OFAC: The New Compliance Hot Seat

Since September 11, 2001, much attention has been given to the variety of anti-money laundering and crime prevention laws with which financial institutions comply. Now at the front of this list is OFAC, the Office of Foreign Assets Control. Prior to the terrorist acts of last September, financial institutions and their examiners gave lip service to OFAC compliance. Examiners asked if you had an OFAC compliance program. If your answer was "yes" they went on to other things.

In today's world, OFAC compliance is a whole different matter. In fact, OFAC got top billing at ABA's National Regulatory Conference. For those with questions about what OFAC is and what OFAC does, the panel of experts cleared up the questions and gave some valuable compliance tips.

OFAC administers and enforces a variety of economic sanction programs. These programs are established in a variety of ways, including federal legislation and Executive Order. Each of the authorizing acts or orders has a common denominator of carrying out national policy.

OFAC sanctions are based on the premise that terrorism and related political crimes or hostile policies must rely on money. Limiting access to funds is a way of limiting the ability of a terrorist group to operate in this country. So overnight, OFAC compliance changed from being an esoteric nuisance to an essential element of patriotism and national policy.

The economic sanctions are broad and trigger compliance actions not only by financial institutions but to all U.S. businesses and citizens. Any U.S. citizen anywhere in the world is reached by OFAC requirements. OFAC sanctions also apply to foreign-owned companies with offices located in the U.S.

Deborah Thoren-Peden, Partner with Pillsbury, Winthrop, LLC in Los Angeles, advised the audience to pay attention to service providers. Your service providers are directly accountable to OFAC. Not only should the vendors be accountable to you - their customer - for serving your compliance responsibilities, they are also directly accountable to OFAC in their own right.

Terrorism is a relatively recent addition to OFAC. Economic sanctions have been applied for decades based on national interests. For example, Iranian assets were subjected to OFAC requirements in 1979. The application of sanctions to terrorists dates from 1996 and the Taliban was added in 1999. Since September, 2001, OFAC has added the list of Specially Designated Global Terrorists ("SDGTs")

What
It is all very well and good to learn about what OFAC is. But the really important question is what we should do. And here is where OFAC affects financial institutions more than any other sector of the economy. Financial institutions handle the money. At some point, almost every economic transaction passes through a financial institution. After all, OFAC follows the money (and any other tangible assets.)

The most important action sounds a bit like it belongs on the sports page: blocking. This involves taking the money. Grab and freeze it. As funds subject to blocking enter the institution, you should place the funds in a blocked account. You then become the custodian of these funds. You report the transaction to OFAC and hang on to the funds until OFAC tells you to release them. Only OFAC - never the customer - can make the decision that the funds may be released.

This deep freeze requirement does place some unfortunate consequences on individuals or companies that have the misfortune of sharing a name with an entity or individual on the OFAC list. This customer may provide you with convincing evidence, including evidence of economic harm suffered by the freeze. However, you must ignore the customer's evidence and rely only on OFAC's decision.

Another OFAC technique is to refuse to provide the service. For example, if a customer on the OFAC list wants to purchase a cashier's check, you cannot sell it to them.

Once funds are blocked, you must notify OFAC within 10 days. OFAC begins tracking the assets and is able to notify you to release the funds if the owner is taken off the OFAC list.

There is also an annual reporting requirement. In September of each year (and the month should be easy to remember now!) any financial institution holding blocked funds must report to OFAC on the status of those accounts. Forms for this purpose are provided on OFAC's website.

Some Technicalities
The complexity and importance of identifying and stopping terrorists makes OFAC compliance particularly important. This means going beyond mere technical compliance - which actually constitutes the minimum - and looking for ways to make the system work better. This may mean reporting the best and most accurate information possible on SARs and to OFAC.

The panel suggested going beyond name matches and using information on the list such as date of birth and address to confirm the match.

OFAC uses the information you provide and shares it with the investigating agencies. Every OFAC report therefore augments the information database for investigators.

Penalties
Why comply? In addition to national interests, the penalties for OFAC violations can be worse than the penalties under BSA. For a single instance or "count" of willfully violating OFAC requirements, a corporation may be fined up to $10,000,000.00. Yes, the decimals and commas are in the right place! An individual may be fined up to $5,000,000 for the same kind of violations. The monetary penalty may be accompanied by to 30 years imprisonment. All of this pales against the high probability of being labeled as a terrorist in the public's eye. An OFAC violation that involved moving funds for Al Qaeda would be a front-page story all across the country.

OFAC penalties may also be connected to BSA penalties. Failure to identify and freeze funds may also violate the Bank Secrecy Act. If this happens, expect penalties under both laws.

Advice From Experts
Faced with this, what should you do? First, be sure that you have an OFAC compliance program. Designate an individual (it could well be you) to be responsible for OFAC compliance. This person should screen all transactions - or closely supervise the process, depending on bank size.

Depending on the size of your institution and the number of accounts, review all account names manually or using interdict software.

All transactions should be checked. Look at all names on the account or transaction. The names you review should include account holders, debtors, customers, buyers, sellers, originators, recipients, beneficiaries, trustees, other financial institutions. Elliot Berman, an attorney with Godfrey & Kahn in Milwaukee, WI, reminded the audience to check current customers as well as new customers and new transactions. You may have "moles" among your current customers. The fact that they have banked with you for three years or more does not affect your OFAC obligations in any way. It takes a long time to plan a major terrorist act. The first step is to lay the plans that may include banking relationships.

If you have a match, contact OFAC immediately. They will tell you what to do next. This may involve blocking the funds. If so, remember to send your report to OFAC within 10 days. The phone call won't cover this requirement.

If you have blocked funds, check your system for ensuring that those funds stay blocked. You don't want anyone releasing them as a customer service!

Questions?
OFAC would like to answer your questions. They can only do that if you call. Farnell Cowan, Compliance Officer with OFAC (and a former banker) urged you to call. She said that OFAC has been getting between 300 - 400 calls per day since September 11. Ms. Cowan also asked for questions and concerns from the industry. OFAC is planning to issue a "Frequently Asked Questions" information document. Here is your chance to get your question answered.

ACTION STEPS

Visit the OFAC website at www.treas.gov/OFAC and download their information documents. Useful articles include two that were published in ABA's Bank Compliance Magazine.
Download the reporting forms and place the annual reporting requirement on someone's calendar for September.
Review training materials used for new employees, tellers, branch managers, and customer service representatives and evaluate whether the materials provide adequate information on OFAC and how to handle affected transactions.
Check with your service providers to find out what they do to comply with OFAC. Remember, this isn't just the responsibility of the financial institution. OFAC applies to all businesses in the U.S.
Set a schedule for running your full customer list through the OFAC screening to be sure you identify customers affected by additions or changes to the list.
Send OFAC any questions you want answered.