| Office of Foreign Assets Control

Compliance for Internet, Web Based Activities, and Personal Communications

72. Can I send money to a sanctioned country using a third-country company’s website? Can I buy gifts for someone in a sanctioned country over the internet? The websites tell me that it’s ok because they themselves are not sanctioned parties.

You cannot do something indirectly that you would not be able to do directly. Therefore, these sites can be used to facilitate authorized transactions, but you cannot use them to perform a transaction which would be in violation of U.S. law. For example, the Cuban Assets Control Regulations (CACR) authorize any U.S. person to send $1,000 per quarter to close relatives in Cuba, provided that the recipient is not a prohibited official of the Government of Cuba, as defined in § 515.337 or a prohibited member of the Cuban Communist Party, as defined in § 515.338, or a close relative of such persons, as defined in § 515.339. See 31 CFR § 515.570(a) and (j) for additional applicable conditions. Subject to those conditions, the U.S. remitter can use a third-country provider to send these funds to Cuba. If the person attempts to send more than $1000 per quarter to any one individual, however, he or she may be in violation of U.S. law and subject to penalties. Another example is booking unauthorized travel to Cuba using an internet travel service provider in a third country. Spending money on unauthorized travel-related transactions involving Cuba is prohibited by the CACR, regardless of how the travel is booked or how it is paid for. The fact that the trip was booked through a third-country company, either in person or over the internet, is irrelevant.

Mon, 10/26/2020 - 12:00

73. My company provides money remittance and account services via the Internet. Does OFAC have any compliance guidance for this type of business?

Complying with United States sanctions policy presents unique challenges to institutions that operate exclusively on the Internet. The Internet has often been thought of as an "anonymous venue" in that e-commerce transactions can be conducted in relative privacy with little or no face-to-face contact among the parties in a transaction. This anonymity creates a significant challenge for Internet businesses that wish to satisfy their due diligence requirements.

In order to be compliant with OFAC-governed sanctions regulations, US jurisdiction entities must ensure that they are not:

A. Engaging in trade or transaction activities that violate the regulations behind OFAC’s country-based sanctions programs, and;

B. Engaging in trade or transaction activities with sanctions targets named on OFAC's list of Specially Designated Nationals and Blocked Persons (SDN's).

A number of Internet-based financial service companies already developed Internet Protocol (IP) address blocking procedures. These companies use publicly available data to maintain tables of IP addresses based on geographic region. Users attempting to initiate an online transaction or access an account from a sanctioned country are blocked based on their IP address. While this approach is effective, it does not fully address an Internet firm’s compliance risks. The fact that international distribution authorities can reassign IP blocks makes the geographic location of an IP potentially dynamic.

The anonymous character of Internet-based transactions often places obstacles in the path of rigorous compliance practices. Firms that facilitate or engage in e-commerce should do their best to know their customers directly. In order to minimize their liabilities, Internet remittance and account service firms should attempt to gather authentic identification information on their customers before a new account is opened or new transaction is initiated. This information will help confirm the customer’s identity and help the e-commerce firm ensure it is not conducting business with a sanctions target. Currently many Internet remittance companies use credit card authentication as the primary method of confirming a customer's identity. While this method is technologically expedient, it does not meet the standards of due diligence normally found in the non-Internet-based financial community. A company cannot rely on another firm’s compliance program in order to mitigate risk.

It is recommended that e-commerce firms gather and record "purpose of payment" information on each transaction they process. In the non-Internet sector, financial institutions are able to stop in-process transactions and gather more information on them. Due to the level of automation found within the Internet financial sector, this type of in-process information gathering is not always possible. Collecting information on the purpose of payments up front will allow Internet firms to better screen outgoing and incoming transactions for potential violations.

Tue, 04/13/2004 - 12:00

434. Are all applications designed to run on mobile operating systems (“apps”) covered by General License (GL) D-2?

The exportation to Iran of apps that are designated EAR99 or classified under export control classification number (ECCN) 5D992.c, as specified in category (8) of the Annex to GL D-2, is authorized under the GL D-2, including apps downloaded via online app stores.