On April 24, 2024, President Biden signed into law H.R. 815, which among other things extended from five to ten years the statute of limitations (SOL) for certain violations of US sanctions. The Act is primarily a foreign aid and national security legislative package that grabbed headlines for its provision of $98 billion in foreign aid for Ukraine, Israel, and Taiwan, and a mandate for ByteDance, Ltd. to sell or divest its interests in the social media application TikTok (the Act). The Act also ushered in significant—although less attention-grabbing—changes to the US sanctions landscape.
By extending the SOL, OFAC and the US Department of Justice (DOJ) can pursue civil and criminal enforcement actions related to older conduct than all but a few other federal crimes. As a result, companies might consider (i) longer lookback periods for due diligence and sanctions-related representations and warranties; (ii) reviewing compliance policies and procedures, as well as the lookback period for internal audits and internal investigations, to account for the extended SOL; (iii) preparing for longer record-keeping obligations to match the extended SOL; and (iv) voluntary self-disclosures, particularly for potential violations that might have been near expiration under the former five-year SOL.
The Act also foreshadows further shifts in sanctions enforcement by (i) authorizing the United States to seize and transfer certain “frozen” Russian sovereign assets to benefit Ukraine; and (ii) requiring OFAC to provide a classified briefing on its staffing levels to Congress.
Congress Doubles the Statute of Limitations
The Act extends the SOL for US sanctions violations by amending the statutory authorities underlying most US sanctions programs: the International Emergency Economic Powers Act (IEEPA) and the Trading with the Enemy Act (TWEA). As a result, the Act extends the SOL for civil and criminal enforcement actions under IEEPA and TWEA to ten years after the latest date of a potential violation.
The Act’s extension of IEEPA’s SOL in particular will have implications beyond US sanctions programs administered by OFAC. The Act’s amendment of IEEPA’s SOL applies to all IEEPA-based legal authorities, which, for example, would extend the SOL for DOJ National Security Division’s forthcoming program pursuant to Executive Order 14117 (concerning the prevention of large-scale transfers of sensitive personal data and US government-related data to countries of concern) and for the US Treasury Department’s Office of Investment Security (OIS)’s Outbound Investment Program pursuant to Executive Order 14105 (concerning restrictions on US investments to China, including Hong Kong and Macau, in certain technology sectors).
Although the Act extends the SOL for US sanctions violations, companies should note that the Act does not change the SOL for violations of most US export controls. The Act does not amend the Export Control Reform Act (ECRA) or Arms Export Control Act (AECA), which are the primary statutory authority for the Export Administration Regulations (EAR) and the International Traffic in Arms Regulations (ITAR), respectively. Congress may act later to extend the SOL for US export control violations, to harmonize the SOL across these areas of international trade regulation.
Ongoing Impact on Companies
The SOL extension increases civil and criminal enforcement risk, which may impact compliance programs and decision-making around voluntary self-disclosure of potential violations that might have been close to expiring under the previous five-year SOL. Some key considerations for companies include:
- Transaction due diligence, representations, and warranties: companies engaging in mergers and acquisitions—as well as other commercial transactions and activities—might consider extending the lookback period for due diligence into counterparties. The extended SOL also underscores the importance of carefully negotiating the representations and warranties because the extended SOL doubles the period of time for which companies’ conduct may be subject to regulatory scrutiny. Accordingly, companies should consider including extended lookback periods for representations and warranties.
- Recordkeeping practices: companies should be prepared to update recordkeeping policies and practices to reflect the new ten-year limitations period. OFAC has not yet updated the recordkeeping requirements in 31 CFR § 501.601.
- Compliance, internal audit, and internal investigation programs: companies should consider reviewing their sanctions compliance function, including the lookback period for internal audits and international investigations, to account for the ten-year SOL. Companies might consider, where appropriate, strengthening their compliance function—and conducting audits at regular intervals to ensure that it is functioning properly in practice—to help account for an increased civil and criminal enforcement risk for sanctions violations.
- Voluntary self-disclosures: companies should consider the extended SOL period when deciding whether to voluntary self-disclose a potential sanctions violation, particularly for potential violations that might have been close to expiring under the five-year SOL. The ten-year SOL also provides regulators with more time and opportunity to investigate possible sanctions violations, which could result in more enforcement actions and larger penalties due to regulators’ increased runway to investigate such violations. Additionally, enforcement agencies may have less need for agreements to toll (i.e., suspend) the SOL, which OFAC considers in determining appropriate enforcement outcomes.
Further Guidance and Regulatory Updates Expected
The US Supreme Court has already decided that Congress cannot reopen the SOL for criminal enforcement, as doing so is impermissible as a matter of constitutional law (Bouie v. City of Columbia, 378 U.S. 347, 352–53 (1964)). OFAC has not, however, provided guidance on how it will apply the new ten-year SOL to civil enforcement, and OFAC may issue guidance to address the SOL for civil violations that occurred prior to the Act’s signing on April 24, 2024. For example, OFAC may address whether five more years would be added to the SOL for sanctions violations that occurred prior to April 24, 2024, or if the extension would only apply to violations following the April enactment date. It is expected, however, that civil suits where the statute of limitations has already expired will not be re-opened, and only civil actions that were still actionable on April 24, 2024 would continue to be actionable for the extended ten-year duration from the date of the conduct that may have breached sanctions. Finally, it also remains to be seen whether OFAC will update rules related to the new SOL, like recordkeeping requirements in 31 CFR § 501.601, to match the ten-year period.
Conclusion
The Act is the latest example of lawmakers’ efforts to update tools and bolster resources to enforce US sanctions. This follows DOJ’s 2022 proposal to extend the SOL for sanctions violations to facilitate investigations and DOJ’s recent hiring of dozens of new prosecutors to investigate criminal violations of sanctions and export controls, which is an increasingly important US enforcement priority. Accordingly, companies might consider evaluating—and taking steps to mitigate—their exposure to these risks.
