Although aid to Israel, Ukraine, and Taiwan made headlines last month when President Biden signed H.R. 815, the law also significantly expanded the scope of agencies’ enforcement authority under two key national security laws: the International Emergency Economic Powers Act (IEEPA) and the Trading with the Enemy Act (TWEA). Both now have 10-year civil and criminal statutes of limitations, rather than five.

IEEPA and TWEA are the basis for many of the sanctions programs maintained and enforced by the Office of Foreign Assets Control (OFAC). IEEPA is also the statutory authority for certain export controls under the Export Administration Regulations.

As a result of the amendment, the statute of limitations under most of OFAC’s sanctions programs is now 10 years. This includes the Belarus, Cuba, Iran, North Korea, Russia, and Syria sanctions.

Although the extension of the criminal statutes of limitations may face challenges under the Constitution’s Ex Post Facto Clause, the limitations imposed by that clause are unlikely to impact the expanded civil enforcement authority. Civil enforcement is also more common. Civil penalties under IEEPA are currently $364,992 per violation; under TWEA, they are $108,489.

Practical implications

Although OFAC may issue guidance on the extended statute of limitations, companies should begin considering the following:

  • Recordkeeping: Currently, OFAC’s regulations only require companies to maintain transaction- and license-related records for five years. Even if OFAC does not amend its regulations, companies should consider updating internal policies and procedures to adopt a 10-year recordkeeping requirement to ensure the company has the information it needs if OFAC brings an enforcement action.
  • Internal audit policies and procedures: Companies should also consider revising investigations and internal audit policies and procedures to assess compliance over the past 10 years.
  • Acquisition-related due diligence: To address successor liability risks, if a buyer will acquire 10 years’ worth of the target’s liability for sanctions (and to a lesser extent, export control) violations, the lookback and disclosure period should cover more than the typical three to five years. Sellers are unlikely to want a longer lookback and disclosure period though, which may create friction in the negotiating process.
  • Pending disclosures or enforcement actions: Companies should evaluate the extent to which the extended statutes of limitations may create additional penalty exposure in current enforcement actions or pending voluntary self-disclosures. In many cases, the company may not have examined potential violations outside the five-year statute of limitations.