On April 24, 2024, President Biden signed into law H.R. 815 (Pub. L. 118-50), “Making emergency supplemental appropriations for the fiscal year ending September 30, 2024, and for other purposes” (the “Act”), which includes emergency supplemental appropriations related to national security and foreign assistance. Specifically, Section 3111 of the Act contains a provision to double the statute of limitations (“SOL”) from five to ten years for civil and criminal violations of the U.S. Department of the Treasury’s Office of Foreign Assets Control (“OFAC”) sanctions programs. The new SOL has immediate effect applicable to sanctions violations that are not yet time barred. The doubling of the SOL is authorized under the International Emergency Economic Powers Act (“IEEPA”) and the Trading with the Enemy Act (“TWEA”). This change means companies may now be held liable for violations of most OFAC sanctions for up to ten years after occurrence, significantly impacting compliance programs, mergers and acquisitions due diligence, and enforcement actions.

Background

Over the past year, the U.S. government has increasingly emphasized the importance of sanctions enforcement and self-disclosure of sanctions violations. In March 2023, Deputy Attorney General Lisa Monaco indicated heightened enforcement of sanctions laws, comparing them to the enforcement of Foreign Corrupt Practices Act violations. In July 2023, the U.S. Department of Justice (“DOJ”), OFAC, and the U.S. Department of Commerce’s Bureau of Industry and Security (“BIS”) issued a Tri-Seal Compliance Note, underscoring the necessity of compliance with sanctions, export controls, and national security laws, and encouraging prompt disclosure and remediation of potential violations.

Extension of Statute of Limitations

The Act’s Section 3111 extends the SOL for civil and criminal violations of IEEPA and TWEA from five to ten years for violations that are not yet time barred. IEEPA is the basis for nearly all OFAC-administered sanctions programs, while TWEA underpins the Cuba sanctions program. This extension grants OFAC and the DOJ more time to investigate and prosecute sanctions violations, thereby increasing the likelihood of identifying potential infractions.

Implications for Companies

1. Policies and Procedures for Information Retention: Companies should update policies and procedures to retain relevant information for at least ten years. OFAC’s regulations (e.g., 31 CFR §501.601) are expected to be amended accordingly, and failure to maintain records for the required period could result in violations.
2. Scope and Methodology of Internal Investigations: Companies should expand the scope of internal investigations to include transactions from the past ten years, likely increasing costs and resource demands.
3. Voluntary Self-Disclosures: The extended SOL may influence company decisions to voluntarily disclose violations given the longer time for regulatory oversight.
4. Due Diligence in Transactions: Companies should incorporate a ten-year evaluation of sanctions risk and compliance programs in due diligence processes for investments, mergers, acquisitions, and lending.
5. Representations and Warranties: Companies need to reassess and potentially extend representations and warranties related to sanctions compliance in relevant agreements to account for the new ten-year SOL.

Impact on Export Controls and Other National Security Laws

The Act does not change the SOL for violations under the Export Control Reform Act (“ECRA”) or the Arms Export Control Act, which govern the Export Administration Regulations (“EAR”) and the International Traffic in Arms Regulations (“ITAR”). However, the BIS is reviewing the Act to determine its impact on the EAR, as IEEPA previously served as its primary statutory authority before ECRA.

Additionally, the extended IEEPA SOL may affect national security controls related to information and communications technology and services, outbound investment, and sensitive data transfers, which are based on executive orders under IEEPA. These controls will now have a ten-year SOL.

New Sanctions

As a result of the increased risk of U.S. restricted technology controlled under the EAR and ITAR reaching the Government of Iran or Iranian-backed groups, Pub. L. 118-50 imposes stricter and more significant measures, particularly due to third countries providing direct and indirect support to Iran. The Iran-China Energy Sanctions Act of 2023 prohibits U.S. financial institutions from opening or maintaining certain accounts with foreign financial institutions that are (1) Chinese and engaged in the purchase of petroleum or petroleum products from Iran; or (2) engaged in the purchase of Iranian unmanned aerial vehicles (“UAVs”), UAV parts, or related systems.

The Rebuilding Economic Prosperity and Opportunity for Ukrainians Act (“REPO Act”, Division F of the Act) empowers the U.S. President to seize specific Russian state assets to aid Ukraine, including assets of the Central Bank of Russia, the Russian National Wealth Fund, and the Russian Ministry of Finance. The Fight and Combat Rampant Iranian Missile Exports Act (“Fight CRIME Act”, Division K of the Act) imposes blocking and visa sanctions on foreign individuals supporting Iran's missile and drone development programs, as determined by the U.S. President, including their adult family members. The Stop Harboring Iranian Petroleum Act (“SHIP Act”, Division J of the Act) mandates blocking sanctions within 180 days on foreign entities engaging in certain activities related to Iranian petroleum exports.

The SHIP Act also requires blocking sanctions, docking restrictions, and visa bans on foreign entities involved in supporting Iranian petroleum exports starting October 21, 2024, which includes owning or operating a vessel through which such owner knowingly conducts a ship to ship transfer involving a significant transaction of any petroleum product from Iran. Additionally, the Fight CRIME Act expands U.S. sanctions related to Iran's missile program, requiring blocking sanctions and visa bans on foreign entities engaged in specified activities starting April 24, 2024, including engaging in activities related to supplying and transferring specified “covered technology” necessary for missile development, production, and operation, or related goods,  technology, parts, or components to, from, or involving the Government of Iran or Iranian-backed groups.

What’s Next?

OFAC is expected to issue guidance on the implications of the expanded SOL on enforcement cases, internal investigations, and voluntary self-disclosures. The new ten-year SOL authority will likely result in increased enforcement and penalties, as OFAC can now pursue more violations without requiring tolling agreements or proving exceptions to the SOL.

The new SOL rule doesn't apply to past cases. If the five-year window for a possible crime or civil claim has passed, the Act won't bring it back. This applies even if the civil claim has already expired. Yet, if the five-year period hasn't finished, the new ten-year limit will count for both civil and criminal matters.

This legislative change underscores the need for companies to closely examine their sanctions risk profiles and compliance programs to mitigate potential liabilities and adapt to the evolving enforcement landscape.