WE’VE JUST BEEN FINED –WHAT DO WE DO NEXT? Organizing to Satisfy the Terms of a Settlement Agreement Scott Nance Compliance Consulting

Introduction Large sanctions cases are generally resolved by a settlement agreement The settlement agreement sets forth what the company must do to avoid further punishment Satisfying the terms of a settlement agreement requires extensive internal organization and planning

Overview: The Steps to Take Analyze the agreement and the results of internal investigations Form a team Identify the specific measures that need to be implemented Set a schedule

Step One: Analyze the Agreement The settlement agreement will specify what you must do to comply Compliance, Legal, and outside counsel should work together to analyze the agreement The analysis should include as well the results of any internal investigations Outcome: A list of specific things the company must do to satisfy the terms of the agreement Outcome: A list of specific things the company should do to respond to deficiencies identified in the Statement of Facts and by internal investigations

The ING Settlement Agreement The settlement agreement between the U.S. federal government, the State of New York, and ING is a good example of a deferred prosecution agreement Fine of $619 million Internal review of sanctions compliance policies and procedures and their implementation Performed by internal audit Submitted one year after conclusion of agreement Application of OFAC sanctions to the same extent as EU and other sanctions Training for personnel involved in USD transactions Transactions involving countries subject to U.S. sanctions Required use of MT202 COV message form for bank-to- bank payments

The Settlement Agreement: ING Procedures to identify and report attempts to circumvent sanctions screening Maintain an electronic database of USD funds transfers for a specified period for two years Not knowingly process USD-denominated cross-border transfers involving Cuba, Burma, Iran, North Korea, Sudan, or Syria unless permitted by US law Officials will not make any public statements justifying ING’s conduct or downplaying the significance of ING’s behavior

Step Two: Form a Team Create a team to oversee compliance Legal The business Depending on the terms of the agreement and internal needs, the team may also include Outside counsel Audit Outside consultants Other functions, such as Payments and Customer Services, may also need to be involved Reporting to regulators

Organizing the Team Appoint at least two coordinators One will typically be from Legal and one from Compliance Establish governance procedures for the team How decisions are made How conflicts are resolved Reporting to upper management

Step 3: Identify Specific Actions Identify what specific actions the settlement agreement requires Map out what other steps the organization needs to take to build a robust compliance function The Statement of Facts Internal investigations Internal review Specify who must be involved to satisfy each requirement, and who is responsible Determine what resources are required to accomplish this

Examples of Specific Actions Report on assessment to regulators Specific internal actions required by the agreement Use of MT202 COV messages for inter-bank transactions Maintenance of a database of US dollar transactions Organizational changes Creation of a central sanctions team New policies and procedures General sanctions policies regarding business with sanctioned countries Procedures for reviewing and approving transactions Training

Internal Audit The settlement agreement may specify that Internal Audit perform an assessment and prepare a report Establish the Terms of Reference for Internal Audit’s assessment What functions/geographic offices will be reviewed What the review will cover Provide sanctions training to Internal Audit Internal Audit seldom has the necessary level of sanctions expertise Establish governance There will always be disagreements, so it is essential to decide in advance who can resolve them

Step 4: Set a Schedule Establish a plan, with a timetable, for addressing each item Identify who is responsible Set a specific date for performance Build in lead time If the settlement agreement requires a report to regulators, schedule periodic drafts to be circulated well in advance Conduct periodic reviews to confirm progress and identify future action items

Final Thoughts A sanctions violation offers an opportunity to put your organization on a solid compliance footing Satisfying the terms of the agreement requires organization, cooperation, and planning There will be disagreements, and tempers will fray But someday soon this will all be over