The fifth-largest OFAC settlement in the published dataset, and unusual for what it documents: not an employee’s workaround but a written procedure.
Three banks, one pattern
The release covers three UniCredit Group entities, each settling separately as part of a global resolution with US federal and New York authorities.
- UniCredit Bank AG (Munich), $553 million. Between 2007 and 2011 it processed 2,158 dollar payments worth about $527 million through US banks. OFAC found two separate patterns, plus a third involving oil.
- UniCredit Bank Austria AG, $20 million. 127 violations up to 2012, using SWIFT MT202 cover payments that did not reveal the sanctioned party, trade-finance payments that omitted the sanctions nexus, and six payments manually “cleaned” and resubmitted after US banks rejected them.
- UniCredit S.p.A. (Milan, the group parent), $37 million. 612 violations with the same methods: cover payments, trade-finance payments that hid the sanctioned interest, and payment messages that left out any reference to it.
What the Munich bank did
Accounts for IRISL. UniCredit operated dollar accounts for the Islamic Republic of Iran Shipping Lines and companies connected to it, and managed them so that US intermediaries could not see IRISL’s involvement. It used auto-transfer mechanisms and applied controls selectively, and kept processing IRISL-interest payments for almost two years after OFAC designated IRISL in September 2008. Three IRISL-affiliated companies, Ashtead, Fairway and Hanseatic Trade Trust & Shipping, were not themselves listed at the time. Two weeks after the designation, UniCredit removed Fairway from its IRISL customer group, lifting the internal ban on dollar payments for it, without first confirming IRISL had no interest in its accounts. See front companies.
The “OFAC neutral” guide. UniCredit also processed dollar payments for persons subject to nonproliferation and other sanctions in what OFAC calls a non-transparent manner, following a formal procedures document that gave step-by-step instructions for handling transactions “in an ‘OFAC neutral manner’.” Staff confirmed that payment instructions contained no references to sanctioned persons or countries. OFAC found the bank “appears to have acted with willful intent to circumvent U.S. economic sanctions law,” after its own legal department told compliance it was “pursuing a zero-tolerance policy” on “creative solutions” — and the practice continued for five more years. This is wire stripping as written policy; see correspondent banking abuse.
Oil letters of credit. UniCredit paid dollar letters of credit for oil from Kazakhstan that its customer then shipped to Iran. The invoices and bills of lading in the bank’s own trade files referred to the onward shipment to Iran.
The penalty
OFAC rated the Munich bank’s conduct egregious, set a base penalty of $1.37 billion and settled at $553 million, crediting cooperation (an extensive internal investigation, identifying every transaction, a tolling agreement) and remedial action. The group settlement was paid together with the US and New York penalties, not on top of them.
What the record shows
- A control can be a document. The mechanism here was not a software setting but a procedures guide, which is why it stayed consistent across branches and product lines for years.
- A designation does not reach affiliates nobody has listed. IRISL’s unlisted affiliates kept moving dollars for two years because the screening that mattered was on the customer group, not the name.
- The documents were in the bank’s own files. The oil letters of credit carried the Iran reference on their face.