Office of Foreign Assets Control (OFAC)

Subscribe to Office of Foreign Assets Control (OFAC)

October is National Cybersecurity Awareness Month, and the U.S. Department of the Treasury’s Financial Crimes Enforcement Network (“FinCEN”) and Office of Foreign Assets Control (“OFAC”) kicked off the month by issuing two advisories that aim to increase cybersecurity awareness, assist financial institutions in detecting and reporting ransomware activity, and highlight potential sanctions risks for facilitating ransomware payments.

The FinCEN and OFAC advisories signal the seriousness with which the Department of Treasury treats the threat of cybercriminals and ransomware attacks. Both FinCEN and OFAC have now squarely placed an obligation on financial institutions and other payment intermediaries to put procedures in place to detect ransomware payments and to restrict payments to blocked individuals. It appears FinCEN and OFAC want to make sure cybercrime does not pay by cutting off cybercriminals’ access into the financial system.

While both FinCEN and OFAC have offered guidance to financial institutions formulating policies and procedures for deciding whether to process or report payment requests that may be connected to ransomware attacks, OFAC has also offered a warning: facilitating ransomware payments may lead to an enforcement action and civil penalties. Given the growing national security concerns associated with ransomware attacks, the advisories rightly encourage financial institutions and other payment intermediaries that facilitate ransomware payments to share information via Suspicious Activity Reports (“SARs”) and to fully cooperate with law enforcement during and after ransomware attacks.…
Continue Reading FinCEN and OFAC Advisories Aim to Increase Cybersecurity Awareness and Thwart Ransomware Attacks in the Financial Sector

Is Art an “Ideal Playing Ground” for Money Laundering?

Last week, the Permanent Subcommittee on Investigations for the U.S. Senate released a detailed, 147-page report titled “The Art Industry and U.S. Policies That Undermine Sanctions” (“the Report”). Although the Report ostensibly addresses the evasion of U.S. sanctions law, much of the Report actually focuses on the connection between high-end art and potential money laundering schemes and anti-money laundering (“AML”) risks. Among other proposals, the Report recommends that the Bank Secrecy Act (“BSA”) be amended to include art dealers as “financial institutions” subject to AML obligations under the BSA.

The Report focuses on an elaborate case study documenting how certain Russian oligarchs allegedly used transactions involving high-end art and shell companies to evade U.S. sanctions, imposed on them on March 20, 2014 in response to Russia’s invasion of Ukraine and the annexation of Crimea. We will not focus on the detailed allegations in the Report regarding the particular facts of this alleged scheme, or the alleged involvement of certain major art auction houses. Rather, we will focus on the more general sections in the Report relating to systemic concerns about the potential role of high-end art in money laundering schemes, and the more general findings of fact and recommendations generated by these concerns.

The Report was not issued in a vacuum; rather, it clearly was written in part to spur legislative action. Proposed legislation on BSA/AML reform is pending before the U.S. Congress and Senate, including a proposal – currently nestled within a lengthy proposed amendment to a defense spending bill – to (i) add to the list of “financial institutions” covered by the BSA “a person trading or acting as an intermediary in the trade of antiquities, including an advisor, consultant or any other person who engages as a business in the solicitation of the sale of antiquities;” and (ii) require a study by the Secretary of the Treasury “on the facilitation of money laundering and terror finance through the trade of works of art or antiquities,” including an evaluation of whether certain art industry markets (“by size, entity type, domestic or international geographic locations, or otherwise”) should be regulated under the BSA. And, this general issue has been percolating for some time. Last year, we blogged in detail about the potential role of high-end art and antiquities in money laundering schemes, and the voluntary AML programs which art dealers might adopt to combat such schemes.…
Continue Reading Using Art to Evade Sanctions and Launder Money: The Senate Report

The Southern District of New York (“SDNY”) recently rejected a retaliation claim brought by a former bank employee under the Bank Secrecy Act (“BSA”), granting summary judgment in favor of the employer bank because the former employee failed to demonstrate that his firing was caused by his act of reporting a potential violation of law to the government. Although the reasoning underlying the Court’s Order is straight-forward, the case provides another reminder of the often difficult employment issues that both financial institutions and potential whistleblowers can face.

