3M Nailed Again, on Sanctions

Manufacturing giant 3M Corp. is paying $9.6 million to settle charges that its overseas business units and resellers improperly sold goods into Iran in the 2010s, in a fascinating glimpse of how overseas employees might try to circumvent trade controls. 

The settlement was announced by the Office of Foreign Assets Control (OFAC) on Thursday. This is the second regulatory enforcement action against 3M that we’ve seen recently; last month, the company paid $6.5 million to settle FCPA violations with the Securities and Exchange Commission. 

So what happened here? According to the OFAC settlement, trouble began in 2016, as the United States was preparing to reach a partial rapprochement with Iran that would allow foreign subsidiaries of U.S. companies to sell certain goods to Iranian customers. Anticipating that deal, employees of 3M’s Middle East operations (3M Gulf) hatched a plan to sell reflective sheeting for license plates to a German company, which would then sell that blank license plates onward to Iranian transportation authorities — meaning, to the Iranian government. 

3M’s trade compliance counsel in the United States did approve that arrangement, per a new policy 3M had developed since the window for sales to Iran had wedged open. But the trade compliance team only blessed that specific arrangement: 3M Gulf selling sheeting to the German company. “The trade compliance employee responsible for doing restricted-party checks mistook the German intermediary to be the end user of the sheeting, and did not perform due diligence on the Iranian” end-use customer, OFAC said.

That’s not ideal, and then things got worse. Several weeks later, the German company informed 3M’s Middle Eastern and European offices that it wouldn’t be converting the sheeting into blank license plates after all; the company would just be selling the reflective sheeting to Iranian buyers directly. “Despite this departure from the proposal as approved,” OFAC said, the 3M Middle East and European offices “did not bring this change to trade compliance’s attention.” And a few weeks after that, the local 3M offices received a due diligence report that tied their end-use customers to the Iranian police; the local 3M executives promptly failed to bring that detail to the trade compliance team’s attention.

Things got worse still. The local 3M people changed the contracting entity from 3M Gulf to 3M East, based in Switzerland, even though 3M Gulf was the only 3M subsidiary permitted to do business with Iran at all. “When numerous managers involved in planning the logistics of the Iran business raised concerns about the deal, the shift out of 3M Gulf, the identity of the end user, and the need to go back to trade compliance counsel for review of the transactions, the [local executives] ignored them,” OFAC said with its usual gift for understatement.

Ultimately 3M sent 43 shipments to Iran from 2016 to 2018, when the Trump Administration pulled the plug on the Iran deal. 3M’s license to sell into Iran expired, and the improper transactions came to light as 3M ended the business relationship. 

A Sanctions Compliance Analysis

OFAC deemed 3M’s misconduct “egregious,” but also praised 3M for the voluntary self-disclosure and extensive remediation work the company vowed to undertake. Let’s take a look at how those various factors stacked up.

First are the aggravating factors that left OFAC displeased:

• 3M Gulf senior managers willfully violated U.S. sanctions laws by exporting the sheeting to a prohibited Iranian customer. Numerous other 3M employees failed to evaluate the proposed sales properly from a sanctions compliance perspective. Those employees had reason to know that the sales would be sanctions violations, but turned a blind eye to ample evidence of the truth. 
• 3M employees had actual knowledge of the transactions and the identity of the specific end user long before the sales agreement was signed. 
• That end-use customer in Iran was affiliated with the Iranian police, and Iranian law enforcement agencies weren’t eligible to participate in the Iran trade deal.

Then we have the mitigating factors that OFAC appreciated seeing:

• 3M did have a risk-based trade compliance program in place at the time of the violations, even if that program didn’t work well.
• 3M voluntarily self-disclosed its violations, cooperated with OFAC in the ensuing investigation, and undertook a thorough internal investigation of its own.
• 3M implemented a broad range of remedial measures, which included firing or reprimanding six employees, hiring more trade compliance personnel both in the United States and in the Middle East, added a new policy that trade compliance counsel must re-review any proposal that had been changed, and introduced enhanced due diligence for any business involving a sanctioned country or region.

And for the next five years, a “senior-level executive or manager” at 3M must certify that the company continues to maintain all the improved internal controls, new policies, expanded training, and other sanctions compliance measures mentioned above. 

So what else can the rest of us learn from this case? Above all, the importance of having a risk-based compliance program that exists and is working. 

Yes, that sanctions compliance program failed to work in this specific instance, where numerous 3M executives were misleading the compliance team and failing to follow stated policies about dealing with Iranian customers. That led to the $9.6 million penalty against the company. But the statutory maximum for these sanctions violations were $27.4 million — if 3M had no sanctions compliance program at all, or a paper-based program that wasn’t based on risk, imagine how much larger its penalty would be with all these other egregious facts. 

We also see, yet again, that regulators value voluntary self-disclosure, cooperation, and remediation. That’s not news unto itself, but 3M did engage in all three of those steps. That tells me that management at least tried to take its culture of compliance seriously. 

Indeed, let’s go back to that FCPA enforcement from a few weeks ago. The misconduct in that case also happened in the mid-2010s, where executives at 3M China conspired with local travel agencies to wine and dine Chinese government officials on pricey tourism junkets.

The SEC credited 3M for self-reporting the mess “promptly,” cooperating extensively in the ensuing investigation, and undertaking “significant remedial measures” that included firing the offending employees, cutting business ties with the complicit travel agencies, and tightening internal controls for cross-border fund transfers.

Nobody likes to see compliance program failures, but in both cases 3M moved quickly to correct the issues that came to light. That high-level determination to remedy a bad situation matters, just as much as the internal controls you end up implementing.