CUNA Comment Letter

OFAC Economic Sanctions Enforcement Procedures for Banking Institutions (F.R. Doc. 06-278)

March 13, 2006

Assistant Director of Records
ATTN: Request for Comments (Enforcement Procedures)
Office of Foreign Assets Control
Department of the Treasury
1500 Pennsylvania Ave., N.W.
Washington, D.C. 20220

Dear Sir or Madam:

The Credit Union National Association (CUNA) appreciates the opportunity to comment on the Office of Foreign Assets Controls (OFAC’s) interim final rule regarding economic sanctions enforcement procedures for banking institutions. The interim final rule provides a general procedural framework for the enforcement of economic sanctions enforcement programs with respect to banking institutions. Under the rule, OFAC will take an institutional rather than a transactional approach to enforcement of the OFAC regulatory regime to bar criminals and terrorists from using the U.S. financial system to carry out their illegal activities. OFAC rules are intended ensure that financial institutions block transactions of any person appearing on a list of Specially Designated Nationals and Blocked Persons (SDN List). CUNA represents approximately 87 percent of our nation’s 8,900 state and federal credit unions, which serve nearly 87 million members.

CUNA supports OFAC's separate enforcement process for credit unions and other financial institutions, which is designed to take into consideration the role of such institutions, the nature of the transactions in which they engage, and the fact that they are heavily regulated. We also generally support the procedural framework as set forth in the interim final rule. In particular, we think the periodic institutional review makes sense. Under the interim final rule, prior to taking enforcement actions, OFAC generally will review violations or suspected violations by a particular institution over a period of time, rather than evaluating each apparent violation independently. The interim final rule indicates that this review will take place for institutions with violations or suspected violations. We believe it is appropriate that institutions that do not have violations or suspected violations will not be subject to this periodic review. We do have one concern with the periodic review. The new procedures call for a periodic review of institutions with violations, except for “significant violations for which prompt appropriate.” The rule does not define what significant violations entail; we think it should be addressed in the guidelines.

CUNA supports OFAC’s approach to take into consideration in its enforcement procedures that the OFAC compliance program at each institution should be tailored to its unique circumstances. We think it is important that OFAC recognizes that the institution’s compliance program must reflect the particular circumstances of each institution, including: the institution’s business volume; the institution’s members or customers; the products and services offered; the institution's history of sanctions violations; the number of OFAC-related transactions handled correctly compared to the number and nature of transactions handled incorrectly; the quality and effectiveness of the institution's overall OFAC compliance program; and whether the apparent violation or violations in question are the result of systemic failures at the institution or are atypical in nature. CUNA appreciates the specific inclusion of the size of the institution as one of the factors; and we further urge OFAC to ensure that its regulations are not overly burdensome on smaller institutions, including smaller credit unions, with limited staff and resources.

However, we have a concern with one of the enumerated factors affecting OFAC’s decision as to the appropriate administrative/enforcement action – voluntary disclosure to OFAC of the apparent violation(s) by the institution. Specifically, we have a concern with the term “voluntary” defined in this context to be contingent on another party’s requirement to file a report on the same transaction, whether or not the other party actually files a report. While OFAC indicates that the agency will consider such reports by an institution as cooperation and, therefore, as a mitigating factor in its enforcement decisions, we feel this would not sufficiently serve the agency’s goal of encouraging voluntary disclosure. We urge OFAC to redefine voluntary disclosure to include any disclosure reported by an institution, even if another party already filed a report with OFAC concerning that conduct. Financial institutions typically are doing their best to report information to OFAC voluntarily and are not always able to know or control whether or not another party reports information to OFAC. Further, we propose that OFAC consider additional incentives for voluntary reporting, such as zero or low penalties for first offenses and a significant penalty/fine reduction for subsequent violations that are voluntarily reported. We feel strongly that these would assist OFAC’s efforts to obtain timely information to most effectively administer and enforce economic and trade sanctions programs against targeted countries and groups of individuals, such as terrorists and narcotics traffickers.

We think the two annexes in the interim final rule will prove useful for financial institutions: Annex A - OFAC Risk Matrices and Annex B - Sound Institution OFAC Compliance Programs. We feel the two OFAC Risk Matrices in Annex A will help institutions understand whether their examiners will consider their operations to be in a category of high, moderate or low risk for OFAC violations. And Annex B, containing items that are characteristic of effective OFAC compliance programs, provides helpful guidance for financial institutions in maintaining effective OFAC policies, procedures and controls that are commensurate with the institution’s OFAC “risk profile.”

However, we do have some recommendations with regard to the OFAC Risk Matrices in Annex A. Matrix A is from the Federal Financial Institution’s (FFIEC’s) Bank Secrecy Act/Anti-Money Laundering Examination Manual (BSA/AML Manual), which indicates that an institution’s policies, procedures, and processes for reviewing transactions and transaction parties should reflect the institution’s OFAC risk assessment. OFAC regulations involve strict liability, requiring financial institutions to block or "freeze" property and payment of any funds transfers or transactions involving blocked countries or individuals on the SDN List and to report the "blocks" within 10 business days of occurrence. We request OFAC to consider providing a safe harbor from the strict liability standards in its regulations for institutions that perform risk assessments and meet all the other requirements for a sound OFAC compliance program as indicated in Annex B.

According to the interim final rule, OFAC may grant up to thirty days for an institution to respond to the preliminary assessment of the enforcement action(s) the agency intends to pursue. In addition, OFAC may grant further extensions “at its sole discretion where it determines this is appropriate”. We believe that OFAC should permit at a minimum thirty days for an institution to respond and routinely allow an additional thirty day extension upon request.

Finally, we urge OFAC to conduct a review of these enforcement procedures after they have been in place for one year to assess how effectively they are working and to allow financial institutions and financial institution regulators the chance to provide feedback to further improve the guidelines.

Thank you for the opportunity to comment on the interim final rule. If you have any questions about our comments, please contact Associate General Counsel Mary Dunn or me at (202) 638-5777.


Catherine A. Orr
CUNA Senior Regulatory Counsel