On January 17, the Treasury Department’s Office of Foreign Assets Control (OFAC) and the Commerce Department’s Bureau of Industry and Security (BIS) announced that Haas Automation Inc. (Haas) agreed to settle potential civil liability related to multiple violations of the Ukraine-/Russia-related Sanctions Regulations and the Export Administration Regulations (EAR).
The OFAC Enforcement Release is available here; the BIS settlement materials are available here.
Below we summarize the violations and highlight a few key takeaways from this matter, particularly related to the risks of doing business through a distributor and the importance of regular denied party screening.
Background on Haas
Haas is a manufacturer of machine tools and related parts, including computer numerical control (CNC) vertical and horizontal machining centers and CNC lathes. CNC is a technique that uses computers to control machine tools to perform precise cutting and other tasks. For U.S. export control purposes, CNC machines are classified under EAR99, meaning that they can generally be exported and re-exported to end-users without a license.
Haas products are used broadly, including for aerospace, defense, electronics, marine, and military applications. However, the company does not ordinarily sell products directly to customers. Instead, the company uses a series of third-party distributors to provide products and services in different regions around the world. Haas sells products to its distributors from its manufacturing facility in California, where it is based, and from wholly-owned distribution centers in Belgium or China. In addition, the distribution center in China sometimes provides products directly to end-users in China.
As a general matter, customers place orders with their local distributor, which then fulfills the order from Haas using a web-based sales portal. Through the portal, Haas is made aware of the identity of the customer for each order.
OFAC and BIS Violations Involved Third-Party Distributors
OFAC asserted that, between December 2019 and March 2022, Haas indirectly supplied CNC machines and related services, and issued spare part orders, to Specially Designated Nationals (SDNs) in Russia. U.S. parties are prohibited from conducting virtually any transaction, directly or indirectly, with an SDN. Notably, several of these parties were not named on the SDN List maintained by OFAC but were nonetheless deemed to be SDNs because they were owned 50% or more by entities on the SDN List. More information about the “50% Rule” is available here.
For its part, BIS alleged that Haas violated the EAR 41 times when it exported, re-exported, or transferred (in-country) items used to service CNC machines to six Chinese entities and two Russian entities on the BIS Entity List. The majority of these violations involved shipments made via authorized distributors, though at least some of the violations involved Haas’s wholly-owned distribution center in China. As noted above, CNC machines are classified under EAR99, and such items can be exported or re-exported to most end-users without a license. However, in the case of parties on the Entity List – including the customers who received Haas products in this matter – an export license is usually required for exports and other transfers of even those items (such as CNC machines) covered under EAR99.
BIS also alleged that Haas’s authorized distributor in Russia, through a freight forwarder, filed inaccurate and incomplete Electronic Export Information filings for shipments to Russia.
Mitigating and Aggravating Factors Influenced the Settlement Amount
Both OFAC and BIS agreed to significantly reduced penalty amounts.
OFAC highlighted Haas’s extensive cooperation during the investigation, its lack of prior misconduct, and the significant remedial action undertaken by the company. In particular, OFAC emphasized the hiring of additional compliance personnel, strengthening of compliance policies, purchase of a new denied party screening tool, implementation of additional training requirements, and the establishment of an audit procedure for use in the case of high-risk distributors.
OFAC also considered aggravating factors, including Haas’s failure to exercise due care while operating in a high-risk environment and its failure to conduct adequate due diligence on customers or implement the necessary screening controls. Interestingly, OFAC also determined that while Haas reported the apparent violations, that report did not constitute a voluntary self-disclosure under the Enforcement Guidelines. OFAC seemingly viewed the fact that BIS had initiated its investigation of Haas before Haas disclosed the matter to OFAC as sufficient to establish prior government knowledge of the matter (in which case no mitigation credit for voluntary disclosure is given).
BIS also emphasized the company’s cooperation and remedial efforts in announcing its penalty against Haas. However, BIS imposed an additional obligation on Haas by requiring Haas to engage an outside consultant to complete two annual audits of the company’s export controls compliance program and to provide the audit results to BIS.
Third-Party Risk and Compliance Lessons
This enforcement action is another example of the export and sanctions risks associated with third-party representatives. U.S. sanctions and export controls reach both direct and indirect conduct, and as a result, any third party acting on behalf of a company can expose that company to liability. These often include distributors, particularly in a scenario where, like in this matter, a distributor procures parts from a company and the company knows the end use or end user of those parts. Thus, it is essential to implement compliance measures that address these risks.
Accordingly, when selling to a distributor, it is critical to ensure that the distributor understands its obligations under applicable trade laws. Unsurprisingly, non-U.S. parties may not recognize that U.S. export law follows U.S.-origin items wherever located, and that causing a U.S. company to violate U.S. sanctions is itself a violation.
Similarly, U.S. companies must be vigilant in monitoring transactions – and transaction parties – for sanctions and export risk. According to OFAC, for seven blocked customers, Haas failed to understand their ownership structures and recognize that blocked entities owned 50% or more of those customers.
Most importantly, it appears that denied party screening did not occur for each transaction at issue. The government’s enforcement summaries and related documents suggest that some customers who received Haas parts were not designated as SDNs (by OFAC) or listed on the Entity List (by BIS) at the time of the initial sale to that customer. These customers were then designated between that initial sale and a subsequent transaction. Because screening did not occur as part of the diligence on that subsequent transaction, neither Haas nor its authorized distributor discovered that the subsequent transaction was prohibited.
The government expects companies to take a risk-based approach to compliance, including when screening transactions and transaction partners. In many cases, it may be appropriate not to re-screen customers before every transaction. However, the Haas matter demonstrates that in a high-risk jurisdiction in which restrictions and requirements change regularly (such as China and Russia), more substantial, comprehensive compliance checks are needed.
If you have any questions about how these settlements may impact your business or compliance practices, please contact the authors.