In the last year, our firm that operates on the international arena as a medium-sized business in logistics industry faced sanctions following the breach of US Office of Foreign Asset Control (OFAC). Under the provisions of OFAC, the company has violated the cybersecurity rules that might indirectly bring a significant threat to the national security or the stability of the United States economy by engaging in online transactional activities from the external supplier located in Russian Federation without initial integration of payment arrangements. While the action was not purposeful and still undergoes internal investigation, the company recognizes being subjected to the cyber-related sanctions pursuant to E.O. 13694, which partially blocks the interests in property as acknowledged by the Secretary of Treasury and is implemented with approval on behalf of the Attorney General and the Secretary of State1.
According to the impact assessment, the sanctions might have the following impact on the firm. First, the speed of provision of services might be tampered with restrictions to perform financial transactions to a limited amount of funds or prices, as specified in the relevant contractual agreements, until specific counteractions are not implemented. Second, there is a significant risk for the existing logistics operations performed by the company, as well as the threat to internal computer systems and networks if a cyberattack based on financial fraud is initiated.
Third, there is an issue with protecting local resources and trade secrets until the sanction bans are lifted or appropriately addressed, which might be a time-consuming effort without the appropriate interventions. Finally, company information could be used by the compromised firm for illegal purposes, which brings risks to the safety of corporate accounts and anticipated shareholder value.
The sanctions might also have additional risks in terms of the triple bottom line of social, economic, and environmental impact. In terms of social risks, the firm might experience conflicts with customers and suppliers, who will expect confirmation that the appropriate risk assessments were conducted and the bans are lifted. Further, some stakeholders might opt for pausing or even completely stopping collaboration because of the risks to associated information systems’ performance, especially those using shared logistical resources. The firm might also lose its reputation as a trusted service provider on the market if the detailed information on sanction goes publicly. Finally, the firm might not meet its organizational revenue targets because of the operational limits, which might result in future budget cuts and reporting decreases in operational profits because of the government sanctions as a single problem case.
To mitigate the risks of sanctions for the business, the following approaches could be considered. First, it is advised to perform the internal performance analysis of technical systems according to the principles of forensic investigation using either simulation or engaging a third-party audit firm. The logic behind is that abnormal transactions were not previously traced within the organizational premises; therefore, it is required to analyze the backbone of attacks both from the external and internal risk perspectives.
Second, it is recommended to engage with a further consultancy with agencies such as FATF, or audit companies such as KPMG to enquire on the potential engagement in future financial monitoring and analysis of suppliers that might eventually cause business issues based on their existing business relationship models. Both qualitative and quantitative approaches might be feasible to be implemented, while the preference is to use the mix of both, based on the analysis of event logs, adherence to policies, and the ability to meet governance codes. Third, new policies and procedures in maintaining transactions with foreign suppliers should be established and submitted to OFAC to avoid further sanctions for non-compliance.
Additionally, it is advised to utilize consultancy from the logistics and information technology companies in UK that have recently faced sanctions and the need of revamping their information technology infrastructure. It could be achieved through a best practice sharing or benchmarking method depending on the complexity of effort and relevance to the overall objective of meeting supply chain resilience standards. Furthermore, it is also important to regularly monitor recent provisions of the OFAC in relation to authorized and prohibited transactions, as well as the need of specific licenses that may refer to the operations with suspicious suppliers. Finally, it is recommended to avoid business partnership with companies that fall under classification of Specially Designated Nationals (SDN) and Blocked Persons List (SDN) according to OFAC reports.
Footnotes
Financial Action Task Force (2006) Trade-based money laundering. Web.