Assessing exposure to sanctions and broader financial crime risks is a critical diligence consideration when thinking of investing in any cross-border transactions. The continued expansion and increased complexity of sanctions regimes, greater frequency of regulatory changes, and escalating enforcement has made this more important and more challenging to assess during the diligence process in recent years.
Here we use a fictional case study to outline the steps that buyers can take to identify, evaluate, and address sanctions risks, and the commercial considerations that sanctions compliance can cause. Though not intended as an exhaustive diligence and risk assessment, it raises the process and considerations for buyers.
Introducing our case study
This case study assumes a US and a European fund are co-investing, with the US entity taking the majority position. Their target is a business unit carved out of an industrial company headquartered in Germany. The target is reliant on agents and distributors for business development and revenue, some of which sell its products in Cuba and Iran. Finally, it has a manufacturing joint venture with a company that is owned by a Russian oligarch, with onward sales to Russian clients. Turkey is its third largest sales market after the US and EU.
Our pre-transaction diligence consists of an inside-out legal assessment and an outside-in investigation. The findings of each of these workstreams inform the other. We then outline post-transaction considerations. However, it is worth stating that from the outset of the deal it is helpful for investors and their anticipated financing parties to align on their approach to sanctions diligence, perceived key sanctions risk factors, and agree what is acceptable from a sanctions risk perspective to secure financing. This means diligence and analysis is focused on the correct issues and set within a clear framework.
Pre-transaction considerations: inside-out
There are four key considerations for the inside-out legal assessment.
- Has the Target identified sanctions as a risk area? - If so, a productive first step of diligence is to understand the target’s own conclusions regarding sanctions exposure (to be pressure tested as part of the diligence process), and the compliance program implemented by the Target to mitigate that risk. We consider the target’s policies, procedures and supporting systems, such as screening software; the target’s compliance resources and governance structure for managing sanctions risks; and whether it has monitoring and audit programmes. We would also review whether the sanctions programme is applied to the target’s joint venture in Russia, particularly considering regulations that prohibit Russian parties from complying with foreign sanctions regimes.
- What is the Target’s exposure to primary sanctions liability? -In this case, the Target is directly subject to both the EU sanctions regime, and certain components of the US sanctions regime. Given we are considering a German company, we would look to assess which aspects of its business have historically been subject to US jurisdiction. The principal questions are whether transactions have been conducted in US dollars; involved US financial institutions, involved US persons or subsidiaries, and the use of US-origin content. We would also consider changes to primary sanctions jurisdiction because of a majority investment by a US sponsor. The US sanctions regimes involving Cuba, Iran and Russia extend directly to foreign entities owned or controlled by US Persons. Therefore, we would consider if any direct or indirect dealings with Cuba, Iran and Russia are commercially material. Any such business would almost certainly need to be wound down pre-closure unless there are general or specific licenses from OFAC (Office of Foreign Assets Control) that could enable operations to continue under new US majority ownership. We would work with the buyer to evaluate collateral consequences of terminating business with Cuba and Iran. This could jeopardise the target’s global contracts with clients or distributors and create further revenue loss than the revenue generated in Cuba and Iran. If the decision is taken to wind down the Iran or Cuba business pre-close then we look at ongoing sales contracts, ongoing service contracts, warranty obligations, the accounts receivable, and whether that is also commercially material. We would lastly consider what provisions are needed in the transactional documents to ensure such steps were completed in compliance with law and prior to closing.
- What is the Target’s exposure to US secondary sanctions? The third consideration is US secondary sanctions, which can apply to business activity without a US link. We identify where direct or indirect business and entities are subject to secondary sanctions programs administered by OFAC, and whether those exposure points have been considered by the Target’s evaluation. Knowing who the company is doing business with, the type of products they are selling, and the type of industries that they are supporting, we then seek to collect the relevant information to bottom out that analysis ourselves.
- Has the Target violated applicable sanctions in the past?The fourth and final consideration for the inside-out diligence is whether there have been historic sanctions violations, and if so, how they were approached and addressed, whether they were self-disclosed or been the subject of enforcement or government inquiries. As appropriate, we would assess the potential maximum civil or criminal penalties along with likely outcomes based on similar cases and experience.
Pre-transaction considerations: outside-in
We now consider the pre-transaction outside-in investigative diligence. Its objectives are to provide additional insight and context to any concerns raised in the inside-out legal assessment; identify any sanctions or additional risk considerations that are not revealed in self-declared information and management interviews with the target; and to gauge the target’s culture and approach towards sanctions and broader risk management. Taken together, this gives the buyer greater confidence about the target’s profile and tests their knowledge and assumptions about the deal.
- The first step is to independently review the target’s ownership, control and joint ventures to ensure they are not owned or controlled by sanctioned entities or individuals. In this case, given the target’s domicile and profile is in Germany it would be unlikely. The Russian joint venture partner would be a primary focus. We use the range of investigative diligence methods to do this, namely local language searches, reviews of corporate registry databases and other legal archives, and interviews with people who know the joint venture partner and its owner. These could be people at competitors, in industry bodies, from government and diplomacy, and other related fields. We would use these methods to understand the profile and relationships of the joint venture partner, and the extent to which they are sanctioned now or have a profile that means they are likely to be sanctioned in the future if additional sanctions are imposed on Russia. Beyond the partner, we would also seek to evaluate the sanctions and risk profile of the joint venture’s client base in Russia to see if these third parties expose the buyers to risk. To do this, we identify external information available about the target’s clients, including from government procurement databases, and then compare this with any self-declared information provided by the target. We would also use these investigative methods to see if the target’s operations or sales practices touch on Crimea or separatist regions in eastern Ukraine, given they are subject to different and more extensive US, EU, and third-country sanctions regimes.
