In recent years the United States’ aggressive use of economic sanctions and other trade restrictions has been rattling trade compliance managers and reshaping supply chains of large and small companies around the world. Among the most consequential measures was the listing of the Chinese telecommunications giant Huawei and its subsidiaries world-wide on the U.S. Entity List. Many companies have already re-adjusted their supply chains to respond to these disruptions, but it is likely that economic warfare through imposition of restrictions on foreign companies and entities will continue.
Imagine that you just learned that one of your customers has supplied your company’s product into the supply chain of a restricted company, such as a Huawei subsidiary. What should you do or not do in these circumstances? Let us start with what you should NOT DO:
- Panic. Even if your product finds its way into the supply chain of a restricted party, there are good chances that no violation is actually taking place. The jurisdiction of the U.S. Department of Commerce, Bureau of Industry and Security (BIS) which enforces the Entity List, applies to the “items subject to the EAR.” The jurisdiction of the Office of Foreign Assets Control (OFAC), which enforces the restrictions of the Specially Designated Nationals list, applies to U.S. persons and, under some sanctions programs, subsidiaries of U.S. companies. It is quite possible that the product that or transaction that reaches the restricted party is not subject to U.S. jurisdiction and therefore does not violate U.S. law. Careful supply chain and legal analysis is required to determine whether this is so.
- Ignore it. Another distinct possibility is that your company cannot be held legally liable for the fact that your product was reaching a restricted party when you did not know about it. However, now that you do know about it, legal liability will attach to your actions if you allow this trade to continue. If there is a violation taking place and you fail to take measures to stop it, OFAC or BIS will not look kindly upon it.
- Rush in with a voluntary disclosure. OFAC and BIS strongly encourage voluntary self-disclosures and usually grant the discloser significant mitigation of penalties. In many cases, disclosure is the best policy. However, it should not be automatic. In some circumstances, for example where there are relatively small technical violations, fixing the problem internally may be the better policy. A careful assessment of the circumstances and legal advice should be employed to decide whether to make a voluntary self-disclosure.
- Cover it up. Notwithstanding the point above, attempting to cover up significant violations will be about the gravest mistake a company can make. U.S. government uses powerful data mining and intelligence tools to detect violations that impede U.S. foreign policy, and there is always a chance that a competitor or a disgruntled employee will report it. U.S. government will treat attempts to cover up or even to timely report significant violations as aggravating factors in deciding the level of penalties.
- Go it alone. The analysis required to determine whether your customer supplying your product to a restricted party amounts to your company’s violation can be quite complex. In today’s extended supply chains, a product can go through four or five tiers of manufacturing before reaching the original equipment manufacturer (OEM) such as Huawei. In many cases, your product will loose its distinct identity in the process of substantial transformation into a higher-tier product, and the product that is ultimately provided to the OEM will no longer be an item subject to the EAR. On the other hand, foreign-made products that contain more than a de minimis amount of controlled U.S. content will still be items subject to the EAR. In other cases, the involvement and level of awareness of U.S. persons may need to be investigated. If your company does not possess sufficient technical and legal expertise to conduct the appropriate analysis, it could commit further very costly mistakes by failing to engage external expertise.
Of course there are also proactive measures that companies engaging in cross-border trade should undertake to detect and respond to discoveries of their products entering the supply chains of restricted entities. One of the best of these is avoiding unpleasant surprises in the first place by conducting risk assessments. In fact, OFAC in its Framework for Compliance Commitments makes it quite clear that it expects organizations to routinely conduct risk assessments in order to identify potential risks of sanctions violations.
And what if you do confirm that your product has been provided to a restricted party in violation of applicable law? You should take it seriously, but it is not the end of the world. Follow the following quick-action guide:
- Immediately take measures to stop further violations from taking place
- Inform your upper management
- Communicate your actions to your customer(s)
- Gather information regarding the scope and extent of violations
- Consider engaging outside counsel
- Consider filing a voluntary disclosure
- Evaluate whether the risks of use and distribution of your products were sufficiently managed with legal commitments such as contract clauses and end-user certifications
- If they were, consider whether your customer(s) complied with their legal commitments. If they did not, take appropriate measures
- Assess whether compliance gaps in your organization have led or contributed to the violation, and take appropriate measures to fix the gaps
- Coordinate with your public relations officer to control possible fallout from disclosure of violations or suspension of supply to your customer(s)
Discovering that your company may have engaged in a violation by providing its product to a restricted party is bound to be a nerve-wrecking experience. However, it is becoming more common as sanctions and trade restrictions are used more and more as a tool of economic warfare. When you handle it properly and promptly, you can limit your company’s legal liability, strengthen your compliance procedures, and build the regulators’ trust in your company’s commitment to trade compliance.
(A version of this post first appeared in the April 2020 issue of the Export Compliance Manager, a journal of World Export Control Review.)
