German software company to pay $8m over unlawful Iran exports

SAP, a German multinational software corporation, has agreed to pay more than $8 million to the DoJ, US Commerce Department and OFAC over “thousands” of violations spanning 6 years of the Export Administration Regulations and the Iranian Transactions and Sanctions Regulations. The violations occurred in 2 main ways:

  1. Between 2010 and 2017, SAP and its overseas partners released/sold/exported US-origin software to users located in Iran on more than 20,000 occasions without the required licences. Despite SAP being aware that Iranian users were downloading the software, geolocation filters were not used to remedy the issue; and
  2. Between 2011 to 2017, SAP’s Cloud Business Group companies (CBGs) allowed approximately 2,360 Iranian users to access cloud services based in the US. After SAP had acquired these CBGs, SAP decided that they would operate as standalone entities despite not having adequate compliance programmes.

SAP has entered into a non-prosecution agreement with the DoJ, under which it has disgorged $5.14 million of “ill-gotten” profits, and has invested $27 million into its compliance programme: (1) implementing GeoIP blocking; (2) deactivating Iranian users of SAP cloud based services; (3) transitioning to automated sanctioned party screening of its CBGs; (4) auditing and suspending SAP partners that sold to Iran-affiliated customers; and (5) hiring US-based export controls staff, and (6) conducting more robust due diligence at the acquisition stage.

This is the first voluntary self-disclosure of export violations to have led to a non-prosecution agreement since the DoJ introduced the “VSD policy” in 2019 to encourage businesses to self-disclose all potential export control and sanctions violations (see post). See press release.

In addition, SAP has entered into a settlement agreement with the Commerce Department under which SAP has agreed to pay $3,290,000, and will complete 3 audits of its export compliance programme over a 3-year period. See press release. OFAC and SAP agreed a settlement of $2,132,174 for 190 non-egregious sanctions violations. The amount payable will be satisfied by SAP’s payments to the DOJ and Commerce Department. See Notice and press release.

IranIran United StatesUnited States

About Maya Lester QC

Maya Lester QC

Maya Lester QC is a senior barrister (Queen’s Counsel) at Brick Court Chambers with a wide-ranging practice in public law, European law, competition law, international law, human rights & civil liberties. She has a particular expertise in sanctions. The legal directories say she is the...

See profile for Maya Lester QC >