Published

Your Questions, Answered – Russia Sanctions: Impact on Your Third-Party Compliance Webinar

Recently, NAVEX hosted a webinar featuring Michael Volkov and Jessica Sanders from the Volkov Law Group, titled Russia Sanctions: Impact on Your Third-Party Compliance. If you missed the webinar, visit the events page to watch it on-demand.

During the webinar, we had a record number of questions from our audience and want to ensure they are addressed accordingly. Below are those questions from the attendees and responses from the presenters.

Which is your advice on End User Certifications? Should these be requested always or only when potential diversion risk is identified?

A robust End User Certification practice is critical to ensuring compliance with Russian Sanctions. It is important to obtain an end user certification from a customer (and a distributor) that affirms that the products will not be sold or transferred to a (1) prohibited entity or individual (Specially Designated National (including the prohibited oligarchs or entities that they control); (2) a prohibited Military End User or prohibited End Use (under BIS regulations) and (3) a restricted party subject to prohibitions on certain prohibited transactions). 

Normally, end user certifications should be secured where there is some risk of diversion. However, given the wide scope and application of Russia sanctions, we recommend that End User Certifications should be secured in most cases. The Russia Sanctions will be aggressively enforced and the standard for OFAC enforcement is where a party has “knowledge” or “reason to know” that a product may end up with a prohibited person or for a prohibited end use. Given this environment, we strongly urge our clients to secure such documentation.  

Is it prohibited to purchase a product from a company outside the U.S. that sourced some or all of the product from Russia?  If so, what level of knowledge or inquiry is required? 

This is a very difficult area in which to ensure compliance. To the extent a company purchases, directly or indirectly, a prohibited product or a product from a prohibited person or entity, the company may be held liable, even without specific knowledge that the prohibited person or product is in its supply chain. 

The e.l.f. Cosmetics enforcement action by OFAC establishes this precedent. In that case, e.l.f. was found liable for its sourcing through a Chinese supplier of eyelashes from a North Korean prohibited supplier. The company had no direct knowledge of this sourcing activity. In holding e.l.f. liable, OFAC cited the fact that e.l.f. Cosmetics failed to conduct any regular check of its supply chain as a key factor for imposing liability. Nonetheless, e.l.f. was held liable without any specific knowledge of the prohibited sourced material.  

We fully expect that OFAC will take a similar position here with the Russia sanctions enforcement. In the absence of evidence of knowledge, however, I do not expect that the Justice Department will initiate criminal enforcement of such conduct. That would be completely unexpected and unprecedented. OFAC is a civil enforcement agency and could bring civil enforcement actions against companies and individuals for supply chain violations.

Do the prohibited transactions with USD only include companies on the sanctions or SDN list?

We have received a lot of inquiries on this issue. The recent executive orders (on luxury goods and Russian specialty products) included prohibitions on export of U.S. dollar denominated banknotes.  OFAC also issued GL 18 which authorized banknote issuance by ATMs and for “personal remittances.” The scope of this prohibition is still subject to some interpretation – right now, we are advising clients that U.S. dollar wires, ACH transactions may be permitted, but U.S. dollar denominated banknotes may not unless authorized by GL 18. This means that U.S. dollar transactions may be subject to a variety of prohibitions, including transactions with SDNs, specified imported oil, Russian specialty items and luxury goods, along with prohibited transactions under BIS dual-use regulations and ITAR defense articles.  

Does OFAC require a company to screen (potential) investors?

OFAC expects that companies conduct due diligence and screening on investors to ensure that such investments do not violate sanctions (e.g., specially designated nationals or those subject to menu-based restrictions). Also, the U.S. issued two new Executive Orders that prohibited “new investments” in a range of products and services. To ensure compliance, it is critical to identify potential investors and to examine the potential investments to determine if they fall within the new prohibitions. This is a fast-moving issue and we expect more regulations to be issued in a coming days defining more on the “new investment” issue.

If we know our U.S. customer's end user is in Russia, what are our responsibilities in this transaction? 

If you know the end user is in Russia, you should definitely conduct due diligence and obtain certain assurances concerning the end user. If the ultimate end user is in Russia, we need to make sure the end user is not a prohibited person under OFAC regulations (Specially Designated National) or owned 50 percent or more by a prohibited person or combination of persons. In addition, an end user could be a designated entity subject to menu-based restrictions (e.g. 14 day limitation on new debt or equity). Further, depending on the BIS ECCN for a specific product or technology, the end user could be a prohibited military end user or military end use.  

In general, a U.S. Company can be held liable for the resale, reshipment or transfer of a product or service to prohibited end user where the company has knowledge or “reason to know” that the product may end up with a prohibited under user or for a prohibited end use.

With companies that are pulling out of Russia altogether, do you expect DOJ to be more lax in imposing penalties on sanctions violations during the wind-down of those operations?

Our view is that DOJ/OFAC and BIS are likely to aggressively enforce the Russia Sanctions. DOJ has specifically stated that it intends to enforce these sanctions. This position is unusual for DOJ to articulate so early in a sanctions program.  

For more information, here is a link to DOJ’s press release on the issue.

What is the responsibility of the multinational companies which have business in the U.S., with regard to transactions of their subsidiaries located in other countries?  

Under the Russia Sanctions program, the sanctions apply to “U.S. Persons,” which means, "any United States citizen, lawful permanent resident, entity organized under the laws of the United States or any jurisdiction within the United States (including foreign branches), or any person in the United States.”  

With regard to global subsidiaries, the Russia Sanctions apply to “foreign branches,” as well as U.S. citizens who work anywhere in the world (and green card holders), and foreign nationals when in the United States. U.S. Persons are also liable if they facilitate, aid or abet any specific transactions that would be prohibited if conducted by a U.S. Person.

In Conclusion

As this situation continues to evolve, it is important to stay up to date in order to maintain compliance with the Russia sanctions. NAVEX will continue to share resources to help keep your business in compliance. For more information about how the Russia Sanctions impact your third-party compliance:

Watch the Webinar


Chat with a solutions expert to learn how you can take your compliance program to the next level of maturity.



Sneak Peek: NAVEX Next 2022 European Risk and Compliance Virtual Conference

This NAVEX blog post provides a preview into the NAVEX Next Virtual Risk and Compliance Conference Europe 2022.

Previous/Next Article Chevron Icon of a previous/next arrow. Previous Post

Risk Management as a Business Enabler

What is the relationship between governance, risk and compliance – widely referred to as “GRC” – and business agility? This blog post discusses the hallmarks of a high-performing GRC program: agility, resilience and the organization’s impact on people and the environment.

Next Post Previous/Next Article Chevron Icon of a previous/next arrow.