Category Archives: All

Export Compliance in 11 Words

Introducing a Twelve-Part Blog Series on Export Compliance Essentials

If you’re a newcomer to the world of U.S. export controls and you’ve just been charged with setting up an export compliance program for your firm, we wouldn’t at all be surprised to hear that you’re feeling a little overwhelmed right now. Does “bewitched, bothered, and bewildered” describe your state of mind as you struggle to make sense of the export laws and regulations and sort out which ones apply to your company? Are you wondering where to start?

If you’re finding export compliance to be a daunting task, rest assured that you’re not alone. The ever-changing complexities of U.S. export laws and regulations, licensing requirements, economic and trade sanctions, arms embargoes, and other legal and regulatory constraints present unique challenges to U.S. exporters as they strive to meet their business objectives while remaining compliant. Actually, taking on those challenges successfully without the proper training and support is more than just daunting, it’s impossible.

At Export Compliance Solutions, we’ve gained quite a lot of experience over the years helping our customers — small and medium-sized businesses and organizations of all kinds, and some of the big guys, too — identify, analyze, resolve and mitigate the regulatory issues and risks of selling in the international marketplace. Based on that experience, we’ve prepared a brand-new blog series for you, in which we share the most important lessons we’ve learned, condensed and summed up in 11 key words. The twelve posts (including this one) that you’ll be reading over the next several weeks will by no means cover everything there is to know, nor will they answer all your questions about export controls. What this series will do for you is lay a solid groundwork for understanding how to protect your business against export violations. “Export Compliance in 11 Words” will provide you with a sound starting-point for formulating an intelligent and practicable export compliance plan tailored to the needs and realities of your business.

Here’s an overview of what’s ahead:

ANALYZE – Because every business is different, there is no such thing as a generic, all-purpose, one-size-fits-all corporate export compliance program. Processes and procedures that are critical components of another company’s compliance strategy may be impracticable in scope and inappropriate in subject matter for yours. A program that doesn’t fit your needs will waste time, money, and personnel, and may even weaken your competitive advantage, while providing little or no protection against violations, fines, and penalties in the areas where your business is actually most vulnerable. But you can’t design a program that effectively addresses the real risks your company faces until you are confident you know what those risks are. That’s why conducting a strategic risk analysis of your business from an export-compliance standpoint — preferably alongside an outside expert — is an indispensable prerequisite to everything else. The company’s past, present, and future export customers, products, and services; the likelihood of certain kinds of violations; the controls and personnel already in place; the current regulatory environment and trends; the potential severity of fines and other consequences — all these issues and others need to be discussed in detail, analyzed, and evaluated before written policies and procedures are formulated and put in place.

EDUCATE – The oversight and management of corporate export compliance in today’s world requires substantial and ongoing professional training, including — but by no means limited to — a thorough familiarity with all the applicable U.S. Government laws and regulations. Once you’ve acquired the necessary training and knowledge yourself, your number one priority as a compliance officer should be training others in your company. The goals of this training should be (1) instilling and maintaining a high level of export compliance awareness company-wide and (2) ensuring that management and employees at all levels understand their export control responsibilities and have the appropriate competencies and skills to carry them out effectively, so that exports are made in compliance with both U.S. laws and regulations and the company’s best interests.

CLASSIFY – Export compliance personnel must know their company’s products and services, clearly identify, flag, and classify those categories of products, services, or technical data which are subject to export controls, and fully understand which regulatory requirements apply to each category. They must also know their company’s customers and be able to pinpoint risks and vulnerabilities from a regulatory standpoint.

SECURE – Responsible information-handling practices are critical to export compliance. You are responsible to protect your company’s controlled technical data and information against access by unauthorized persons, both on the ground and in the cloud, not only inside your facilities, but wherever your business and its workforce interfaces with the global marketplace. Your employees need to know that if they’re sharing technical data, such as plans and blueprints, even within the U.S., or if they’re allowing the visual inspection of ITAR-controlled articles by foreign nationals, they’re exporting technology; and if they’re doing these without proper authorization, they’re committing an export violation.

SCREEN – “Screening” is the process of checking and cross-referencing the parties involved in an export transaction against the many, continually updated lists of restricted or denied parties maintained by various governments and government agencies. If you’re a frequent or regular exporter (or are actively seeking to market your goods and services more widely overseas) and you aren’t routinely using some kind of Restricted-Party Screening (RPS) software to screen your customers, consignees, suppliers, employees, etc., you’re a fool. But you’re an even bigger fool if you are relying on RPS software alone to flag high-risk transactions and detect potential compliance problems. Even with the necessary screening software in place and properly configured to your company’s needs, the dictum remains true: your company’s employees are your ultimate line of defense — which is why their training and motivation is absolutely critical to compliance.

DOCUMENT – Certain specific recordkeeping for export transactions is mandated by the EAR, the ITAR, and the various OFAC Sanctions programs. But an effective corporate compliance program ought to be tracking and documenting much more than that bare minimum. Not only do transaction and licensing records need to be complete, accurate, and secure, they also need to be readily accessible in case of a compliance audit or other investigation.

COMMUNICATE – Proper communications are essential to export compliance. Critical compliance communications include the timely filing of the multiple reports mandated by U.S. export laws and regulations, enforced by the regulatory agencies, as well as having procedures in place for making prompt voluntary disclosures when violations or possible violations are discovered. It also means developing a communications strategy for keeping management, employees, suppliers, and customers in the loop about regulatory changes and all other compliance-related concerns and issues, as needed.

MONITOR – Even the most carefully formulated policies and procedures are meaningless if actual, real-life compliance with them is not checked and verified, and if instances of possible or actual non-compliance are not reported and promptly addressed. Moreover, if the monitoring of internal compliance processes is only sporadic, occasional, or random at best, it is not likely to be effective, and consequently the risk of violations occurring will be high. But reliable, continuous monitoring and control of processes and procedures necessitates building and maintaining an appropriate infrastructure.

ASSESS – A corporate export compliance program is properly focused on identifying and mitigating risks and vulnerabilities. To evaluate the effectiveness of your compliance efforts, frequent internal assessments and audits of processes and procedures are indispensable. So are periodic independent outside reviews of your overall compliance policies and program. It is critically important that the findings and recommendations of these reviews be reported to top management. Short-term and long-term follow-up on the implementation of corrective measures and program improvements should be an integral part of the review process.

ADAPT – Regulatory, technological, and business environments are rapidly and continually changing, and those changes are unavoidably impacting your company. “Innovate or die” is a common adage in the business world, and, while it may sound a bit melodramatic, it expresses a simple truth. If your company is surviving — and, we hope, thriving! — it’s safe to say you’ve made some significant changes over the last couple of years, and that’s all to the good. But if your export compliance program isn’t changing and adapting along with the rest of your business, your company’s survival may be at risk.

OWN – An effective export compliance program requires buy-in, visible involvement, and credible commitment on the part of top management — communicated, among other ways, by the allocation of adequate personnel and resources to the compliance function. When this sort of management commitment is perceived, when employees see that management is taking compliance seriously, company-wide engagement and employee motivation are likely to follow. Your compliance standards and policies, as well as the rationale behind them, should not only be spelled out explicitly in writing, but also well understood and acknowledged by each employee. Individual export compliance responsibilities need to be clearly articulated and included in job descriptions to ensure personal accountability and ownership. Moreover, your employees need to know that rules and procedures will be strictly enforced. The predictable result of not clearly assigning ownership of a process is a failed implementation of the process.

It is often said that without a top-down, pervasive corporate culture of compliance, no export compliance program will ultimately succeed. That may sound trite, and perhaps a bit corny, but it is nonetheless true, and its importance should not be underestimated. The human element remains the key to compliance. If you’re training your employees so they know how to do the right thing and motivating them so they want to do it, you’re on the way to creating a risk-aware corporate culture of compliance—the necessary foundation for any effective export compliance program.

Sound like information you need to know? If you’re new to export compliance responsibilities, or if you’re already dealing with U.S. export controls and would appreciate an update and review of the basics, you won’t want to miss a single one of the posts in this series. Sign up today for a free subscription to An EAR . . . to the ITAR and we’ll notify you of each new installment during the weeks ahead.

(None of the information is intended to be authoritative official or professional legal advice. Consult your own legal counsel or compliance specialists before taking actions based upon this blog or other unofficial sources.)

BIS Proposal Mirrors OFAC Penalty Guidelines: How Will This Impact Your Compliance Program?

On December 28, 2015, the Commerce Department’s Bureau of Industry and Security (BIS) published a Proposed Rule (80 FR 80710) that—if adopted—would revise the agency’s guidance concerning the settlement of civil (a.k.a. administrative) enforcement cases for export violations under the EAR.

The proposed changes would not apply to penalties imposed in civil cases involving Restrictive Trade Practices and Boycotts (Part 760 of the EAR), for which the current enforcement guidance in Supplement No. 2 of Part 766 would still apply; nor would they apply to penalties in criminal cases, which BIS refers to the Department of Justice for prosecution.

BIS will accept comments on this Proposed Rule until February 26.

What is BIS’s reason for revising the current guidelines?

The preamble to the proposal states that this revision is intended “to make administrative penalties more predictable to the public.” A second reason given is perhaps the most important one: to bring the Commerce Department’s enforcement policies into line with the penalty guidelines followed by the Treasury Department’s Office of Foreign Assets Control (OFAC).

In 2009, OFAC put into place a revised set of Economic Enforcement Guidelines for the Treasury Department’s sanctions programs. Since then, “the OFAC Guidelines” have provided a helpful framework of factors used by OFAC to determine whether or not to impose monetary penalties, and if so, how much. What BIS is now proposing is essentially a rewrite of its current “Guidance on Charging and Penalty Determinations in Settlement of Administrative Enforcement Cases” (found in Supplement No. 1 to 15 CFR Part 766) to make it substantially similar to those OFAC guidelines.

Greater transparency to the exporting community, harmonization of licensing policies and definitions among the regulatory agencies, and better coordination of enforcement actions are certainly laudable goals. They were important objectives of Phases I and II the U.S. Government’s Export Control Reform Initiative (ECR) when it was launched in 2010.

What will change if these guidelines are implemented?

Perhaps the most significant change is that the Proposed Rule would amend the factors BIS will consider when deciding whether to pursue administrative charges or settle allegations of EAR violations and when setting penalties in civil enforcement case settlements; it also explains how penalties would be calculated. The current BIS guidelines only list the factors to be taken into account in determining appropriate enforcement. The revised guidelines now under consideration—patterned after OFAC’s Guidelines—would use the transaction value to determine a baseline for assessing a civil penalty, applying a systematic calculation method set out in the Proposed Rule.

Under the proposed guidelines, BIS would first decide whether an enforcement case should be categorized as egregious or non­egregious. (Some of the factors that would enter into their decision are explained in the proposal.) They would also look at whether or not the apparent violations had been voluntarily disclosed by the exporter. These two factors, taken together with the transaction value (defined as the total U.S. dollar value of the transaction) and the maximum applicable penalty for each violation, as fixed by law, would be used to calculate a “base amount” for assessing penalties in the case. (The formulas to be employed in that calculation are explained in detail in the proposal.) Next, the agency would ascertain how many apparent violations of the EAR had occurred.