Whistleblowing as to alleged anti-money laundering (AML) violations is a growing phenomenon, perhaps best exemplified by the fact that a whistleblower precipitated the colossal Dankse Bank money laundering scandal. Previously, we blogged about a bank whistleblower case producing the opposite result as the SDNY Order here. In this post, we discuss both the BSA whistleblower statute and the SDNY Order, and, more generally, we note steps that financial institutions might take to protect themselves from liability and legitimate whistleblowers from retaliation.…
Continue Reading Would-Be Whistleblower Fails to Show Causation Under the Bank Secrecy Act for Termination

The Border with North Korea

Indictment Again Highlights the Role of Correspondent Banking in Money Laundering

On May 28, 2020, the U.S. Department of Justice (“DOJ”) unsealed a 50-page indictment against 28 North Korean and 5 Chinese bankers accused of using more than 250 front companies to obscure $2.5 billion in illicit financial dealings (“the Indictment”). The complex and far-flung scheme purportedly involved covert branches of North Korea’s state-owned Foreign Trade Bank (“FTB”)—all opened in foreign countries in an attempt to access the U.S. financial system, and to circumvent sanctions intended to guard against threats to national security, foreign policy, and the U.S. economy. The Indictment charges the individuals with conspiring to launder money, violations of the “international” prong of the money laundering statute (about which we have blogged), bank fraud, and violations of the International Emergency Economic Powers Act.

Although the Indictment is interesting standing alone, it also represents the latest in a series of enforcement actions involving North Korea and the U.S. financial system.…
Continue Reading 28 North Korean and 5 Chinese Bankers Accused of a $2.5 Billion Laundering Scheme

We are really pleased to be moderating the Practising Law Institute’s 2020 Anti-Money Laundering Conference on May 12, 2020, starting at 9 a.m. Perhaps needless to say, this year’s conference will be entirely virtual.  But the conference still should be as informative, interesting and timely as always.  Our conference co-chair, Nicole S. Healy of Ropers…

Second Post in a Two-Post Series

On March 19, 2020, Swedbank received its first sanction at the conclusion of parallel investigations by Swedish and Estonian authorities for its role in the seemingly non-stop Anti-Money Laundering (“AML”) debacle centered around Danske Bank and its now-notorious Estonian Branch. In the first of what will likely be multiple sanctions, Swedbank AB was ordered to pay a record 4 billion Swedish Krona ($38 million) and its subsidiary, Swedbank AS, has been ordered to improve its AML risk control systems to comply with applicable requirements.

In our first post, we discussed the various public AML-related investigations and enforcement actions plaguing Swedbank. In this post, we discuss the details and implication of the report of internal investigation regarding Swedbank’s alleged deficiencies in its AML processes performed by an outside law firm at the request of Swedbank, which has made the report publically available.

The Report is lengthy and detailed.  As we discuss, however, the Report highlights some basic, evergreen issues in AML compliance and enforcement: the need to implement adequate systems to manage high-risk customers; the need to identify beneficial ownership; the need for top management to understand and truly respect AML compliance; the need for transparency with regulators; and the need for transparency by financial institutions with investors and the public.

…
Continue Reading AML Problems Plague Swedbank: The Internal Investigation Report

AMA Details Components of a Strong AML/BSA Program for the Gaming Industry

Earlier this month, the American Gaming Association (“AGA”) released an updated Best Practices for Anti-Money Laundering (“AML”) Compliance (“Best Practices Guidance”) reflecting a heightened focus on risk assessment as well as Know Your Customer/Customer Due Diligence measures for the gaming industry.  This update amends the industry’s first set of comprehensive best practices for AML compliance, issued in 2014.  At the time, the best practices were well-received by the U.S. Department of Treasury’s Financial Crimes Enforcement Network (“FinCEN”).  These updated Best Practices have drawn from recent FinCEN guidance and enforcement actions, the Treasury Department’s National Money Laundering Risk Assessment, and the Office of Foreign Assets Control’s (“OFAC”) updated compliance guidelines and provide detailed guidance regarding how the industry can continue to be “a leader in compliance.”

