Export / Sanctions

Due to geopolitical tensions and conflicts such as in Ukraine or the Middle East, export control and sanctions regulations keep evolving. Recent activities of in particular both, the U.S. and the EU, show that one particular focus is on combatting the circumvention of sanctions regulations.

On 22 December 2023, U.S. President Joe Biden signed an executive order (EO 14114) threatening penalties for financial institutions that help Russia circumvent sanctions. A few days earlier, the EU adopted the 12th package of sanctions against Russia that includes additional listings of Russian individuals and entities as well as new import and export bans. Moreover, the EU has introduced a quarterly reporting obligation of entities established in the EU concerning the transfer of funds exceeding €100,000 out of the EU. This reporting obligation will become effective as of 1 May 2024. It applies to EU entities in which Russians or entities established in Russia directly or indirectly hold more than 40 percent of the shares.

Furthermore, with regard to specific goods or technology, exporters shall, as of 20 March 2024, contractually prohibit re-exportation to Russia and re exportation for use in Russia if their contract partner is not from the EU or an allied third country.

Also at the level of EU Member States, a trend can be seen that aims to combat the circumvention of sanctions regulations. Germany, for example, has demonstrated a tougher stance in the enforcement of EU sanctions. This can particularly be seen from the following activities:

Already in 2022, Germany has adopted two Sanctions Enforcement Acts (Sanktionsdurchsetzungsgesetze) that introduced new asset tracing and freezing powers, as well as structural improvements in, among others, the operational implementation of sanctions.
In February 2023, German public prosecutors and customs authorities searched premises of three German companies as well as the residence of three individuals. The reason for these dawn raids was the sale, export and delivery of IT and electrical sectors goods from a German company to a Turkish company. The components were later found in the remains of Russian missiles in Ukraine which suggests that the goods had been diverted to Russia via Turkey.
In October 2023, German police, public prosecutors and customs authorities searched the properties of an Russian Oligarch to seize assets.
Moreover, the German Federal Government proposed a draft of the Combating Financial Crimes Act (Finanzkriminalitätsbekämpfungsgesetz). This draft law is part of a broad reform aiming to strengthen the fight against financial crime, in particular, money laundering and circumvention of sanctions.
At the end of 2023, the German supervisory authorities carried out several on-site financial crime audits of licensed institutions, focusing on financial sanctions. The audit covered, among others, questions relating to the proper governance, screening measures, reporting, resources and compliance in domestic and foreign branches of the institutions.

Internal Investigations of a potential Export Control or Sanctions Infringement

The increased activity of the authorities in conjunction with complex legal frameworks and fast-changing rules and regulations demonstrate the need to keep internal compliance programmes under review. Infringements of export control or sanctions provisions may result in heavy fines, reputational damage and criminal prosecution of individuals. As a result, internal investigations of alleged infringements – whether those may have occurred wilfully or negligently – are a crucial instrument to protect the integrity of a company and to ensure that it keeps control of the situation.

Typically, internal investigations of a potential export control or sanctions infringement are triggered by one of the following situations:

Internal suspicions of export control or sanctions infringements. Often, companies themselves realise that they have erred in applying export control or sanctions provisions. Such internal suspicions can arise, for example, through reports via whistleblower channels of the company or through internal audits. In such cases, an internal investigation is required to fully assess the gravity of the infringement, potential liability of the company and the steps required to remedy the concerns.
Official investigations by authorities. Internal investigations may also follow official investigations by authorities. These may either be triggered by a specific suspicion of a violation or an external review such as an external audit of the company's books without any specific suspicion of export control issues. In such a case, a company should mirror the authority's "fishing expedition" to ensure that it has clean records. Where an authority is already investigating an alleged breach of export control or sanctions laws, the company concerned may want to investigate whether any further infringements have occurred and require immediate action.
M&A and financing. Finally, investigations of potential past export control and sanctions issues and, more generally, of the compliance system in this field may be caused by M&A or financing projects. In the course of preparing documents for a due diligence or for corporate finance projects, third parties may request a statement on potential legal areas of concern and a risk assessment. In this case, companies need to investigate their compliance internally with the export control and sanctions rules applicable to them.

