Amazon pays $135K to settle OFAC screening violations

The apparent violations were deemed “non-egregious” by OFAC, and Amazon voluntarily self-disclosed the incident in addition to cooperating with the subsequent investigation. The penalty amount is equal to the sum of half the transaction value for each apparent violation.

Deficiencies in Amazon’s sanctions screening processes led to the company providing goods and services to persons sanctioned by OFAC in Crimea, Iran, and Syria, the regulator explained in a Web notice. Amazon also accepted and processed orders on its Websites for persons located in or employed by the foreign missions of Cuba, Iran, North Korea, Sudan, and Syria. OFAC describes the transactions as consisting primarily of low-value retail goods and services.

The apparent violations took place from November 2011 to October 2018 and occurred “primarily because Amazon’s automated sanctions screening processes failed to fully analyze all transaction and customer data relevant to compliance with OFAC’s sanctions regulations,” OFAC explains. Examples provided include an order destined for “Yalta, Krimea”—instead of the correct spelling “Crimea”—not being flagged and hundreds of other instances of misspellings slipping through screening.

“This case demonstrates the importance of implementing and maintaining effective, risk-based sanctions compliance controls, including sanctions screening measures appropriate for ecommerce and other internet-based businesses that operate on a global scale,” OFAC stated. “[G]lobal companies that rely heavily on automated sanctions screening processes should take reasonable, risk-based steps to ensure that their processes are appropriately configured to screen relevant customer information and to capture data quality issues, such as common misspellings.”

Among remedial measures taken by Amazon and listed by OFAC as mitigating factors include the investment of substantial resources to improve Amazon’s overall sanctions compliance program, adding significant headcount to the company’s compliance teams, and increasing the frequency of its sanctions compliance reviews.