OFAC Enforcement Action: MidFirst Bank “misunderstood” Vendor Sanctions Screening Process

The Office of Foreign Assets Control (OFAC) of the US Department of the Treasury has issued a Finding of Violation (FOV) to MidFirst Bank for violations of the Weapons of Mass Destruction Proliferators Sanctions Regulations (WMDPSR). In the enforcement notice, OFAC states the bank maintained accounts for individuals added to the Specially Designated Nationals (SDN) List and processed 34 payments totaling $613,879 on behalf of the blocked persons. 

The first violations occurred within six hours of the designation, amounting to five payments that made up 98% of the total amount transacted by the sanctioned individuals.

According to OFAC, the bank misunderstood the frequency with which its vendor conducted SDN checks against its existing customer base. MidFirst mistakenly assumed the vendor screened existing customers daily. In reality, this was happening once a month. 

On October 5, 2020, MidFirst reported to OFAC that its sanctions screening vendor had notified the bank that the blocked persons had been added to the Specially Designated National list 14 days after their addition. MidFirst then promptly disabled accounts belonging to the blocked persons and made remediation efforts by updating the frequency with which the bank screened against sanctions lists.   

The MidFirst FOV was issued shortly after American Express National Bank was fined $430,500 for 214 apparent violations of OFAC’s Kingpin sanctions. 

Scanning and reporting deficiencies 

Since MidFirst’s entire customer base was only screened against additions and changes to the Specially Designated Nationals List once a month, the bank could have been unaware that it was maintaining an account for a blocked person for up to 30 days post designation. 

To close a compliance gap such as this, financial institutions must closely monitor the lists maintained by OFAC, the EU, and the UN, and re-screen within an appropriate period of time, based on their risk-based approach. Since significant overlap exists among these lists, having a list management solution that consolidates data and offers real-time updates is crucial to staying on top of the various changes across all sanctions programs and reacting quickly.

Aggravating and mitigating factors

OFAC determined MidFirst’s low re-screening frequency to be one of the most prominent aggravating factors in issuing the FOV. OFAC also noted that by allowing the accounts to operate for two weeks post-designation, there was harm to the objectives of the sanctions program and the potential for significant damage through asset flight.

However, OFAC determined the following to be MidFirst’s mitigating factors:

• After discovering the violations, MidFirst ensured the vendor re-screened existing accounts more frequently
• The bank implemented a manual process to be notified of all OFAC list updates and introduced manual rescreening of the customer base whenever the Specially Designated Nationals List is updated
• MidFirst cooperated with OFAC
• No Penalty Notice or FOV had been issued to MidFirst from OFAC in the five years preceding this violation
  

Based on these factors, OFAC decided to issue MidFirst with a FOV instead of a monetary penalty. 

Key takeaways

As this case shows, sanctions lists change frequently and firms can be in violation of a sanctions regime a matter of minutes or hours after updates have been made. Not only does this call for a robust understanding of the scope and frequency of a firm’s screening process, but it also underlines the importance of real-time monitoring of the latest news and alerts. 

Additionally, compliance teams should ensure vendor agreements are thoroughly understood, and those responsible for sanctions compliance have appropriate oversight and rigor around sanctions compliance programs.

The “Compliance Considerations” and “Civil Penalties and Enforcement Information” provided towards the end of the FOV should also be revisited by compliance staff to ensure an up-to-date understanding of the risk-based approach to sanctions compliance encouraged by OFAC.