Finally, the presence of certain aggravating factors (e.g., indications of willfulness or recklessness, extent of harm done to the goals of the regulatory program) and/or mitigating factors (e.g., evidence that effective remedial measures were promptly taken, exceptional cooperation with OEE, likelihood that a license would have been approved if applied for) and/or general factors (e.g., an operational corporate compliance program conforming to the BIS guidelines for exporters)—these would all be considered and weighed to decide whether the penalty should be adjusted downward, or upward (capped by the statutory maximum), and by how much.

The maximum legal penalties for violations of the EAR would not be affected by the Proposed Rule. The Export Administration Act (EAA) of 1979— the legal basis for U.S. export controls on dual use items—actually lapsed in 2001 and has never been reauthorized by Congress. At present BIS derives its statutory authority to administer and enforce the EAR from the International Emergency Economic Powers Act (IEEPA), the same statutory authority by which OFAC implements most of its economic sanctions programs. Under the terms of the IEEPA, the maximum applicable penalty for civil violations can be as high as $250,000 for each violation, or twice the value of the transaction, whichever is greater. (If you are thinking that’s a very steep fine, you’re entirely right. Consider, however, the penalties associated with criminal violations under the IEEPA: a fine of up to $1 million or 20 years in prison. Or both. For each violation.)

Is this proposed change likely to result in higher penalties than we’re seeing now?

That’s a good question, but it’s hard to answer with any certainty. It will largely depend on BIS. Under the Proposed Rule, the penalty amounts would still be determined by the agency on a case-by-case basis, and the revised guidelines allow considerable enforcement discretion. Very considerable discretion.

BIS says it wants to retain sufficient administrative flexibility under the revised guidelines to allow proportionality in its enforcement actions. Instead of being tightly bound to mechanical penalty calculations, the agency will consider the totality of the circumstances in each case and tailor its response to the seriousness of the violation. Be that as it may, the trade-off for greater flexibility in regulations is always less certainty and predictability. That’s one reason why it isn’t entirely clear how the proposed guidelines would affect the size of civil penalties imposed.

One thing is quite clear: the Proposed Rule provides for significantly higher civil penalties in “egregious” cases. BIS assures exporters that it expects the vast majority of apparent violations investigated by its Office of Export Enforcement (OEE) to fall into the “non-egregious” category. Judging by the record of OFAC, which has been following a similar enforcement approach over the last six years, that does seem very likely. But it isn’t as reassuring as it might be. Here’s why: in addition to determining the penalty amount for each violation, BIS expressly retains the administrative discretion to determine how many violations have occurred in an enforcement case. If you’re thinking that this is simply a matter of knowing how to count, think again. Even under the current guidelines, OEE has been known to “pile on” violations in certain cases. What that means is something like this: if the identical incorrect information (say, a wrong EECN, description, or monetary value) has been entered in multiple fields of the AES filing, it may be counted—at OEE’s discretion—either as a single export violation or as multiple separate violations, and be charged accordingly. In this way, even “non-egregious” violations can result in unexpectedly large penalties.

And there are other reasons why it’s hard to predict the impact of the revised guidelines on the size of penalties: the definitions of some key regulatory terms in this Proposed Rule are less than precise. Take the term “transaction value,” for example. Under the Proposed Rule, this value is to be the starting point for most penalty calculations. That means it is critically important that we know precisely how BIS will determine the “transaction value” in a given enforcement case. Regrettably, the definition of this term provided in the Rule raises more questions than it answers:

Transaction value means the U.S. dollar value of a subject transaction, as demonstrated by commercial invoices, bills of lading, signed Customs declarations, or similar documents. Where the transaction value is not otherwise ascertainable, BIS may consider the market value of the items that were the subject of the transaction and/or the economic benefit derived by the Respondent from the transaction, in determining transaction value. In situations involving a lease of U.S.-origin items, the transaction value will generally be the value of the lease. For purposes of these Guidelines, ‘‘transaction value’’ will not necessarily have the same meaning, nor be applied in the same manner, as that term is used for import valuation purposes at 19 CFR 152.103.

What do you think of that definition? Clear . . . or cloudy? Egregious or non-egregious? Once these guidelines have been finalized and implemented, BIS will presumably provide answers to some of the questions exporters will surely be asking about this: What transaction is the “subject transaction”? How will the referenced documents be used in determining its value? What happens when the documents contain inconsistent information? In what circumstances is the transaction value considered to be “not otherwise ascertainable”? How will “market value” and “economic benefit” be evaluated? Which of these two values will be prioritized? Once we know how BIS understands this and other key terms in the revised guidelines, we’ll be in a better position to assess the impact of the changes on penalty amounts.

Should we expect to see more enforcement actions by BIS if this rule is implemented?

Yes, you can definitely expect to see more enforcement actions by BIS, but probably not as a result of these revised guidelines—at least, not directly.

BIS says it does not expect the adoption of this Proposed Rule to increase the number of cases which are charged administratively—and which therefore result in monetary penalties, rather than being closed with a warning letter. We have no reason to doubt that statement. Nevertheless, BIS’s statistics show without a doubt that it has been drastically ramping up its enforcement of the EAR over the past several years. The agency has significantly increased its manpower, enhanced its enforcement tools, and broadened the scope of its investigations. Its pursuit of export violations—both civil and criminal—has intensified each year. There is every reason to believe that trend will continue.

Insofar as clearer rules, more explicit guidance, and greater alignment with other agencies (such as OFAC) will allow more cases to be brought forward, and either settled or charged, we expect the implementation of this Proposed Rule to facilitate the current trend.

Will Voluntary Self-Disclosures still be a mitigating factor under this Proposed Rule?

Technically, no. Voluntary Self-Disclosures are no longer stated to be “mitigating factors” per se.

But actually, yes. And that’s a very definite yes. Under this Proposed Rule, which closely follows the OFAC Guidelines, whether or not the exporter has submitted a VSD is the second most significant component in establishing the base penalty amount. So, this new proposal is entirely in keeping with BIS’s longstanding policy of strongly encouraging voluntary notifications of violations. Export violations that were completely disclosed in timely VSD would be afforded more significant deductions in the base penalty amount than would have been afforded if BIS had discovered the violation independently.

According to BIS, only three percent of VSDs submitted over the past several years have resulted in a civil penalty. In most cases, BIS says, VSDs result in the issuance of warning letters.

BIS’s enforcement statistics, as well as the penalty calculation formulas in the Proposed Rule, indicate that an exporter would be wise to voluntarily self-report as soon as possible whenever a potential violation is discovered. Of course, whether or not a VSD is warranted by your company’s specific circumstances is a matter you should discuss with your corporate legal counsel. Generally speaking, however, submitting a full voluntary self-disclosure, including an account of corrective measures immediately taken to guard against future violations, is likely to limit potential penalties.

One caveat though: BIS does not look favorably on exporters who submit untruthful or misleading VSDs, or attempt to conceal some of the facts.

Would the implementation of this Proposed Rule be good news or bad news for U.S. exporters?

On the whole, probably good news.

Good News #1: Despite the uncertainty and unpredictability we noted above, due to BIS’s broad discretionary power in enforcing the EAR, the new guidelines should aid exporters—at least, to some extent—in estimating the range of likely penalties, especially for export violations that involve both the EAR and OFAC sanctions programs.

Good News #2: The trade-off for uncertainty and unpredictability, as we also noted above, is enforcement flexibility. In settlement negotiations, we would expect the flexibility and discretionary powers retained by BIS under this Proposed Rule to work in an exporter’s favor. In appropriate cases, BIS has the authority to suspend or defer payment of a civil penalty, taking into account whether the Respondent has demonstrated a limited ability to pay, whether the matter is part of a global settlement with other U.S. Government agencies, and/or whether the Respondent has agreed to apply a portion or all of the funds suspended or deferred for purposes of improving the company’s internal compliance program. Should your company ever be the Respondent, we’re certain you’ll see that as good news!

Good News #3: Even now, while the new guidelines are not yet in place, the Proposed Rule is already very helpful to exporters, as an indication of the approach to settlement and penalty determinations that BIS is likely to take in the years ahead.

What else should I take away from this?

One more thing: in case this wasn’t already abundantly clear to you, the Proposed Rule makes it even clearer: creating, maintaining, and prioritizing a comprehensive corporate compliance program that incorporates all the key elements identified in the BIS Compliance Guidelinesincluding written guidelines that tell your company’s employees exactly what is expected of them and provide a framework for senior management to engage intelligently with all compliance issues—is a critical requirement for every U.S. exporter, and is certain to become even more critical in the months and years ahead.

(None of the information is intended to be authoritative official or professional legal advice. Consult your own legal counsel or compliance specialists before taking actions based upon this blog or other unofficial sources.)

Revising U.S. Export Controls: ISIS Network Poses Challenges

As the year 2015 draws to a close, fifteen of the twenty-one categories on the U.S. Munitions List (USML) have been revised as part of the U.S Government’s Export Control Reform Initiative (ECR). For three others— Categories XII (Fire Control/Sensors/Night Vision), XIV (Toxicological Agents), and XVIII (Directed Energy Weapons)—public comments have been received on new Proposed Rules, but have not yet been acted on. The revisions for the remaining three categories—I (Firearms), II (Artillery), and III (Ammunition)—have not yet been published in proposed form. As was the case with previous changes, the new rules are expected to create positive lists for each category and transfer the export jurisdiction for some types of ammunition, ordnance, and other items from State to Commerce. As the State/DDTC web site explains, the ECR initiative “is designed to better protect America’s most sensitive defense technologies, while reducing unnecessary restrictions on exports of less sensitive items.”

Precisely when these last three categories will be revised, and what the changes will be, is not clear. Work on them continues, but the wait shouldn’t be too long, because State has indicated that its goal is to finalize this initial review and revision of the entire USML in 2016.

What are the actual effects of the revisions so far? That’s a natural question at this point, but measuring and assessing the contribution of ECR is complex and challenging.

The Commerce Department has just made that task a little easier, however. On November 2, the Department’s Office of Technology Evaluation (OTE) launched a new BIS Data Portal, which makes available to the public, for the first time, regularly updated aggregate information on the numbers and kinds of export licenses issued and current U.S. export trends. The new web portal offers a valuable analysis of controlled trade with select countries, charting the ongoing impact of ECR, and exporter compliance, with tables, graphs, and Defense Industrial Base studies that users can download in either PDF or Excel format. Among the encouraging data items posted by BIS are numbers showing a steady decrease in the average processing time for a license, despite a dramatic increase in the number of applications processed.

As for the effects of ECR to date, according to the OTE’s early analyses, the regulatory changes that have been made since the initial implementation went into effect in October 2013 are already speeding up the export process significantly and helping U.S. defense companies export more goods, during a period when the U.S. defense budget is being cut and military spending is declining, while military spending in other parts of the world—especially Asia, the Middle East, Eastern Europe, and Africa—on the rise.

