In OFAC’s guidance document that was released last week, OFAC made it clear that it will consider using its enforcement authority against the individuals involved in a sanctions violation, not just the entities. OFAC recognized that individual employees, particularly those in supervisory, managerial or executive level positions, have played a crucial role in facilitating or concealing violations of OFAC’s sanctions programs. The executives subject to OFAC’s jurisdiction are individuals at a company with a U.S. parent, or an entity that conducts transactions in the U.S., with the U.S. or a third party that is based in the U.S. 
OFAC generally administers and enforces economic and trade sanctions based on U.S.-foreign policies and national security goals against individuals, groups and entities engaged in activities that threaten the national security, foreign policy or economy of the U.S. The recent guidance makes it clear that executives are not beyond the reach of OFAC, and that individuals are subject to personal liability for violating OFAC’s sanctions program.
Although this is not a new right granted to OFAC, the guidance indicates that OFAC is more inclined to bring civil actions against individuals. In the past ten years, we have seen only a few cases where civil enforcement actions were brought against individuals. Although there has been a significant dip in the number of cases, the value of the fines has increased significantly.
Executives should make sure that the company’s sanctions compliance program incorporates at least five essential components of compliance: (1) management commitment; (2) risk assessment; (3) internal controls; (4) testing and auditing; and (5) training. The commitment of executives to the success of the sanctions program is key, and it is covered by the first of the five components.
OFAC stated in its guidance that “Senior Management’s commitment to, and support of, an organization’s risk-based [sanctions compliance program] is one of the most important factors in determining its success.” Senior management must recognize the seriousness of apparent violations of the laws and regulations administered by OFAC, and implement measures to reduce apparent violations and address root causes of past violations.
OFAC has identified scenarios where supervisory, managerial or executive employees of an entity have conducted or facilitated transactions with OFAC-sanctioned persons, regions or countries even though the entity itself had a strong compliance program in place. It is the personal responsibility of each of these individuals to take their senior management role seriously, help their organization comply with its sanctions compliance program, and make sure it is not concealing activities from its organization or regulators and law enforcement.
You can read OFAC’s guidance here. The guidance deals broadly with OFAC’s perspective on the essential components of a proper sanctions compliance program that should be implemented by companies, as well as outlining how OFAC incorporates these components in its evaluation of apparent violations.