How law firms around the world should handle clients subject to US sanctions

In the past two years, we have published chapters on how best to identify and mitigate US sanctions risk in Latin America, and, most recently, a chapter that provides an overview of recent trends in US sanctions and how Latin American companies can continue to mitigate such risks. This year, our third chapter aims to provide guidance to law firms anywhere in the world that deal with clients that are subject to US sanctions.

As sanctions continue to be the US government’s preferred foreign policy tool, an increasing number of persons, including individuals and companies, are being identified on the US Department of the Treasury (the Treasury)’s Office of Foreign Assets Control (OFAC) Specially Designated Nationals and Blocked Persons List (SDN List). Additionally, the United States is continuing to impose an array of new sanctions on countries and regions. As such, it is increasingly likely that a law firm, wherever it is located in the world, finds itself in a position where it has a relationship with a client that is subject to US sanctions. When this occurs, it is important that both US and non-US persons understand the implications of such sanctions on the client and the risks law firms may face for providing legal services to persons subject to US sanctions.

Notably, while the US government’s imposition of sanctions on a client may not appear to concern foreign lawyers and law firms operating outside of the US, this view does not adequately reflect the reach of US sanctions. Law firms that choose to represent clients subject to US sanctions must consider a variety of legal and practical factors when representing those clients. Below, we provide a general overview of US sanctions, a summary of sanctions risks specific to law firms, and suggested mitigation measures. We also offer recommendations law firms can implement to protect themselves from US sanctions enforcement actions.

US sanctions: background

In our firm’s sanctions, export controls and anti-money laundering practice, we often see that clients do not understand the full extraterritorial reach of US sanctions or when and how those sanctions may apply to their activities. Below, we offer a background summary on US sanctions to clarify their application to US and non-US persons.

Primary sanctions

US ‘primary’ sanctions apply to any transaction with a nexus to a US person. The definition of ‘US person’ may vary depending on which sanctions programme is involved, as ‘US person’ can be defined differently across sanctions programmes (e.g., if the sanctions nexus involves a person sanctioned under the Syria sanctions programme, one would look to the Syrian Sanctions Regulations at 31 C.F.R. 542 for a definition of US persons); however, the term is generally defined as, ‘any United States citizen, lawful permanent resident, entity organized under the laws of the United States or any jurisdiction within the United States (including foreign branches), or any person in the United States’. Note that dual national persons and lawful permanent residents are considered US persons even while they are physically located outside the United States. In all but two sanctions programmes (Iran and Cuba), non-US subsidiaries of US companies are not treated as US persons, but non-US branches of US companies (e.g., the Citibank branch in Buenos Aires) may be US persons. The sanctions programmes targeting Iran and Cuba apply the restrictions for US persons to any non-US entity that is owned or controlled by a US person.

Unless authorised by a general or specific license issued by OFAC, or exempt, OFAC’s regulations generally prohibit all transactions by US persons or within (or transiting) the United States that involve any property or interests in property of designated or otherwise blocked persons. Notably, non-US persons, including non-US law firms, may also face liability under US primary sanctions if non-US persons ‘cause’ a US person to violate sanctions. Using US dollars in a transaction is the most common way to create a US nexus that would lead a non-US person to incur US sanctions liability for ‘causing’ a US person to violate sanctions. Virtually all US dollar bank transactions must be cleared through a correspondent account with a US bank, so a non-US party transacting with a sanctioned party in US dollars could be liable for a violation of US sanctions by causing the US bank to process the transaction, even when these transactions originate from and terminate at non-US banks.

In other words, if a non-US law firm is involved in a US dollar bank transaction that relates to an individual or entity on OFAC’s SDN List, or any other person blocked pursuant to OFAC’s 50 Percent Rule, OFAC may hold the non-US law firm responsible for causing the US financial institutions to violate the primary sanctions, even if the subject transaction between the non-US persons is performed entirely outside the United States Non-US law firms could face the same sanctions risk for receiving a payment in US dollars from a client located in a sanctioned jurisdiction. In this case, non-US persons outside the United States may be considered to ‘cause’ the United States bank to violate the primary sanctions and may bear the corresponding liability for such violation.