Specifics to be considered in Internal Investigations in the Area of Sanctions and Export Control

While an internal investigation in the area of export control and sanctions has many parallels with investigations in other legal areas, some specifics need to be considered.

It follows from the nature of trade activities that often several jurisdictions may need to be considered in determining which law applies to a specific transaction. Therefore, before starting the internal investigation, the applicable legal regime and the competent authorities have to be determined. Thereby, it has to be taken into account that especially U.S. legislation has an extraterritorial reach. This means that, provided there is some nexus to the U.S. (e.g. payment in USD, involvement of U.S. citizens), U.S. sanctions regulations may be applicable to the company even though it is not located in the U.S. In this regard, the concept of secondary sanctions should also be taken into account. Secondary sanctions may, for example, become relevant if non-U.S. financial institutions are deemed to have conducted or facilitated significant transactions for Specifically Designated Nationals (SDNs) for operating or having operated in Russia's technology, defence, construction, aerospace or manufacturing sectors. Even if U.S. sanctions are not applicable, often financing documents involving U.S. banks contain clauses that oblige parties to treat themselves as if U.S. sanctions were applicable.
Other member states of the EU such as Germany may even prohibit complying with certain sanctions other states imposed (anti-boycott laws). In the EU, the Blocking Statute expressly mentions certain U.S. sanctions that EU companies are not allowed to follow. It is worth noting that the U.S. also has an anti-boycott regime that is stricter than in Germany. In particular, in the U.S., a reporting obligation for boycott requests exists regardless of whether the company complied with the request. This may affect the way an investigation is structured between the EU and the U.S. For instance, German subsidiaries receiving a boycott request should make their U.S. parent entity aware of it, so that the U.S. corporation can comply with potential reporting obligations.
Sanctions provisions can rapidly change due to political developments. This makes it challenging for companies to keep their compliance systems up-to-date. For instance, from time to time entities or individuals are added to or removed from asset-freezing lists. In other areas, newly introduced sanctions sometimes make provision for the grandfathering of existing contracts otherwise covered under the new regime. These grandfathering provisions can differ between EU and U.S. sanctions regimes and between contracts entered into in a variety of different time frames, sometimes they only apply on a temporary basis, in effect stipulating a grace period for winding up existing contracts.
Investigations in the area of export control and sanctions generally gain high management attention. This is not only due to the risk of fines and reputational damage. Under certain legal systems in the EU, it is mandatory for companies exporting goods to have a board member take legal responsibility for export control compliance. Governmental procedures are often directed against this board member, especially if a lower-level employee that might be responsible for the alleged infringement cannot be determined. Accordingly, investigations of export control infringements require professional handling, including experience of substantive export control laws and the procedural aspects of handling an investigation to fulfil management expectations. Close coordination between compliance and trade experts is therefore fundamental to the investigation due to the specialised knowledge of foreign trade law required.
The clarification of the relevant facts often requires a combination of several investigative measures. In general, it is useful to direct the internal investigation towards gaining an understanding of the internal (control) processes, the IT systems used, the (technical) specifications of the product or service and the actual supply chain and logistics. Therefore, unlike in other investigations, a review of email data of employees often does not contain all the relevant facts required for a risk assessment. Even interviews with the key employees involved do not ensure that all facts can be sufficiently established. Rather, many investigations in the area of export control or sanctions therefore, require an in-depth review of the company's electronic accounts in order to identify the number of shipments involved, the items shipped, and the consignees of the goods. For instance, this may originate in ERP systems tracking all orders and shipments a company handles in its day-to-day business operations. Accordingly, a thorough legal investigation goes hand in hand with the involvement of forensic experts experienced in the e-discovery of structured data.

Cooperation with Authorities

The complexity of export control law and sanctions provisions and the difficulties in reviewing the vast amount of data is also a challenge for authorities. Therefore, many national (supervisory, export control or customs) authorities appreciate the cooperation of companies that investigate potential infringements internally and present the results of their review to officials (whilst observing applicable data privacy provisions).

