Quis Custodiet IPSA? Due Diligence Firm Settles Iran Sanctions Violation Case

IPSA, a world-leading due diligence and risk mitigation firm, has agreed to pay US$ 259,200 to settle what the Office of Foreign Assets Control (OFAC) identifies as violations of American sanctions regulations on trade with Iran, in connection with due diligence work it performed on behalf of a Caribbean CIU.

“IPSA International Services, Inc. (IPSA), Phoenix, Arizona, has agreed to pay $259,200 to settle its potential civil liability for 72 apparent violations of the Iranian Transactions and Sanctions Regulations, 31 C.F.R. part 560 (ITSR). The apparent violations involve, on 44 separate occasions, IPSA’s importation of Iranian-origin services into the United States in apparent violation of § 560.201 of the ITSR,” writes OFAC.

IPSA, it appears, was conducting background verification on Iranian nationals applying to a citizenship by investment program, at the behest of a Caribbean government. Based in the United States, IPSA could not itself legally conduct due diligence in Iran, and as such engaged its Dubai subsidiary to perform the requisite legwork.

This subsidiary, in turn, passed the task along to a subcontractor inside Iran, which carried out the background check and ultimately forwarded a report on its findings to the US-based parent company. This, OFAC concluded, constitutes a “non-egregious” infraction of the US-Iran sanctions regulations.

While OFAC’s report makes no mention of which country’s CIP the case relates to, the transactions in question stem from October 2012, at which time only Dominica and Saint Kitts & Nevis had formal CIPs.

“The total transaction value of the apparent violations was $290,784. The statutory maximum civil penalty amount in this case was $18,000,000, and the base civil penalty amount was $720,000,” OFAC stated.

When OFAC gives you a chance to settle for a third of the base penalty amount – unless you’re 110% certain you’re innocent – copping a plea is probably a wise course of action.

The case sets an intriguing precedent. How can any US-based due diligence company double-check information about Iranians without violating sanctions regulations? If a DD firm needs to verify, for example, that a client whose stated source of funds is an apartment building in Tehran that he inherited from his parents, they would inevitably need boots on the ground to visit land registry and tax records offices and so on. 

To do that, they’d need to either enlist the services of an Iranian firm, or have a subsidiary of their own performing the investigation, either of which would need to get paid somehow by the parent company, either directly or through a subsidiary. The definition of “trading” with Iran has been applied very broadly in this instance.

The irony of a company that specializes in preventing law-breaking individuals and firms from slipping through the cracks itself caught breaking the law is surely not lost on observers in the CBI-industry. IPSA is supposed to prevent sanctions-violators from obtaining citizenships by investment, and as such ensure the continued integrity of CBI programs. But when IPSA itself commits the very transgressions it is supposed to uncover in others, they jeopardize the reputation of the whole CBI-industry.

Who will guard the guards? Who will do due diligence on due diligence firms? Talk about a rabbit hole of infinite regression!