Toll Holdings Limited OFAC Settlement: $6.1M (2022)

Between approximately January 2013 and February 2019, Toll originated or caused to be received 2,958 payments totaling approximately $48,409,909 in connection with shipments conducted by Toll, its affiliates, or providers and suppliers to, from, or through the DPRK, Iran, or Syria, and/or involving property or interests in property of SDN-listed entities. These payments were processed through at least four U.S. financial institutions or foreign branches of U.S.-incorporated financial institutions, involving 23 different Toll entities across Asia, Europe, the Middle East, and North America.

Of the 2,958 payments, 424 involved Mahan Airlines, designated pursuant to E.O. 13224 (327 transactions), or Hafiz Darya Shipping Lines Company, designated pursuant to E.O. 13382 (97 transactions). The remaining 2,534 funds transfers were payments for shipments to, from, or transshipping through the DPRK, Iran, or Syria.

Toll failed to adopt or implement policies and controls that prevented it from conducting transactions involving designated parties or persons in sanctioned jurisdictions. This failure resulted in part from Toll's rapid expansion without a requisite increase in compliance resources. Beginning in 2007, Toll began acquiring small, local, or regional freight forwarding companies; by 2017, it had almost 600 invoicing, data, payment, and other system applications spread across its various business units.

By or before May 2015, some Toll personnel knew or had reason to know that the subject payments were in potential violation of U.S. sanctions prohibitions. That month, after one of Toll's banks restricted a Toll subsidiary's U.S. dollar account following identification of a Syria-related transaction, a Toll headquarters treasury employee sent an email instructing UAE and South Korea affiliates to avoid including the names of sanctioned jurisdictions on invoices going forward. The bank continued to raise concerns, and in June 2016 threatened to terminate its relationship with Toll after evaluating Toll's controls and deeming them unacceptable.

Although Toll decided in June 2016 to cease all business with U.S.-sanctioned countries, it did not implement compliance policies and procedures sufficient to prevent payments involving sanctioned persons through the U.S. financial system. In February 2017, Toll introduced "hard controls" that disabled country and location codes for ports and cities in sanctioned countries in its freight management system; 2,853 of the 2,958 payments had already occurred before those controls were implemented.

The apparent violations encompassed § 510.212 of the North Korea Sanctions Regulations, 31 C.F.R. part 510; § 542.205 of the Syrian Sanctions Regulations, 31 C.F.R. part 542; § 560.203 of the Iranian Transactions and Sanctions Regulations, 31 C.F.R. part 560; § 544.201 of the Weapons of Mass Destruction Proliferators Sanctions Regulations, 31 C.F.R. part 544; and § 594.201 of the Global Terrorism Sanctions Regulations, 31 C.F.R. part 594.

The statutory maximum civil monetary penalty applicable in this matter is $826,431,378. OFAC determined that Toll voluntarily self-disclosed the Apparent Violations and that the Apparent Violations constitute a non-egregious case. Accordingly, under OFAC's Economic Sanctions Enforcement Guidelines, 31 C.F.R. Part 501, app. A, the base civil monetary penalty is $15,329,638, equaling one-half the transaction value for each apparent violation, capped at the lesser of $125,000 for transactions on or before November 2, 2015, and $153,961 for transactions after November 2, 2015, or one-half of the applicable statutory maximum, per each apparent violation. The settlement amount of $6,131,855 reflects OFAC's consideration of the General Factors under the Enforcement Guidelines.

This enforcement action highlights the importance of instituting strong internal controls and procedures to govern payments involving affiliates, subsidiaries, agents, or other counterparties when any of them conduct business with sanctioned jurisdictions or persons. Complex payment and invoicing arrangements, while normal business conduct, can pose sanctions risks when linkages to sanctioned jurisdictions or persons are obscured, or when mechanisms to preclude their involvement with U.S. financial institutions are absent or not implemented effectively.

Entities should respond promptly and fully to address compliance weaknesses when issues first arise, identify their full extent and causes, and implement necessary changes to their compliance programs, practices, and procedures. These changes should reflect the specific gaps identified with respect to the applicable sanctions restrictions. Reminders of established compliance policies alone may not result in concrete changes to conduct that poses risks of apparent violations.

This action further emphasizes the need for entities to identify and implement measures to mitigate sanctions risks when merging with or acquiring other enterprises. The need for such efforts can be particularly acute when expanding rapidly, including when disparate information technology systems and databases are being integrated across multiple entities. In such cases, the need to adequately resource compliance functions, including compliance personnel and sanctions-related technology and systems, is especially important.

In addition, this case illustrates the care non-U.S. persons should take to avoid prohibited transactions involving sanctioned jurisdictions and persons when their activities rely on the use of U.S. financial institutions or otherwise involve U.S. persons or a U.S. nexus. Non-U.S. persons that seek to conduct business involving U.S. persons or the United States, including processing transactions through the U.S. financial system, should ensure their compliance policies contain measures to prevent violative dealings with sanctioned persons or jurisdictions.

This page summarizes an OFAC enforcement case based on the document archived below. SanctionsLookup assumes no liability for errors, omissions, or inaccuracies in the original documents, this summary, or any changes made to the source documents at any time.

Provided for informational purposes only and does not constitute legal or compliance advice. Always consult the source document directly rather than relying on this summary.