Key Holding Pays the Price After Overlooking Cuba Sanctions

Key Takeaways

• OFAC Settlement: Key Holding, LLC agreed to pay $608,825 to settle potential civil liability for 36 apparent violations of U.S. sanctions on Cuba by its Colombian subsidiary.
• Unlicensed Cuba Shipments: Between January 2022 and July 2023, the subsidiary managed over $3 million in shipments to Cuba without proper licensing, triggering OFAC scrutiny.
• Lack of Compliance Controls: At the time of the violations, neither Key Holding nor its subsidiary had sanctions compliance programs in place, despite the acquisition making the subsidiary subject to U.S. jurisdiction.
• Mitigation and Cooperation: OFAC credited the company’s voluntary self-disclosure, quick remediation steps, and full cooperation, reducing the penalty from a possible $4 million.
• Compliance Warning for Multinationals: The case underscores the importance of integrating sanctions compliance into M&A due diligence and implementing controls across all subsidiaries, especially in high-risk jurisdictions.

Deep Dive

Key Holding, a Delaware-based logistics firm with global operations, just learned the hard way that in the world of sanctions, ignorance isn’t bliss, it’s rather expensive. After acquiring a Colombian freight subsidiary in late 2021, the company failed to realize that the acquisition brought new obligations under U.S. sanctions laws. That oversight ultimately led to 36 unauthorized shipments to Cuba, triggering a $608,825 settlement with the U.S. Treasury Department’s Office of Foreign Assets Control (OFAC).

The violations weren’t a case of rogue actors or bad intent, but they weren’t a fluke either. From January 2022 to July 2023, Key Logistics Colombia S.A.S., the newly acquired subsidiary, arranged shipments from Colombia, Spain, China, and Panama to consignees in Cuba. Most were relatively benign but a few involved industrial equipment like oil well components and electric forage choppers. All were subject to OFAC’s Cuban Assets Control Regulations (CACR), which prohibit U.S. persons and their foreign subsidiaries from engaging in unlicensed transactions with Cuba.

At the time, neither Key Holding nor its Colombian arm had a sanctions compliance program in place. In fact, the U.S. parent company didn’t even realize its new subsidiary’s Cuba business existed, until January 2024, when it surfaced during due diligence for a pending sale.

Once the issue was spotted, Key Holding moved fast. The company stopped accepting Cuba-related orders and quickly began rolling out compliance reforms. By April 2024, it had implemented its first-ever sanctions and export control policy across its subsidiaries, followed shortly by mandatory training. A month later, it adopted an automated screening platform to flag problematic shipments in real time.

Still, the damage was done. As OFAC sees it, the firm should have known better.

Under U.S. sanctions law, the moment Key Holding acquired its Colombian subsidiary, that entity became subject to U.S. jurisdiction. That means Key Colombia’s transactions with Cuba (whether intentional or not) counted as violations.

OFAC didn’t view the case as egregious, and it credited the company’s self-disclosure and remedial steps. But the regulator still flagged several red flags:

• Lack of due diligence: No one hit pause to assess the sanctions implications of the acquisition.
• Failure to screen shipments: There was no process to vet what was being sent or where it was going.
• Compliance blind spots: Employees at Key Colombia were aware of the shipments, even if U.S. leadership wasn’t.

While the base penalty could have run to $1.2 million, and the maximum over $4 million, OFAC settled on just over half the base amount, citing the company’s clean record and quick course correction.

This case offers a textbook lesson for multinationals, especially those expanding through M&A, that when you buy a company, you buy its compliance risk too.

Whether it’s Cuba, Iran, North Korea, or Russia-related sanctions, foreign subsidiaries of U.S. companies are not exempt. And even seemingly harmless transactions can trigger costly investigations if the paperwork doesn’t line up with U.S. law.

OFAC recommends that companies:

• Immediately evaluate the sanctions implications of new acquisitions
• Implement training and screening systems across all entities, foreign and domestic
• Review shipping documents like air waybills and certificates of origin with care
• Establish escalation protocols when something seems off

Alongside the settlement, OFAC and FinCEN reiterated that individuals, anywhere in the world, can report potential sanctions violations through the U.S. whistleblower program. Tips that lead to enforcement actions involving over $1 million in penalties could qualify for awards. It’s one more reason for companies to get their compliance houses in order before someone else does it for them.

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey.