Addressing Sanctions Compliance Challenges in the Insurance Industry

By Jaclyn Jaeger

The ever-evolving global sanctions landscape continues to impose new restrictions on companies across many industries, but the insurance industry must navigate and overcome some especially unique sanctions compliance challenges.

This article highlights some of the insurance industry’s toughest challenges, explores recent amendments to the Office of Foreign Asset Control’s (OFAC) Frequently Asked Questions (FAQs) for the insurance industry, and discusses risk management and due diligence best practices.

Insurance industry challenges

What makes sanctions compliance uniquely challenging for insurance industry participants, including insurers, reinsurers, underwriters, brokers, and agents, is that they are vulnerable to sanctions risks that apply not only to their own operations, but also those of their insured clients.

If a policyholder engages with a sanctioned person on OFAC’s Specially Designated Nationals and Blocked Persons List (SDN List), or within a jurisdiction subject to OFAC sanctions, that can indirectly expose the insurer or reinsurer to sanctions violations.

“Insurers have to manage the indirect exposure often with less information than their insureds have,” Crowell & Moring partner David Wolff told ACI Insights. Establishing a robust sanctions compliance program and monitoring for sanctions risk in the insurance industry requires understanding the insured’s sanctions risk exposure and internal controls.

A second key challenge is conflicts in global sanctions regulations. U.S. insurance companies have clients across multiple industries, and oftentimes these companies operate internationally in jurisdictions that don’t have the same sanctions restrictions as the United States.

One example is OFAC’s sanctions targeting Cuba. The European Union, for example, does not impose economic sanctions on Cuba. Practically speaking, it becomes a challenge for U.S. insurers or reinsurers to mitigate sanctions risks when their insureds aren’t subject to the same sanctions requirements.

Another example is when the United States withdrew from the Iran Nuclear Deal, and Europe did not. “There is anxiety around whether or not that will become true again with Russia,” Wolff said.

For legal and compliance professionals in the insurance industry, key questions to consider may include: In what jurisdictions of insured policyholders do sanctions conflicts exist? How does the business monitor for sanctions risk? Do risk management measures need to be reviewed, and enhanced?

Newly amended OFAC FAQs

To assist insurance industry participants in addressing common sanctions compliance challenges, OFAC on Nov. 13, 2024, amended 10 insurance-related FAQs and published two new ones (FAQs 1199 and 1200).

For those who have been practicing in the industry for quite some time, the amended FAQs are “welcome guidance,” Wolff said. They also reflect that sanctions expectations and compliance have evolved over the last two decades when many of these FAQs were last amended.

The most substantive changes are summarized below:

Ongoing sanctions screening: Another sanctions compliance best practice OFAC highlighted in the amended FAQs is the importance of sanctions screening. “While OFAC does not technically require parties to screen against sanctions lists, the only practical way to ensure you do not transact with a sanctioned party is to conduct screening,” Wolff said.

In FAQ 65, in addressing how frequently to screen databases, OFAC recommended insurers use a risk-based approach to sanctions compliance in line with OFAC’s “Framework for Compliance Commitments.” In that framework, OFAC stressed that a central tenant of a risk-based approach is a risk assessment because it’s “integral” in informing the sanctions compliance program’s policies, procedures, internal controls, and training.

A risk assessment should review all of an insurer’s touchpoints, including its customer base; products and services; its geographic location, as well as those of its customers. Screening frequency will vary “depending on the size and nature of an insurer’s business, including the particular risk factors of its products and customer base, and its relevant regulator,” OFAC stated in the FAQs.

OFAC additionally stressed in FAQ 65 the importance of screening throughout the lifecycle of the insurance policy, “at policy renewal, policy amendment (including, but not limited to, the addition of insured parties or beneficiaries to the policy), claim submission, claim payment, updates by OFAC to its sanctions or sanctions lists, and at any other time when an insurer may be exposed to sanctions risk.”

