Washington, D.C. (May 29, 2024) - On April 24, 2024, President Biden signed into law the 21st Century Peace Through Strength Act, Pub. L. 118–50 (H.R.815) (“the Act”), a multifaceted law that is mostly known for providing aid to Ukraine and other U.S. allies and for mandating that TikTok divest its Chinese ownership or be banned in the United States. A less noticed section of the Act will have a great practical impact on countless American businesses that operate internationally by doubling the statute of limitations period for sanctions violations from 5 to 10 years.
Most U.S. sanctions programs are based on the International Emergency Economic Powers Act (the “IEEPA”) and/or the Trading With the Enemy Act (the “TWEA”). Prior to the enactment of the Act, neither statute had an express limitations period. Therefore, the default five year statute of limitations periods under federal law applied. See 18 U.S.C. § 3282(a) (default five year period for criminal offenses); 28 U.S.C. § 2462 (default five year period to bring a civil enforcement proceeding).
Section 3111 of the Act changed the legal landscape. It added new sections to both the IEEPA and the TWEA. Those new sections provide in almost identical language that both criminal prosecutions and civil enforcement proceedings can be brought within 10 years after the latest date of the violation. The Act does not expressly address the question of retroactivity. Under long settled rules of statutory construction, however, it is likely that the Act will not revive possible criminal and civil violations for which the former five-year period has already expired. However, if the five-year period has not yet lapsed on the date the Act became law, the new 10-year limitation period will likely govern, for both civil and criminal violations. In concrete terms, enforcement actions over possible violations of the IEEPA or the TWEA that occurred before April 24, 2019 are most likely still time-barred notwithstanding the enactment of the Act. On the other hand, the U.S. government probably has under the Act 10 years to pursue violations that occurred between April 24, 2019 and April 24, 2024.
As a result of these statutory amendments, businesses should immediately adjust their practices and procedures, including the recordkeeping requirements for internal sanctions compliance programs, which usually had been fixed at five years. This period conforms to U.S. Department of Treasury's Office of Foreign Assets Control (“OFAC”) regulation requiring records be maintained for five years. See 31 CFR §501.601. OFAC will likely amend this regulation in due course, but businesses should presume that the new 10-year statutory periods trump this regulatory period, effective immediately. Likewise, in corporate transactions, acquirers have usually requested sanctions compliance documents and crafted related contractual representations and warranties provisions based on the five-year period. This standard look-back window should be changed to 10 years going forward.
OFAC issued in May 2019 a Framework for OFAC Compliance Commitments. This framework provides general guidelines on how to employ a risk-based approach to sanctions compliance. The framework sets out five essential components of compliance: (1) management commitment; (2) risk assessment; (3) internal controls; (4) testing and auditing; and (5) training. The expansion of the statute of limitations will likely affect many of these components.
Criminal and civil enforcement of sanctions violations has been a top priority for the United States government in recent years. This trend is likely to continue, with geopolitical tensions increasing in multiple parts of the globe. The Act will give American authorities additional ammunition on the enforcement front.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.