Lessons in Harman Sanctions Case

We haven’t talked sanctions enforcement lately but now have reason to do so, thanks to an enforcement action last week against a global electronics company that hinged on a weak compliance program and poor oversight of international distributors. 

Said company is Harman International, headquartered in Connecticut and a subsidiary of Samsung since 2017. Harman agreed last week to pay $1.45 million in penalties to the U.S. Office of Foreign Assets Control (OFAC) for shipping electronics equipment to Iran in the late 2010s. OFAC specifically faulted Harman for an under-resourced trade compliance capability — and since sanctions enforcement is a risk going nowhere but up these days, let’s see what lessons we can learn.

The misconduct happened from 2018 through most of 2020. According to the OFAC settlement order, Harman’s distributor in the United Arab Emirates sold Harman products into Iran, with the knowledge and support of 13 British nationals working for the U.S.-based professional services subsidiary of Harman International, a group known as Harman Professional.

The scheme worked as follows. First the Harman Pro team shipped goods to Harman’s distribution center in Denmark. The UAE distributor took possession of the goods there, and became responsible for all onward shipment after that: filing export declarations with the Danish customs authorities, shipping the goods to the distributor’s warehouse in Dubai, and paying all tariffs due to the UAE government.

Once the Harman electronics equipment was in Dubai, the UAE distributor then shipped those goods to customers in Iran — a violation of U.S. sanctions law. We don’t know the exact number and value of those shipments because Harman Pro’s records were so poor (more on that in a moment), but OFAC estimates that $148,000 worth of Harman goods were sold into Iran across 11 transactions. 

Harman Pro’s Sanctions Violations

The issue here is how much those 13 employees at Harman Pro were aware that the goods they were sending to the UAE distributor would ultimately go to Iran.

According to OFAC, the 13 Harman Pro employees clearly did know that Iran was an end-use customer, because the employees used coded references in company email to avoid mentioning Iran by name:

[F]rom at least December 2016 to July 2019, members of the British sales team used deceptive terms such as “the northern region,” “North Dubai,” and “up north” in an apparent reference to Iran’s geographical location directly north of the UAE.

For example, in one instance from 2017, the EMEA regional director for Harman Pro noted that most of the UAE distributor’s business was in “North Dubai.” In another instance from 2019, a senior sales executive told that same EMEA regional director that one particular Harman product was destined for an end-user “up north.” 

Eventually Harman Pro and the UAE distributor had “a series of disputes,” which led Harman to cut ties with the distributor in 2020. Sometime after that, Harman voluntarily self-disclosed the sanctions violations to OFAC, and here we are.

The Poor Compliance Efforts

OFAC flagged multiple shortcomings in Harman’s sanctions compliance program. Namely… 

• Policies and procedures. Harman had no formal system for monitoring or auditing sanctions-related risks. Instead, the legal team typically relied on business units themselves to identify potential issues. 
• Personnel and resources, Part I. Harman had only one employee — the senior director of supply chain and global trade compliance — responsible for managing U.S. economic sanctions and export control risks, and this person lacked the expertise and screening tools to perform his duties adequately.
• Personnel and resources, Part II. Likewise, Harman’s in-house attorneys didn’t have the training, time, or resources to develop expertise on OFAC sanctions and export controls. That left Harman unable to sufficiently extend its policies and controls throughout the enterprise, including to overseas employees of its U.S. subsidiaries.

There was also the poor recordkeeping from those British employees of Harman Pro. They knew they were playing footsie with Iranian customers, and tried to mask those transactions with the “North Dubai” nonsense and other loosey-goosey recordkeeping practices. As the OFAC order phrased it, “Because of the dearth of records and the British sales team’s efforts to obfuscate its sales to Iran, the total value of the distributor’s Iran diversions could not be definitively determined.” 

The British employees were all mid-level managers or higher, by the way. They had titles such as sales director, director of sales operations, senior director for Finance, regional director, and account manager. People who should have known better — and clearly did, since they were masking the Iran angle in their email communications.

Aggravating and Mitigating Factors

The total possible monetary penalty for these violations was $4.15 million. Because Harman self-disclosed the matter, that cut the potential penalty in half to $2.07 million. From there OFAC reached the final penalty of $1.45 million by evaluating numerous factors.

First were the aggravating factors. The British sales team had actual knowledge that the sales in question were destined for Iran; and engaged in a deliberate, long-running effort to hide that fact by using euphemisms for Iran in their email. Making matters worse, Harman was at the time (and still is today) a large and sophisticated company, which should have had a more sophisticated sanctions compliance program. It didn’t.

Then came the mitigating factors. Once Harman did voluntarily self-disclose its violations, the company undertook a full internal investigation and cooperated with OFAC too. Harman also made “substantial investments in enhanced sanctions compliance resources.” That included new internal reporting guidelines for sanctions risks, more autonomy and resources for the global trade compliance department, and better training for select employees. 

Harman also agreed to invest $400,000 in additional sanctions compliance controls, although the settlement order doesn’t specify what those new controls are.

The lesson for the rest of us is that the remedial steps Harman has taken lately should be the steps you take now to avoid future sanctions risk.

That is, these violations all happened more than five years ago, and sanctions enforcement risk today is considerably higher than it was then. That’s especially true for violations involving Iran, and just generally true across the board. You need to anticipate that enforcement climate and design a sanctions program that can survive in it.

This doesn’t necessarily mean you need to spend oodles of cash on a new sanctions compliance program; but you do need to review the structure of your program and the authority of your sanctions compliance personnel to determine whether they’re sufficient for your company’s risk profile. 

That’s where Harman went wrong, really. It didn’t have policies and procedures to assess sanctions risk in any serious way; it relied on local business units to identify issues. It had only one sanctions compliance employee, who didn’t have enough resources to do the job. None of that is copacetic with what OFAC wants to see from an effective sanctions compliance program. 

Good for Harman that it’s on the right path now. The rest of us should avoid the pitfalls Harman tripped over in the past.