On October 27, 2015, the United States Department of the Treasury’s Office of Foreign Assets Control (“OFAC”) issued a web notice of its settlement with Gil Tours Travel, Inc., a Philadelphia-based travel company. The company was hit with violations under the Cuban Asset Control Regulations (“CACR”), 31 C.F.R. Part 515. According to information released by OFAC, the company violated the CACR when it dealt in property in which Cuba or Cuban nationals had an interest. In short, it seems that Gil Travel provided prohibited travel-related services without authorization from OFAC. The base penalty for the violations totaled $97,500; Gil Travel settled with OFAC for $43,875.

In its application of the Enforcement Guidelines, 31 C.F.R. Part 501 Appendix A, one of the aggravating factors cited to by OFAC was Gil Travel’s failure to have a compliance program in place, even when it knew there was a potential to implicate a sanctions program administered by OFAC. Time and time again, U.S. businesses get hit with steep civil penalties from OFAC after-the-fact, and Gil Travel is just the latest example. Not only could companies decrease the likelihood of an OFAC civil penalty, but in the event a penalty is inevitable, they could have a much stronger case for a mitigated penalty if the company can point to a compliance program and demonstrate a good faith effort to adhere to OFAC sanctions compliance.

So why don’t more companies have a compliance program in place? There seems to be misconceptions that the development and implementation of a robust compliance program is too financially burdensome, taxing on company resources, or simply unnecessary. This holds true for companies of all sizes, but especially for small businesses that don’t have the manpower or resources to implement a large-scale compliance program. However, if one were to compare the cost of an OFAC civil penalty with the cost of developing a tailored compliance program and training employees so that the program is carried out effectively, surely the latter is more cost effective in the long-term.

Although it may seem daunting, developing a compliance program is not an insurmountable task. There are a number of online resources available that provide a framework for developing an effective compliance program. For example, the United States Department of Commerce’s Bureau of Industry and Security (“BIS”) has published comprehensive guidelines on how to create a compliance program. Although the guidance is intended for the import/export industry, it can still serve as a useful baseline tool to identify the elements of a successful compliance program. The United States Department of State’s Directorate of Defense Trade Controls (“DDTC”) has published similar guidance. While not nearly as comprehensive as the guidance from BIS, it still touches upon some of the basic elements of an effective compliance program.

Finally, let’s not forget guidance published by OFAC. While the guidance varies by industry, the risk matrices are particularly helpful when presented with a situation where there is a sanctions risk involved. The matrices help to ask the right questions, determine the level of risk, and ultimately, decide whether to proceed with a transaction or simply walk away.

When building a compliance program from the ground up, management should first address the importance of sanctions compliance by issuing a directive that sets the tone for the company as a whole. The company should also undertake an overall risk assessment, taking into consideration a company’s customer, product, and activity profiles, its distribution channels, the complexity and volume of its transactions, its operating environment, and the geographic risk of where it does business. Once those factors have been defined, a company can review the import, export, and sanctions regulations of relevant countries, including the reach of U.S. jurisdiction, and draft a program that best suits the needs of the company.

In addition to online resources, experienced compliance counsel can provide guidance when building a program sufficient to cover all potential scenarios that may arise. Moreover, counsel can help to identify gaps in current compliance programs to help avoid potential pitfalls, which could lead to violations.

At the end of the day, a compliance program is only as effective as the personnel administering it. Employee training is an essential element to any successful compliance program. Moreover, employee training must adapt as changes to sanctions programs and regulations occur. Keeping staff actively in the loop with compliance will help to minimize the chance that a transaction will slip through the cracks.

Although the institution of a robust compliance program may not prevent an OFAC investigation, it can certainly serve to argue for a mitigated penalty. It happens to often that companies are forced to implement a program after they’ve been hit with a substantial civil penalty, and moreover, suffered damage to their business reputation. With the plethora of resources available, and OFAC’s enforcement actions as guidance, every company that may slightly implicate sanctions in their day-to-day activities should jump on the bandwagon and get an effective compliance program in place.

The author of this blog post is Margaret Ververis, an OFAC attorney specializing in sanctions compliance and criminal defense matters. If you have any questions, please contact her at 202-440-2581 or ververis@ferrariassociatespc.com.