Over the past few years, OFAC has brought an increasing number of enforcement actions against non-US persons for activity originating outside the United States, demonstrating that OFAC is more than willing to extend its enforcement authority to foreign persons who cause US persons to violate US sanctions laws. A recent example includes OFAC’s enforcement action on 25 April 2022, where Toll Holdings Limited (Toll), an international freight forwarding and logistics company headquartered in Melbourne, Australia, agreed to pay US$6,131,855 to settle its potential civil liability for 2,958 apparent violations of multiple OFAC sanctions programmes. The apparent violations occurred when Toll originated or received payments through the US financial system involving sanctioned jurisdictions and persons. These payments were in connection with sea, air, and rail shipments conducted by Toll, its affiliates, or suppliers to, from, or through North Korea, Iran or Syria, or the property or interests in property of an entity on OFAC’s SDN List. Another example occurred on 14 January 2021, when PT Bukit Muria Jaya (BMJ), a paper products manufacturer located in Indonesia, agreed to pay US$1.01 million to settle its potential civil liability for 28 apparent violations that arose from its exportation of cigarette paper to North Korea. BMJ directed payments for these exports to its US dollar bank account at a non-US bank, which ‘caused’ US banks to clear wire transfers related to these shipments, including shipments made to a blocked North Korean person.

Notably, OFAC has never brought an enforcement action against a law firm. However, while OFAC’s previous enforcement actions mainly targeted financial institutions, in recent years OFAC has begun targeting a wider variety of companies, including service providers. On 21 December 2023, OFAC brought an enforcement action against insurer Privilege Underwriters Reciprocal Exchange for providing a private fleet auto insurance policy, a jewelry and art insurance policy, and two high value homeowner’s insurance policies to an entity majority owned by a sanctioned individual. Additionally, OFAC issued an enforcement action against two virtual currency service providers, Bit Pay, Inc. on 18 February 2021 and BitGo, Inc. on 30 December 2020, for alleged sanctions violations, including a failure to identify persons conducting transactions from sanctioned jurisdictions through their platforms. On 13 June 2019, OFAC issued an enforcement action against Expedia Group, Inc., a travel service provider, for dealing in property or interests in property of Cuba or Cuban nationals with travel or travel-related services for travel within Cuba or between Cuba and locations outside the United States. As OFAC increasingly continues to issue enforcement actions against service providers, we recommend that law firms ensure they are in compliance with US sanctions to avoid becoming the first law firm target of an OFAC enforcement action.

The civil penalties can be severe if a non-US person is found to have caused a US person to violate US sanctions. Most country-specific sanctions programmes are authorised under the International Emergency Economic Powers Act (IEEPA). Civil violations of IEEPA are subject to a strict liability standard and carry a maximum penalty of up to US$368,136 (as adjusted for inflation) or twice the value of the transaction, whichever is greater for each violation. Criminal violations of IEEPA have a heightened intent requirement, specifically that the unlawful conduct was ‘wilful’, and carry a maximum penalty of US$1 million and up to 20 years imprisonment, as well as potential criminal forfeiture of any property or funds involved in the violations. In addition, significant non-monetary collateral consequences may result from a violation, including significant reputational harm.

Secondary sanctions

Separately, ‘secondary’ sanctions specifically target non-US persons engaged in activities with the primary sanctions target that undermine or evade the purpose of the sanctions regime. Secondary sanctions do not require any US nexus. The purpose of secondary sanctions is to deter non-US persons from engaging in certain dealings with sanctioned countries or persons by restricting their access to US markets. After determining that a foreign person has engaged in an activity actionable under secondary sanctions, such as participating in certain transactions with an individual or entity on OFAC’s SDN List, the US government can impose restrictions of varying severity on the foreign person. These measures include the denial of export licenses or loans from US financial institutions, and in the most severe cases may include designating the foreign person as an SDN. The non-US persons, however, would not be subject to civil or criminal liabilities (monetary fines or imprisonment) for secondary sanctions violations (unlike with primary US sanctions).

