In an era of active U.S. sanctions policy, it is not uncommon to see the Office of Foreign Assets Control (“OFAC”) issue a notice changing U.S. sanctions – promulgating a new sanctions program or updating the designation of a bad actor on the List of Specially Designated Nationals.  But without much fanfare, OFAC recently published a notice in the Federal Register that will have a broad impact on every person whose business is subject to U.S. sanctions requirements. 

On September 13, 2024, OFAC issued an interim final rule to amend its Reporting, Procedures and Penalties Regulations (the ‘‘Regulations’’), extending recordkeeping requirements for certain transactions from five to 10 years, consistent with the statute of limitations for violations of sanctions administered by OFAC. This interim final rule will be effective on March 12, 2025 – 180 days after publication.  See, https://www.federalregister.gov/documents/2024/09/13/2024-20674/reporting-procedures-and-penalties

On April 24, 2024, the 21st Century Peace through Strength Act (the “Act”) was signed into law.  One of the effects of this new law was to extend from five years to 10 years the statute of limitations for civil and criminal violations of sanctions promulgated under the International Emergency Economic Powers Act (“IEEPA”), and the Trading with the Enemy Act (“TWEA”).  Prior to the Act coming into force, enforcement actions brought under IEEPA or TWEA were subject to a five-year statute of limitations. The new 10-year statute of limitations applies to any violation that was not time-barred at the time of the Act’s enactment, meaning any violation that occurred after April 24, 2019.  To account for this extended statute of limitations period, OFAC has published its interim final rule extending the recordkeeping requirements codified at 31 CFR 501.601 and 515.572 from five years to 10 years. 

Under the revised Regulations, every person that engages in any transaction that is subject to the OFAC sanctions will need to keep “a full and accurate record of each such transaction” for a period of 10 years after the date of the transaction.  This requirement will apply regardless of whether specific or general licenses were utilized for the transaction. 

This change in the recordkeeping time period means that businesses will need to update their U.S. sanctions compliance programs and work with their IT departments to ensure that the records of all transactions conducted pursuant to a sanctions authorization, which already should be maintained for five years, are maintained now for an additional five years in a manner that allows for OFAC examination.  This may require exceptions to a business’s standard records retention policy as most businesses have a records retention policy that is much shorter than 10 years.  Considerations will also need to be made as to the format and storage locations of these records.  

This new requirement will apply to any person engaging in transactions subject to U.S. sanctions. Not only will it apply to a U.S. company that sells products to a sanctioned country subject to a specific license from OFAC, but it will also apply to related service businesses, such as banks that provide financing for authorized sales, and lawyers who utilize a legal services general license to represent a sanctioned client.  Fortunately, businesses do have almost six months before the requirement will become effective.  But planning for this requirement should start now, 2025 will be on us before we know it, and OFAC will be expecting everyone’s recordkeeping policies will be in order by March 12, 2025.