Many of the cases on this site involve a company that is not American, selling goods that are not American, to a customer that is not in the United States. They still end in an OFAC settlement. That is not a quirk of those cases. It follows from how the prohibitions are written, and it has a small number of recurring routes.
What the US government says
The March 2024 Tri-Seal Compliance Note from the Departments of Commerce, the Treasury and Justice is the clearest statement. It says US sanctions “can create legal exposure not only for U.S. persons, but also for non-U.S. companies who continue to engage with sanctioned jurisdictions or persons in violation of applicable laws.” It lists the ways foreign persons are caught, and the routes below follow its structure.
Route 1: the dollar passes through the United States
Non-US persons “are prohibited from causing or conspiring to cause U.S. persons to wittingly or unwittingly violate U.S. sanctions.” The commonest way to do that is to put a US bank in the chain. The note describes a non-US person who “routes a prohibited transaction through the United States or the U.S. financial system, thereby causing a U.S. financial institution to process the payment in violation of OFAC sanctions”, and one who “obscures or omits reference to the involvement of a sanctioned party or jurisdiction.”
- Danfoss. A Danish group’s UAE subsidiary sold equipment to customers in Iran, Syria and Sudan and told them to pay into a US bank’s UAE branch. OFAC’s point, in its own words, is that “the sale of non-U.S. goods by a non-U.S. person to an entity in an OFAC-sanctioned country” can violate the regulations “when the financial transactions related to that activity are processed through or involve U.S. financial institutions.” See the Danfoss case.
- Bukit Muria Jaya. An Indonesian company took payment for cigarette paper to North Korea in a US dollar account, and 28 wires cleared through US banks. See the BMJ case.
- Banks. The large bank settlements, such as UniCredit and BNP Paribas, are the same route at scale: dollar payments for sanctioned parties that cleared through New York.
This is the reason correspondent banking and third-country accounts keep recurring. The control that matters is the one on the dollar, not the one on the goods.
Route 2: the company is owned or controlled by a US person
“In certain sanctions programs, foreign entities owned or controlled by U.S. persons also must comply with applicable restrictions.” The Tri-Seal Note cites three examples: 31 CFR 560.215 for Iran, 31 CFR 515.329 for Cuba, and 31 CFR 510.214 for certain North Korea measures. These rules are why an acquisition changes a company’s legal position overnight. See acquisition integration gaps.
- Key Holding: a Colombian subsidiary shipping to Cuba became subject to the Cuba regulations when a Delaware company bought it.
- Rice Lake: an Italian subsidiary lost its authorisation to sell to Iran when a general licence was revoked, and kept selling through a UAE distributor.
- Nasdaq: an Armenian exchange subsidiary, inherited through an acquisition, was treated as the parent’s liability.
OFAC’s Framework lists the misunderstanding behind these as a root cause: organisations that failed to appreciate that sanctions applied to them on the basis of their status as “a U.S.-owned or controlled subsidiary (in the Cuba and Iran programs).” Its separate root cause for “facilitating transactions by non-U.S. persons (including through or by overseas subsidiaries or affiliates)” covers a US parent that approves or refers a deal that its foreign unit then carries out. See facilitation.
Route 3: the goods or the content are American
Certain programmes “also require foreign persons in possession of U.S.-origin goods to comply.” For export controls the Note puts it simply: “the law follows the goods.” Its example is that an exporter cannot bypass the Iran embargo “by shipping an item to a distributor in the United Arab Emirates” and asking the distributor to send it on, because “this would be considered a reexport to Iran,” and “both the U.S. exporter and the UAE distributor could be liable.” See third-country transshipment.
Route 4: evading or conspiring
The note also lists conduct that evades US sanctions or conspires to cause a violation. A foreign company that edits a customer’s name out of a document, as the Bukit Muria Jaya sales staff did, or that plans a route with an intermediary, as in the Unicat case, is on this route whether or not a US person was ever aware of it.
How this differs from secondary sanctions
Secondary sanctions threaten a foreign person with loss of access to the US market for conduct that is lawful where it happens. The routes above are different: they are primary prohibitions that a foreign person is alleged to have violated, and the penalty is civil or criminal liability. In the Danfoss case OFAC found no evidence that the company used third-party payers to evade sanctions. What it penalised was the effect on a US bank.
It also matters that civil liability is strict. A person subject to US jurisdiction “may be held civilly liable even if such person did not know or have reason to know” that the transaction was prohibited, though knowledge changes the penalty. See strict liability and how penalties are decided.
What this means for screening
A foreign company or bank has three questions the goods and the customer’s location do not answer. Does any payment in the chain clear through a US bank, in dollars or otherwise? Does a US person own or control any part of the group, including a unit bought recently? And does any item in the shipment originate in the United States or contain US content? A “no” to all three is not a reason to stop asking, because the same facts can be arranged so that the answer appears to be no.