As we all know, “sanctions is the new FCPA,” and there has been lots of action when it comes to both sanctions and export violation enforcement.

Two recent cases highlight what we need to do to lessen the sting of U.S. sanctions and export violations, so let’s dive in.

Case number 1: The first-ever declination by the national security division

A twist on the Varsity Blues scandal, the MilliporeSigma "fake varsity" fraud scheme resulted in the first declination under the U.S. Department of Justice (DOJ) National Security Division's (NSD) voluntary disclosure program.

The recently updated NSD Enforcement Policy, like the DOJ’s Principles of Federal Prosecution of Business Organizations, emphasizes the importance of voluntary self-disclosure, cooperation, and remediation.

Other factors considered when evaluating to issue a declination are the nature and seriousness of the offense, law enforcement priorities, and the criminal history of the offender. Since 2016, the DOJ has listed only 20 declinations on its website, a number dwarfed by the 31 corporate enforcement actions in 2023 alone.

From July 2016 to May 2023, a customer with the assistance of a MilliporeSignma salesperson, faked an affiliation with a large Florida university to obtain controlled biochemical materials, that were then repackaged and sent to China with false export documents.

The fake varsity affiliation led MilliporeSigma to provide over $4.9 million worth of discounts and other benefits, such as free overnight shipping, not available to the general public.

When the products arrived at the university stockroom, a stockroom employee diverted the products to the customer, who repackaged them and shipped them to China with export documents that contained false statements about the value and content.

How the company “stepped up and owned up”

Voluntary self-disclosure within a week: 

MilliporeSigma Compliance personnel became aware that certain shipments were suspicious. Voluntary self-disclosure was made within a week of the company hiring outside counsel and without the company completing its investigation and knowing the full extent of the misconduct.

MilliporeSigma proactively identified and produced documents to the DOJ that established probable cause to search residences and electronic devices of culpable individuals including the criminal wrongdoing committed by its own salesperson. This cooperation allowed the DOJ to quickly identify the individuals responsible for the scheme and secure their felony guilty pleas.

In addition to the termination of the salesperson, the company agreed to improve internal controls and its compliance program.

The DOJ noted that, in most instances, the chemical compounds did not require an export license and they did not present a significant threat to national security in the quantities and concentrations sold.

Even though MilliporeSigma obtained some revenue from sales, the DOJ concluded that the company was victimized by the conspirators' scheme to fraudulently obtain significantly discounted products and free overnight shipping, and therefore was not required to disgorge profits or pay any forfeiture or restitution.

Contrary to MilliporeSignma is the rare three-year export ban of USGoBuy, the first such action since 2018. In 2021, the Bureau of Industry and Security (BSI) found that the company had shipped riflescopes to China and the United Arab Emirates. Per the settlement agreement, the company conducted an audit of its compliance program which found 176 instances where UsGoBuy failed to make the required export filings or maintain adequate export records, some of which occurred after the settlement. From the audit, USGoBuy was to develop a detailed plan of corrective actions.

Despite these violations and the significant and continued compliance failures identified through the audit, USGoBuy did not implement corrective actions to address these issues. It appears to not have taken any steps at all to improve its compliance with export control laws.

In 2022, Homeland Security Investigators (HSI) intercepted a shipment of an export-controlled item being sent to USGoBuy’s Oregon warehouse for a customer located in China. HSI added conspicuous labels to the shipping box stating that an export license was required and replaced the item with one that did not require authorization. Despite the export control markings, USGoBuy exported the package to China on the very same day that it was received.

USGoBuy’s failure to adhere to its settlement agreement, implement corrective actions, and continued violations of export control laws resulted in the three-year ban which essentially will put the company out of business.

These activities show that BSI and the DOJ are serious about the enforcement of export control laws. In July 2024, BSI issued a publication called “

,” which details its numerous recent enforcement activities.

Navigating the complexities of U.S. sanctions and export violations requires a proactive approach to compliance. The cases of MilliporeSigma and USGoBuy underscore the critical importance of having robust compliance measures in place. Whether it’s voluntary self-disclosure or the effective implementation of corrective actions, these cases highlight the significant consequences of compliance failures and the benefits of timely and honest cooperation with authorities. For companies dealing with third-party relationships, maintaining a strong compliance framework is not just advisable — it's essential.