Depending on the specific infringements in question, companies may qualify for a voluntary disclosure programme that provides companies with full immunity from fines in some jurisdictions. However, companies should seek legal advice before proactively making use of such procedure. This is because they may find themselves in a risky situation, including a criminal investigation, if the conduct is not covered by the scope of the applicable voluntary disclosure scheme, or if such a scheme is not provided for under applicable national legislation. However, even if full immunity is not available, disclosing information voluntarily is often considered a mitigating factor in determining a fine and may even lead to a termination of administrative procedures without a conviction.

Internal Compliance Policies

Increased attention by regulators in the area of trade and sanctions compliance, as well as higher expectations at management and shareholder level, are necessarily leading to the maturing of internal compliance policies. Different authorities provide guidance on key aspects to consider. Compliance policies should cover the full range of possible export control or sanctions issues, taking into account a company's individual risk profile in this area. Robust internal policies should firstly prevent or at least help pick up possible infringements. Secondly, they should provide a structure as to how an investigation should be carried out. Thirdly, a robust internal compliance policy provides reassurance to authorities that a company not only takes this subject seriously but has the means to implement any lessons learned in the case of a genuinely mistaken infringement. This may act as a mitigating factor in determining a fine.

Conclusion

In times of dynamic international relations, export control and sanctions law gain importance as a political instrument. Infringements carry a high risk of fines, criminal prosecution and reputational damage for companies, their management, and their personnel. Internal investigations in this area require specialised expertise regarding the substantive legal assessment, the procedural management of the investigation, the forensic review of electronic data and the internal procedures followed at all stages of the supply chain until the export is completed.

Dr. Falk Schöning Partner Hogan Lovells Brussels T +32 2 505 0911 E falk.schoening@hoganlovells.com	Falk Schöning can assist you regarding all questions and problems of EU and German antitrust law, foreign investment control law and export control law. He advises in particular on international cases which require coordination between different legal systems or representation vis-à-vis several regulators. Falk is frequently called on by companies which need advice on EU or German export control law, in particular regarding procedures with the German authorities. He knows the typical pitfalls of trade and sanctions cases and regularly cooperates with European and German regulators BAFA, Bundesbank, the Federal Ministry of Economics and the customs authorities. As part of Hogan Lovells' wider European trade compliance team Falk frequently structures compliance programmes according to BAFA's guidance on Internal Compliance Programmes.

Dr. Richard Reimer Partner Hogan Lovells Frankfurt T +49 69 962 36 414 E richard.reimer@hoganlovells.com	Richard Reimer advises financial institutions, FinTechs and other companies on all aspects of financial regulation and compliance, with a particular focus on payments law. Furthermore, Richard advises on regulatory aspects of M&A transactions involving financial institutions (e.g. ownership control proceedings). He has dealt with major investigations in the financial sector and handled the relationship with the financial supervisory authority (BaFin). He is trusted advisor of the Federal Association of Payment and E-Money Institutions and as such involved in all relevant legislative procedures. He is part of the investment fund team and contributes to all regulatory aspects in structuring investments in Germany. Richard leads a team which primarily advises on banking licence proceedings, own funds requirements and compliance projects including whistleblowing systems, anti-money laundering compliance and financial sanctions.

Michael Jahn Counsel Hogan Lovells Munich T +49 89 29012 246 E michael.jahn@hoganlovells.com	Michael Jahn advises national and international companies, including various Fortune 500 and DAX 40 companies, on issues regarding commercial criminal law as well as on topics related to compliance and internal investigations. As part of his practice, Michael advises in particular on the set-up and management of internal investigations, often in the context of public prosecutor investigations. In doing so, he coordinates the review of relevant data and provides the legal assessments, in particular regarding possible questions of liability of companies and their employees. Michael has extensive experience in communicating with authorities, for example in the context of dawn raids or sanction proceedings.