At this stage, it is probably fair to say that the shifting of many controlled items from the USML to the less restrictive Commerce Control List (CCL) has made exporting considerably easier for many small and medium-sized U.S. companies. For large firms in the U.S. defense sector, however, the very welcome expansion of export opportunities has been accompanied by an unwelcome sharp increase in compliance expenditures (in the short term, at least) as they grapple with the complexities and uncertainties of adjusting to the ECR changes, reclassifying products and product lines, reevaluating risk profiles and projected compliance costs vs. anticipated sales revenue, and making sure that the continuing stream of new compliance and cybersecurity requirements “flows down” to their subcontractors.

Transitioning has proved to be somewhat more difficult than anticipated. In recognition of this, on October 3, 2015, the DDTC posted an Industry Notice with updated guidance extending the two-year time periods originally permitted to defense exporters for transitioning to BIS export authorizations.

The extent to which some of the other hoped-for benefits of ECR—such forestalling the offshore outsourcing of high-tech production capabilities and generating jobs for U.S. workers— have been realized is harder to assess at this point.

Meanwhile, on the world scene, an in-depth investigative news story entitled “ISIS: The Munitions Trail” by Erika Solomon and Ahmed Mhidi, published in the Financial Times on November 30, sheds considerable light on how and where the militant movement calling itself the Islamic State, or ISIS, gets its guns, artillery, and ammunition—the three categories of military equipment on the USML that are still awaiting revision. It also raises hair raising questions about the effectiveness of the U.S. export control system, and highlights the enormous and growing challenges it now faces after two years of changes under ECR.

According to the FT investigation, the terrorist group is awash in funds from the sale of oil on the black market and several other sources, and is abundantly furnished with captured light and heavy arms (including a great deal of U.S.-made military equipment). Its most urgent, ongoing need is for vast quantities of ammunition:

ISIS seized weapons worth hundreds of millions dollars when it captured Iraq’s second city, Mosul, in the summer of 2014. Since then, in every battle that it has won, it has acquired more material. Its arsenal includes US-made Abrams tanks, M16 rifles, MK-19 40mm grenade launchers (seized from the Iraqi army) and Russian M-46 130mm field guns (taken from Syrian forces).

“But dealers say despite this, there is one thing ISIS still needs: ammunition. Most in demand are rounds for Kalashnikov assault rifles, medium-calibre machine guns and 14.5mm and 12.5mm anti-aircraft guns. ISIS also buys rocket-propelled grenades and sniper bullets, but in smaller quantities.”

The details of the organization’s operations, as reported in the article, make it evident that any nation or coalition seeking to halt the flow of needed military supplies to ISIS— which (in addition to ammunition) include agricultural chemicals and mining materials that are used to manufacture explosives for the bombs that have made ISIS infamous, and common electronic devices that are made into bomb triggers—faces a nearly impossible task. With a complex, state-like infrastructure, a multinational network of black-market traders, and a sophisticated logistics operation capable of moving large supplies of munitions to its fighting men in many fields with remarkable speed, it would appear that the “world’s richest Jihadi group” is having no difficulty procuring whatever military supplies it requires.

“They buy like mad. They buy every day: morning, afternoon and night,” says Abu Ali, who, like others who have operated inside Isis territories, asked not to be identified by his real name. . . .

These materials come from all over the world, says one Iraqi official: “Just put your finger on a map, and they’ve got something from there.”

Historically, one major stated goal of U.S. defense export controls has always been to make it as difficult as possible for unscrupulous arms dealers, terrorist organizations, and proliferators of weapons of mass destruction to obtain goods that are militarily useful.

A closely related goal has been to deter human rights abuses and prevent the stoking of violent civil disorder in certain countries, or the inflaming of regional instability. For this reason, the State Department has long sought to block the sales of small arms (such as semiautomatic rifles), light weapons (such as artillery rockets), arms parts, artillery shells, and ammunition (i.e., the “less sensitive” defense items controlled by USML Categories I, II, and III), as well as communications and surveillance equipment, and certain other goods, to governments and other entities with a consistent record of committing atrocities.

Still another goal of defense export controls has been to combat illicit arms trafficking and prevent retransfers to transnational criminal organizations via black-market middlemen. Tracking U.S. small arms and other military equipment after export has often led to the apprehension and prosecution of criminals involved in the illicit trafficking of drugs, money, art, and human beings.

Other nations and international organizations are actively involved, along with the U. S., in these arms control, nonproliferation, and international crimefighting efforts.

If the description of the “munitions trail” to ISIS in the November 30 Financial Times report is accurate, however, it plainly casts doubt on the effectiveness of past and present U.S. export controls. It is hard to avoid the conclusion that, whatever measures were taken by the U.S. and other nations to stem the flow of weapons, munitions, and other military equipment to the Islamic State and similar terrorist groups, they have largely been ineffective.

Somehow, an elaborate system of export licensing, re-export and retransfer authorizations, end-user assurances, end-use monitoring, marking, and tracking, not to mention a U.N. arms embargo on ISIS, has failed to prevent the group from acquiring a massive arsenal of weapons and equipment—weapons it has used, and continues to use, to carry out indiscriminate attacks on civilian populations and commit multiple atrocities, posing a dire threat to millions of people in the Middle East region and beyond.

The DDTC has repeated stated that the initial review and revision of the twenty-one USML categories, now in its last phase, is not intended to be the end of reforms to the U.S. export control regime. State readily acknowledges that there is still work to do on ECR; ongoing review and further input from industry and the public is expected and encouraged.

The growing terror threat posed by the Islamic State group strongly underlines the need for a great deal of further thought and discussion of U.S. export controls on arms and munitions with a view to enhancing end-user/end-use controls, ensuring effective monitoring, verification, and enforcement, and minimizing diversion and re-export risks—especially for small arms, light weapons, and ammunition.

(None of the information is intended to be authoritative official or professional legal advice. Consult your own legal counsel or compliance specialists before taking actions based upon this blog or other unofficial sources.)

The Key Elements of an Effective OFAC Compliance Program

Question: What advice can you offer on how to set up and maintain a successful OFAC compliance program?

Because each company has different risks and different risk tolerances, there is no simple and clear formula for creating a successful OFAC compliance program. Nevertheless, the “Compliance Program Guidelines” issued by DDTC, the “Compliance Guidelines” issued by BIS, and the summary of “Regulations for Exporters and Importers” issued by OFAC identify certain elements that each agency considers essential for a program to be effective. The advice given by the three agencies has a great deal in common. Here are the key elements of any effective corporate export compliance program, with a few comments about each.

Management Commitment and a Strong Compliance Culture

In order for any compliance measures to be effective, the Board of Directors and senior management must buy into and commit to the success of the program. By clearly demonstrating their support and participation, the company’s leadership can set the tone for the entire staff and foster a culture of integrity—which includes transparency and compliance—throughout the organization. That means, among other things, a culture of self-reporting possible violations and inquiring to assess their scope and the extent of program exposure, instead of a culture of covering up and writing off penalties for violations as “a cost of doing business.”

A Qualified and Empowered Export Compliance Officer

Unless your company is very small, the appointment of a dedicated Export Compliance Officer (ECO) with a clear mandate to focus on this critical function is highly desirable. Consider that your ECO is charged with protecting you from risks where penalties can reach hundreds of millions of dollars. With a roster of laws and regulations that is continually changing, managerial staff in internal control roles today have a more challenging job than ever before, with ever-wider responsibilities.

Your company’s ECO should:

—     have a direct line of communication to the Board of Directors and senior management.

—     be knowledgeable concerning the ITAR, EAR, and OFAC regulations, and have a good working understanding of your company’s products, services, technologies, suppliers, and customer base. Don’t hire an inexperienced individual, unqualified for the role, and don’t skimp on his/her ongoing education and training.

—     have full authority to look into all compliance-related matters and put together a project team to address and resolve problems when they arise.

—     have sole responsibility for managing communications with regulatory agencies (such as Commerce/BIS, State/DDTC, and Treasury/OFAC) for all compliance-related issues.

—     be responsible for monitoring official announcements and press releases from DDTC, BIS, and OFAC daily for developments or enforcement actions that could impact your company’s line of business or its suppliers, and for communicating changes in regulations, policies, or procedures to company personnel by means of in-house e-mails, newsletters, announcements, or notices posted on the company intranet.

Thoughtful, Clearly Articulated Internal Policies, Procedures, and Controls

The level of sophistication of your internal compliance controls will naturally depend on the nature and scale of your business. What is essential is that policies, procedures, and controls be carefully thought out, clearly set down in writing, and effectively communicated to all employees, agents, and business partners. Individual compliance responsibilities should also be expressly included in job descriptions and performance evaluations of personnel, as appropriate.

You need to provide your employees with an easy way—such as an anonymous hotline or “help line”—to report potential violations of U.S. export laws and regulations or of the company’s export compliance policies without fear of reprisal; and you need to be consistent in investigating each report, and in implementing disciplinary procedures to address violations when they are encountered.

Effective Use of Information Technology

To avoid OFAC violations, it is crucial that companies have robust screening procedures in place that cover transactions, customers, suppliers, personnel, and business partners. This is a daunting task, because OFAC is concerned not only with a relatively small number of country sanctions (such as those found on BIS’s Commerce Country Chart and DDTC’s Country Policies and Embargoes chart), but also with many thousands of Specially Designated Nationals (SDNs), an ever-changing list of individuals, business entities, groups and organizations, banks, and even ships (or “vessels of concern,” as OFAC calls them). Nor is the SDN List the only list against which transactions should be screened. There are also the BIS’s Denied Persons List, Entity List, and Unverified List, the DDTC’s Debarred Parties List, the FBI’s Most Wanted Terrorist List, United Nations 1267 List, the European Union Sanction List, the HM Treasury Sanction List, and others as well.

Even if your company is small, reliance on manual screening and monitoring processes alone now carries an unacceptably high risk and should no longer be considered a viable option. Today it is imperative that U.S. exporters use information technology to the maximum extent feasible in seeking to implement the know-your-customer rule (KYC) and other due-diligence measures for preventing unlawful diversion and ensuring that their shipments will reach only authorized end-users for authorized end-uses. A reliable screening software solution that uploads changes to the list as close to real-time as possible is a critical element in any company’s compliance program.

Many “off-the-shelf” transaction monitoring systems—most of them web-based—are available, at a wide range of prices and with a range of features that include basic screening against multiple denied parties lists, batch screening, sophisticated search algorithms employing “fuzzy logic,” the ability to generate custom reports of all kinds, automated recordkeeping, and real-time monitoring with immediate notification of any changes. But even with the purchase of commercial software, developing and implementing a screening system that will protect your company effectively is going to require the investment of some time and effort to calibrate, configure, and fine-tune the screening algorithm to match your business’s specific needs. The failure to do so will render even the best screening software ineffective and leave your company at risk. Screening software also brings with it certain inevitable limitations, including the potential for false positives, even after the screening algorithm has been optimally configured for your company’s risk profile. In some cases, it will be necessary to follow up the screening with manual reviews of entities or persons.