Technology to keep you ahead of sanctions and export violations

If your organization is striving to strengthen its compliance program, Diligent Third-Party Manager can be an invaluable asset. This solution allows you to effectively monitor and manage third-party risks, ensuring your organization stays ahead in the ever-evolving regulatory landscape.

 helps you systematically monitor, screen and share critical due diligence data, so you can ensure your compliance program is both proactive 

To see how Diligent can assist your organization in achieving best-in-class governance and compliance, 

How to lessen the sting of U.S. sanctions & export violations

Imagine a scenario where a salesperson, driven by the desire to meet their commission targets, misleads a client about the capabilities of a product. This seemingly isolated incident could have far-reaching consequences for the entire organisation, potentially leading to legal action under the new 

 This is not a hypothetical situation; it's a real risk that organisations must now address under the Economic Crime and Corporate Transparency Act (ECCTA).

As the business landscape becomes increasingly complex, the stakes for compliance have never been higher. The FTPF offence, introduced by the ECCTA, is a significant legislative change that organisations cannot afford to ignore. But what exactly does this new offence entail? How can your organisation ensure it is not caught off guard? What practical steps can you take to prevent fraud and avoid the severe financial and reputational consequences?

This blog post, based on insights from our recent webinar hosted in partnership with 

, provides key tips and practical advice to help your organisation navigate this new legislation. Read on to build your understanding and find answers to the top questions asked during the session.

1. Understand the scope and implications of the FTPF Offence

The FTPF offence is broad and far-reaching, with significant implications for a wide range of organisations. As 

"There's a wide attack on subsidiaries, and they can be held liable in their own right, as well as creating liability for a parent organisation."

This means that the act has extra-territorial reach, affecting overseas subsidiaries and branches of UK companies. The offence can be committed by any associated person, including employees, contractors, and international distributors: "The fraud can be committed by any associated person, which can be anybody providing services for or on behalf of an organisation," Stevenson stated. 

The guidance makes it clear that the offence can be completed before any gain is received, and the intention to benefit the organisation doesn't need to be the sole motivation for the fraud. "A salesperson who's on commission may mis-sell to increase their own commission. But in doing so, they're also increasing the company's sales, so as a result, the company may be prosecuted for failure to prevent that fraud," she added.

2. Implement robust and tailored fraud prevention procedures

To avoid liability, organisations need to implement robust and tailored fraud prevention procedures. As Stevenson emphasised:

"To have a defence, organisations have got to have reasonable prevention procedures in place to prevent the fraud, and those procedures must have existed when the fraud was committed."

The onus is on the organisation to demonstrate this, and the standard of proof is the balance of probabilities. "The guidance is really explicit that there is an expectation that organisations will go above and beyond existing procedures," Stevenson added. This means that simply having basic procedures in place is not enough; organisations must continuously assess and improve their fraud prevention measures.

Risk assessment is a critical component of the fraud prevention framework. "Before an organisation can prevent fraud, it needs to understand its risks. So the risk assessment is absolutely critical," Stevenson explained. She suggested involving directors and senior managers in the process, using the fraud triangle to map vulnerabilities, and reviewing existing systems such as whistleblowing and internal investigations.

"It's important to learn from failures, so use every fraud incident as an opportunity to refine controls and strengthen defences."

The FTPF offence is not limited to a single department but requires a cross-functional approach.

"The nature of this offence means that there is a broad reach across an organisation such that it will require collaboration and cooperation across all functions."

This includes involving directors, senior managers, and other key personnel in the risk assessment process. "It's important to remember that the offence covers both directors and senior managers, so it means that a person who's playing a significant role in the making of decisions or managing the activities of the organisation is included," Stevenson noted.

5. Ensure top-level commitment and accountability

Top-level commitment is crucial for effective fraud prevention. Senior leadership should foster an open culture and make fraud prevention visible. As Stevenson emphasised:

"Top-level commitment is crucial; if senior leaders aren't taking it seriously, then nobody else is going to."

This commitment should be reflected in clear purpose statements and demonstrated through actions. Senior leaders must set the tone at the top, ensuring that all employees understand the importance of fraud prevention.

6. Embed a culture of integrity and compliance

Creating a culture of integrity and compliance is essential for preventing fraud. "This is about embedding the right culture, processes, and accountability," Stevenson noted. Employees should feel empowered to report suspicious activities without fear of retaliation. Clear communication, open channels for reporting, and a zero-tolerance policy for fraud are key to fostering this culture.

Download our whitepaper today and adapt swiftly to stay compliant and protect your organisation's reputation.

Navigate ECCTA with confidence

7. Utilise technology for real-time monitoring and reporting

Technology can significantly enhance fraud prevention efforts. Here are some actionable steps to make the most of 

Implement tools that can detect and respond to potential fraud quickly. Early detection is key to preventing fraud from escalating.

Ensure cross-departmental communication: 

Use a single technology platform that integrates objectives, risks, controls, testing, audits, and policies. This ensures everyone in the organisation is on the same page.

