Stock Groups

With Russian sanctions, small companies may be in for a big surprise


The U.S. president Joe Biden addresses developments in Ukraine and Russia from the East Room in the White House on February 22, 2022.

Drew Angerer | Getty Images

Due to Russia’s invasion of Ukraine, over 400 multinational corporations have left Russia. It’s not only reputational risk at stake, but a complex web of sanctions imposed by the U.S. government as well as a global financial systems blockade that makes operating in Russia difficult, if not impossible — and the list of sanctioned entities and individuals keeps getting longer.

Main Street might feel a relief as the largest businesses in the economy protect their brand and operate. This would be an error. This risk could be an exception for Main Street businesses, however experts warn that small businesses should take simple steps to verify their links with sanctioned Russian individuals and businesses. Otherwise, they may face a worst-case scenario.

As an example, take cybersecurity training provider INE. This is a small business, so it didn’t expect to be in trouble with the sanctions. However, it took a few precautions after sanctions began to hit and was able to identify potential violations that it may have missed. Its path to identifying the problems was not a smooth one. Its founder is married to an ex-government official, Citigroup compliance executive. She mentioned that it was difficult for Wall Street banks and other companies to keep up with all the sanctions and the support of the Treasury Department won’t filter through to the rest of the economy. This insight led INE and Citigroup to compile a client list that was compared to the U.S. Treasury Sanctions Database. INE found it did business with sanctioned banks.

Scott Cederbaum (INE’s chief market officer), said that he found two Russian companies sanctioned at high levels. His wife is a Citi executive. He said, “We were stunned when we discovered it.” It would never have occurred to us to sell to Russian clients.

Treasury Office of Foreign Assets Control websiteThis was the beginning point of the discovery. However, the results led the company to ask questions about the government that they couldn’t provide sufficient answers.

INE was forced to cut all ties immediately with two of its clients who had received IT training services.

Small business owners don’t see the value in visibility and no one is talking about it. Cederbaum explained that she has talked with many people, and they all agree it is not being thought about.

Although Wall Street banks and legal firms work closely with top-tier clients of the bank, smaller businesses may not be able to get as much assistance even though they do have relationships with them. CNBC reached PNC and JP Morgan as well as Wells Fargo, Bank of America, Bank of America (and Goldman Sachs), but they all refused to respond or did not return phone calls.

Silicon Valley Bank is a bank that INE collaborates with. Cederbaum stated that the Bank has been very helpful. A spokeswoman for the Bank said it was advising its clients to get in touch with their legal firms.

Although the likelihood of small businesses having connections to Russian entities that are on sanction lists is low, it is possible for them to be connected in an international digital economy, where they can offer services instantly through the internet.

Although Main Street shouldn’t be afraid, it is not the ultimate goal. The risk of violating sanctions is small but it is better to look into the matter than assume that the company is in good standing. Cederbaum explained that the “specter” exists. Cederbaum stated, “If there is a risk to your business you need to be aware of it.” He advised that any small business dealings with Russia should be done properly. 

Small business owners are protected from sanctions

Doreen Edelman, partner and chair of Lowenstein Sandler’s global trade and national security practice, said there is a big gap between start-ups in technology and smaller companies in general when it comes to compliance. Edelman explained that “it isn’t on their top 10” list. Everybody has a problem now.

There are potential problems beyond OFAC sanctions. Commerce Department export controls, which prohibit export and transfer of goods to Russian entities that appear on the Export Lists, can also cause issues. They may be applied to research or institutions as well. And it doesn’t need to be a physical product — putting data on the web or in the cloud could be a violation based on who can access it. Edelman stated that this is only for general products.

Edelman stated that all items must have an export number. For example, a scientific measuring device. Edelman also said that there is a possibility of the government denying licenses. This includes Russians who work for American companies, such as a machine or software development company. In this case, sharing technology can be considered the same thing as exporting it from the U.S. Edelman stated that a Russian living and working in America is an export to Russia.

Most small businesses will believe that they don’t send anything to the U.S., so sanctions won’t be applied. Companies need to ensure that they screen all relationships, as even U.S.-based companies could have Russian connections. “You are supposed to be screening absolutely everyone you do business with — suppliers, customers and partners. Edelman stated that this is a very strict responsibility and doesn’t really matter if it’s not known. 

Technology industry risks

Although physical product chains can be more difficult to track, software companies should screen for restricted users to verify that their site is accessible. Russia is home to thousands of tech professionals, with many based in Moscow and St. Petersburg. Russia has everything you need to market your business, from graphic design to marketing and web development.

