who should know about OFAC rules and account blocking. Remind everyone that it is better to ask than to guess. Guessing wrong may close the bank.
Circulate a pop quiz question such as "what is an SDNT? (First, make sure you know the answer - Specially Designated Narcotics Trafficker)
Establish a review process for accounts to identify accounts and deposits that should be blocked.
Monitor your compliance procedure to make sure it works.
Consider giving a reward to alert staff members that identify and block transactions correctly.