In the course of performing compliance audits and risk assessments for exporters, both large and small, in the U.S. and overseas, our audit teams still encounter far too many companies who employ a manual transaction screening procedure that consists of logging on to a series of web sites, screening customers, vendors, personnel, and other entities of concern, one at a time, against a hodgepodge of lists, and then updating the results of the search on a tracking spreadsheet. Not only is this manual method time-consuming and limited in the number of lists you can reasonably screen against, but also it does not lend itself well to compliance records retention. Spreadsheet programs, such as Excel, were never meant to function as databases. They are not secure and are notoriously error-prone. They cannot handle attachments of documents, photos, licenses, verifications, and other evidence. While it is true that they are easy to use and convenient to update, because they lack the ability to track changes over a period of time and have no audit trails for data or formulas, they are an auditor’s nightmare. Even the most basic IT-based screening solution and monitoring is clearly preferable.

Ongoing, Relevant Employee Training

Regular employee training ensuring that all staff understand the applicable laws and regulations as well as the business’s policies, processes, and specific risk profile, has always been a key component of any corporate compliance program. But for OFAC compliance, training is even more critical than it is for ITAR and EAR compliance, due to the dynamic nature of U.S. trade embargoes and the speed with which some programs are announced and evolve. Even automated screening can go only so far in helping to detect sanctions violations. Consider that entities on the SDN List can open fake bank accounts, individuals can create false identities, and both can use proxies or agents to place orders on their behalf internationally. There is always some degree of risk that you are doing business with someone you shouldn’t and are violating OFAC’s rules. Alert trained employees will spot red flags and inconsistencies that software can’t.

For that reason, you need to identify your company’s frontline employees from a compliance perspective—those whose duties require an awareness of ITAR, EAR, and OFAC regulations—and train them to understand the sanctions vulnerabilities you face and how serious these are, spot potential problems quickly, and respond appropriately. Those men and women are your ultimate line of defense. Even when there is a strong commitment on the part of management and when sound internal processes are in place, a work force without proper training will leave your company exposed and at high risk. All the compliance policies, procedures, and “best practices” in the world are worthless unless they are known, correctly understood, and followed by your employees. Even worse, they may create a sense of false security.

Export compliance training needs to start right away, with new employee orientation. Regular retraining events should provide updates to internal polices, procedures, processes, and monitoring systems. In order for compliance awareness training to be fully effective, it needs to include realistic practical illustrations of potential violations and credible scenarios of suspicious activities with “red flags” that should put a transaction on hold and trigger a report to Compliance. For that reason, off-the-shelf employee training materials should never be simply purchased and deployed “out of the box”; they must first be tailored to the specifics of the company’s business. This is definitely not a situation where “one size fits all.”

The following are some of the most common weaknesses our teams have observed when assessing corporate training programs:

—     Employee training is not conducted regularly or frequently enough.

—     Deadlines for completing or renewing training are not enforced.

—     Training content is not being updated.

—     Training is deployed, but without any test or questionnaire to verify knowledge retention.

—     When employees were found to have breached either U.S. export regulations or the company’s stated compliance policy, additional employee training was not conducted to remedy the situation and prevent repetition.


“Every one of your employees has the ability to damage—or to protect
and enhance—the reputation of the company.”

Independent Reviews and Risk Assessments

Regular compliance reviews and assessments, conducted by experienced outside auditors, consultants, or other qualified independent parties, are really the only reliable way to verify that your OFAC compliance program is operating as effectively as possible and is fully compliant with the law. It is imperative that these assessments be performed by an individual or team not directly tied to or responsible to the Compliance Department. In very large corporations, they could be conducted by the Internal Audit Department, if one exists, but only if Internal Audit has proper specific export compliance expertise. Otherwise, the company should hire experienced external consultants.

The frequency of these reviews should be commensurate with your company’s risk profile. Every 12 to 18 months is typical. Ask the reviewers to report their findings directly to the Board and/or senior management—not only to the compliance officer or department. And it’s always a good idea to ask that an Executive Summary be included in the written report. The report should aim at giving management practical insight into the programmatic strengths and weaknesses. It should also suggest specific remedial actions to bring the company back into full compliance. Those suggestions should not be ignored.


“A single weak or missing element will undermine
your entire OFAC compliance program.”

(None of the information is intended to be authoritative official or professional legal advice. Consult your own legal counsel or compliance specialists before taking actions based upon this blog or other unofficial sources.)

OFAC: The Not to Be Forgotten Part of Export Compliance (Part 3 of 3)

Question: I’m seeing a lot of headlines about OFAC sanctions in the global trade news lately. Why has developing a corporate OFAC compliance program suddenly become so important?

Over the past few years, the U.S. Government has increasingly looked to trade embargoes and economic sanctions programs, which OFAC administers, to help achieve its foreign policy and national security objectives. Sanctions have also served as an integral component of America’s counter-terrorism strategy and campaign to halt the spread of weapons of mass destruction. More recently, they are being employed in innovative ways to combat malicious cyber activity and transnational organized crime.

Not surprisingly, given that America’s economy and capital markets are still the largest in the world, U.S. sanctions have had a dramatic impact on international trade; in multiple instances, they appear to have been effective in influencing the behavior of countries that the government viewed as national security threats. Because of the proven effectiveness of these measures, and probably also because of the nation’s current economic state and a generally war-weary public, sanctions have become a tool of first resort for U.S. foreign policy. Consequently, we have seen OFAC (with help from the Department of Justice) ramping up their sanctions enforcement and aggressively pursuing potential violators throughout the world.

Major prosecutions under the Foreign Corrupt Practices Act have made the headlines several times this past year. Economic sanctions enforcement seems poised to be the next big focus for government regulators. U.S. businesses that operate, or intend to operate, in the global marketplace urgently need to take a close look at their corporate export compliance programs and develop strategies for complying with rapidly changing regulations and enforcement policies in this area.

(1)    Proactive is always better than reactive.

More and more large U.S. and multi-national corporations, especially those who are prime U.S. Government contractors, are now addressing the OFAC compliance challenge and requiring all those with whom they do business—subcontractors, vendors, suppliers, partners—to demonstrate a similar diligence. Addressing the OFAC compliance challenge on your own timeline, rather than waiting until you are obligated by a contract or business transaction to do so, will allow you to choose compliance options that are cost-effective for your company’s business model, circumstances, and goals.

(2)    The recent Yates Memo has sounded a new warning note and made enforcement more personal.

The policy memorandum issued on September 15, 2015 by Deputy Attorney General Sally Quillian Yates appears to signal a more aggressive approach by the U.S. Government that prioritizes the prosecution of individual corporate executives in cases of corporate wrongdoing, including sanctions violations. While the insistence on individual accountability for corporate misdeeds is not new, the policy outlined in the Yates Memorandum places a greater emphasis than before on requiring the corporation’s internal investigation to identify the individual decision-makers who were involved in, or were responsible for, the regulatory noncompliance. Essentially, companies that want any “cooperation credit” from the U.S. Government (i.e., mitigation of penalties) will first need to fully disclose to the prosecutors the results of their internal investigation concerning the employees and senior executives involved.

Although the significance and implications of the Yates Memo are not yet entirely clear, the trend in regulatory enforcement that it represents underscores the need for companies to have more effective export compliance policies and procedures in place. You may want to consider including policies that spotlight individual accountability and processes that facilitate the rapid triage of incident reports and immediate and thorough investigations when appropriate.

Question: In what ways is achieving and maintaining OFAC compliance a greater challenge for a company than ITAR and EAR compliance?

(1)    OFAC sanctions are continually evolving. U.S. trade embargoes and economic sanctions, and the names of entities on the SDN List, can and do change very quickly—even overnight. For that reason, keeping abreast of new and evolving programs and ensuring compliance with recordkeeping, reporting, licensing, and other OFAC requirements can be extraordinarily difficult.

The Treasury Department’s SDN List contains several thousand names, and people or organizations can be removed from it, or added to it, at any time. Several foreign jurisdictions, including the European Union, Canada, and Mexico, also maintain “blocking statutes” that may address the U.S. trade embargoes and sanctions concerns, and a wide range of other restrictive measures as well, so your company’s transactions may need to be screened against multiple lists. What is more, some of these restrictive measures may conflict with U.S. regulations. Due diligence requires continuous, real-time, comprehensive monitoring to ensure that your dealings and transactions with foreign countries and individuals are not in violation of OFAC prohibitions.

(2)    OFAC sanctions are extraordinarily comprehensive. In addition to prohibiting certain transactions, OFAC regulations prohibit U.S. persons from “facilitating” (i.e., assisting, supporting, directing, or approving) a transaction by, or with, a sanctioned entity. The regulatory definition of “facilitation” is quite general, and its concrete interpretation has not been clear, since enforcement actions against companies for “facilitation” violations have been fairly infrequent. That situation has now changed dramatically. In the past few years, the U.S. Government has begun aggressively pursuing criminal actions against individuals and firms that “willfully facilitate” sanctions violations. Referring prohibited business to a foreign party, providing guidance or advice on a prohibited activity, financing or insuring or guaranteeing a prohibited transaction, providing merchandise or services in connection with a prohibited activity—any or all of these may constitute facilitation, and thus violate the OFAC regulations.

Most OFAC Sanctions Programs apply to ‘‘U.S. persons,’’ a term embracing U.S. citizens, permanent resident aliens, entities organized under the laws of the U.S. or any jurisdiction within the U.S. (including foreign branches of U.S. corporations), and any persons in the U.S. However, some sanctions programs state a wider jurisdiction. The Cuban Assets Control Regulations (CACR), 31 C.F.R. Part 515, use a more broadly defined term, ‘‘Persons subject to the jurisdiction of the U.S.,’’ which includes foreign subsidiaries of U.S. companies (see 31 C.F.R §515.329 and §515.330).

(3)    OFAC violations can carry staggering penalties.

Violations of the OFAC regulations may incur either civil or criminal penalties, or both. We have seen a very aggressive enforcement trend over the past few years. Increasingly, the U.S. Government has chosen to pursue criminal charges against violators (or has settled cases using criminal allegations), and a series of record-setting penalties have been imposed for OFAC sanctions violations. Examples within the last year include the almost $1 billion in fines handed down to BNP Paribas, and more recently Commerzbank’s agreement to pay $258 million in fines for falsifying business records for sanctioned countries. Nor is it only banks that have been prosecuted for sanctions violations. The Department of Justice recently agreed to a fine of $232 million to settle criminal charges with Schlumberger Oilfield Holdings Ltd for violating U.S. sanctions. That action and a few others are indications that regulators may soon be turning their attention to U.S. manufacturing companies as well.

* * *

A serious OFAC compliance program demonstrates that your company is aware of the SDN List and sanctions regulations, understands the risks, and is actively trying to prevent OFAC violations. If a violation does occur, it will be a strong mitigating factor against severe penalties. In some recent criminal prosecutions, the U.S. Government has contended—and the Courts have agreed—that failing to have an adequate compliance program in place was an indication of “reckless disregard” and therefore supported prosecution of the company and individual employees for willful, criminal violations of regulations. Depending on the sanctions program, criminal penalties for willful violations can include fines of up to $20 million and imprisonment of up to 30 years. Even worse, a single transaction can produce multiple violations, placing a company at risk of significant liability.

