Well, we are in a new era — a fundamental change has occurred, long in the making. National security and trade enforcement have coalesced to elevate trade risks — sanctions and export controls violations will be prosecuted aggressively by DOJ with the support and coordination with relevant regulatory agencies — OFAC, BIS, and DTCC.
My focus has not been to instill fear and knee-jerk reactions but to alert compliance professionals of a new reality and environment where national security and criminal prosecution merge. For compliance practitioner, the stakes could not be higher — violation of trade laws and regulations carry significant legal enforcement risks and tangible reputational damage. A company cannot afford to engage in trade activities that undermine the United States’ security.
We need to keep a close eye on DOJ’s activities, as well as regulatory enforcement actions involving OFAC, BIS, and DDTC. DOJ is quickly build a criminal enforcement program, closely coordinated with sharing of information among the regulatory agencies. Watch out — what was once the province of the FCPA, is quickly being replaced by acronyms relating to trade compliance.
Notwithstanding this new environment, however, we are facing many well-known risks and need to embrace well-established mitigation strategies — due diligence, transaction monitoring, audits, reviews and other common practices.
In reviewing the Cadence case, it is obvious that some basic practices and controls were ignored or not even in place. Let’s review some of the obvious issues.
First, Cadence sought to deliver sensitive technology to a prohibited entity by using an alias for the prohibited entity. By injecting this false entity in the transaction, Cadence employees, who were well aware of the prohibition against supplying EDA technology to NDUT, used initially Central South CAD Center (CSCC), an alias for NUDT, and then subsequently, switched to another associated entity, Phytium Technology Co. Ltd. (Phytium) to complete the transactions.
Basic due diligence and transaction screening would have flagged these transactions as involving prohibited entities. Red flags permeated all of these transactions and a robust trade compliance program would have escalated all of these transactions for heightened scrutiny and eventually barred the transactions.
A second glaring issue is the absence of any commitment to a culture of ethics and compliance. Cadence employees in the US and China were well aware that they were prohibited from supplying exports to NUDT were prohibited. Nonetheless, the Cadence sales personnel disguised sales to NUDT by using Chinese characters instead of English. Sales review emails omitted any reference to sales to the Chinese military.
Cadence’s trade compliance efforts ignored the seriousness of this new prohibition starting in 2015 — there were no attempts to build controls and checks to prevent sales personnel from engaging in prohibited transactions. Further, we have no suggestion that Cadence compliance personnel conducted audits, transaction monitoring or testing.
During the relevant time period, Cadence employed only one export control compliance officer responsible for Cadence’s export control program. This compliance officer provided regular training to employees who eventually ignored known prohibitions against sales to the Chinese military.
Starting in 2020, Cadence expanded its export control program in response to identified violations uncovered after a BIS inquiry. Cadence hired additional compliance personnel, formalized its training program and enhanced its screening program. Cadence now has an effective compliance program.
