UniCredit Bank AG OFAC Settlement: $553.4M (2019)

Last updated: July 20, 2026

UniCredit Bank AG, a financial institution headquartered in Germany and a subsidiary of the UniCredit Group, settled its potential civil liability for 2,158 apparent violations of multiple sanctions programs, primarily the Weapons of Mass Destruction Proliferators Sanctions Regulations, 31 C.F.R. Part 544, but also the Cuban Assets Control Regulations, the Burmese Sanctions Regulations, the Sudanese Sanctions Regulations, the Syrian Sanctions Regulations, the Iranian Transactions and Sanctions Regulations, the Libyan Sanctions Regulations, and the Global Terrorism Sanctions Regulations. The violations arose from the bank's processing of payments totaling $527,467,001 through financial institutions in the United States between January 3, 2007 and December 27, 2011. UniCredit Bank AG agreed to a settlement amount of $553,380,759, part of a global settlement with OFAC, the U.S. Department of Justice, the New York County District Attorney's Office, the Federal Reserve Board of Governors, and the Department of Financial Services of the State of New York.

Penalty Amount

$553,380,759.00

Enforcement Date

April 15, 2019

Rank in Top Penalties

Case Details

Type:: Entity
Name:: UniCredit Bank AG
Country:: 🇩🇪 Germany
Industry:: Banking
Address:: München, Germany
Penalty amount:: $553,380,759.00
Base civil monetary penalty:: $1,366,372,244.00
Egregious case:: Yes
Apparent violations:: 2158
Voluntary self disclosure:: No
Case:: Settlement
Violation period:: January 3, 2007 to December 27, 2011
Program:: Weapons of Mass Destruction Proliferators Sanctions Regulations, 31 C.F.R. Part 544 (WMDPSR)Cuban Assets Control Regulations, 31 C.F.R. Part 515 (CACR)Burmese Sanctions Regulations, 31 C.F.R. Part 537 (BSR)Sudanese Sanctions Regulations, 31 C.F.R. Part 538 (SSR)Syrian Sanctions Regulations, 31 C.F.R. Part 542 (SySR)Iranian Transactions and Sanctions Regulations, 31 C.F.R. Part 560 (ITSR)Libyan Sanctions Regulations, 31 C.F.R. Part 570 (LSR)Global Terrorism Sanctions Regulations, 31 C.F.R. Part 594 (GTSR)
Enforcement date:: April 15, 2019

Nature of the Apparent Violations

Between January 3, 2007 and December 27, 2011, UniCredit Bank AG processed 2,158 payments totaling $527,467,001 through financial institutions in the United States in apparent violation of the Weapons of Mass Destruction Proliferators Sanctions Regulations (31 C.F.R. Part 544), the Cuban Assets Control Regulations (31 C.F.R. Part 515), the Burmese Sanctions Regulations (31 C.F.R. Part 537), the Sudanese Sanctions Regulations (31 C.F.R. Part 538), the Syrian Sanctions Regulations (31 C.F.R. Part 542), the Iranian Transactions and Sanctions Regulations (31 C.F.R. Part 560), the Libyan Sanctions Regulations (31 C.F.R. Part 570), and the Global Terrorism Sanctions Regulations (31 C.F.R. Part 594).

During this period, UniCredit operated U.S. dollar (USD) accounts on behalf of the Islamic Republic of Iran Shipping Lines (IRISL) and several companies owned by or otherwise affiliated with IRISL, including Ashtead Shipping Company Limited, Fairway Shipping Limited, and Hanseatic Trade Trust & Shipping GmbH (HTTS), and managed those accounts in a manner that did not identify IRISL's interest or involvement in transactions sent to or through U.S. intermediaries. UniCredit implemented auto-transfer mechanisms and selectively applied controls on certain of those companies' accounts, and processed transactions involving an interest of IRISL to or through the United States for almost two years after OFAC added IRISL to the SDN List in September 2008. Ashtead, Fairway, and HTTS had not themselves been listed as SDNs at the time of the transactions.

In addition to the IRISL-related conduct, UniCredit processed USD payments in a non-transparent manner through financial institutions in the United States on behalf of persons subject to the WMDPSR and other U.S. sanctions programs. The bank processed such payments pursuant to instructions outlined in a guide that provided step-by-step instructions for handling transactions in an "OFAC neutral manner." UniCredit also processed USD payments under letters of credit that it issued for the delivery of oil from Central Asia in Kazakhstan but where UniCredit's customer subsequently shipped the oil to Iran. Information related to the onward shipment to Iran was available to UniCredit in the documents it examined prior to effecting the USD payments through the U.S. financial system.

How OFAC Determined the Penalty

OFAC determined that UniCredit Bank AG did not voluntarily self-disclose the Apparent Violations and that the Apparent Violations constitute an egregious case. The total base penalty amount for the Apparent Violations was $1,366,372,244.