Exclusionary clauses: In amended FAQ 102, OFAC reinforced the importance of utilizing an exclusionary clause as “the best and most reliable approach for issuing policies with global risk coverage without violating U.S. sanctions law.”

An exclusionary clause, also called a sanctions clause, “prevents the extension of a prohibited service, such as insurance coverage or indemnification, to sanctioned persons or jurisdictions, or for prohibited activities,” stated OFAC, clarifying that the “wording of such clauses may vary depending on the type of policy.”

Many insurers or reinsurers will include a clause in their policy that states, “‘This policy is either suspended or excluded concerning any risks that expose the insurer or reinsurer or broker to sanctions risk,’” Wolff noted.

Exclusionary clause exception: In some international markets, non-U.S. insurers will issue global insurance policies without an exclusion that applies to U.S. sanctions. In FAQ 103, OFAC advises, “In cases where an exclusionary clause is not commercially feasible, but the policy would involve the provision of coverage to a sanctioned person or jurisdiction, or prohibited activity, the insurer should apply to OFAC for a specific license prior to issuing the global insurance policy.”

& SANCTIONS COMPLIANCE for

Additional FAQs

Some of the amended FAQs address questions regarding blocked portions of a group policy. in FAQ 63, OFAC advised that, where a policyholder or a named beneficiary of a group health plan, for example, is added to OFAC’s SDN List or located in a sanctioned jurisdiction, “in most cases, insurers should cease providing coverage to the relevant policyholder or named beneficiary … unless authorized by OFAC or otherwise exempt.”

15th Annual Forum on AML

Furthermore, in FAQ 64, OFAC clarified that a claim made under the blocked portion of a group policy, such as a worker’s compensation policy, cannot be paid without OFAC authorization. FAQ 64 further advises that any premium payments made by or on behalf of the blocked person “should be blocked and placed in a blocked interest-bearing account at a U.S. financial institution.”

Newly added FAQ 1199 addresses the question as to whether a claim can be paid under a blocked policy if the payment is for an innocent third party, such as in the event of an accident. In these circumstances, the insurance company should contact OFAC to discuss the specific circumstances.

Newly added FAQ 1200 addresses the question of whether an insurance company may pay a claim from a nonsanctioned person for a loss caused by a blocked person, such as a specially designated terrorist organization. OFAC confirmed, under such scenarios, that “the mere fact that a blocked person has caused the loss does not in and of itself create a blocked interest in the policy or any claim or payment under the policy.” A U.S. insurer or reinsurer may pay such claims to non-sanctioned persons.

OFAC further encouraged insurers who receive such claims “to conduct necessary due diligence to ensure there are no other potential sanctions risks associated with making or facilitating related claim payments,” such as the involvement of a blocked financial institution.

Unanswered questions

Ryan Fayhee, a partner at law firm Akin, told ACI Insights that while OFAC’s amended FAQs are “helpful,” they aren’t as helpful as direct engagement with the private sector, which he commented OFAC has been resistant to historically, as compared to agencies like the U.S. Department of Commerce’s Bureau of Industry and Security (BIS).

Importantly, the insurance-related FAQs don’t address every issue. For example, one question that has been a topic of much debate is whether a Director & Officer (D&O) insurance policy can cover a director or an executive in the United States alleged to have directed or facilitated sanctions violations with a sanctioned party.

If the insured is not a sanctioned entity, and the director or executive is not a sanctioned person, can that individual still be covered by the D&O policy? “There just isn’t enough consistency around the answer to that question,” Fayhee said.

For questions that the insurance-related FAQs do not address, legal and compliance professionals in the insurance industry should refer to current OFAC resources, such as its “Framework for Compliance Commitments,” implementing regulations, and the Sanctions Programs and Country Information. Participating in industry networking events is also advised to stay on top of the latest sanctions compliance best practices.

ACI will be holding its “AML & Sanctions Compliance for the Insurance Industry” event on Jan. 22-23, 2025, in New York. For more information, and to register, please visit: https://www.americanconference.com/aml-ofac-insurance/