In addition to avoiding draconian penalties, another good reason for making OFAC compliance (and EAR/ITAR compliance) a high priority is minimizing costly and time-consuming investigations. Even if the finding is that no violation has occurred, or if civil penalties are eventually waived due to mitigating factors, responding to U.S. Government queries regarding potential violations and conducting comprehensive internal investigations can place a heavy and damaging burden on corporate resources.

Given those risks, it’s hardly surprising that more and more company boards and senior executives are moving enhanced OFAC compliance measures to the top of their agendas.

Catch next week’s post “The Key Elements of an Effective OFAC Compliance Program” for advice on how to set up and maintain a successful OFAC compliance program.

(None of the information is intended to be authoritative official or professional legal advice. Consult your own legal counsel or compliance specialists before taking actions based upon this blog or other unofficial sources.)

OFAC: The Not To Be Forgotten Element of Export Compliance (Part 2 of 3)

Question: In your last post, you referred to “OFAC export authorizations” and the possibility that a U.S. company might apply for and obtain an “OFAC Specific License” for an export transaction involving a sanctioned country. Isn’t that a contradiction in terms? I thought the whole point of U.S. economic sanctions was that no financial transactions or business dealings whatsoever are permitted with a customer in, or from, an OFAC-sanctioned country.

While it’s true that economic sanctions administered and enforced by OFAC can impose sweeping prohibitions against trade with targeted countries—Cuba, Iran, and Sudan, for example—and that U.S. Government policy is normally to deny export licenses in such cases, exceptions do exist which permit exports to OFAC-sanctioned countries in certain cases.

For one thing, because each sanctions program is based on a unique set of foreign policy imperatives, no two are exactly alike. Each of the twenty-eight OFAC Sanctions Programs is distinct and different; the range and coverage varies greatly from country to country. Some programs are nearly total in scope, while others are much more narrowly focused. So the application of sanctions to a country does not necessarily mean that all commercial opportunities in that country or that country’s nationals are off limits. There is a huge difference, for example, between the fairly limited and selectively tailored sanctions currently imposed on certain individuals and entities under the Ukraine/Russia Sanctions Program, and the strict and comprehensive sanctions that that are currently imposed on most transactions with the Iranian government, Iranians, and Iranian entities. For that reason, a deal involving a sanctioned country will sometimes be able to go forward because it falls outside the scope of the applicable OFAC export prohibitions. Determining whether this is true in any particular case, of course, requires a detailed review of the regulations currently in force.

Even for comprehensively sanctioned countries such as Cuba, Iran, and Sudan, the prohibitions on trade, although stringent and far-reaching, are not absolute. Many companies are surprised to learn that the U.S. permits the imports and exports of certain items to and from these nations despite the tense political relationships.

What’s more, due to the political nature of sanctions and their use by the U.S. Government as diplomatic tools to influence the behaviors of other nations, OFAC regulations are constantly changing. On the positive side, this means that new opportunities for U.S. exporters can open up at any time. For example, on July 11, 2012, OFAC moved to lift a near-total ban on business with Myanmar (Burma), and began allowing certain U.S. investments in that country in response to the government’s promises of reform and transition to democracy. Other regulatory changes followed, and in April of this year OFAC took several Myanmar companies and individuals off the blacklist.

Some types of permitted transactions reflect long-standing and fundamental principles of U.S. foreign policy.

  • It has generally been U.S. foreign policy to promote and encourage the free flow of information and freedom of speech between the U.S. and other nations. The Berman Amendment, passed by Congress in 1988, as amended and expanded by the Free Trade in Ideas Act in 1994, makes it clear that OFAC does not have the statutory authority to regulate “directly or indirectly” transactions concerning the import or export of “information and informational materials” to or from sanctioned countries, “regardless of format or medium of transmission.” “Informational materials” in this context has been deemed to include most books, magazines, eBooks, and other publications; pre-recorded video and audio tapes and CDs; and paintings, sculptures, and other works of art; and it may include payments for such items, depending on the sanctions program involved. It is essential to keep in mind, however, that this does not cover CCL items: controlled software and controlled technical data do not fall within this exemption. Exporters should also be aware that the application of this “informational materials” exemption to such related activities as the development, marketing, and distribution of the materials is a matter of ongoing legal controversy; those related activities may require an OFAC Specific License.
  • It has not generally been the policy of the U.S. to withhold the supply of food and medicine to other nations as a means of furthering U.S. foreign policy goals. Thus, U.S. sanctions programs have usually included provisions explicitly allowing humanitarian exports of food, clothing, medicine, and other forms of humanitarian support. Even nations whose governments are notoriously hostile to the U.S. or who have been spotlighted as supporters of terrorism can receive exports of U.S.-origin humanitarian goods. To that end, the Trade Sanctions Reform and Export Enhancement Act of 2000 (TSRA), also known as the Nethercutt Amendment, authorizes the export of certain agricultural commodities, medical supplies, and medical devices to otherwise comprehensively embargoed countries under licenses issued by OFAC (for Iran and Sudan) or Commerce/BIS (for Cuba). This complicated measure authorizes exports of certain agricultural commodities, medicines, and medical devices to Cuba, Iran, Sudan, and Libya. The criteria for items that meet the TSRA definition of agricultural commodity or medicine/medical device are varied and complex, however, and close consultation with OFAC, BIS, and the FDA is highly advisable for U.S. exporters.

While compliance with TSRA licenses and adherence to the scope of the Berman Amendment exemptions can be complicated, these efforts can yield opportunities for U.S. companies that export eligible items.

Some other examples of transactions that may be permitted even with countries under strict U.S. economic sanctions include the provision of telecommunications services, research activities by U.S. persons (although this is sometimes conditioned on obtaining specific approval from either BIS or OFAC or both), and professional meetings. The applicability of these exemptions to specific occasions and circumstances must always be carefully analyzed and considered, however.

What kinds of OFAC authorization are available? There are three categories: Exemptions, OFAC General Licenses, and OFAC Specific Licenses. When someone tells you that you need to obtain an “OFAC license,” they are generally referring to the third category, Specific Licenses. But before pursuing such a license, you should look closely at the first two categories, and see if there is either an Exemption or an OFAC General License that covers the transactions you wish to engage in.

Exemptions. The legislation underlying the regulations administered by OFAC may expressly exempt a particular good, service, benefit, or activity from the kinds of transactions the agency is authorized to block or prohibit. The category of OFAC Exemptions includes those activities, goods, and services which are beyond the legal authority of the Executive Branch to sanction—and therefore outside the realm of OFAC’s regulatory powers. Some examples of activities that are usually exempt have already been mentioned. Another example of a common exemption is travel: freedom of movement is considered by many to be a fundamental liberty, and under most U.S. sanctions programs— which, like the ITAR and EAR, are authorized by the International Emergency Economic Powers Act (IEEPA)—transactions related to travel to and from the country by individuals who are U.S. persons are not prohibited.

A notable—and highly controversial—exception has been Cuba Sanctions, which are largely authorized by the Trading With the Enemy Act of 1917 (TWEA). The U.S. has imposed a comprehensive economic embargo against Cuba since the 1960s. The embargo regulations do not actually ban travel itself, and the Cuban Assets Control Regulations (CACR) do expressly authorize transactions incident to 12 categories of travel, among which are “journalistic activities” and “educational activities, including people-to-people contact.” In addition, OFAC Specific Licenses are issued a case-by-case basis. Nevertheless, the restrictions placed on financial transactions related to travel to Cuba have effectively banned all tourist travel from the U.S.—formerly a major source of revenue for that nation. Some Cuban travel restrictions have been significantly eased by amendments to the CACR during the past few years, most recently in January 2015; and nineteen U.S. airports are now officially authorized by Customs and Border Protection to serve flights to and from Cuba. But given that transactions for tourist activities are still expressly forbidden by a provision in the TSRA, the practical economic significance of these recent regulatory changes for the U.S. travel industry and other sectors is uncertain.

OFAC General Licenses. If no exemption covers the goods or services you want to export, and they are therefore subject to OFAC regulation, then you should determine whether OFAC has published a General License indicating that the agency consents to the export of goods or services of that kind to the sanctioned country. Some general licenses are contained within the OFAC regulations themselves. When an embargo is new, or has just been amended, there may be general licenses issued that have not yet been codified in the CFR, but can be found on the OFAC web site. Various regulatory interpretations are also issued from time to time by OFAC; the legal effect of these interpretations may be equivalent to that of a general license.

General licenses are open-ended authorizations: they grant blanket authority to engage in a certain kind of transaction and you don’t have to apply to use them—although sometimes there are notification or reporting requirements. One important way in which an OFAC General License differs from an Exemption is that OFAC can rescind a general license at any time, whereas it is beyond OFAC’s legal authority to apply sanctions to exempt goods, activities, or transactions.

OFAC Specific Licenses. If the goods or services you want to export are neither exempt from OFAC regulation nor covered by an OFAC General License, you have the option of applying for an OFAC Specific License.

OFAC has fairly broad legal authority to allow—on a case-by-case basis—transactions that would otherwise be prohibited under specific sanctions provisions. OFAC’s Licensing Division reviews all applications from exporters strictly in the order in which they were submitted, and issues or denies licenses based on U.S. foreign policy and national security goals.

Before you proceed to apply for a license, however, we suggest that you review the the details of your proposed export transaction thoroughly, asking the following questions:

(1)   Are there are any U.S. Persons involved in the transaction? (The definition of “U.S. Person” includes a U.S. citizen, a permanent legal resident, an entity formed under the laws of the United States, or anyone physically present in the U.S.)

(2)   Are any of the parties to your proposed export transaction targeted by U.S. economic sanctions (e.g., individuals, businesses, institutions, organizations, or other entities, or official government agents or agencies, who ordinarily reside or operate in sanctioned countries)? (Be sure to identify all parties—including brokers, intermediate banks, freight forwarders, shipping companies, and any other middlemen—their nationalities and their relationship to the transaction.)

(3)    Is the nature of the proposed transaction such that it comes under and is prohibited by the applicable laws and regulations?

If the answer to these three questions is Yes, then you should assume that an OFAC license will be needed before the transaction can be conducted.

How can I apply for a license? For official guidance related to applying for an OFAC Specific License, in addition to the information and instructions found on the OFAC web site, you should refer to 31 CFR 501.801.

You may submit your application electronically, using the online form on the OFAC website at Alternatively, you may send a letter of request providing a detailed description of the proposed transaction, including the names and addresses of all individuals or companies involved. You can mail your license request letter to the following address:

Office of Foreign Assets Control
U.S. Department of the Treasury
Treasury Annex
Attn: Licensing Division
1500 Pennsylvania Avenue, NW
Washington, DC 20220-0002

All U.S. exporters ought to take full advantage of the extensive compliance resources provided by OFAC on their web site. The agency devotes considerable effort to compliance outreach, and has compiled and published a veritable library of reference materials, including publications geared toward the specific concerns of exporters and importers, including summaries of each sanctions program. They also make an up-to-date SDN list available in a variety of searchable formats.

