On April 24, 2024, President Joe Biden signed into law HR 815, a wide-ranging foreign aid and national security bill that includes, among many other programs, $60 billion in aid for Ukraine. Tucked into a section of the bill targeting international fentanyl traffickers was a provision that doubles the statute of limitations from five to 10 years for almost all sanctions violations as well as certain export control violations, including those related to missile or chemical and biological weapon proliferation.
For any company with exposure to these legal regimes, this change will have implications in a variety of contexts, including due diligence in M&A and private equity transactions, internal recordkeeping requirements, and the design of corporate compliance programs. Perhaps most important, regulators and prosecutors will now have twice as much time to investigate related civil or criminal violations.
The new statute of limitations applies to the International Emergency Economic Powers Act (IEEPA) and the Trading With the Enemy Act (TWEA). IEEPA is the foundational law for nearly all U.S. sanctions regimes implemented by the Treasury Department and certain export control programs enforced by the Commerce Department. TWEA is the foundational law for the Cuba sanctions program overseen by Treasury. The key enforcement agencies that will benefit from this expansion of authority are Treasury’s Office of Foreign Assets Control (OFAC) and the Department of Justice, which has authority for all criminal enforcement of federal laws, including sanctions and export control laws.
One area that will see a direct impact is transactional due diligence. Companies attempting to acquire, invest in, or lend funds to a target with exposure to U.S. sanctions and export control laws may want to request documentation that extends through the entire 10-year lookback period. Representations and warranties in the related agreements should also take into account this longer period of potential liability. The doubled timeframe is likely to increase costs and logistical burdens for both parties.
For covered entities, there is also the issue of recordkeeping. OFAC currently requires everyone engaging in transactions “subject to” its regulations to maintain “a full and accurate record of each such transaction” for at least five years. It is likely that this regulation (31 CFR §501.601) will soon be amended to require the retention of records for at least 10 years. In the meantime, the new statute of limitations may prompt OFAC to issue administrative subpoenas seeking records going back 10 years, notwithstanding the absence of any current requirement to retain records that long. Businesses that operate in this area should be on notice and will need to reevaluate their record management protocols to ensure that the appropriate documents are preserved.
The new statute of limitations is not retroactive. If the five-year period has already lapsed on a potential criminal charge, this new law will not resurrect it. That is likely to be the case for an already expired civil claim as well. However, if the five-year period has not yet run, the new 10-year term should apply in both the civil and criminal contexts.
Most federal crimes have a five-year statute of limitations. By increasing this limitations period to 10 years, Congress has placed these sanctions and export-control violations in a smaller category of more serious federal crimes, including arson and embezzling from a federal financial institution.
This change is just the latest development in the DOJ’s expansion of its enforcement agenda for sanctions evasion, export control violations, and similar economic crimes. Last year, Deputy Attorney General Lisa Monaco described sanctions as “the new FCPA” in terms of DOJ priorities and announced she would hire at least 25 new prosecutors to join the National Security Division to work on these issues. This new law significantly expands the pool of potential violations for those new prosecutors to investigate.