A Hong Kong-based subsidiary of Japanese trade conglomerate Sojitz Corp. agreed to pay approximately $5.2 million for violations of U.S. sanctions against Iran that occurred when rogue employees deliberately misled company executives and compliance regarding the true origin of goods worth more than $75 million.

The Treasury Department’s Office of Foreign Assets Control (OFAC) announced the fine Tuesday against Sojitz Hong Kong (Sojitz HK) for a series of transactions related to the procurement of 64,000 tons of Iranian-origin high density polyethylene resin, paid for through U.S. financial institutions to a bank in Thailand for a Chinese customer. The payments, 60 in all, occurred from 2016-18, OFAC said.

The trading by Sojitz HK “appears to have conferred significant economic benefits to Iran and undermined broad U.S. sanctions specifically targeting Iran’s petrochemical sector, a major source of revenue generation for the government of Iran,” OFAC said in its enforcement release.

Among mitigating factors, the parent company was not aware its subsidiary was violating U.S. sanctions and self-reported the apparent violations when they were discovered. Sojitz cooperated with the investigation, has had no previous sanctions violations, and implemented remedial actions, OFAC said. As a result, the apparent violations were considered non-egregious.

Compliance lessons: According to OFAC, Sojitz’s compliance team in Japan gave explicit and repeated instructions to employees of Sojitz HK that the law and company policy forbid U.S. dollar payments through U.S. financial institutions to pay for goods from Iran. Despite those warnings, several Sojitz HK employees arranged to pay for the resin sourced from an Iranian manufacturer for a Chinese customer. One of the employees was a mid-level manager.

The Sojitz HK employees hid the fact the resin was made in Iran by representing on transactional documents and in the company’s internal business approval processes that it was made in Thailand. The Iranian manufacturer that produced the resin was not named by OFAC.

Among its remedial measures, Sojitz “conduct[ed] a thorough internal look-back investigation to identify the root causes of the compliance failures and significantly enhanced its compliance program to address deficiencies and minimize the risk of recurrence,” OFAC said.

Sojitz also fired the employees who engaged in the misconduct; revised its sanctions screening procedures “to require that the counterparties in all business transactions be subject to mandatory compliance screening to ensure that business is carried out in compliance with company-wide sanctions compliance policies and applicable laws and regulations”; and enhanced the independence and capability of its of its sanctions compliance unit “by housing the unit inside the legal department and hiring additional compliance expertise.”

OFAC recommends companies conduct “robust risk assessments to identify activities that pose greater sanctions risks,” then implement “appropriately tailored risk-based procedures designed to minimize violations” that include the ability of rogue employees to circumvent internal controls. Testing and auditing of a firm’s compliance program might also guard against such conduct, the regulator noted.

The case “further illustrates the importance for parent companies to ensure that appropriate compliance programs and procedures are implemented at their overseas subsidiaries and to exercise appropriate oversight over activities that may pose sanctions risks,” OFAC said.

“OFAC’s release captures the salient details of the event in question such that we do not have any additional comments,” Sojitz said in an emailed statement. “We are continually improving our policies and procedures to comply with relevant laws and regulations, including those with respect to sanctions.”