Finally, you should understand that an OFAC Specific License application, like any request for an exception to a rule, needs to be an advocacy document. That is to say, in order for your application to be granted in a situation of presumed denial, you will have to do more than merely provide the detailed facts concerning the transaction you are proposing; you will also need to make a convincing case for the issuance of the license by appealing to the provisions of the relevant laws and regulations—ideally, to a section or clause indicating the potential availability of special permits or export authorizations for certain reasons or in certain circumstances. You may want to appeal to the stated U.S. Government policy and rationale behind the specific export control regime as well.

In Part 3 of this post, we’ll offer you some practical advice and suggestions for ensuring that OFAC compliance is fully and effectively integrated with ITAR and EAR compliance processes and internal controls in your company’s overall export compliance program.

(None of the information is intended to be authoritative official or professional legal advice. Consult your own legal counsel or compliance specialists before taking actions based upon this blog or other unofficial sources.)

OFAC: The Not To Be Forgotten Element of Export Compliance (Part 1 of 3)

Question: I read in the Daily Bugle recently about a small family-owned business in Maryland with only ten employees that had to pay a $78,750 penalty for alleged export violations. The article said they had shipped three HVAC duct fabrication machines to a company in China and received payments for them “without authorization from OFAC.” Can you tell me what this is all about? I’m familiar with ITAR and EAR export controls, of course. As a U.S. manufacturer and exporter, my company is registered with the State Department’s DDTC, and we’ve applied for multiple BIS export licenses using the SNAP-R system, but this was new to me. How much do I need to know about OFAC? Bottom line: how critical is this for my company?

Yes, you should know about this. Not knowing can be costly and painful, as that company you read about in the news—Precision Products Inc. (PPI) of Charlotte Hall, Maryland—learned to their dismay earlier this year. You, too, are among those to whom OFAC regulations apply.

OFAC, the Office of Foreign Assets Control, is an often overlooked but extremely powerful and far-reaching agency of the Treasury Department. Its mission is to administer and enforce economic and trade sanctions based on U.S. foreign policy and national security goals. Many of these sanctions programs—prohibitions on financial dealing—have been put in place by the U.S. Government to ensure that companies don’t unwittingly do business with terrorist organizations, sanctioned countries, nationals of some countries, and other specified entities who are engaged in activities related to the proliferation of weapons of mass destruction or other threats. Some OFAC sanctions are based on United Nations and other international mandates, and are therefore multilateral in scope, involving close cooperation with allied governments.

OFAC acts under Presidential wartime and national emergency powers, as well as authority granted by specific legislation. The agency has the authority to prohibit U.S. citizens and corporations from making payments, or providing anything of value, to embargoed countries, businesses, organizations, or individuals. It has the power to impose controls on business transactions of all kinds and freeze any assets that are under U.S. jurisdiction. It publishes the constantly updated list of over 6,000 names–the Specially Designated Nationals List (“SDN List”)–of companies and individuals whose assets are blocked. This is a “black list”: Americans are expressly forbidden to enter into transactions with any of these companies and individuals. U.S. exporters and importers are required to exercise due diligence in searching the SDN List and confirming that dealings with foreign countries are not in violation of OFAC sanctions programs.

In addition, OFAC prohibits travel to, and certain other dealings with, embargoed countries and entities. There are a handful of countries commonly referred to as “OFAC countries” or “embargoed destinations”—a few of the most widely known in recent years have been Cuba, Iran, North Korea, Sudan, and Syria—to whom comprehensive trade sanctions, administered by OFAC, have been applied. In other cases, the economic sanctions have taken a variety of forms, including arms embargoes, capital restraints, asset freezes, and trade restrictions.

Has OFAC been around for a long time? As an arm of the Treasury Department that sets out and enforces trade sanctions issued by the U.S. Government, OFAC is arguably one of the oldest law enforcement agencies in the country. It dates back prior to the War of 1812, when Treasury was first authorized to administer U.S. economic sanctions imposed against a hostile foreign power—in that case, Great Britain, which was harassing American sailors. In more recent times, between 1940 and 1947, Foreign Funds Control (FFC) and the Office of International Finance (OIF) were established as units of the Treasury Department, with legal authority deriving from the Trading with the Enemy Act (TWEA). FFC administered controls over enemy assets and restrictions on trade with enemy states during World War II. It was abolished in 1947, and its functions were transferred to the OIF. In 1950, the OIF morphed into the Division of Foreign Assets Control, when President Truman declared a national emergency and blocked all Chinese and North Korean assets subject to U.S. jurisdiction following the entry of the People’s Republic of China into the Korean War. In 1962, the Treasury Department changed the agency’s name to OFAC.

How critical is OFAC compliance? Absolutely critical. Understanding and monitoring OFAC compliance is a must for U.S. businesses who have foreign suppliers, customers, or clients, or who work with overseas partners. Exporters and importers who are “U.S. persons”—a regulatory term that should be well known to any compliance officer acquainted with the ITAR—are responsible for following OFAC regulations designed to halt terrorist and other illegal funds from circulating. In certain cases, foreign subsidiaries owned by U.S. companies and foreign persons in possession of U.S.-origin goods are also required to comply. So, if you are a small business owner or an individual doing business overseas, you need to familiarize yourself with OFAC. And if you are a company officer or manager in an industry with significant foreign trade, you need to make sure that OFAC compliance is an essential component of your corporate compliance program.

Penalties for violating the regulations administered by OFAC are serious, and have grown even more serious in the last few years. Depending on the sanctions program, potential criminal penalties for willful violations include fines ranging up to $20 million and imprisonment of up to 30 years. Civil penalties for violations of the Trading With the Enemy Act (TWEA) can be as much as $65,000 for each violation. Civil penalties for violations of the International Emergency Economic Powers Act (IEEPA) can range up to $250,000 for each violation, or twice the gain from the violation, whichever is greater. Over the past several years, the number and monetary value of enforcement actions by OFAC have increased dramatically: civil penalties and settlements rose from about $3.5 million in 2008 to more than $1.2 billion in 2014. These are not penalties that can simply be written off as “the cost of doing business”!

Yet OFAC compliance is the most commonly misunderstood and most likely to be forgotten element in corporate export compliance programs. Discussions of U.S. export controls are frequently dominated by and focused on ensuring compliance with the ITAR and EAR, while OFAC regulations are overlooked or undervalued. Yet OFAC rules generally override all other export controls, and OFAC restrictions may apply even when an EAR license exception or ITAR exemption is available.

The widespread tendency to underestimate the importance of monitoring OFAC compliance is especially problematic because OFAC’s programs are dynamic: the embargoes and sanctions, the scope and details of the restrictions, and the names on the SDN List and other lists change very frequently. What is more, new lists may appear at any time, as U.S. foreign policy refocuses in response to a rapidly changing world scene—witness the Sectoral Sanctions Identification List (“SSI List”) that OFAC issued in 2014, targeting transactions with persons in four sectors of the Russian economy: financial services, energy, defense, and mining. It is essential therefore that exporters check the Treasury web site frequently and have the necessary processes and internal controls in place to monitor compliance continuously. Firms with weak processes and controls limit their ability to prevent violations, or to detect and quickly deal with them if they do occur. They run significant risks of heavy fines and other damaging consequences.

In Part Two of this post, we’ll take a look at the three kinds of OFAC export authorizations available to U.S. companies—Exemptions, General Licenses, and Special Licenses, explain when you may need an OFAC Special License and how you can apply for one, and clear up a couple of common misconceptions. (No, OFAC requirements don’t impact only banks and financial institutions!)

In Part Three, we’ll look at the essential ingredients of a robust corporate OFAC compliance program. (Hint: simply checking your customers’ names and addresses against the SDN List is not enough!)

In today’s challenging international environment, the economic and trade sanctions administered by OFAC are likely to play a larger and larger role in cross-border transactions. It will be important for U.S. exporters to understand these controls thoroughly and keep abreast of changing requirements in order to focus on maintaining full compliance. The Export Compliance Solutions Training Academy provides a variety of training options—including 2-day regional seminars, in-house training, and live web-based seminars—that afford comprehensive coverage of ITAR, EAR, and OFAC controls, supplemented by case studies, practical advice, and help with strategic planning for your business. Check out the information on our web site about course offerings and online video training in export compliance awareness for your employees. Contact us by phone or e-mail to learn more. The ECS staff represents the most recognized expertise in the compliance field. We’re here to help!

(None of the information is intended to be authoritative official or professional legal advice. Consult your own legal counsel or compliance specialists before taking actions based upon this blog or other unofficial sources.)

Redefining EAR and ITAR Terms: Little Changes Could Make a Big Difference for Exporters

Question: Thanks for the heads-up last week about the compliance risks of storing sensitive data in the cloud—and the good news that regulatory changes may be ahead. Are there other revisions to the EAR and ITAR in the works that are likely to impact my company’s policies for safeguarding export-controlled technology and technical data? As I look at the Proposed Rules published by State and Commerce on June 3, I get the impression that they’re mostly about definitions—clarifying the meanings of certain technical terms. How important is all that stuff, practically speaking, to a firm like ours?

Very important. Compliance requirements and potential violations often hinge on the definition of a single word! So you really need to review these proposed new definitions carefully—both the Commerce Department’s proposed revisions to the definitions in the EAR and the State Department’s proposed revisions to definitions in the ITAR— to determine what impact they would have on your operations and compliance obligations, should they be adopted.

As I’m sure you’re well aware, U.S. export controls under the ITAR for defense articles and services contrast sharply with the (generally) more liberal controls under the EAR for “dual-use” commodities, software, and technology. For that reason, it’s critically important that you determine accurately whether or not the items or technical data you plan to ship or transfer internationally are subject to ITAR controls. Making that jurisdictional determination requires paying careful attention to the current USML and the appropriate categories within the USML that apply to the export in question.

That’s one of the reasons it’s also vital that you follow closely all the recent changes that have been made to the USML—and the “600 series” ECCNs of the CCL— due to the ongoing Export Control Reform initiative, as well as those changes that are still being made. And that most emphatically includes proposed revisions to the definitions of terms!

The Proposed Rule published by the DDTC on June 3 is notable for its length (14 pages of hard copy in the small print of the triple-columned Federal Register) and for the unusually large number of revisions to the ITAR that are proposed. It contains a plethora of new definitions for regulatory terms, making it a veritable dictionary. Many of the proposed revisions are meant to harmonize the ITAR rules with those of the EAR. The BIS published a similar Proposed Rule with conforming amendments.

The key terms and phrases that would be redefined, clarified, updated, or adopted under the June 3 Proposed Rules include the following:

Technical Data
Public Domain
Fundamental, Basic, and Applied Research
Defense Article
Defense Service
Characteristics and Functions (of an item)
Peculiarly Responsible
Transfer (in-country)
End-to-end Encryption

For exports controlled by the ITAR, two of the proposed new definitions are especially noteworthy: “public domain” (vs. “technical data”) and “defense service.” That’s because these definitions potentially apply to every single category of the U.S. Munitions List.

