Wells Fargo Bank, N.A. OFAC Settlement: $30M (2023)

Wachovia's trade insourcing platform, Eximbills, operated in two versions: a "Comprehensive" version where Wachovia processed trade transactions on behalf of the customer, and a "Hosted" version where the software was provided to the customer to manage its own transactions. In May 2006, Wachovia and Bank A agreed in writing that Bank A bore primary responsibility to screen for OFAC issues on the Hosted version and would refrain from using it for transactions with sanctioned jurisdictions or entities.

Around May 2007, Bank A sought a single platform for all of its trade finance services, including those involving sanctioned jurisdictions and persons. A mid-level manager within Wachovia's legacy Global Trade Services unit directed Wachovia to specially design a customized Hosted version of Eximbills so that Bank A could use it to handle trade finance instruments involving OFAC-sanctioned jurisdictions and persons. Around July 2008, Wachovia and Bank A modified their agreements accordingly, and Bank A began using this platform for such transactions. Bank A's use of the Hosted Eximbills platform relied on Wachovia's (and later Wells Fargo's) technology infrastructure at the bank's branch in Hong Kong and data facility in North Carolina. Wachovia also built a redirect mechanism into the software: if Bank A inadvertently sent a transaction involving a sanctioned jurisdiction or person to the Comprehensive version, the program would route it to Bank A for processing through the Hosted version. Seven of the 124 apparent violations arose through this mechanism.

After Wells Fargo acquired Wachovia in 2008, Wells Fargo personnel raised potential sanctions concerns from the inherited trade insourcing relationships on multiple occasions, including to senior management. No regular or systematic process was established to review Bank A's use of Eximbills for OFAC compliance. An internal working group formed around 2013 recognized potential facilitation risks under OFAC regulations but its proposed three-point remediation plan was absorbed into a broader holistic review of the trade finance technology business and never implemented. A 2014 internal audit relied on the business line's self-assessment that the platform was not high risk and did not specifically review the Hosted Eximbills business. It was not until late 2015, nearly seven years after Bank A began using the customized platform, that a business review discovered that Bank A had been processing non-compliant trade instruments since 2008.

Between approximately December 27, 2010 and December 7, 2015, Wells Fargo facilitated 124 transactions processed by Bank A involving sanctioned parties or jurisdictions, totaling approximately $532,068,794, that would have been prohibited if performed by Wells Fargo or another U.S. person or within the United States. These constituted apparent violations of the Iranian Transactions and Sanctions Regulations, 31 C.F.R. § 560.208, the now-repealed Sudanese Sanctions Regulations, 31 C.F.R. § 538.206, and the Syrian Sanctions Regulations, 31 C.F.R. § 542.210.

The statutory maximum civil monetary penalty applicable in this matter is $1,066,738,422.22. OFAC determined that the apparent violations were voluntarily self-disclosed and egregious. Accordingly, under OFAC's Economic Sanctions Enforcement Guidelines, 31 C.F.R. part 501, app. A, the base civil monetary penalty applicable in this matter is one-half of the statutory maximum, which is $533,369,211. The settlement amount of $30,000,000 reflects OFAC's consideration of the General Factors under the Enforcement Guidelines.

This action highlights the risks that companies may face when employees pursue new business opportunities or the preservation of existing business relationships without proper oversight. Such oversight is important across all business units within an organization, including lines of business that may be small relative to the larger organization or that involve products or services falling outside the larger organization's core business. Moreover, when sanctions compliance risks are raised internally — including concerns arising from smaller, non-core business lines — companies should promptly seek to thoroughly investigate and address those risks. Finally, this action emphasizes the necessity for comprehensive due diligence regarding potential sanctions risk when one entity acquires another through merger or acquisition.

This page summarizes an OFAC enforcement case based on the document archived below. SanctionsLookup assumes no liability for errors, omissions, or inaccuracies in the original documents, this summary, or any changes made to the source documents at any time.

Provided for informational purposes only and does not constitute legal or compliance advice. Always consult the source document directly rather than relying on this summary.