 Maintain a central repository for all critical policies, such as whistleblowing, fraud, and bribery and corruption. Ensure these policies are easily accessible and regularly updated.

 Use technology to keep track of policy updates and ensure compliance. Regularly review and update your policies to reflect the latest regulations and best practices.

By following these steps, organisations can create a robust framework for fraud prevention and ensure better alignment and communication across all departments.

8. Include anti-fraud clauses in supplier contracts and codes of conduct

Anti-fraud clauses should be included in supplier contracts and codes of conduct to ensure that all associated persons are aware of the organisation's commitment to preventing fraud. As Stevenson noted:

"The more you can do to implement anti-fraud clauses ahead of September 1st, the better."

These clauses should be clearly defined and communicated to all relevant parties.

9. Regularly review and update procedures

Compliance is an ongoing process, and procedures should be regularly reviewed and updated to ensure they remain effective. This includes documenting and reviewing the organisation's risk assessment, which is a critical component of fraud prevention. Regular reviews help organisations stay ahead of emerging risks and adapt to changing circumstances.

The potential fines for failing to prevent fraud can be significant, similar to other stringent legislation like GDPR. While the exact calculation method based on global turnover isn't explicitly detailed, it's likely that the fines will consider the global turnover of the organisation, not just the UK-based turnover. This aligns with the broad and stringent nature of the legislation, which aims to have 'teeth' with hefty fines and penalties.

Your questions answered: Key insights from the webinar

We received numerous insightful questions from attendees. Here, we address some of the most pressing queries answered by Stevenson during the session to help you better understand and implement the necessary measures for compliance.

1. What types of fraud are covered under the FTPF offence?

"The FTPF offence encompasses a broad range of frauds, both financial and non-financial. This includes fraud by false representation, such as greenwashing and misleading product claims, and cheating the public revenue, like tax evasion and false accounting. Essentially, any fraudulent activity that benefits the organisation or its clients can fall under this offence."

2. Who can commit the base fraud under this offence?

"The offence can be committed by any associated person, which includes employees, contractors, international distributors, and even employees of subsidiaries. The key factor is whether the individual is providing services for or on behalf of the organisation. Notably, the offence can be completed before any gain is received, and the intention to benefit the organisation doesn't need to be the sole motivation for the fraud."

3. How does the FTPF offence apply to overseas subsidiaries of UK companies?

"The FTPF offence has extra-territorial reach, meaning it can apply to overseas subsidiaries and branches of UK companies. If a UK-based employee commits fraud, their employer can be prosecuted regardless of where the company is based. Similarly, if a non-UK-based employee commits fraud in the UK or targets victims in the UK, the employer can also be prosecuted."

4. What constitutes 'reasonable prevention procedures' to defend against the FTPF offence?

"To have a defence, organisations must have reasonable prevention procedures in place at the time the fraud was committed. This includes conducting thorough risk assessments, implementing tailored fraud prevention measures, and ensuring top-level commitment to fraud prevention. The standard of proof is the balance of probabilities, meaning it must be more likely than not that the organisation had these procedures in place."

5. Are there specific reporting obligations related to the FTPF offence?

"While there are no explicit requirements to report compliance with the FTPF offence in annual reports, organisations should consider broader reporting and disclosure practices. This includes documenting and reviewing risk assessments and fraud prevention measures and ensuring transparency in their compliance efforts."

6. Should anti-fraud clauses be included in supplier contracts?

"Yes, including anti-fraud clauses in supplier contracts and codes of conduct is crucial. These clauses should clearly define the organisation's commitment to preventing fraud and be communicated to all relevant parties. Implementing these clauses ahead of the September 1st deadline is advisable to mitigate supply chain risks."

Next steps: Building a resilient compliance framework

The corporate offence of failing to prevent fraud under the Economic Crime and Corporate Transparency Act isa serious issue that requires a comprehensive and proactive approach. By following these key tips and maintaining a culture of transparency and accountability, organisations can effectively mitigate the risk of fraud and ensure compliance with the law.

 to gain a more comprehensive understanding of these topics and to explore the detailed discussions and insights shared by our experts.

Ready to transform your ECCTA compliance from a challenge into a competitive advantage? 

Find out more and request a demo with Diligent Entities here.

Diligent

Blog

How to lessen the sting of U.S. sanctions & export violations

Understanding and preventing the new ECCTA failure to prevent fraud offence

Solutions

Resources

Company

Your Data Matters

Diligent

Blog

How to lessen the sting of U.S. sanctions & export violations

Understanding and preventing the new ECCTA failure to prevent fraud offence

SolutionsSolutions

ResourcesResources

CompanyCompany

Your Data Matters

Solutions

Resources

Company