On Nov. 5, 2008, the US Treasury Department's Office of Foreign Assets Control (OFAC) issued new guidance for the securities industry, "Opening Securities and Futures Accounts from an OFAC Perspective" (Account Guidance), and revised existing guidance, "Risk Factors for OFAC Compliance in the Securities Industry" (Risk Matrix). The Account Guidance and the Risk Matrix break new ground in several areas and clarify OFAC's expectations for compliance by securities and futures firms with respect to its sanctions regulations. At the same time, they leave the industry with a number of unanswered questions. This Regulatory Alert discusses the ways in which the Account Guidance and Risk Matrix can inform the securities industry's compliance with the OFAC rules, as well as some of the open issues.
OFAC administers and enforces list-based and country-based economic sanctions against targeted foreign countries and regimes, terrorists and terrorist organizations, and others in furtherance of US policy goals (collectively, the OFAC Sanctions). OFAC Sanctions apply to all US citizens and permanent residents located anywhere in the world, entities organized under US law (including foreign branches), US branches of foreign entities, all persons (individuals and entities) located in the United States and, in limited circumstances, foreign subsidiaries of US entities and foreign persons (collectively, Subject Persons). OFAC Sanctions implicate a wide range of commercial and financial transactions, including the provision of services and dealings in property, involving targeted countries, entities and individuals that are undertaken (both directly and indirectly) by Subject Persons.
Although the OFAC Sanctions constitute a strict liability regime, the Account Guidance explicitly confirms that securities and futures firms--which are broadly defined to include investment advisers, broker-dealers, futures commissions merchants, introducing brokers in commodities, commodity pool operations and commodity trading advisers--should develop risk-based OFAC compliance programs. The Account Guidance also outlines a number of factors a securities or futures firm should evaluate to determine both its OFAC Sanctions risks and those of each client/customer and proposed transaction. As well, the Risk Matrix provides securities and futures firms with greater details about the nature and scope of the up-front due diligence a securities firm should perform on each client/customer and intermediary as part of a risk-based OFAC compliance program. The Risk Matrix also gives concrete examples of "high-risk" clients/customers and intermediaries.
The Account Guidance makes clear that OFAC will consider a securities or futures firm's risk-based compliance program in determining possible penalty outcomes in dealing with apparent violations. This is noteworthy because OFAC's recently-issued Economic Sanctions Enforcement Guidelines1 make no mention of risk-based compliance policies in its discussion of factors impacting the deposition of enforcement cases.
For what appears to be the first time, the Account Guidance makes a clear link between OFAC's rules and regulations and those of the Bank Secrecy Act (BSA), to which many securities and futures firms are also subject. Specifically, the Account Guidance recommends that a firm's OFAC compliance program includes risk-based measures for verifying the identity of its customers and clients, similar to what broker-dealers and futures commission merchants and introducing brokers in commodities should be doing as part of their Customer Identification Program (CIP) required by the BSA.2 The effort to harmonize the regulations governing the OFAC Sanctions and anti-money laundering regimes in the United States is an important compliance development, although it appears that the Account Guidance imposes new CIP-like obligations on investment advisers, commodity pool operators and commodity trading advisers, in addition to the OFAC screening that these firms may already be doing. There is also no guidance on whether identity verification procedures should be performed on counterparties to a firm's transactions, whether conducted as a principal or on behalf of a client/customer.
As part of this effort to recognize the interconnectedness between the OFAC Sanctions requirements and the BSA rules, the Account Guidance notes two important distinctions. First, under the BSA's CIP requirements, a securities or futures firm is not required to "look through" the accountholder (such as a trust or omnibus account) to determine the identity of the underlying beneficial owner. However, because the OFAC Sanctions apply to all property and interests of a sanctioned individual or entity in the control or possession of a US person, the Account Guidance suggests that a securities firm may want to obtain beneficial ownership information in some cases (such as accounts opened by non-US individuals or entities located in high-risk jurisdictions). The Account Guidance further states that as a part of a risk-based OFAC compliance program, it would be prudent for a securities or futures firm to verify some, but not necessarily all, beneficial owners, guarantors and principals.
The second difference is that in certain situations, the CIP rules permit one financial institution to rely on another financial institution with respect to identifying and verifying the identity of customers/clients that the institutions have in common. By contrast, the Account Guidance states that OFAC does not generally permit a securities or futures firm to shift its compliance liability to a third party that undertakes the securities or futures firm's OFAC compliance obligations. This calls into question, at least in certain circumstances, the reliance by a firm on certifications from service providers and intermediaries that they have conducted OFAC screening on presented transactions.
The Account Guidance provides clear direction on the extent to which securities and futures firms should screen names and addresses against the OFAC Sanctions. As part of an OFAC compliance program, the Account Guidance recommends that securities firms screen (i) new clients/customers and (ii) investments or transactions by or on behalf of such clients/customers. The Account Guidance is more explicit than prior OFAC statements that periodic screening on non-accountholders, such as beneficial owners, guarantors and principals, may be appropriate depending on the firm's risk profile. Although the Account Guidance does not make more than a passing reference to screening a securities or future firm's counterparties, vendors and the like, each firm should include policies and procedures in its OFAC compliance program that address the OFAC Sanctions risk of these parties.
The Account Guidance also focuses on when the identity verification and screening processes should be undertaken, although some ambiguity remains. OFAC states that the up-front due diligence should occur before the account is opened or within a reasonable time thereafter. It also suggests that securities and futures firms may need to restrict transactions until the identity verification and screening process is completed. At the same time, however, the Account Guidance acknowledges that some transactions may settle quickly (T+1) and, at a minimum, screening of accountholders and counterparties should occur when the account is opened or the relationship commenced. It is not clear in a T+1 transaction whether OFAC anticipates that identity verification would also occur.
The Account Guidance can be found here, and the Risk Matrix can be found here.
1 73 Fed. Reg. 51933 (Sept. 8, 2008).
2 The US Treasury's Financial Crimes Enforcement Network recently withdrew its notice of proposed rule making that would have required investment advisers and commodity trading advisers to implement a CIP. 73 Fed. Reg. 65567 (Nov. 4, 2008); 73 Fed. Reg. 65568 (Nov. 4, 2008). Commodities pool operators are also not subject to the CIP requirements.
