SAP has reached a settlement with US investigators to close a prosecution relating to the violation of economic sanctions and the illegal export of software to Iran. The cloud software vendor admitted to violating existing sanctions and an embargo placed on the country by the United States.
According to the US Department of Justice (DOJ), SAP violated both the Export Administration Regulations and the Iranian Transactions and Sanctions Regulations "thousands" of times over a period of six years.
In voluntary disclosures the company made to the three agencies, SAP acknowledged violations of the Export Administration Regulations and the Iranian Transactions and Sanctions Regulations. As a result of its voluntary disclosure to DOJ, extensive cooperation and strong remediation costing more than $27 million, DOJ’s National Security Division (NSD) and the U.S. Attorney’s Office for the District of Massachusetts entered into a Non-Prosecution Agreement with SAP. Pursuant to that agreement, SAP will disgorge $5.14 million of ill-gotten gain.
This action demonstrates that the Office of Export Enforcement will continue to leverage our unique authorities to enforce our nation’s export control laws and to deter new violations. Violators of the EAR will be held accountable through criminal or civil penalties, or both when appropriate,” said Special Agent in Charge William Higgins for the Commerce Department’s Office of Export Enforcement, Boston Field Office. “These laws are designed to protect U.S. Foreign Policy and National Security and will be vigorously investigated.
“By supplying Iran with millions of dollars’ worth of illegally exported software and services, SAP circumvented U.S. economic sanctions against Iran-pressure that is intended to end Iran’s malign behavior. However, it was SAP that first uncovered and reported this sanctions violation, and we would like to thank them for working hard to enhance their compliance program to prevent future violations,” said Special Agent in Charge Joseph R. Bonavolonta for the FBI’s Boston Division. “Let this case be a lesson to others that it’s better to self-report and own up to one’s mistakes than undermine U.S. foreign policy and adversely affect our national security.”
First, between 2010 and 2017, SAP and its overseas partners released U.S-origin software, including upgrades or software patches more than 20,000 times to users located in Iran. Previously, South Africa's companies registry office is pursuing criminal complaints against SAP SAPG.DE, KPMG and McKinsey on suspicion that business they conducted with friends of President Jacob Zuma broke the companies act.
The vast majority of the Iranian downloads went to 14 companies, which SAP partners in Turkey, United Arab Emirates, Germany and Malaysia knew were Iranian-controlled front companies. The remaining downloads went to several multinational companies with operations in Iran, which downloaded SAP’s software, updates, or patches from locations in Iran.
Concurrently with this agreement, SAP is entering into administrative agreements with the Department of Commerce, Bureau of Industry and Security (BIS) and the Department of the Treasury, Office of Foreign Assets Control (OFAC). Among other things, the BIS settlement agreement requires SAP to conduct internal audits of its compliance with U.S. export control laws and regulations and produce audit reports to BIS for a period of three years.
