Yesterday when I posted on the latest release of civil penalty information by the Office of Foreign Assets Control (“OFAC”), I promised to do a second post on the $11,000 penalty paid to OFAC by GEICO General Insurance Company (“GEICO”). The penalty was paid to settle charges that GEICO provided an automobile insurance policy to a Specially Designated Narcotics Trafficker (“SDNTK”).
There is no indication whether this violation was voluntarily disclosed. My cynical guess (not based on a single fact) is that the whole deal came to light when the SDNTK ran into someone. GEICO then suddenly discovered its insured was an SDNTK and tried to use that as an excuse not to pay out for the damages to the other driver.
But here’s what is most interesting about OFAC’s announcement of the GEICO penalty settlement. The agency noted:
The settlement amount reflects OFAC’s consideration of the following General Factors: GEICO does not screen its existing policyholders database for SDNs as the SDN list is updated but only on an annual basis. GEICO has committed to making improvements to remedy this gap in its OFAC compliance program.
Based on this statement, it would appear that the SDNTK was listed as such by OFAC after GEICO had issued the policy. Because GEICO screened its database of customers annually, it continued to provide insurance for a period of time after the designation. Bad gecko.
But this is a problem that bedevils every compliance program. How often should customer lists be scanned? Based on this statement from OFAC, annually is not enough. Instead the agency seems to suggest that every company must rescan its customer list each and every time OFAC adds someone to the SDN list. This seems overly burdensome and not justified by any significant benefit. A better policy would be for OFAC to establish a safe harbor for companies that rescan their customer lists at specified intervals, such as monthly or bi-weekly.