Last Friday, the U.S. Departments of Commerce, Justice, State, and the Treasury issued a joint guidance sheet on Iran’s unmanned aerial vehicles (“UAVs”) program (the “Iran UAV Guidance”). The Iran UAV Guidance highlighted (I) the threat Iran’s UAV program poses; (II) the key items that Iran relies on to expand its UAV program; (III) the expansion of U.S. export controls on Iran; (IV) U.S. sanctions imposed on Iran; (V) red flag indicators of export control evasion; and (VI) penalties for violating these laws.

The multiple agencies that authored the Iran UAV Guidance have put companies and individuals that operate in Iran, or may operate in nearby countries, on notice of the elevated risks to those dealings. Additionally, all companies should take note of the red flags identified, and the specific parts and components highlighted, and enhance their compliance policies and procedures as necessary.

A summary of the key points follows.

  1. Threat from Iran: The Iran UAV Guidance explains that Iranian UAVs have been provided to Russia for use by Russia in its war against Ukraine, and to the Houthis for use in their strikes inside Yemen and neighboring countries. Iran has also reportedly offered to provide UAV production technology and facilities to Tajikistan and Russia.
  2. Key Items: To effectuate these shipments of UAVs, Iran relies on procurement of non-Iranian origin parts, with a particular preference for U.S.-origin technologies. According to the Iran UAV Guidance, the parts most sought after by Iran are:
    1. Electronics: Including transceiver modules, processors and controllers, memories, amplifiers, and other electronic integrated circuits, field programmable gate arrays (FPGAs), RF transceivers, microcontrollers, and capacitors;
    1. Guidance, navigation and control equipment: Including accelerometers, gyroscopes, inertial measurement units, and navigational sensors; and
    1. Related components: Including aircraft spark-ignition and compression-ignition internal combustion piston engines and associated spare parts, and modules such as flight computers.
  3. U.S. Export Controls: In response to these threats, the United States has expanded the export controls imposed on Iran. The Iran UAV Guidance highlighted the following additional controls.
    1. Certain EAR99 Items Controlled: Previously, only non-EAR99 items were controlled for export, reexport, and transfer to Iran under the EAR (U.S. sanctions, as described below, incorporate further controls catching many of these items). In February 2023, the U.S. Department of Commerce’s Bureau of Industry and Security (“BIS”) identified a series of items (using HTS codes) normally classified as EAR99 that are now prohibited for export, reexport, and transfer to Iran (“Part 746 Supp. No. 7”). Moreover, the Russia and Belarus foreign direct product rules were expanded to include Part 746 Supp. No. 7. BIS further expanded Part 746 Supp. No. 7 in May 2023.
    1. Iran Foreign Direct Product Rule: At the same time, BIS also created a new foreign direct product rule applicable to these items as well as electronics, computers, communications and information security, and navigation and avionics identified on the Commerce Control List (“CCL”) (collectively, the “Iran FDPR”).
    1. Entity List Designations: BIS has added a series of persons to its Entity List due to their involvement in the production of Iranian UAVs or in the transfer of Iranian UAVs to Russia.
  4. U.S. Sanctions: The United States has imposed a comprehensive embargo on Iran for decades now. The Iran UAV Guidance reminds readers that the U.S. Department of the Treasury’s Office of Foreign Assets Controls (“OFAC”) prohibits most direct or indirect commercial, financial, or trade transactions with Iran involving U.S. persons (which includes subsidiaries of U.S. persons) or within the United States.
    1. Reexport Prohibitions: Specifically, the Iran UAV Guidance highlights that non-U.S. persons are prohibited from reexporting, directly or indirectly, any goods, technology, or services originally exported from the United States if (1) there is knowledge (including reason to know) that the reexport is intended for Iran or the Government of Iran; and (ii) the item is subject to U.S. export licensing requirements. This prohibition applies to the reexportation by non-U.S. persons of any items that are made outside of the United States with 10% or more U.S.-controlled content by value.
    1. Prohibition on U.S. Dollar Transactions: Any provision of services to Iran by non-U.S. persons, when payment includes U.S. dollars processed by a U.S. financial institution, is prohibited since it would cause a U.S. person to violate U.S. sanctions on Iran.
