INTERNATIONAL TRADE LAW
Sanctions Compliance in Mergers and Acquisitions
In an acquisition, you can inherit the target’s sanctions violations — so addressing sanctions compliance means doing real OFAC due diligence before closing and integrating the target into your compliance program immediately after. This is the doctrine of successor liability, and OFAC has applied it repeatedly: the buyer pays for conduct that happened on the seller’s watch. Contractual promises from the seller help, but they do not erase the risk.
Successor Liability Is the Core Problem
When you acquire a company, you generally acquire its liabilities — including unresolved OFAC violations. OFAC has stated and enforced this position, treating the acquirer as responsible for the target’s pre-closing sanctions conduct. The practical consequence: diligence that ignores sanctions is diligence that leaves a hole exactly where the penalties are largest.
The enforcement record makes the point concretely:
- Wells Fargo (2023) agreed to remit $30 million after acquiring a bank whose legacy software let a customer process trade-finance transactions tied to sanctioned persons and jurisdictions — exposure that traced back to the acquired institution.
- Kollmorgen and Keysight both faced penalties for sanctioned-party sales by acquired subsidiaries that continued — and were actively concealed — after the deal, even where the buyers had taken compliance steps.
The lesson from these cases is consistent: the acquirer is on the hook, and good-faith effort reduces but does not eliminate the exposure.
Before Closing: Sanctions Due Diligence
Sanctions diligence should run alongside the financial and legal review, not as an afterthought. The essentials:
| Diligence step | What you are looking for |
|---|---|
| Screen the target and its owners | SDN matches; ownership that triggers the 50 Percent Rule |
| Map customers, suppliers, and geographies | Exposure to sanctioned jurisdictions or parties |
| Review the target’s compliance program | Whether screening and controls actually exist and function |
| Examine transaction history | Past dealings that could be unresolved violations |
| Identify dual-use or controlled products | Export-control as well as sanctions exposure |
Under OFAC’s 50 Percent Rule, an entity owned 50% or more by blocked persons is itself blocked even if unlisted — so diligence has to look through the target’s ownership, not just screen its name.
In the Deal Documents: Allocate the Risk
Diligence findings flow into the contract. Representations and warranties about sanctions compliance, specific indemnities for pre-closing violations, and closing conditions tied to remediation all allocate risk between buyer and seller. These provisions matter — and OFAC has noted that contractual protections evidence the buyer’s good faith — but they do not transfer liability away from the acquirer in OFAC’s eyes. They are a backstop, not a substitute for diligence.
After Closing: Integrate Fast
The Kollmorgen and Keysight cases turned on conduct that continued after the deal. That is the avoidable failure. As soon as control passes, the acquired business must be brought under the buyer’s sanctions compliance program: extend screening to its counterparties, apply your internal controls and escalation procedures, retrain its staff, and audit for legacy exposure. OFAC’s expectation is explicit — newly acquired subsidiaries should adopt and maintain the controls needed to prevent violations, promptly.
If You Find a Problem
Diligence sometimes surfaces actual violations, pre- or post-closing. A qualifying voluntary self-disclosure to OFAC generally halves the base civil penalty in a non-egregious case — and given that the civil maximum is, as of 2026, the greater of roughly $377,700 or twice the transaction value per violation (adjusted annually for inflation), self-reporting a discovered problem is usually the right call. Build the disclosure decision into the integration plan.
Frequently Asked Questions
Can I inherit sanctions liability when I buy a company?
Yes. OFAC applies successor liability, so the acquirer can be held responsible for the target’s pre-closing sanctions violations. This is why sanctions-specific due diligence is essential before closing.
Do indemnities from the seller protect me?
Only partially. Representations, warranties, and indemnities allocate risk between the parties and evidence good faith, but they do not transfer OFAC liability away from the acquirer. Diligence and post-closing integration do the real protective work.
What’s the biggest avoidable mistake in M&A sanctions compliance?
Letting prohibited conduct continue after closing. In several OFAC cases, penalties followed sanctioned-party sales by an acquired subsidiary that persisted post-deal — exactly the gap that fast integration closes.
How soon should I integrate the target’s compliance program?
Immediately upon taking control. Extend your screening, internal controls, and training to the acquired business at once, and audit it for legacy exposure, because OFAC expects newly acquired subsidiaries to adopt effective controls promptly.
Sanctions exposure is one of the few diligence items where the penalty can dwarf the deal’s upside. Reidel Law Firm runs pre-closing sanctions diligence and post-closing integration reviews for a predictable flat fee: get a flat-fee compliance memo before you sign the LOI.