…
Continue Reading AMA Updates AML Best Practices for AML Compliance

Organization Excels at Niche Branding but Stumbles in Avoiding Enforcement

The first paragraph of the press release sums it up:

Today the U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) took action against Evil Corp, the Russia-based cybercriminal organization responsible for the development and distribution of the Dridex malware.  Evil Corp has used the Dridex malware to infect computers and harvest login credentials from hundreds of banks and financial institutions in over 40 countries, causing more than $100 million in theft.  This malicious software has caused millions of dollars of damage to U.S. and international financial institutions and their customers.  Concurrent with OFAC’s action, the Department of Justice charged two of Evil Corp’s members with criminal violations, and the Department of State announced a reward for information up to $5 million leading to the capture or conviction of Evil Corp’s leader.  These U.S. actions were carried out in close coordination with the United Kingdom’s National Crime Agency (NCA).  Additionally, based on information obtained by the Treasury Department’s Financial Crimes Enforcement Network (FinCEN), the Treasury Department’s Office of Cybersecurity and Critical Infrastructure Protection (OCCIP) released previously unreported indicators of compromise associated with the Dridex malware and its use against the financial services sector.

The Department of Treasury press release is extremely detailed.  Summarized very broadly, it observes that OFAC’s designation targets 17 individuals and seven entities, including Evil Corp, its “core cyber operators, multiple businesses associated with a group member, and financial facilitators utilized by the group.”  The designation means that all property and interests in property of these persons subject to U.S. jurisdiction are blocked, and U.S. persons are generally prohibited in engaging in transactions with them.

As noted below, the U.S. government is alleging that these cyber criminals are working with the Russian government.  FinCEN and the Cybersecurity and Infrastructure Security Agency (CISA) of the Department of Homeland Security also have issued an Alert to financial institutions regarding how to try to detect, mitigate and report the presence of the pernicious Dridex malware.…
Continue Reading U.S. Treasury and DOJ Target “Evil Corp”

The Pink Mosque in Shiraz, Iran

On October 25, 2019, FinCEN issued a final rule imposing the Fifth Special Measure against the Islamic Republic of Iran as a “jurisdiction of primary money laundering concern” (“Final Rule”) under Section 311 of the USA PATRIOT ACT.  The Final Rule will prohibit the opening or maintaining of a correspondent bank account in the U.S. for, or on behalf of, an Iranian financial institution.  It also will prohibit the correspondent accounts of foreign financial institutions at covered U.S. financial institutions from processing transactions involving Iranian financial institutions.…
Continue Reading FinCEN Identifies Iran as a Jurisdiction of Primary Money Laundering Concern

The Hagia Sophia Church in Istanbul, Turkey

Indictment Alleges that Bank and its Officers Used Front Companies to Evade Prohibitions on Iran’s Access to the U.S. Financial System

The U.S. Attorney for the Southern District of New York has charged Turkish state-owned bank Halkbank (formally known as Türkiye Halk Bankasi A.S.) with money laundering, bank fraud and sanctions offenses under the International Emergency Economic Powers Act, or IEEPA, arising from the Bank’s alleged involvement in a multibillion-dollar scheme to evade U.S. sanctions on Iran. As alleged in the six-count indictment, senior officials at Halkbank designed and executed the Bank’s systemic and illicit movement of Iranian oil revenue moving through the Bank to give Iran access to the funds. This case is an extension of prosecutions initiated in late 2017 against nine individual defendants in the scheme, including bank employees and the former Turkish Minister of the Economy.…
Continue Reading DOJ Charges Turkish State-Owned Halkbank With Money Laundering, Fraud, and Iran-Related Sanctions Offenses