Bank's 'Compliance Deficiencies' Lead to Sanctions Violations, $2.3M Fine

The Office of Foreign Assets Control fined the United Kingdom-based Bank of China more than $2.3 million for processing more than 100 transactions that violated then-U.S. sanctions against Sudan, according to an enforcement order. The bank illegally exported financial services from the U.S. when it processed about $40 million worth of transactions through the U.S. financial system on behalf of parties in Sudan, OFAC said Aug. 26.

The violations arose from “compliance deficiencies” by the bank’s staff, which failed to “appropriately evaluate and escalate potential transactions” that had “underlying account and transactional documentation” indicating ties to Sudan, the order said. The bank discovered the violations after conducting an internal investigation, which showed it had processed transactions for two customers associated with Sudan.

One bank customer was an entity located outside of Sudan but a branch in that country became the “instructing party and account signatory” to transactions processed by the Bank of China U.K., OFAC said. OFAC said “written communications” between the bank and the customer referenced Sudan, and it added that the bank also processed transactions for “recipients” that “appeared” to be in Sudan at the time.

The bank discovered the other customer, another Sudanese subsidiary of an entity incorporated outside of Sudan, as part of the bank’s “know-your-customer documentation” procedures. The subsidiary provided the bank with information that showed it was registered in Sudan.

Despite the Sudan ties, the bank’s internal customer database didn’t include references to Sudan in the name or address fields of either customer, OFAC said. The bank also didn’t include references to Sudan in messages to U.S. banks, the order said. In total, Bank of China U.K. processed 111 payments between 2014 and 2016 worth nearly $40.6 million, which violated the Sudanese Sanctions Regulations. Those sanctions were revoked in 2017.

Bank of China U.K. voluntarily disclosed the violations, which constituted a nonegregious case. Although the maximum penalty was more than $99 million, several mitigating factors substantially lowered the fine, including that the bank had no prior sanctions history, cooperated with OFAC’s investigation and signed a tolling agreement. OFAC also said the bank took several remedial measures, including establishing an executive committee responsible for implementing compliance procedures, conducting an “annual enterprise-wide sanctions risk assessment by business line,” introducing a firm-wide centralized customer due diligence process, and customizing sanctions compliance training for staff based on their tenure and business line.

Aggravating factors included the bank’s “reckless disregard” for U.S. sanctions requirements when it processed transactions despite having information that showed the customers had ties to Sudan. OFAC also said certain staff knew the transactions were related to entities in Sudan and said the bank “conferred economic benefit” to a then-sanctioned country for at least 1.5 years. The agency also noted the Bank of China U.K. is a “commercially sophisticated financial institution” that processes international transactions.

The case shows the importance of integrating know-your-customer information “holistically throughout internal databases,” OFAC said. Those databases can then inform compliance decisions and help flag sanctions concerns, it said. The bank didn’t comment.