Bob Morrissey, an F&I manager for Scoville-Meno Honda in Oneonta, N.Y., had heard of others getting a hit, but he had never experienced one himself. That all changed on June 14, but as he said, the experience wasn’t all it was cracked up to be.
It happened on a Saturday. The name of the customer Morrissey was talking to on the phone partially matched a name on the Specially Designated Nationals (SDN) list, a compilation of individuals and groups sanctioned from conducting business in the United States.
Morrissey double checked the name with an online database, but couldn’t clear his customer. Since this was his first hit, he eagerly called the Office of Foreign Assets Control (OFAC), the federal agency that oversees and compiles the SDN list. Unfortunately, as he’d come to find out, the Washington, D.C.-based office was closed on weekends, which meant he’d have to leave a voicemail message with his name and contact information on the department’s automated answering machine.
Three days later Morrissey received a call back from an agency employee. He was asked for his customer’s name only, but no other information was requested. “Nothing about address, date of birth, Social Security number or anything,” recalled Morrissey. “He says, ‘No, it’s only a partial hit. You’re OK.’ That’s it, conversation over.”
The casualness and brevity of his encounter with the OFAC employee left Morrissey disenchanted by how the 58-year-old agency handled his situation. “If it was a typical handling of a hit, the process is so flawed that it will yield no results,” he said.
“I’m not asking to make a major case out of a partial hit, but at least there should be more of an effort to be certain it’s a false hit,” he added. “How about asking for additional info to see if there are any other similarities?”
Verifying a Hit
Morrissey’s question is valid for any auto dealer that comes across a partial or full OFAC hit. What are dealers suppose to do when their compliance solution indicates a positive hit? The answer is simple, but it may also confound dealers who get OFAC hits.
Officially, the OFAC office advises business owners who think they have a hit to contact the government agency’s 800-number to verify their customer’s personal information. An agency representative will ask for a customer’s first and last name. If there is not an exact match, then the dealer is free to conduct business with the customer.
However, if there is a match, then the representative will ask for more of the customer’s personal information, such as address, nationality, passport, tax ID or cedula number, date of birth, place of birth, former names and aliases, until the hit is verified.
The process is straightforward and low-tech, which is why dealers such as Morrissey question why the OFAC does not take a more rigorous approach to verifying customer information. Aside from asking a series of questions, the department does not employ any other method for validating an individual’s identity. To the agency’s credit, its staff is well versed on compliance issues involving financial institutions and other businesses, but only provides limited service to dealers with questions.
The agency takes thousands of calls each year from businesses nationwide, but has no record of how many of those businesses included automotive dealerships, said John Rankin, a former spokesperson for the OFAC. The agency also has no record of partial or full hits reported by auto dealers.
In addition, OFAC does not mandate that dealers use a specific compliance process to conform to its regulation. “We recognize that all businesses are different,” Rankin said. “What works for a huge operation might not work for a smaller outfit.”
Rankin said that hits recorded by a dealership’s compliance solution may be related to another list, such as the FBI’s Most Wanted List or the State Department’s Debarred Parties List. That’s because lists from various government and international organizations are often lumped into one database, and used by compliance solution providers. So, if a dealer runs a credit bureau report on a customer, it’s possible his or her name will be screened against all of these records.
“It’s important that businesses understand the list and think about what process they have to make sure it’s a false positive or if it’s actually a real name,” Rankin said.
Origins of OFAC and the SDN List
The OFAC became actively involved in scrutinizing cash and other transactions with foreign nationals under the USA Patriot Act, which went into effect after the Sept. 11 terrorist attacks in 2001. Since then, the agency has monitored auto dealerships and other businesses.
The OFAC was originally created in 1950 during the Korean War in response to President Truman’s order to block all Chinese and North Korean assets subject to U.S. jurisdiction. The agency operates under the jurisdiction of the U.S. Department of the Treasury, and continues to be responsible for the administration and enforcement of the federal government’s economic and trade sanctions.
