Violation of OFAC Reporting Requirements: “No Harm, No Foul”? No Way!

A recent enforcement action by the Department of the Treasury’s Office of Foreign Assets Control (“OFAC”) against MasterCard International Incorporated (“MasterCard”) stands as a reminder of the importance of strictly complying with even seemingly ministerial reporting requirements applicable to financial institutions that hold blocked property of sanctioned persons, and indeed of adherence to all OFAC reporting requirements. Although MasterCard escaped with only a Finding of Violation, the consequences could have been much worse under different circumstances. In May 1995, in response to issuance of Executive Order 12959, “Prohibiting Certain Transactions With Respect to Iran”, MasterCard blocked accounts in which Bank Melli and Bank Saderat held interests, which meant that no funds in those accounts could be transferred out of the accounts. Over the next twelve years, the banks’ accounts became dormant on MasterCard’s books, but the assets remained with MasterCard and the accounts remained blocked. In 2007, OFAC added the names of Bank Melli and Bank Saderat to the List of Specially Designated Nationals and Blocked Persons (“SDN List”). Following this designation, MasterCard failed to report the blocked accounts to OFAC, as it was required to do. Even though MasterCard had properly restricted the accounts of the two Iranian banks for more than a decade in response to the 1995 Executive Order, and had not conducted any prohibited transactions with or concerning the banks or the banks’ blocked property, MasterCard’s failure to report the now-dormant accounts to OFAC following the banks’ 2007 SDN designation constituted a violation of the blocked property reporting requirements of OFAC’s Reporting, Procedures and Penalties Regulations (“RPPR”), 31 C.F.R. § 501.603(b). In explaining the reasons why a Finding of Violation was issued, OFAC noted:

• MasterCard is a large and commercially sophisticated company that deals primarily with banks and other financial institutions, and should have identified and reported accounts, funds, property, and interests in property belonging to banks designated on the SDN List, regardless of whether the accounts were dormant or active. Although MasterCard personnel did not appear to have actual knowledge of the failure to comply with the reporting requirement, OFAC deemed MasterCard to have had reason to know of its obligations.
• MasterCard's failure to report resulted in OFAC’s reports to Congress and responses to other inquiries related to blocked property being incomplete, which could have had a negative impact on U.S. government decision-making regarding blocked assets and parties subject to blocking.
• MasterCard’s failure to properly record interest on the accounts reduced the value of blocked assets available to the Congress and the President.
• MasterCard’s OFAC compliance program lacked internal controls that would have prevented, or later identified the oversight of, the violations.

Although finding that MasterCard violated the RPPR, OFAC noted several mitigating factors that no doubt accounted for the agency’s decision to not impose more severe (e.g., monetary) penalties. These included:

• No MasterCard personnel, including managers or supervisors, appeared to have had actual knowledge of the conduct that led to the violations.
• The funds never reached the sanctioned parties.
• MasterCard had not received a penalty notice or Finding of Violation from OFAC relating to substantially similar matters in the five years preceding the date of the conduct giving rise to the violations.
• MasterCard substantially cooperated with OFAC’s investigation, including voluntary self-disclosure and executing a statute of limitations tolling agreement and an extension to the agreement.

While dodging monetary penalties, MasterCard did not emerge entirely unscathed. In the event of a similar violation by MasterCard any time in the next five years, the existence of Finding of Violation makes it more likely that OFAC will penalize MasterCard more severely, e.g., through the imposition of monetary penalties. MasterCard’s experience should serve as a lesson to all financial institutions and other businesses that are or may become subject to OFAC reporting requirements that OFAC does not view a failure to report as a mere case of no harm, no foul. The government has a significant interest in knowing of the existence of blocked accounts and the assets in those accounts. Although MasterCard presumably utilized sophisticated interdiction software and devoted significant resources to OFAC compliance, it seems likely that its oversight occurred because dormant accounts were not screened and there was no other mechanism in place to review those accounts for compliance. While it is no doubt easier to say than to do, financial institutions and other businesses need to be constantly vigilant in looking for, and closing, gaps in their OFAC compliance programs.