Photo of Peter Flanagan

Peter Flanagan counsels clients on a broad range of compliance requirements affecting international trade and investment. These include most notably export controls, economic sanctions constraints, defense trade limitations, and the implications of related non-U.S. requirements. He also has experience in financial services regulation.

Mr. Flanagan has advised leading companies in the oil and gas sector, pharmaceutical and medical technology companies, defense contractors, manufacturing entities, financial institutions and private equity firms, software and high-technology concerns, and university-affiliated laboratories. Consistently ranked as a top-tier practitioner, Mr. Flanagan has deep experience in assisting multinational clients with complex compliance, enforcement, and licensing matters before the key U.S. trade controls agencies, including the U.S. Departments of Treasury, Commerce, and State.

On September 21, 2021, the U.S. Department of the Treasury’s Office of Foreign Assets Control (“OFAC”) issued an “Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments” (the “Updated Advisory”).  The Updated Advisory updates and supersedes an earlier OFAC Advisory released on October 1, 2020, and is directed toward not only organizations victimized by ransomware attacks, but also financial institutions, cyber insurance firms, and forensic and incident-response firms that assist organizations victimized by ransomware attacks.

The Updated Advisory is largely consistent with the previous version released in October 2020, restating the U.S. government’s opposition to ransomware victims making payments to cyber threat actors and making clear OFAC’s commitment to bringing enforcement actions in connection with such payments when they constitute U.S. sanctions violations.  However, the Updated Advisory adds important new guidance on “the proactive steps companies can take to mitigate [sanctions enforcement] risks,” including implementing strong cybersecurity practices before an attack; and promptly reporting a ransomware attack to, and engaging in timely and ongoing cooperation with, law enforcement or other relevant agencies.  Taking these steps would constitute “mitigating factors” in any OFAC enforcement action resulting from sanctions violations in connection with ransomware payments.

In conjunction with the new Advisory, OFAC for the first time designated for sanctions a Russian cryptocurrency exchange, SUEX OTC, that OFAC alleges has been involved in facilitating numerous ransomware payments for malicious cyber actors.  As a result of this designation, U.S. persons (that is, all individual U.S. citizens and permanent residents, U.S.-incorporated entities and their branch offices, and anyone physically within the United States) are now prohibited from engaging in or facilitating virtually all transactions with or involving SUEX OTC.


Continue Reading OFAC Issues Updated Guidance on Ransomware Payments