The $553,380,759 settlement amount reflects OFAC's consideration of the facts and circumstances pursuant to the General Factors Affecting Administrative Action under OFAC's Economic Sanctions Enforcement Guidelines, 31 CFR Part 501, app. A. This settlement with OFAC is part of a global settlement among various UniCredit Group entities, OFAC, the U.S. Department of Justice, the New York County District Attorney's Office, the Federal Reserve Board of Governors, and the Department of Financial Services of the State of New York. UniCredit Bank AG's obligation to pay OFAC the settlement amount was deemed satisfied up to an equal amount by payments in satisfaction of penalties assessed by U.S. federal officials arising out of the same patterns of conduct during the same time periods.

Aggravating Factors

With regard to the IRISL-related conduct: (a) UniCredit Bank AG acted, at a minimum, with reckless disregard for U.S. sanctions requirements by failing to implement and successfully deploy appropriate controls to prevent the processing of transactions in which IRISL had an interest; (b) UniCredit Bank AG acted recklessly when it continued, after the designation of IRISL and a September 15, 2008 internal email policy directive not to process USD payments for IRISL-affiliated customers, to process payments on behalf of Ashtead entirely through the auto-transfer arrangement which did not allow U.S. intermediary parties to discern the IRISL interest in the payments; (c) UniCredit Bank AG acted recklessly when it removed Fairway from the bank's IRISL customer group (thus removing the internal prohibition on processing USD transactions on behalf of Fairway) approximately two weeks after OFAC designated IRISL without first adequately confirming that IRISL did not have an interest in the Fairway accounts; (d) UniCredit Bank AG acted recklessly when it processed USD transactions on behalf of Fairway and HTTS despite knowing of several warning signs regarding IRISL's interest in the companies' accounts; and (e) UniCredit Bank AG knew or should have known prior to OFAC's designation of IRISL that IRISL had an interest in the various IRISL-related accounts (including those belonging to Ashtead, Fairway, and HTTS)
With regard to the OFAC Neutral Process: (a) the bank appears to have acted with willful intent to circumvent U.S. economic sanctions law by processing transactions to or through the United States pursuant to policies and procedures, codified in a formal UniCredit Bank AG procedures document ("the Guide"), that instructed bank personnel to confirm that payment instructions were formatted in a manner that ensured U.S. intermediary parties could not detect the involvement of OFAC-sanctioned parties or countries, after the bank's legal department informed the bank's compliance department it was "pursuing a zero-tolerance policy" regarding "creative solutions" being employed with respect to payments; and (b) the bank continued processing these non-transparent, OFAC-prohibited transactions to or through the United States for an additional five years
With regard to the oil-related transactions, UniCredit Bank AG had at the very least reason to know that the transactions involved Iran because the invoices, bills of lading, and other shipping documentation in the trade files UniCredit Bank AG maintained and was required to review contained references to onward shipment to Iran
Further, the conduct described above resulted from a pattern or practice that spanned many years and multiple UniCredit Bank AG branches and product lines
UniCredit Bank AG's conduct conferred significant economic benefit to persons subject to U.S. sanctions and undermined the integrity and policy objectives of multiple U.S. sanctions programs. Over the span of almost four years, UniCredit Bank AG processed transactions worth over $500 million for persons and countries subject to OFAC sanctions, including IRISL, an entity designated by OFAC for its weapons of mass destruction proliferation activities. The processing of these transactions also benefited these sanctioned persons and countries by providing them access to the U.S. financial system
UniCredit Bank AG is a large and commercially sophisticated financial institution

Mitigating Factors

OFAC has not issued UniCredit Bank AG a penalty notice or Finding of Violation in the five years preceding the date of the earliest transaction giving rise to the Apparent Violations
UniCredit Bank AG cooperated with OFAC's investigation of the Apparent Violations by conducting an extensive internal investigation, identifying all of the subject transactions, and executing a statute of limitations tolling agreement with multiple extensions
UniCredit Bank AG took remedial action in response to the Apparent Violations described above
A small number of the Apparent Violations involving an interest of IRISL occurred shortly after OFAC's designation of IRISL on September 10, 2008

Official Source Documents

This page summarizes an OFAC enforcement case based on the document archived below. SanctionsLookup assumes no liability for errors, omissions, or inaccuracies in the original documents, this summary, or any changes made to the source documents at any time.

Provided for informational purposes only and does not constitute legal or compliance advice. Always consult the source document directly rather than relying on this summary.

View archived version View on ofac.treasury.gov

Archived on June 13, 2026

SHA-256: 7a5bf9bbff6846687f2e45e222b7058059c8b09a898bd98ee0d175d2b25318b3