The Russia, Iran, Syria, and North Korea sanctions programmes contain significant secondary sanctions, including mandatory sanctions imposed under legislation by Congress. Additionally, generally all SDNs carry discretionary secondary sanctions implications. Therefore, non-US law firms risk exposure to both primary and secondary sanctions under a sanctions programme, if such firms engage in certain activities with a blocked person. While secondary sanctions are generally idiosyncratic to their specific sanctions programme, and the specific criteria for liability vary, most secondary sanctions require that a transaction be ‘significant’ or ‘material’ before secondary sanctions liability will arise. OFAC generally considers a highly fact-dependent seven factor test in weighing whether a transaction should be considered ‘significant’ or ‘material,’ including the size, number, and frequency of transactions; awareness of management; and impact of the transactions on the objectives of the sanctions programme.

Law firms’ specific sanctions risks and risk mitigation recommendations

Primary sanctions risk and risk mitigation recommendations

Non-US persons are not subject to US primary sanctions themselves. However, there are ways non-US persons can subject themselves to US jurisdiction and inadvertently violate US primary sanctions. For example, as described above, the physical presence of a person in the United States subjects such persons (regardless of the person being a non-US person) to US jurisdiction and requires that they abide by US sanctions, as they are considered US persons. As such, any non-US law firm that has attorneys practicing law within the United States, even temporarily, should be aware of US sanctions laws and regulations and must ensure that their attorneys comply with US sanctions while in the United States. Due to the broad definition of US person under US sanctions regulations, non-US law firms that deal with sanctioned persons or operate in regions subject to US sanctions should conduct an internal assessment to identify any employees who currently reside outside the US but maintain US citizenship. Firm employees working in the US and those with US citizenship, regardless of their location, should not work on matters for sanctioned persons or related to prohibited activities in sanctioned regions unless authorised or exempt under US law.

In addition, a non-US law firm can violate US primary sanctions by causing a US person to violate sanctions. This most frequently occurs when non-US persons use the US dollar when dealing with a sanctioned person or sanctioned region, which causes a US financial institution to process a payment that violates US sanctions. Non-U.S. law firms can mitigate this sanctions risk by avoiding the use of US dollars in transactions with any persons subject to US sanctions or related to jurisdictions that are subject to US sanctions.

Secondary sanctions risk and risk mitigation recommendations

Owing to the broad scope of the United States’ secondary sanctions authorities, non-US law firms could risk exposure to US secondary sanctions for transacting with a sanctioned person even if there are no US touchpoints in such activity. Because the US government’s decision to impose secondary sanctions is a policy decision, non-US law firms should consider reviewing their proposed activity with a sanctioned client to assess the level of secondary sanctions risk such activity poses with respect to the US government’s policy objectives. To conduct this assessment, non-US law firms would need to begin by identifying what executive order a client was sanctioned under, reviewing the preamble of such executive order that explains the purpose of the sanctions and activities the US government seeks to prevent, and assessing whether the legal services it is providing to the sanctioned client may facilitate an activity that the US has outlined as a threat in the preamble of the relevant executive order.

We recommend that non-US law firms mitigate their secondary sanctions risk by screening all clients to ascertain whether the clients are subject to US sanctions. When a law firm identifies a client that is subject to sanctions, it should conduct a risk-based assessment that includes an analysis of (1) the programme under which the client was sanctioned, (2) the legal services sought by the client, (3) the relationship between the legal services and the policy objectives of the relevant sanctions programme, and (4) any relevant authorisations and exceptions that may expressly authorise the legal services.

