OFAC Publishes Guidance on the 10-Year Sanctions Enforcement Window: Actions for Compliance Teams

On July 22, 2024, the US Treasury Department’s Office of Foreign Assets Control (OFAC) published an anticipated “Guidance on Extension of Statute of Limitations” (the Guidance) to clarify that the new 10-year statute of limitations (SOL) only applies to violations that were not time-barred as of April 24, 2024 and to announce its plan to extend recordkeeping requirements at 31 CFR § 501.601 from five to 10 years.

The Guidance relates to the “21st Century Peace Through Strength Act,” (the Act) which was signed into law on April 24, 2024, and, among other things, extends the SOL for civil and criminal enforcement actions under the International Emergency Economic Powers Act (IEEPA) and the Trading with the Enemy Act (TWEA)—the statutory authorities underlying most US sanctions programs—from five to 10 years.  The SOL extension was a less publicized element of the Act, which was better known for providing $98 billion in foreign aid for Ukraine, Israel, and Taiwan, and a mandate for ByteDance, Ltd. to sell or divest its interests in the social media application TikTok.

Sanctions compliance teams at companies should consider taking the following key actions in response to the SOL extension and the Guidance: (1) update look-back periods to cover the prior 10 years or reach back to April 24, 2019, whichever is more recent; (2) update recordkeeping policies and practices to cover 10 years; (3) enhance compliance functions to account for extended SOL and the potential for increased enforcement risk; and (4) consider the extended SOL period when deciding whether to disclose a potential sanctions violation, particularly for potential violations that may have been close to expiring under the five-year SOL.

We have previously written about strategies for companies to help mitigate the risks associated with the extended SOL period.  Now, the OFAC Guidance provides helpful insight into key considerations for sanctions compliance teams on the new regulatory environment. 

OFAC Guidance: Key Takeaways

OFAC’s Guidance addresses two primary questions that were left unaddressed when the Act was passed: (i) which violations are considered time-barred following the SOL extension; and (ii) whether the SOL extension affects companies’ recordkeeping requirements at 31 CFR § 501.601.

The Guidance states that the new 10-year SOL under the Act applies to “any violation that was not time-barred at the time of its enactment.”  Accordingly, the Guidance clarifies that OFAC may bring an enforcement action for civil violations of IEEPA- or TWEA-based prohibitions within 10 years of the latest date of an apparent violation, but only for violations where the latest date of an apparent violation occurred on or after April 25, 2019. 

Additionally, the Guidance announces OFAC’s plans to publish an interim final rule (IFR) to extend the recordkeeping requirements under US sanctions regulations (i.e., Title 31 of the Code of Federal Regulations, Section 501.601) from five to 10 years in line with the extended SOL.  The Guidance states that OFAC intends to solicit public comments in connection with the IFR, and that the recordkeeping requirement is expected to take effect six months after the IFR is published. 

Actions for Sanctions Compliance Teams

As previewed above and in light of OFAC’s Guidance, sanctions compliance teams should consider taking the following actions to help account for the extended SOL period and increased sanctions enforcement risk: 

• Transactional Due Diligence, Representations and Warranties: To help address and allocate the risk of the extended SOL, sanctions compliance teams should consider the new 10-year SOL (but only as far back as April 24, 2019) when drafting look-back periods in connection with transactional due diligence and agreements. These considerations are likely to be relevant in mergers and acquisitions, capital markets transactions, financings, other commercial agreements, as well as for due diligence into counterparties. Additionally, sanctions compliance teams should consider incorporating the extended SOL period for sanctions-related representations and warranties in templates for transaction documents and agreements.  
• Recordkeeping: Sanctions compliance teams should consider updating internal recordkeeping policies and practices to maintain 10 years of records in anticipation of the extension of the recordkeeping period.  OFAC states in the Guidance its intent to extend the US sanctions recordkeeping requirements at 31 CFR § 501.601 from five years to 10 years, which would become effective six months after publication of the IFR.  Taking proactive steps now to prepare for this change—including taking stock of the potential associated costs and practical burdens—can help companies be ready for the new recordkeeping rules once they become effective.
• Compliance, Internal Audit, and Internal Investigation Programs: Sanctions compliance teams should consider taking steps to account for the 10-year SOL and the potential for overall increased enforcement risk for sanctions violations.  The extended SOL provides a longer period of time for OFAC to investigate and initiate an enforcement action for apparent violations of IEEPA- and TWEA-based prohibitions. Additionally, the extended SOL may presage OFAC’s increased willingness to channel resources to enforce sanctions prohibitions, as reflected in the Act’s requirement that OFAC provide classified briefings to Congress on its staffing levels. 
• Voluntary Self-Disclosures: When deciding whether to voluntarily self-disclose a potential sanctions violation that might have been close to expiration under the previous five-year SOL, sanctions compliance teams should now consider the extended SOL and the Guidance.  Under the extended SOL, civil violations of IEEPA- and TWEA-based prohibitions where the latest date of an apparent violation occurred on or after April 25, 2019, are subject to the extended SOL.  Accordingly, enforcement agencies now have increased runway to investigate these apparent sanctions violations.  As a result, companies could face more enforcement actions and larger penalties.

The Act foreshadows regulators’ willingness and interest to channel resources to sanctions enforcement.  Accordingly, compliance teams should consider the actions described in this article to help prepare for and reduce the risks related to the new sanctions compliance and enforcement landscape.