The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) assessed a $4.1 million fine against Berkshire Hathaway on Tuesday for “egregious” violations of sanctions against Iran committed by a subsidiary in Turkey.

According to OFAC’s enforcement order, Berkshire subsidiary Iscar Kesici Takim Ticareti ve Imalati Limited Sirket (Iscar Turkey) violated U.S. sanctions against Iran 144 times between December 2012 and January 2016.

The violations occurred when Iscar Turkey used two Turkish distributors to ship about $383,000 worth of cutting tools and related products to customers in Iran, “including several entities later identified as meeting the definition of the Government of Iran,” OFAC said in a press release.

“OFAC determined that Berkshire voluntarily self-disclosed the apparent violations on behalf of Iscar Turkey, and that the apparent violations constitute an egregious case,” the press release said.

The violations occurred without Berkshire’s knowledge, OFAC said, until the company received an anonymous tip in January 2016. The company halted any further sales, replaced the employees involved, and implemented compliance initiatives to prevent further violations. The company self-reported the violations to OFAC in May 2016.

According to OFAC, employees of Iscar Turkey used deceptive practices to hide the sales to Iranian customers from corporate headquarters, misled its corporate compliance officers who looked into the matter, then lied to OFAC agents who were investigating the case.

OFAC said its investigation found the sanctions violations were orchestrated by the general manager of Iscar Turkey, who believed U.S. sanctions against Iran would be lifted eventually and wanted to position the company to sell products in Iran when that occurred. But the manager also engaged in deceptive practices to sell products to customers in Iran.

According to OFAC, Iscar Turkey’s general manager and several employees used private email addresses that bypassed the controls and visibility of the corporate email system to communicate about orders from Iranian customers; created false names in internal records of Iscar Turkey to conceal transactions; provided false assurances in response to compliance inquiries; provided ”fraudulent evidence of a compliance training session; and, when the internal investigation was initiated, lying to interviewers and counseling others to lie.” He and others also used incorrect end-user addresses and created at least one fake company in order to obscure the sales.

OFAC reduced the original fine against Berkshire from $18.4 million to $4.1 million due to mitigating factors in the case, which included the self-reporting of the violations, the company’s cooperation with OFAC investigators, as well as its actions after it became aware of the violations.

The case offers several lessons to compliance officers responsible for overseeing the conduct of foreign subsidiaries, specifically regarding weaknesses in internal controls related to sanctions compliance, OFAC said in its settlement agreement. As part of the settlement, Berkshire agreed to implement and maintain sanctions compliance measures for five years.

Some of those measures include conducting periodic sanctions risk assessments; implementing internal controls that match the results of those risk assessments; employing testing or internal audit procedures “appropriate to the level and sophistication of its sanctions compliance program”; conducting OFAC-related compliance training; and providing certification to OFAC each year that all those measures are in effect.

As part of its enforcement action, OFAC said Berkshire should have conducted more due diligence, “particularly with regard to affiliates, subsidiaries, or counter-parties that are known to transact with OFAC-sanctioned countries or persons.” The company should have worked more diligently to ensure its subsidiaries “understand their obligation to comply with all applicable OFAC sanctions, to include when they supply goods to other companies within their corporate chain, and to report potentially violative conduct.” The company also should have verified “the accuracy of end-users and associated underlying paperwork for goods shipped through third-country distributors, particularly where there are red flags indicating potential OFAC-sanctioned countries or persons.”