The largest OFAC settlement of its era and still the reference point for correspondent banking cases. The figures below come from OFAC’s enforcement information for 30 June 2014.
What was actually found
BNP Paribas settled potential civil liability for 3,897 apparent violations across four programmes: the Sudanese Sanctions Regulations, the Iranian Transactions and Sanctions Regulations, the Cuban Assets Control Regulations and the Burmese Sanctions Regulations.
OFAC describes the conduct as a systematic practice, spanning many years and involving multiple BNPP branches and business lines, that concealed, removed, omitted or obscured references to sanctioned parties in dollar payment messages sent to US financial institutions.
The three specific practices are named in the notice: omitting references to sanctioned parties; replacing the names of sanctioned parties with BNPP’s own name or a code word; and structuring payments so that the involvement of sanctioned parties was not identified.
The composition, which is the interesting part
The notice breaks the conduct down by programme, and the breakdown is not what the public account of this case tends to suggest.
| Programme | Transfers | Approximate value | Base penalty |
|---|---|---|---|
| Sudan | 2,663 | $8.37bn | $16.83bn |
| Iran | 318 | $1.18bn | $2.38bn |
| Cuba | 909 | $689m | $59m |
| Burma | 7 | $1.5m | $3.95m |
Sudan, not Iran, is the overwhelming bulk of it — roughly two thirds of the transactions and 87 per cent of the base penalty. This case is remembered as an Iran case and it is principally a Sudan case.
Why the settlement is a twentieth of the base penalty
The combined statutory maximum and base civil monetary penalty was $19,272,380,006. The settlement was $963,619,900, and the obligation was deemed satisfied by payment of an equal or greater amount to the Department of Justice and the New York County District Attorney arising from the same conduct.
This is the single most important thing to understand about reading OFAC penalty figures. The base penalty accrues per violation against a statutory maximum, so multi-year conduct across thousands of payments produces numbers with no relationship to the profit earned or the value transferred. The published settlement is what remains after the General Factors are applied — and, in global resolutions, after credit for what other authorities have already collected.
The aggravating findings
OFAC recorded that the apparent violations were egregious and not voluntarily self-disclosed, and among its aggravating factors found that BNPP had indications its conduct might have constituted violations of US law and therefore acted with reckless disregard; that at least one member of senior management was aware of the conduct; and that business line management and supervisors were aware of it.
That combination — knowledge at management level, over years, across business lines — is what distinguishes an egregious case from an operational failure, and it is why the mitigation available here was so limited.
Why it changed practice
The evidential basis for cases in this category is the institution’s own records: comparing the instruction received against the message sent is an exercise that proves itself, which is why the facts are so rarely contested. This resolution made payment message integrity a board- level matter at every major correspondent bank, and the transparency standards now applied to cross-border payment data are its direct legacy.