US Agencies’ Tri-Seal Compliance Note Emphasizes Extraterritorial Reach of Sanctions and Export Control Obligations

On March 6, 2024, the US Departments of Commerce (“Commerce”), Treasury (“Treasury”), and Justice (“DOJ”) released their latest Tri-Seal Compliance Note (“Note”), which focuses on the “Obligations of foreign-based persons to comply with US sanctions and export control laws.” This Note follows previous Tri-Seal Compliance Notes focused on voluntary self-disclosure policy¹ and the use of third-party intermediaries for sanctions evasion and reflects enhanced interagency cooperation on sanctions and export control compliance and enforcement.

This Note is a clear warning to foreign and US companies alike regarding the wide reach of US jurisdiction under the sanctions and export control laws, even when activities take place entirely outside the United States. The legal principles and policies reflected in the Note are not new, as all three agencies have a long and successful track record of significant enforcement actions against non-US persons under the sanctions and export control laws. However, the Note highlights an increased focus on enforcement and coordination of enforcement activities across agencies, including with respect to evasion and diversion practices abroad. The Note also emphasizes the serious risks of violating these regulations as well as the need to adopt compliance measures (some of which it offers) to mitigate these risks.

Overview. Key sanctions highlights in the Note include:

• An explanation of the various sanctions forms and potential targets (including those persons engaged in prohibited conduct; those attempting to circumvent Treasury’s Office of Foreign Assets Control (“OFAC”) programs; and those assisting sanctioned persons or activities, regardless of physical location), which are authorized by various legislation including the International Emergency Economic Powers Act (“IEEPA”) and the Trading with the Enemy Act (“TWEA”).
• A discussion about sanctions program-specific jurisdiction, including US jurisdiction over foreign persons owned or controlled by a US person transacting with the Government of Iran or subject to Iranian jurisdiction under the Iran sanctions program; any corporation, partnership, association, or other organization owned or controlled by a US person under the Cuba sanctions program; and certain foreign persons under the North Korea sanctions program.
• A warning about civil and criminal penalties (including civil penalties up to $386,136 per violation under IEEPA) potentially imposed on sanctions violators, whose culpability is determined by a strict liability standard.

Key export control highlights in the Note include:

• An explanation of the scope of Commerce’s Export Administration Regulations (“EAR”),² which regulate exports, reexports, and (in-country) transfers not only to US-origin items but also to foreign items containing more than a de minimis amount of US content or that are the direct product of certain US technology.³
• A discussion about how EAR jurisdiction follows the EAR-controlled item, regardless of physical location, including in cases of transshipment, changed end-user, and foreign-produced items outside the US stream of commerce (if the foreign direct product rule is implicated).

The Note also cautions about potential criminal enforcement and the authority of the DOJ to bring criminal prosecutions against foreign parties for sanctions and export control violations.

Expansive Reach and Application to Non-US Persons. The Note describes several recent sanctions enforcement actions against foreign persons by OFAC, Commerce’s Bureau of Industry and Security (“BIS”), and the DOJ, with penalties ranging from multi-billion-dollar fines to suspension of export privileges. These actions targeted activities occurring outside the United States where the principal parties are non-US Persons and where the US nexus may not be obvious, including the following:

(i) Transactions where there may be an incidental tie to the United States, such as processing of dollar-denominated transactions through the US financial system.

(ii) The use of US systems or servers as part of the technology infrastructure for processing transactions or services that occur outside the United States between non-US persons.

(iii) A non-US Person’s procurement or transfer of goods, software, or technology from the United States for transshipment, diversion or other prohibited use directly or indirectly involving a restricted individual, entity, or territory.

(iii) A non-US Person’s re-export/re-transfer from abroad of goods, software, or technology subject to US export controls (including foreign-origin goods, software, or technology subject to controls based on their US content or derivation).

Enforcement actions highlighted in the Note include, for example, a case in which a foreign freight forwarder and OFAC settled on a $6,131,855 civil penalty after the freight forwarder caused US financial institutions to transact with blocked persons in North Korea, Iran, and Syria, as well as a case where a foreign defense contractor’s export privileges were suspended for its actions on behalf of the Russian intelligence services, among others.

The postscript list of practical compliance considerations amplifies the advisory tone of the Note, which concludes by encouraging foreign-based companies and individuals “to take seriously the impacts of US sanctions and export control laws on their business and operations.”

Consistent with long-standing agency guidance on elements of an effective compliance program,⁴ the Note highlights several recommended compliance measures including, among others:

• Employing a risk-based approach to sanctions compliance by developing, implementing, and routinely updating a sanctions compliance program.
• Ensuring that subsidiaries and affiliates are trained on US sanctions and export controls requirements, can effectively identify red flags, and are empowered to escalate and report prohibited conduct to management.
• Identifying and implementing measures to mitigate sanctions and export control risks prior to merging with or acquiring other enterprises.
• Encouraging companies who believe they may have violated these laws to voluntarily self-disclose to the relevant regulator(s).

Conclusion. Similar to the March 2023 Tri-Seal Compliance Note focused on sanctions and export control evasion, this Note serves as a stark warning to US and foreign persons without announcing new compliance principles and policies. Interested parties are strongly encouraged to use the recommended compliance tools to avoid the long enforcement arms of the US government on these matters.

¹ See also Mayer Brown’s Legal Update on the Voluntary Disclosure Note.

² Note that the Department of State did not contribute to the Tri-Seal Note, and, therefore, discussion about the International Traffic in Arms Regulations (“ITAR”) is not included.

³ 15 C.F.R. § 734.4 describes BIS’s de minimis rule which extends EAR-control to foreign-made products that contain more than de minimis levels of controlled US-origin content. Separately, 15 C.F.R. § 734.9 lists the four foreign direct product rules, which extend controls to foreign products of certain US technologies or software.

⁴ See, for example, BIS’s Elements of an Effective Export Compliance Program and A Framework for OFAC Compliance Commitments.