OFAC Issues Guidance Concerning Statute of Limitations Extension

• OFAC has released guidance regarding the extension of the statute of limitations, from 5 to 10 years, for violations of the International Emergency Economic Powers Act (“IEEPA”) and the Trading with the Enemy Act (“TWEA”).
• In the guidance, OFAC clarified that it can now bring an enforcement action for civil violations of IEEPA- or TWEA-based sanctions prohibitions within 10 years of the latest date of the violation if such date was after April 24, 2019. In addition, OFAC plans to extend its recordkeeping requirements under 31 C.F.R. § 501.601 from 5 years to 10 years.
• Companies should prepare for these new changes by updating their compliance programs and record retention practices accordingly.

On April 24, 2024, President Biden signed into law the 21st Century Peace through Strength Act, Pub. L. No. 118-50 (the “Act”). By doing so, the statute of limitations (“SoL”) for violations, both criminal and civil, of IEEPA and TWEA, was extended from 5 years to 10 years, effective immediately. On July 22, 2024, the U.S. Department of the Treasury’s Office of Foreign Assets Control (“OFAC”) issued guidance (“Guidance“) regarding this SoL extension. The Guidance addresses how the SoL extension impacts OFAC’s enforcement approach and announces OFAC’s intention to change its recordkeeping requirements from 5 to 10 years. 

Overview of the Guidance

In the Guidance, OFAC makes clear that the new 10-year SoL applies to any IEEPA or TWEA violation that was not time-barred when the 10-year SoL was enacted on April 24, 2024. Because the law is not retroactive, OFAC may not bring an action for violations occurring outside the applicable SoL at the time the Act was passed. Consequently, OFAC may only commence an enforcement action for IEEPA or TWEA violations within 10 years of the latest date of the violation if such date was after April 24, 2019. Restated, it will not be until violations occurring on April 25, 2029, or thereafter, that OFAC can go back the full 10 years, from the date of the latest violation, and charge entities and individuals with respect to any TWEA or IEEPA violations occurring within 10 years of that (latest) violation.

In its Guidance, OFAC also explained that, through publication of an interim final rule, it plans to extend its recordkeeping requirement, found at 31 C.F.R. § 501.601, from 5 years to 10 years. Currently, this regulation requires “every person engaging in any transaction subject to the provisions of [IEEPA or TWEA to] keep a full and accurate record of each such transaction engaged in, regardless of whether such transaction is effected pursuant to license or otherwise, and such record shall be available for examination for at least five years after the date of such transaction.” OFAC expects the 10-year recordkeeping requirement will be in effect six months after publication of the interim final rule.

Practical Effects of the 10-Year SoL and Recordkeeping Requirements

The 10-year SoL for IEEPA and TWEA violations, in addition to the yet to be enacted 10-year recordkeeping requirement, is set to have significant implications in terms of companies’ sanctions compliance obligations. IEEPA is also the authority for various regulations outside the sanctions context as well, including certain programs administered by the Department of Commerce and the Department of Justice’s National Security Division. Companies should keep this in mind as they make changes to their compliance programs.

Updates to Record Retention Policies

Companies that previously had recordkeeping requirements with retention periods shorter than 10 years may have trouble retrieving records dating back more than 5 years, given they were only previously required to retain records for 5 years. Companies should consider modifying their record retention practices or policies going forward to account for the new 10-year SoL and expected recordkeeping requirement. Companies should also anticipate having to respond to government inquiries (including subpoenas) seeking information and documents going back 10 years related to IEEPA or TWEA violations.

Internal Investigations and Audits

Relatedly, companies engaging in internal investigations or audits who typically conduct a lookback to find all similar violations during the SoL period, should consider that the lookback period will continue to progressively increase, year-after-year, until it reaches its full 10-year scope on April 25, 2029. This is further illustrated in the table below:
 

Transaction-Related Due Diligence and Contractual Terms

Corporate transactions including credit facilities, investments, and mergers and acquisitions will be impacted by the extended SoL as well. Those lending to, acquiring, or investing in companies will want to tailor due diligence requests to account for the new SoL period perhaps using the lookback periods noted above. Parties to transactions may also consider changing representation and warranty provisions in relevant contractual documents to address the new SoL and expected changes to recordkeeping requirements.