On January 23, the Treasury Department’s OFAC announced that a Luxembourg bank agreed to pay $152 million to resolve potential civil claims that the bank concealed the interest of the Central Bank of Iran (CBI) in certain securities held in one of the Luxembourg bank’s custody accounts. OFAC claims that from December 2007 through June 2008, the bank held an account at a U.S. financial institution through which the CBI maintained a beneficial ownership in 26 securities valued at nearly $3 billion. After assuring OFAC of its intention to terminate all business with its Iranian clients, the bank allegedly transferred the securities to another European bank’s custody account at the Luxembourg bank. Though the transfer changed the record ownership of the securities, the custody account allowed CBI to retain beneficial ownership. OFAC alleged that in acting as the channel through which the CBI held interests in the securities, the Luxembourg bank exported custody and related securities services in violation of the Iranian Transactions and Sanctions Regulations. OFAC highlighted the bank’s “strong remedial response” after learning of the alleged lapse mitigated the penalty amount. Although OFAC did not identify the specific enhanced controls implemented by the bank, it encouraged other firms operating as securities intermediaries to implement certain specific measures: (i) make customers aware of the firm’s U.S. sanctions compliance obligations and have customers agree in writing not to use their account(s) with the firm in a manner that could cause a violation of OFAC sanctions; (ii) conduct due diligence, including through the use of questionnaires and certifications, to identify customers who do business in or with countries or persons subject to U.S. sanctions; (iii) impose restrictions and heightened due diligence requirements on the use of certain products or services by customers who are judged to present a higher risk; (iv) attempt to understand the nature and purpose of non-proprietary accounts, including requiring information regarding third parties whose assets may be held in the accounts; and (v) monitor accounts to detect unusual or suspicious activity.