A Sudan case almost entirely, and one that locates the conduct in a subsidiary and its predecessors rather than at the head office.
What OFAC counted
CA-CIB settled 4,297 apparent violations. The Sudan set is nearly all of it:
| Programme | Transactions | Approximate value | Base penalty |
|---|---|---|---|
| Sudan | 4,055 | $337.0m | $1,426.1m |
| Cuba | 173 | $97.2m | $11.2m |
| Burma | 53 | $7.2m | $23.3m |
| Iran | 16 | $0.4m | $4.3m |
Of the 4,055 Sudan transfers, 4,024, worth $317.2 million, were processed by Crédit Agricole (Suisse) S.A. or its predecessors, in particular Crédit Lyonnais (Suisse). Sudan accounts for 97 per cent of the base penalty.
The method
OFAC’s notice says that for a number of years, up to and including 2008, CA-CIB and its predecessor banks and the Swiss subsidiary processed thousands of transactions through US financial institutions. Staff including managers “were aware of U.S. economic sanctions programs and understood that U.S. financial institutions were required to block or reject transactions involving an OFAC-sanctioned country or person.” Despite that, the banks “used cover payments and/or implemented special payment practices in a manner that omitted references to U.S.-sanctioned parties” in dollar SWIFT messages sent to the US, “thereby preventing U.S. financial institutions from appropriately reviewing and analyzing the transactions.” See correspondent banking abuse and Switzerland.
Aggravation and mitigation
Aggravating: Crédit Lyonnais (Suisse) and Crédit Agricole Indosuez (Suisse), which later merged to form the current subsidiary, had indications before the earliest violation that their conduct might violate US law; several managers, particularly at the Swiss locations and in some cases at the Paris head office, were aware; and the compliance programme was inadequate. Mitigating: a clean five-year record, remediation, substantial cooperation including a statute of limitations agreement with multiple extensions, and the fact that most violations occurred between 2003 and 2005, before the publication of the ABN Amro settlement.
What the record shows
- A merged bank inherits the conduct. The violations were by predecessor banks that later merged into the subsidiary, so the liability followed the corporate history.
- Sudan again. See the Sudan page and BNP Paribas, where Sudan was also most of the penalty.