Relevant authorisations

Law firms should also be aware that all sanctions programmes include general licenses, authorisations or exceptions under which law firms may be permitted to provide services to sanctioned persons without violating US primary sanctions or risking exposure to secondary sanctions. Non-US law firms should note that if certain activity was authorised for US persons, the non-US law firm would not risk violating primary sanctions if it engaged in such activity or utilised a US touchpoint, such as a US financial institution or other US person, in such activity.

Additionally, while OFAC only has jurisdiction to authorise activities for US persons, OFAC’s general posture is that non-US persons, including non-US law firms, would not risk exposure to secondary sanctions for engaging in activity that would be authorised or exempt for US persons. This further underscores the importance of law firms understanding which sanctions programmes apply to any person or jurisdiction with whom it seeks to transact and what relevant authorisations exist in those sanctions programmes.

Notably, most sanctions programmes contain general licences authorising US persons to provide certain legal services to sanctioned persons and to receive payment for the provision of those services. These general licences typically also authorise law firms to contract for related services that are ordinarily incident to the provision of those legal services, such as those provided by private investigators or expert witnesses, and to pay for such services. However, these authorisations vary across the sanctions programmes, so if a law firm finds itself providing legal services to a sanctioned person, it should consult the available general licences within the relevant sanctions programme to ensure it is not violating US primary sanctions or exposing itself to secondary sanctions. Note that these general licences are typically limited in scope to certain legal services related to assisting these clients in getting delisted from OFAC’s SDN List, providing legal representation before an authoritative body in the US, or obtaining compliance advice. For the provision of legal services that are not authorised or exempt under US sanctions regulations, law firms should remain vigilant to avoid violating US primary sanctions or exposing themselves to US secondary sanctions risk.

Recommendations for non-US law firms providing services to sanctioned clients

If a law firm identifies a client that is the subject of US sanctions, there are certain steps we recommend the law firm take in order to mitigate its US primary and secondary sanctions risk. First, the law firm should determine whether the client is subject to sanctions by screening the client’s name in OFAC’s online SDN List, available at and conducting due diligence on the client and its beneficial owners. Note that a client can still be subject to US sanctions regardless of whether it is listed on OFAC’s SDN List if it is majority owned by a sanctioned person or persons per OFAC’s 50 Percent Rule.

If the client is subject to US sanctions, we recommend the law firm mitigate its risk of violating US primary sanctions by immediately ring-fencing any US touchpoints from the sanctioned client while it reviews the relevant sanctions programme for any authorisations or exceptions that may authorise the involvement of a US touchpoint in such activity. The firm should prevent employees with US citizenship or operating in the US from transacting with the sanctioned client and should implement a policy that all payments from the sanctioned client be made in currency other than US dollars. To determine whether a relevant authorisation or exception exists, the law firm should first identify the sanctions programme under which the client is sanctioned. This information is recorded on the client’s online SDN List page in the upper right-hand corner. Once the sanctions programme is identified, the law firm can review the sanctions programme’s corresponding regulations, FAQs, and other guidance on the OFAC webpage that corresponds to each sanctions programme to identify what restrictions and authorisations apply to its dealings with the client. If no relevant authorisations that permit the requested legal services exist, the non-US law firm should continue to avoid all US touchpoints related to its activities with the sanctioned client in order to avoid violating US primary sanctions.

To mitigate its US secondary sanctions risk, a non-US law firm should conduct a risk-based analysis of its secondary sanctions risk for its proposed legal services to the sanctioned client. To the extent that the non-US law firm is providing legal services to a sanctioned client that would be authorised for a US person, the non-US law firm would not risk exposure to secondary sanctions for such activities. If, however, no relevant authorisations or exceptions apply to the law firm’s proposed services, the law firm should assess whether the legal services it is providing to the client contradict the US government’s declared policy interests. Legal services in support of activities that conflict with the US government’s policy interests create a heightened risk of secondary sanctions. For more complicated sanctions questions, law firms should consider consulting with specialised counsel with experience in analysing and mitigating sanctions risks.

Endnotes