The agency’s SDN list is a 400-page document that contains more than 6,000 names of individuals and groups who are “owned or controlled by, or acting for or on behalf of, targeted countries.” The list also includes names of individuals, groups, and entities, such as terrorists and narcotics traffickers, designated under programs that are not country-specific. The assets of these individuals and groups are blocked and U.S. persons are generally prohibited from doing business with those on the list.
The SDN list is updated frequently, but not according to a predetermined timetable. The OFAC makes the list available to the public in a PDF or text document format through the agency’s Website. Users can search the list manually or use the “find” feature in the Adobe Acrobat Reader program to locate a name. Another option is to employ compliance software solutions to automatically screen a customer’s name against the list.
Effective Use of the SDN List
Although the outcome of most inquiries can be anti-climatic, the agency’s SDN list is a good first line of defense for some dealers. “I think it’s a great regulation,” said Bob Dixon, an F&I manager at Lewes Auto Mall in Lewes, Del.
Dixon uses the OFAC checks to demonstrate the care his dealership takes with each customer, as he will often take the time to explain to customers what the OFAC screening entails and how it benefits them. He’ll even show customers their results from the OFAC test. “I show them the check mark and they’re impressed with it,” he said. “I haven’t had any complaints. It’s one extra step that protects us and them.”
That extra step may seem tedious, especially considering the numerous compliance regulations dealers must abide by. But it’s a step that must be taken, said Mark Thaw, a certified public accountant and partner of Morrison Brown Argiz & Farra LLP, an accounting firm that specializes in automotive dealerships.
“We are in some form of a financial crisis in the country. [F&I managers] are trying to make deals fly at all costs,” he said. “It’ll be more difficult for businesses to turn away customers, which leave the doors open for potential problems.”
Thaw said dealers must remain vigilant when it comes to compliance, as regulators and plaintiff attorneys are well aware of the pressures today’s credit crunch is putting on dealers. That’s why he recommends that dealers employ technology solutions that check for OFAC and other legal regulations. If anything, he added, software compliance tools demonstrate to state and federal regulators that the dealer is putting forth a good-faith effort to remain compliant.
But dealers can’t simply depend on technology to verify customer information. Morrissey points out that criminals or terrorists designated on the SDN list are savvy, and less likely to be caught using real forms of identity. “If someone is trying to pull a fast one, what are the chances they are going to give you the exact name? They’re not going to serve themselves on a silver platter,” he said.
The ease of using fake or stolen identities is one reason why Morrissey believes OFAC needs to shore up its defenses. He supports the OFAC regulation on credit and cash auto retail transactions, but believes F&I managers need more support in the case of an actual hit.
“If we’re going to add on the expense for compliance and burden F&I personnel, it seems like there should be additional support when a hit comes up,” he said. “What happens if someone tried to spot deliver a vehicle?”
His question is one that OFAC does not have a response to. “There is no simple rule for what an auto dealer should do if he or she is sure that he or she has a correct match to the list,” wrote OFAC’s Rankin in an e-mail. “As I said, such a circumstance would be very rare. In all cases, it is best to contact OFAC for guidance.”
Morrissey said he relies on his compliance solution provider’s instructions to verify his customer’s information. “It gave you steps to investigate further, the number directly for OFAC, and described what steps you could take,” he said. “It was more than thorough.”
However, he still did extra legwork and asked his customer additional questions about her profession. “She worked in the educational field and came up with names of people that I knew who worked in that district,” he said. Having a better idea of his customer’s background gave him the peace of mind to close the deal.
Although software solutions and online databases provide dealers with an instant method to verify a customer’s name, it never hurts to ask a few questions. What F&I managers need to remember is that the dealership and its profits are vulnerable, which is why F&I managers must be vigilant and use every tool available to them.
“As much as you detest or hate this, you don’t have a choice, because it’s a threat that can put you out of business in a worst-case scenario,” Thaw said. “At a minimum it’ll cost you money just with the lawyer, and dealerships don’t have money to do that right now.”