We’ll take a closer look at the first of these this week, and discuss the second and more controversial of the two in a future post.

Revisiting “Public Domain”

The State Department proposes to revise the definition of “public domain” in ITAR Section 120.11 in order to simplify, update, and introduce greater versatility into the definition. The current version of ITAR Section 120.11 enumerates the ways in which “public domain” information might be published. State says that it now believes that defining “public domain” by a list such as this is unnecessarily limiting in scope and insufficiently flexible, given the continually evolving array of physical and electronic media and communication technologies by which information can be disseminated. The new definition they propose is intended to be more versatile than the list-based approach to identifying public-domain information sources.

Under the State Department’s proposed revisions to definitions in the ITAR, unclassified information and software are considered to be in the public domain—and thus not technical data or software subject to the ITAR—“when they have been made available to the public without restrictions upon their further dissemination such as through any of the following . . . .” Among the means of dissemination mentioned, 120.11(a)(4) is of special interest, as it includes in the “public domain” information available on publicly accessible web sites:

(4) Public dissemination (i.e., unlimited distribution) in any form (e.g., not necessarily in published form), including posting on the Internet on sites available to the public;

There are some important qualifications that should be carefully noted, however.

One well-known consequence of the open, uncontrolled nature of the internet is that a vast amount of information can be found online that was uploaded illegally, in violation of a wide range of national and international laws governing copyrights, patents, privacy, public safety, national security, and many other matters. Plainly, the discovery of certain technical data, information, or software on a web site carries no guarantee that the individual or organization posting it hasn’t done so in violation of U.S. export laws and regulations.

With regard to such contingencies, a note to the proposed revision to ITAR Section 120.11 warns that anyone exporting, reexporting, or retransferring export-controlled information found on the internet, or otherwise making it available to the public, will be committing an export violation.

Taken together, the new definition and the warning that accompanies it raise the specter of inadvertent illegal exports of ITAR-controlled technical data by U.S. exporters who had no reason to suspect that the information they were making use of was not in the public domain, given that it was already freely available to the public via the internet. Evidently foreseeing this concern, the DDTC immediately reassures exporters, in a second note to the new Section 120.11, that in such cases a person will not be considered guilty of an export violation . . . unless — as described in the revised Section 127.1(a)(6) — “such person has knowledge that the technical data or software was made publicly available without an authorization.”

But here’s the rub: how can your company be certain that any item of technical information found on the internet was properly cleared for public release before being uploaded? And if your company should inadvertently disseminate technical data that later turns out to have been controlled by the ITAR and uploaded to the internet by somebody else without DDTC authorization, how would you be able to prove that you did not “have knowledge” that it was export-controlled? Those are just a few of the questions and concerns that have been raised about the language of this proposed revision to ITAR Section 120.11. Discussions of these concerns between the regulatory agencies, the defense industry, the research universities, and the legal community are ongoing. It is possible that the language in the Proposed Rules will be revised as a result of those discussions. Whenever the DDTC and BIS publish their Final Rules on the definitions of these key terms — possibly within the next few months — we may find that some of these points have been addressed and further clarified.

Stay on the Safe Side

Be that as it may, here is what we recommend to you as the safest policy and procedure for your company under the current regulations — and none of the revisions currently under consideration by the DDTC or BIS is likely to change this greatly: before posting to the internet any technical information about your company’s products or research, other than non-proprietary general system descriptions or information on the basic function or purpose of an item, thoroughly review the USML and the CCL to determine if the information falls under U.S. export controls. If there is doubt about export jurisdiction, request a Commodity Jurisdiction determination from the DDTC; and if State should determine that ITAR controls apply, obtain an export license for the technical data, or request authorization for “release” of the document you want to post online from the appropriate agency, as described in Section 120.11(b).

Remember that knowingly uploading controlled technical data to the internet without appropriate authorization is a export violation that could have extremely serious penalties and consequences, for both you and your company, whether or not there is any evidence that a foreign national has read or downloaded the data. Don’t needlessly put yourself and your company at risk.

Paragraph (b) of the revised definition explicitly sets forth the DDTC’s requirement of authorization to release information into the “public domain.” This requirement is not new: it also exists under the current rules; the revised rules would state it more explicitly and amend some definitions to clarify the scope of the information covered, but the requirement is already there. Before you can make such information available, the U.S. Government must approve the release through one of the following agencies: (1) The State Department’s DDTC; (2) the DoD’s Office of Security Review (OSR); (3) a relevant U.S. Government contracting authority, if one exists, with the authority to allow the technical data or software to be made available to the public; or (4) another U.S. Government official with the proper authority for this.

In many cases, we believe that requesting a security review by the OSR will be the best and wisest route you can take in order to safeguard your company against the risk of an export violation. Guidelines for submitting documents for review can be found on their web site.

The experienced compliance professionals at Export Compliance Solutions (ECS) are well-positioned to advise you regarding the impact that the revised definitions in the June 3 Proposed Rules are likely to have on your operations and corporate export compliance programs, and to assist you with other export control issues as well. Our consultants frequently work with ECS clients to review their current classification policies and procedures, conduct large-scale or multi-national classification projects, train employees in navigating complex reporting and recordkeeping requirements, discover ways to enhance and streamline administrative processes, and more effectively implement internal compliance audits and assessments. As America’s premier trainers and consultants in EAR and ITAR compliance, we can help you make sure that your company maintains full compliance with the changing Commerce and State Department regulations.

(None of the information is intended to be authoritative official or professional legal advice. Consult your own legal counsel or compliance specialists before taking actions based upon this blog or other unofficial sources.)

Export-Controlled Data – Store It in the Cloud or Keep It Down Home?

Question: Is there any reason that our company can’t use a cloud storage service provider, such as Dropbox, Google Drive, Box, or Microsoft Office 365, to store and share export-controlled information and technical data? Most businesses are using the cloud these days. Are there any problems with this?

The simple answer is, Yes, there are problems. Serious ones. Uploading your ITAR-controlled technical data, or controlled technology subject to the EAR, to “the Cloud” while maintaining full compliance with U.S. export laws and regulations is very challenging, and carries with it a high risk of violations and penalties. As we’ll be explaining on this blog, regulatory changes appear to be on the way. In the not-too-distant future, U.S. companies may be able to use cloud computing and other online digital services, subject to certain encryption requirements, to transfer and store their unclassified technical data without the need to obtain licenses or other authorizations. Hope is on the horizon. At present, however—yes, there are problems.

Even though cloud computing is a rapidly advancing technology at present, with more and more businesses routinely using Dropbox, Google Drive, and similar online services, this has been—and still is—a confusing regulatory area for which State and Commerce have provided very limited guidance until recently. We’re glad that appears to be changing now.

Nevertheless—even after the long-awaited publication of new Proposed Rules by the DDTC and BIS on June 3 containing multiple clarifications and definitions, and even after the issuance of an interim rule by the DoD on August 26 addressing requirements for cloud computing services—it is still far from clear how exporters can be certain they are fully compliant with the EAR and ITAR and avoid inadvertent violations when uploading controlled data to the cloud. A storm of controversy continues to swirl around the subject of cloud computing, IT security, and export controls. Discussions between the defense industry, research universities, the legal community, and the regulatory agencies are intense and ongoing.

Until the dust settles on this, we recommend extreme caution in using any commercial cloud storage service for information storage and transmission when export controls apply. Without clear regulatory guidance, contracting with a third-party for transferring and storing your ITAR-controlled and EAR-controlled data and technology electronically may expose you and your organization to the risk of violating U.S. export laws, with severe penalties and consequences.

But my cloud service provider assures me that my data is absolutely secure—so secure that they themselves have no way to decrypt my files without my password, even if I asked them to.

Yes, Dropbox, Google Drive, Microsoft Office 365, and similar services offer a secure and convenient online environment for storing and sharing documents, and are widely used and trusted in industry for work collaboration, file sharing, and data maintenance. And it is true that they typically provide multiple security precautions, including using SSL for transmitting content and their own separate layer of AES-256 bit encryption server-side.

Nevertheless, even though these IT companies have strict internal security policies limiting access by their employees to their customers’ files, it is evident in many cases that user-data files stored on their servers are in principle accessible by their staff—which may include individuals who are not U.S. persons as defined by the ITAR.

Read the terms of your storage provider’s user agreement and privacy policy carefully. Those legal documents frequently include such warnings as the following: “If we are required to provide your files to a court or law enforcement agency, which we may do under the conditions set forth above, we will remove the encryption from the files before providing them to the authorized government officials.” You’ll also see various disclaimers of responsibility in case of data-security breaches, and statements indicating that the provider has a process in place for contingencies when their system is compromised. Some cloud storage providers claim in their promotional materials that your data is absolutely secure, but remember that what they advertise and what you agree to when you open an account are two different things.

The convenience, economy, and popularity of online services notwithstanding, the use of third-party providers for storing and sharing ITAR-controlled technical data remains problematic. Why?

Here’s one reason: U.S. export control regulations prohibit the unauthorized sharing of controlled technical data with non-U.S persons or foreign nationals, and also prohibit transactions with certain foreign individuals and states. This prohibition includes any form of sharing, including electronic “transmission,” and including even theoretical access to such data by IT administrators or employees who maintain the electronic data storage and transmission systems and who could potentially monitor them. Whenever you store or transmit controlled technical data via non-company servers, you are, in effect, sending your data through cyberspace on the back of a virtual postcard, and you are liable for any access to that data by unlicensed foreign nationals while it is in storage or transit—even if the access is unintentional, and even if you were not aware that the access was occurring.

Remember that commercial cloud computing and online data storage services are not U.S. defense firms; they are unlikely to have segregated systems to protect ITAR-controlled information from foreign-person access. Under the export regulations currently in effect—ignoring, for the moment, proposed revisions to the EAR and ITAR that are under consideration but haven’t been finalized—even high-level encryption is not an adequate security measure for protecting your company’s controlled technical data on non-company servers. Currently, transfer of the data to a server or network location outside the U.S. constitutes an “export” even if the data is encrypted. Furthermore, providing employees who are not U.S. persons, whether they are employed in the U.S. or at non-U.S. offices, with the ability to access ITAR-controlled data (even if they don’t actually access the data) may constitute an “export,” even if the data is protected by encryption.

Here’s another reason: using external providers of cloud storage and file-sharing services, such as Dropbox, Box, or Google Drive, for ITAR-restricted data is problematic because it is difficult or impossible to know where their servers are physically located (that is, whether they are in the U.S. or overseas), how they route data traffic (particularly during peak hours or off-times), or whether their security procedures are truly adequate all along the line to prohibit access to your data by foreign nationals. Most—if not all—cloud computing services routinely use a network of servers that extends beyond U.S. borders. In reality, you have no idea where your data is currently stored—and wherever that may be, it could change tomorrow. Yet any transfer of data from the user to a server outside the U.S., as well as any transfer of the controlled data between two foreign-located servers, constitutes a “transmission,” and thus an unauthorized export, according to current U.S. laws.

