Implications Related to the Doubling of the Statute of Limitations for Civil and Criminal Violations of Two Primary Sanctions Authorities

SUMMARY

On April 24, 2024, President Biden signed into law a foreign military support package (i.e., H.R. 815), which notably included a provision doubling the statute of limitations (“SOL”) from five to ten years for civil and criminal violations of the U.S. Treasury Department’s Office of Foreign Assets Control (“OFAC”) sanctions programs authorized under the International Emergency Economic Powers Act (“IEEPA”) and the Trading with the Enemy Act (“TWEA”). This means that the time for which companies may be held liable for a violation of most OFAC sanctions is now ten years instead of five years. Accordingly, this change can have significant consequences for compliance programs, mergers and acquisitions, and enforcement actions.

BACKGROUND

Over the past year, the U.S. government has been increasingly vocal about the significance of sanctions enforcement and disclosure of sanctions violations. In March 2023, Deputy Attorney General for the U.S. Department of Justice (the “DOJ”) Lisa Monaco signaled increased enforcement of sanctions laws, stating that “sanctions are the new [Foreign Corrupt Practices Act].” Later, in July 2023, a Tri-Seal Compliance Note, issued jointly by the DOJ, OFAC, and the U.S. Commerce Department’s Bureau of Industry and Security (“BIS”), emphasized the importance of compliance with sanctions, export controls, and other national security laws and encouraged promptly disclosing and remediating potential violations when discovered. A newly enacted law that doubled the SOL from five to ten years for sanctions violations of two key sanctions statutory authorities further underscores the need for companies to closely examine their sanctions risk profile and compliance programs.

EXTENSION OF STATUTE OF LIMITATIONS

While H.R. 815 authorized substantial foreign aid for Israel, Ukraine, and the Indo-Pacific region, the legislative package also included the 21st Century Peace Through Strength Act (the “Act”), which includes several provisions related to U.S. economic and trade sanctions. One of the more significant provisions, Section 3111 of the Act, extended the SOL from five to ten years for civil and criminal violations of IEEPA and TWEA, which are the primary statutes underlying economic and trade sanctions programs administered by OFAC. IEEPA is the statutory basis for almost all sanctions programs administered and enforced by OFAC; TWEA serves as the statutory basis for the Cuba sanctions program. As a result of the Act, civil and criminal violations of IEEPA and TWEA-based sanctions programs are now subject to a ten-year SOL. OFAC and the DOJ now have considerably more time to investigate and bring enforcement actions for sanctions violations of affected sanctions programs, increasing the likelihood that they will identify potential violations.

The doubled SOL also is likely to have a significant impact on how companies approach sanctions risk and compliance. We highlight certain potential implications below.

• Policies and procedures related to retaining and maintaining information. Companies should review and consider updating policies and procedures related to retaining and maintaining information relevant to sanctions compliance for at least ten years. In some cases, a company’s overall recordkeeping policy may need to be revised. We expect OFAC to update relevant regulations and conditions related to recordkeeping requirements to account for the extended SOL. Not maintaining information for the required length of time could result in violations of OFAC’s Reporting, Procedures and Penalties Regulations, especially if companies are unable to identify or produce relevant information dating back ten years.
• Internal investigations scope and methodology. Companies now need to consider whether the scope of internal investigations include reviews of relevant transactions dating back ten years instead of five years, which is likely to increase internal investigation costs and time and demand more resources. The methodology of how transactions are reviewed during internal investigations also may be affected, depending on the number of transactions and amount of information to be reviewed.
• Voluntary self-disclosures of apparent violations. The new ten-year SOL likely will affect companies’ decisions to voluntarily self-disclose apparent violations of sanctions. While the ability of OFAC and DOJ to investigate and charge for apparent violations for a ten-year period may make filing a voluntary self-disclosure attractive because of the significant mitigation the agencies afford for voluntary self-disclosures, companies must weigh those benefits against the potentially significant increase in costs and time and demand on resources associated with conducting a ten-year internal investigation.
• Deal due diligence. Companies considering potential investments, mergers and acquisitions, lending, or other deals should consider whether related due diligence should include evaluation of sanctions risk and compliance programs dating back ten years. Buyers in mergers and acquisitions should assess potential increased costs of extended liability.
• Representations and warranties. Related to deal due diligence, companies should revaluate representations and warranties related to sanctions risk and compliance in investments, mergers and acquisitions, lending, and other agreements to ensure the relevant language appropriately addresses the new ten-year SOL.

IMPACT ON EXPORT CONTROLS AND OTHER NATIONAL SECURITY LAWS

The Act does not affect the SOLs related to civil and criminal violations of the Export Control Reform Act (“ECRA”) or Arms Export Control Act, which are primary statutes that underlie the Export Administration Regulations (“EAR”) administered by BIS and the International Traffic in Arms Regulations (“ITAR”) administered by the U.S. State Department’s Directorate of Defense Trade Controls. BIS has publicly indicated that it is reviewing the Act to determine whether elements of the EAR may be affected because for several years IEEPA served as the primary statutory authority for the EAR before ECRA was passed.

In addition, the extended IEEPA SOL may have implications for national security controls related to information and communications technology and services, outbound investment, and transfers of bulk sensitive personal data, which are based on executive orders issued pursuant to IEEPA. Other controls issued under the authority of IEEPA would carry the same ten-year SOL.

WHAT’S NEXT?

We expect OFAC to issue written guidance about the effects the expanded SOL will have on existing and future enforcement cases, including with respect to internal investigations and voluntary self-disclosures. We also expect OFAC to leverage the new ten-year SOL authority in its enforcement processes and enforcement of sanctions violations, potentially resulting in even more enforcement and larger penalties due to the ability to include additional violations without the need for tolling agreements or demonstrating exceptions to the SOL.