    1. Secondary Sanctions Risk: The Iran UAV Guidance emphasizes that any person (U.S. or otherwise) could be designated on the List of Specially Designated Nationals and Blocked Persons (“SDN List”) if they provide material support to persons on the SDN List or, in the instance of foreign financial institutions, they knowingly conduct or facilitate significant financial transactions on behalf of certain SDNs.
    1. Targeting the UAV Sector of Iran: OFAC has designated on the SDN List a series of individuals and entities in Iran, Russia, China, and Turkey due to their involvement in the production, procurement, and proliferation of, or supplying components to, Iran’s UAV systems. The United States retains a wide variety of authorities to impose further designations on persons with a nexus to Iran’s UAV sector.
  5. Red Flag Indicators: The Iran UAV Guidance explains the importance of maintaining an effective compliance program, which should “reflect management commitment to compliance and include risk assessment, internal controls, testing, auditing, and training,” be tailored to the risk the company faces, and empower compliance personnel to prevent or cease violative conduct. Screening counterparties against the SDN List and any BIS restricted party lists is an important best practice. Moreover, in an effort to assist industry, the Iran UAV Guidance lists out a series of red flag indicators that a prospective customer or intermediary may be engaging in export control or sanctions evasion. These include:
    1. Use of corporate vehicles (i.e., legal entities, such as shell companies, and legal arrangements) to obscure (i) ownership, (ii) source of funds, or (iii) countries/entities involved, particularly sanctioned jurisdictions or restricted entities;
    1. Reluctance to share information about the end use of a product, including reluctance to complete an end-user form;
    1. Declining customary installation, training, or maintenance of the purchased item(s);
    1. “Cyber spoofing” of email or web addresses to give the appearance that an illegitimate inquiry is coming from a legitimate business. Often these attempts will leverage known business relationships to lend credibility to the spoofing attempt.
    1. Internet or corporate website traffic originating from IP addresses that do not correspond to a customer’s reported location data;
    1. Transactions involving entities with little or no web presence;
    1. Use of personal rather than corporate email addresses;
    1. Last-minute changes to shipping instructions that appear contrary to customer history or business practices;
    1. Payment coming from a third-party country or business not listed on the End-User Statement or another applicable end-user form;
    1. Use of shell companies to conduct international wire transfers, often involving financial institutions in jurisdictions distinct from company registration;
    1. Changes to standard business documents that obscure the ultimate customer;
    1. Operation of businesses using residential addresses or addresses found to be common to multiple corporate entities;
    1. Transactions involving the use of freight-forwarding firms or other mail forwarding addresses listed as the product’s ultimate customer address;
    1. Transactions associated with atypical shipping routes for a product and destination; or
    1. Routing purchases through certain transshipment points commonly used to illegally redirect restricted items to embargoed destinations.
  6. Penalties: Finally, the Iran UAV Guidance describes the various penalties that can be applicable and how the U.S. government is enforcing these rules.
    1. Penalties: For U.S. export controls, civil penalties can be $353,534 or twice the value of the transaction per violation, and it can result in the denial of export privileges. For U.S. sanctions on Iran, civil penalties can be $356,579 or twice the amount of the underlying transactions per civil violation. In both instances, criminal penalties can be up to $1 million per violation and/or 20 years imprisonment. Notably, since multiple legal regimes (e.g., U.S. export controls, U.S. sanctions) can be applicable, any violation could be subject to multiple penalties.
    1. U.S. Government Taskforces: The U.S. Department of Justice (“DOJ”) leads its Task Force KelptoCapture to enforce sanctions, export controls, and other economic countermeasures imposed on Russia, such as the transfer of UAVs from Iran to the Russian military. DOJ has also partnered with BIS to create the Disruptive Technology Strike Force with a goal of investigating and prosecuting the illicit transfer of sensitive technologies to Iran and other adversaries.
    1. Updated DOJ Voluntary Self-Disclosure Policy: In March 2023, the DOJ issued an updated voluntary self-disclosure policy that explained if a company voluntarily discloses a potential criminal violation, but fully cooperates, takes remedial measures, and there is an absence of other aggravating factors, then the DOJ will offer a non-prosecution agreement and no fine will be issued.