Tricky but doable: Tips for navigating sanctions in third-party relationships

Russia’s war in Ukraine has ramped up the risks associated with sanctions violations, experts said Thursday during a session at Compliance Week’s virtual Third-Party Risk Management and Oversight Summit. Panelists Stephanie Brown Cripps, counsel at law firm Freshfields Bruckhaus Deringer, and Izak Rosenfeld, associate general counsel for nonprofit Access Now, each predicted sanctions enforcement will be a major trend in 2023 and beyond.

“You can see … the size of penalties and the volume of cases increasing,” Rosenfeld said. “All signs point to increased enforcement.”

Many western companies cut ties with Russia in 2022 or made plans to reduce their exposure in the country, following its invasion of Ukraine in February. Doing so reduced the risk continuing a relationship might violate sanctions imposed by the United States, United Kingdom, or European Union, said Nancy Jacobson, counsel for global ethics and compliance at United Airlines.

Jacobson said since Russia invaded Ukraine, United employees have been regularly seeking guidance from the airline’s compliance department on which business relationships might pose a risk of sanctions violations. Many of the issues raised by employees simply merited reassurance they did not, she said.

But some areas of United’s business are especially risky in terms of sanctions. The sale of used airplane parts, for example, requires enhanced due diligence by the compliance team to ensure each transaction does not violate any sanctions. Further, sometimes a license is required to move a particular part from one country to another.

Other relationships that are less important to United’s overall financial health can be jettisoned, she said, something that has happened with a lot of the airline’s previous business activities in Russia.

“We looked at the business risk and asked, ‘Do we want to deal with this?’” she said of United, referring to third parties located in Russia. “The answer, in many cases, was no.”

Third-party vendor contracts that contain sanction compliance clauses—clauses that note if there is a potential sanctions compliance issue, the contract can be voided—are crucial to being able to efficiently eliminate new and emerging risks posed by a vendor or business partner, she said.

“[Sanctions are] constantly evolving. It’s not a one-time analysis. Just because someone is on a sanctions list doesn’t mean you can’t ever do business with them.”

Izak Rosenfeld, Associate General Counsel, Access Now

There are also plenty of legitimate reasons to continue doing business in a sanctioned jurisdiction. United offers flights to Havana despite U.S. sanctions on Cuba, for example. Certain business activities are allowed through exemptions or licenses.

Access Now, Rosenfeld said, “defends and extends the digital rights of users at risk around the world.” The group was formed in response to citizens in Iran, a country long sanctioned by the United States, to provide access to the internet to communicate with the wider world and avoid government censors.

The group’s work necessitates doing business in countries under sanctions. Its employees must understand not only the sanctions but also the exceptions that allow certain business activities to continue. And the landscape is always changing, he said.

“Sanctions are very political; they are based on government decisions,” he said. “It’s constantly evolving. It’s not a one-time analysis. Just because someone is on a sanctions list doesn’t mean you can’t ever do business with them. Sometimes sanctions are lifted on an entire country.”

Access Now continues to use manual processes to conduct due diligence on sanctions, he said, as some of the technology available is too expensive for the small organization.

“It’s a big part of my week to look at changes, read government announcements, and generally stay on top of regular searches,” he said.

Another important way to protect your organization when dealing with third parties in sanctioned jurisdictions is recordkeeping, Jacobson said. Store all documents and related communications on a particular transaction together so they can be recalled, if necessary.

Occasionally, Access Now will have a transaction blocked by an overzealous financial institution, even though the transaction should have been allowed.

“Not everyone is willing to conduct the analysis required to see (the transaction’s) applicability to your business,” he said. “It’s not always met with flexibility. Sometimes, the bank just says no.”

Jacobson said United has had transactions blocked by business partners for sanction violation concerns. It is often helpful to place a note on a particular transaction with the specific exemption or license being used, she said.

The next step is “getting on the phone with attorneys at another company to discuss the agreement,” she said.

If no agreement is reached, the business must take the issue to the Treasury Department’s Office of Foreign Assets Control to resolve.

“There are exemptions that allow transactions in sanctioned jurisdictions,” Rosenfeld said. “A blanket ban on activities—where there is a path to allow them—is not realistic.”