Cederbaum stated that Russian companies aren’t even considering selling their goods or services to Russia. He said that there are many companies in Russia with two to three clients.

Russia’s largest banks have numerous subsidiaries that operate across business types. These include web development and cyber products. According to INE, having an associated entity for a client is a breach of sections in the Treasury Department.

Cederbaum stated that this was uncharted territory for having OFAC sections in a time when there are digital connections to other countries and the level of interconnectivity between Russia and those countries.

Edelman stated that geolocation blocking web platforms can be a smart move to prevent restricted people from accessing online services. The law does not care if the client is paid. She said that “You cannot do business with them” does not refer to payment for services. Access to software via a website suffices.

All are part of outsourcing partnerships, including financial and fintech firms as well computer services and IT businesses and software development agencies. Eastern Europe has become a popular place for tech outsourcingThere is also a better chance that a Russian investor will be involved or have a parent company.

Andrew Sherman, who is a Seyfarth Shaw partner and specializes in business legal advice, said that “it won’t” be your local florist. 

This can include a company that is partially owned by Russian oligarchs and Russian entities that have operations in foreign countries, which a U.S.-based firm would not be able to see. It is called the issues for the tech sector run to the highest levels of Silicon ValleyBut also for the individual start-ups.

Edelman stated, “You should look overseas for distributors, engineers, programmers, and consultants.” We’re hearing from investors in start-up technology companies that ‘it’s a Cayman Islands business, but who is it owned? If it turns out to be a Russian sovereign wealth fund,  you can’t do business with them,” she said. She said, “It is shocking to everyone that either foreign funds have Russian investors in them or investing entities in countries like Singapore. Or Russian investors are directly in U.S entities.  

Treasury makes it much easier for violations to be identified

The government has made it easier in recent years to perform due diligence with the companies now able to go on OFAC’s website and run the screening on sanctioned entities — but it can still be cumbersome with additional Treasury, Commerce and Postal Service lists.

Edelman explained that there are only a handful of lists that deal with U.S.-sanctioned entities. Additionally, the UK and EU have lists to help businesses who operate in those countries. A software program that is used frequently today could need to be checked against up to 60 lists. The best place to start is running a screen on a company’s relationship against the consolidated OFAC list. This also includes Customs data. 

Experts say that even though a violation is not found, it’s important to follow these steps. Inadvertent violations do happen, but companies that can show they had a policy in place, and were doing screenings — more than once as sanctions are added — may lead the government to be less punitive if a violation is found. Edelman stated that these sanctions should be a motivation to create a compliance program. She said she was not impressed by OFAC’s assessment of firms who have an international trade compliance policy but are not managing it.

A mitigating factor can also be the size of a business. Self-disclosure is also an option if there are violations. However, a violation can only be defined as a transaction that is more than one. Edelman stated that $1 per transaction, one thousand times, is enough to cause a multitude of violations. I don’t wish to scare businesses because they could end up with a notice letter and a fine if they disclose that they’re trying to be complainants. However, it would be better to not have any problem. 

Sherman stated that it’s a smart idea for any company doing business in Europe to conduct a thorough review of the business relationships against sanction lists.

Sherman said, “If software is in development and shipping monthly to Eastern bloc countries and wire transfers to former Soviet members, it might be worth asking questions.”

Smaller firms would find it a tragedy if the U.S. Government ended up with them unintentionally.

Although many small- to medium-sized enterprises are insufficient to own any substantial Russian interests or hold holders, they would like to appear to support Ukraine. It’s also a story of David and Goliath, which entrepreneurs can relate to. Sherman explained that it’s probably only 1% to 2% of a chance. However, the evidence you provide will prove your compliance. If you are not proactive and you get audited, or have problems with your case, then you will lose your credibility. Put in the effort. … It’s not the same as 20 years ago. It is possible to do a lot of work online. Just a few Google search and email and you can create a compliance file. You will at least be able to tell someone that you took steps to safeguard the information.

Edelman stated that the process doesn’t need to cost a lot and the first step is to prepare a document on sanctions compliance to show your company is fully aware of the risks and have taken the necessary steps.

Cederbaum explained that “every business in this area has an obligation try to comply regardless the likelihood.” Cederbaum stated that it is worth staying cautious. …We are the most important company, and at the end could have easily fallen into violation of sanctions. Out of over 150,000 clients, we have two.