- Second step would be to look at Cuba and Iran, which are markets the target services through third parties. We would be seeking to establish the extent to which the sales are recent, and whether there is an ongoing in-market presence or sales activity. We would apply similar research techniques to those described in Russia, though also look for archived or dormant corporate entities related to the target and speak to sources with knowledge of the target’s sales and distribution relationships in the country. Caution is required when considering this type of work in sanctioned countries, particularly on behalf of US clients to avoid impermissible dealings or export of services. We would work through this quite carefully to ensure everyone is comfortable with the legal parameters of the research.
- Looking beyond Iran, Cuba, and Russia, a third step is considering other countries that pose indirect sanctions exposure through diversion or third party risk (i.e., distributor, agent). The target has sales operations in markets that are not subject to significant sanctions, though are adjacent to sanctioned countries. Turkey has established trade relationships with Iran, Iraq, and Syria. We would establish if the significant sales volumes in Turkey were due to onward sales to those sanctioned markets through Turkey-based distributors or clients and if there are any red flags suggesting diversion. If we do not have access to detailed internal data, then we would be reliant on identifying external sources with a vantage point over the target’s business model and third parties in Turkey. Sanctions risks, as with many financial crime risks, often appear and can be due to third party relationships, which can be assessed throughout the transaction diligence.
- As a final consideration, we would also evaluate the target’s corporate culture by engaging people with a view of how the company is run, such as former employees, people at competitors, representatives of industry bodies and lobby groups, and people who hold supply or client relationships with the target. We want to evaluate how decisions are made and the extent to which the culture is inclusive and receptive to employees ranging challenging compliance related issues. This can provide helpful insights into specific issues and broader culture to inform management interviews.
Finding this article useful?
Post-transaction: drawing conclusions, closing information gaps and remediation steps
Our findings from the pre-transaction diligence and legal analysis inform recommendations for the buyers to consider once the deal is closed. These recommendations are specific to the terms of the deal, the buyers’ risk appetite, and the conclusions of our analysis. We raise a few hypothetical conclusions and next steps relevant to the analysis of this deal to provide a sense of the conclusions and advice that might be reached. Given the buyers would be in a controlling position post-closing, they have a helpful advantage of being able to drive improvements on specific risk areas.
We would be comfortable that the target has a good sanctions compliance program, consisting of a well-considered sanctions policy and strong supporting procedures, including a sanctions screening tool integrated into its ERP (Emergency Response Plan) system. In many cases, however, when analysing non-US headquartered companies, we find that sanctions risk assessments have been historically deficient in assessing US secondary sanctions risks. In this case we would consider additional risk assessment post-closing.
We would be comfortable that the target has a good sanctions compliance program, consisting of a well-considered sanctions policy and strong supporting procedures, including a sanctions screening tool integrated into its ERP (Emergency Response Plan) system. In many cases, however, when analysing non-US headquartered companies, we find that sanctions risk assessments have been historically deficient in assessing US secondary sanctions risks. In this case we would consider additional risk assessment post-closing.
Additionally, we found that the target’s third-party due diligence processes did not extend beyond screening, giving it limited oversight of its agents and distributors’ sales practices and in some cases clients. This was compounded by weak contractual protections in agreements with distributors and agents and purchase orders with clients, increasing risk of indirect sanctions violations. The risk was mitigated given the lack of a historical US nexus to most of these sales as they were outside the US with non-US persons using currencies other than the US dollar, though we would note the need to monitor and assess the implications of the rapidly evolving restrictions from multiple governments on Russia. This shortcoming could be rectified postclosing by the target improving the risk assessment and diligence of third parties at onboarding; and how third parties are then monitored and audited. This would be applied to the broader third-party population rather than solely third parties in sanctioned countries or countries that trade with sanctioned countries (such as Turkey).
Looking at specific countries, we found that the good sanctions policy and processes at the corporate level were not well applied to the Russian joint venture. As such, it would be helpful to conduct a post-closing detailed forensic review of the Russia business as the target had limited oversight of its complicated network of distributors and ultimate clients in Russia. This would involve reviewing financial data on specific distributors to try and show their sales history and ultimate clients; reviewing agreements and contracts; and interviewing employees of the target and perhaps some of the third parties to understand how these distributors interact with the target and where improvements can be made. This exercise may need to be repeated and refreshed as the sanctions regimes against Russia expanded in late February 2022, and indeed a broader legal and commercial decision about whether business in Russia could continue.
We would be comfortable that the Iran and Cuba business could be wound down easily without outstanding contractual or commercial obligations, and that that would not pose a material business risk, either as standalone business or to global relationships and contracts. The practices in Turkey were indicative of onward sales to Iraq, though not Syria and Iran, though a similar forensic exercise to Russia could be undertaken to understand the extent of any sales in any of those countries. We would use similar methods to Russia, though in this case also addresses and contact information in CRM data and invoices that indicate that the end client might not be in Turkey as the target was led to understand.
The piece was first published in Control Risks 2022 Sanctions Report and was written in conjunction with Sean Seelinger, Partner at Ropes & Gray.