The US Treasury Department has published something that it calls a 'framework' for banks to refer to when trying to comply with the sanctions regime of the Office of Foreign Assets Control.

OFAC, which the Treasury set up in 1950 to help it with Cold-War sanctions against communist countries, now also blacklists individuals, groups and entities at the President's behest.

In the document OFAC strongly encourages organisations subject to US jurisdiction, as well as foreign entities that conduct business in or with the United States or US persons, to take a risk-based approach to sanctions compliance by developing, implementing, and routinely updating sanctions compliance programmes.

Each sanctions compliance programme (SCP) should be predicated on and incorporate at least five essential components of compliance: (1) management commitment; (2) risk assessment; (3) internal controls; (4) testing and auditing; and (5) training.

The document goes on: "When applying the guidelines to a given factual situation, OFAC will consider favorably subject persons that had effective SCPs at the time of an apparent violation.  For example, under General Factor E (compliance programme), OFAC may consider the existence, nature, and adequacy of an SCP, and when appropriate, may mitigate a CMP on that basis.

"Subject persons that have implemented effective SCPs that are predicated on the five essential components of compliance may also benefit from further mitigation of a CMP pursuant to General Factor F (remedial response) when the SCP results in remedial steps being taken. Finally, OFAC may, in appropriate cases, consider the existence of an effective SCP at the time of an apparent violation as a factor in its analysis as to whether a case is deemed egregious."

Senior managers ought to promote a “culture of compliance” throughout their organisations. These efforts could generally be measured by the following criteria.

• The ability of personnel to report sanctions-related misconduct by the organisation or its personnel to senior management without fear of reprisal.
• Senior managers take action that discourages misconduct and prohibited activities, while alerting all to the potential repercussions of non-compliance with OFAC sanctions.
• The ability of the SCP to oversee the actions of the entire organisation, including senior managers, for the purposes of complying with OFAC's sanctions.