But didn’t all that change this year? I read in the news that BIS and DDTC have relaxed their rules now, in recognition of the growing popularity of cloud computing, and that the export regulations have been amended to permit cloud storage of ITAR and EAR data in certain circumstances. Did I hear you right? Are you telling me that’s not true?

You heard me right. That’s not true. Those amendments to the ITAR and the EAR you heard about have not been made—at least, not yet. Here’s what is true:

On June 3, 2015, both the Commerce Department and State Department published long-awaited proposals for revising the EAR and ITAR in order to provide security standards for the transmission and storage of ITAR- and EAR-controlled data and information. If these Proposed Rules are adopted and finalized, they could well represent an important step towards clarifying what exporters need to do in order to comply with U.S. export controls with regard to the transmission, storage, and “cloud” processing of export-controlled technical data, technology, and software.

Among other things, if the revisions proposed on June 3 are eventually adopted and published as final rules, transmitting or storing electronic data in a way that meets certain specified security standards will no longer constitute an “export” of the data, and therefore will not require a prior export authorization or be subject to some other restrictions. Specifically, the June 3 proposals from State and Commerce both say that sending, taking, or storing technical data, technology, or software will not be considered an export when the following conditions are met:

(1) The data must be unclassified;

(2) The data must be secured using “end-to-end encryption” (as defined in the proposed new rule);

(3) The data must be secured using cryptographic modules compliant with a certain encryption standard—FIPS 140–2, or its successors [in stating this condition, the BIS proposal adds the phrase “or other similar cryptographic means,” whereas the DDTC doesn’t wish to add that phrase]; and

(4) The data must not be stored in certain prohibited countries [for the BIS, this means the server locations can’t be in countries listed in Country Group D:5 (see Supplement No. 1 to Part 740 of the EAR) or in the Russian Federation; for the DDTC, this means no data should be stored on servers situated in ITAR Section 126.1 Proscribed Countries or in the Russian Federation].

At first glance, these proposed changes look very hopeful. By providing clarity and legal certainty in this regulatory area, they promise to simplify the compliance process greatly. If implemented, these provisions could offer U.S. companies the option of using the new cloud technologies for transmitting and storing export-controlled data without the risk of export violations, as long they exercise due diligence to ensure that those data security requirements are met.

On closer examination, however, there are some notable caveats in these Proposed Rules:

(1)        Both proposals make it clear that if information should be “released” that permits foreign persons to access your encrypted controlled data (e.g., decryption keys, network access codes, passwords, etc.), then this data transmission or storage will be considered an export, and will be subject to all applicable licensing requirements and restrictions—and penalties for export violations.

(2)        To qualify for this exclusion, your transmission or storage must utilize “end-to-end encryption.” In both the State and Commerce proposals, this means that cryptographic protection of the export-controlled data must be continuous and uninterrupted between the originator and the intended recipient (who could be the originator himself, in the case of simple file storage or archiving). At no point in the process can access in unencrypted form be given to any third parties. That includes internet service providers (ISPs), application providers (such as Microsoft Office 360 or Google Office), or cloud storage providers (such as Dropbox or Box), or any other online services.

(Note: BIS and DDTC are insisting on this condition because they are have found that the methods and procedures currently used by third-party digital service providers, including popular cloud software providers and some e-mail services may allow the data transmitted to be encrypted and decrypted multiple times before it reaches its intended recipient. BIS and DDTC both believe this presents an unacceptable risk of unauthorized release. Keeping the data encrypted from start to finish is the simplest and surest way to minimize the possibility that a foreign cloud service provider or a non-U.S. person employee of a domestic cloud service provider will get access to your ITAR-controlled data or EAR-controlled technology or software in unencrypted form.)

(3)        To qualify for this exclusion, your export-controlled data cannot be stored on, or pass through, any servers in certain specified countries that pose significant national security risks, including the Russian Federation.

On the whole, the provisions in the June 3 Proposed Rules allowing the transfer and storage of properly encrypted technical data are good news for U.S. exporters and should be welcomed. These changes would allow controlled technical data originating in the U.S. to be stored in one or more countries outside of the United States without export licensing, provided the data has been properly encrypted and isn’t stored in arms-embargoed countries or Russia. The proposed security requirements are strict and would almost certainly create complications for the current business model of most cloud storage providers, forcing them to make some changes in the way they operate if they want to serve customers with EAR- and ITAR-compliance requirements. But the requisite changes would appear to be within their capabilities, and the potential benefits of the new rules—which include, among other things, considerably reduced administrative burdens for U.S. manufacturers and suppliers of defense articles and services— are great.

Remember, however, that until State and Commerce have finalized their proposed amendments, the current regulations remain in effect. Until they have been changed, we recommend using locally hosted applications for storing and sharing sensitive technical data. The pundits may well be right when they tell us that the future of data storage is in the cloud, but for now, if your data is export-controlled, the safest place for it is in-house.

There are other important regulatory changes in the works with the potential to impact cloud computing, IT security, and export controls. Next week we’ll look at a few of them. Sign up today for notifications of future posts—and join the discussion by sending your own questions about export compliance to “An EAR . . . to the ITAR.”

(None of the information is intended to be authoritative official or professional legal advice. Consult your own legal counsel or compliance specialists before taking actions based upon this blog or other unofficial sources.)

Oops! I made a mistake… Can I amend a BIS-748P?

Question: I know what to do if it becomes necessary to amend a State/DDTC authorization for exports under the ITAR. But what if I need to make a change to a Commerce/BIS export license? Can I even do that?

The short answer to your question is, Yes, you can – but there’s a very good chance you won’t need to.

Here’s the skinny on correcting a BIS-748P application form or modifying a previously approved export license through the Commerce Department’s SNAP-R system:

You’ve determined that your export falls under the jurisdiction of Commerce and that the transaction requires a license from BIS. You’ve done your research, put together all the information and documentation you need, and have just successfully submitted a SNAP-R BIS-748P license application online. Not long afterwards, before you have even finished congratulating yourself on another job well done, you suddenly realize—to your embarrassment and disgust—that you entered some incorrect information in one of the data fields in your submission, or that you completely forgot to attach the required documents. You quickly log on again to your SNAP-R account and hunt around frantically for an “Undo” or “Recall” button, but fail to find one. Zero, zilch, zip, nada, nothing. What are you supposed to do? Visions of denied licenses, lost time, angry customers, and potential export violations swim before your eyes. Is this going to be a big problem?

Not to worry. Rest assured that you aren’t the first exporter to mess up a license application form. While it’s true that there isn’t any way to undo or recall your Form BIS-748P online once it’s been submitted, all you need to do is phone the BIS’s Office of Export Services and let them know about the mistake. The licensing officer will then simply mark your application “Returned Without Action” (RWA), which means in essence that your application has been rejected, but without any prejudice to future resubmissions. Once that’s done, you can breathe a sigh of relief, copy your original application, fix the mistakes or omissions, and re-submit it to BIS—correctly, this time!—through SNAP-R. Or, if your only mistake was failing to attach the documentation, the licensing officer will just send you an e-mail requesting those documents, to which you can reply directly and rectify the omission.

But what if your export license has already been approved by Commerce, but now you realize you’re going to have to modify it because some things have changed since then? What should you do?

Well, the good news is that you might not have to do anything at all, if:

(1) your modifications are considered “non-material changes,” according to the detailed description in EAR Section 750.7(c);


(2) your modifications are covered by the “shipping tolerances” provision of EAR Section 750.11.

The list of “non-material changes” includes such alterations as a change in unit price or total value, a change in intermediate consignee (if the new intermediate consignee is located in the country of ultimate destination), and a change in the address of purchaser or ultimate consignee (if the new address is located within the same country shown on the license). For the details, read through §750.7(c) carefully; there’s a very good chance you’ll find your change listed there. (And, while you’re doing that, take a couple of minutes more to familiarize yourself with the shipping tolerance exceptions in §750.11 as well; it’s practical knowledge that may prove handy!)

7507 75011 change_to_license

Even in the case of a minor change to your company’s name—assuming that the name change is not the result of a change of ownership, a merger, or an acquisition—you may find that all you really need to do is have the administrator for your SNAP-R account update the name online in the Administration Module. A word of caution, though: a company’s name change may or may not be considered a “non-material change” by the BIS; you’ll need to write to them on company letterhead and request an Advisory Opinion about that before proceeding.

Finally, what if you’ve carefully scrutinized Section 750.7(c) of the EAR and determined that the modification you need to make is unfortunately not among numerous exceptions designated there as “non-material changes”? If that is the case — assuming that you are still shipping the identical items to the identical ultimate consignee — you will need to notify BIS of the change, and it’s up to them to approve or not approve the modification.

You’ll be glad to know that you can deal with this situation online by applying for a “Replacement License” number from BIS. Simply make your request via a SNAP-R Form BIS-748P, using Block 11, “Replacement License Number,” stating concisely what change you are making to the original export license.

In the event that BIS does not approve your “Replacement License” request—they will give you their response in writing— a new export license application will need to be submitted, and approved by BIS, before you can make any further shipments.

easy_stSound easier than you thought it would be? Well, many companies who have entered the regulatory jurisdiction of BIS for the first time recently, thanks to the Export Control Reform Initiative (ECR), have said they were surprised and relieved to discover that Commerce’s controls and licensing regime are often simpler and less restrictive than State’s. Export Licensing Officers have generally found Commerce’s SNAP-R electronic application portal to be more user-friendly than the State Department’s D-Trade system.

There are other significant differences between the two export regimes as well. For example, you do not need to “return” your Commerce export license to BIS once it is no longer valid, as you are required to do with a DSP license from State/DDTC after expiration or exhaustion when it has not been decremented entirely electronically through AES. In future posts, we’ll be spotlighting some other similarities and differences between EAR and ITAR licensing, in addition to providing you with practical information you’ll need when applying for and using Commerce licenses for “600 series” items, which were formerly subject to the ITAR.

Even though the BIS application process is simpler in many ways, be aware that Commerce export licenses typically have more conditions attached than State/DDTC licenses or agreements. And remember this, too: whether you’re exporting your product under a Commerce or a State export license, you and your company are responsible and legally accountable to stay within authorized scope of the export authorization and strictly observe all its provisos and conditions.

penaltyCommerce and State have been increasingly active in export enforcement lately. Civil and criminal penalties for export violations in recent cases have been extremely heavy. Even “minor” export violations of the ITAR and EAR can have very serious consequences for companies and individuals.

Achieving and maintaining corporate ITAR and EAR compliance can be a daunting challenge for U.S. exporters, but we’re here to help. Export Compliance Solutions (ECS) has built a distinguished record based on many years of experience in the field of U.S. export controls. As the nation’s premier export compliance consultants and educators, we offer a wide variety of training, auditing, and advisory services, including live regional and on-site seminars, webinars, export compliance awareness video courses for employees, and other products to support our clients. Give us a call or send us an e-mail today. The ITAR and EAR compliance experts at ECS can help you successfully navigate the sometimes rough regulatory seas of U.S. export controls.

(None of the information is intended to be authoritative official or professional legal advice. Consult your own legal counsel or compliance specialists before taking actions based upon this blog or other unofficial sources.)