Microsoft agreed to pay fines of more than $3 million for selling software to organizations and individuals in Cuba, Iran, Syria, and Russia, which were sanctioned between 2012 and 2019. The US Treasury announced “Many of the blatant violations involved prevented Russian organizations or individuals based in the Crimea region of Ukraine”. All cases occurred before Russia’s full-scale invasion of Ukraine.

Solution details

The company will pay approx. $2.98 million the U.S. Treasury Office of Foreign Assets Control (OFAC), and $347,631 dollars US Department of Commerce. The second fine was originally expected to be $624,013 but was reduced due to an agreement with the Treasury.

According to OFAC notice Microsoft, Microsoft Ireland and Microsoft Russia failed to control who purchased the company’s software and services through third-party partners. Essentially, Microsoft sold the products to companies it could legally do business with, but these companies later sold them to other companies that shouldn’t have access to Microsoft products.

The agency explains that in such cases, companies have a special volume licensing program that must control sales through intermediaries. It turned out that Microsoft did not give due importance to this and did not receive accurate information about the end users of its products.

Plan to circumvent Russian sanctions

The US Treasury says this is just one example of how Russia is trying to circumvent sanctions.

• Employees of “Microsoft Russia” are also deliberately tried to override the company’s due diligence efforts. The post contains details about a Russian oil and gas company that Microsoft reviewed and rejected. Only after that, Microsoft Russia employees successfully used the pseudonym of a subsidiary of this unnamed company to place orders on its behalf. These employees were fired, but OFAC says this fact “underlines the persistent efforts of organizations in the Russian Federation to evade US sanctions.”
• Microsoft had other loopholes in its procedures. We are talking about cases where the company had information that the sanctioned person was using their products, but did not pay attention to this for various reasons. These reasons include “not being able to summarize information accurately”.
• Also, the company did not control all the people who were sanctioned. The listings did not include companies owned by a majority sub-sanctioned company, or Cyrillic or Chinese names that the Treasury says are frequently cited by customers when applying to purchase software.

Microsoft admitted itself

The Treasury Department said Microsoft was “blatantly disregarding US sanctions.”

But it was Microsoft itself who discovered, investigated and independently reported the breaches to the government. The company has made “significant” changes to strengthen its sanctions compliance policies and measures. Presumably, this was the reason for some easing and reduction of the fine.

“Microsoft takes export control and enforcement compliance very seriously, so after we learned of verification errors and violations from several employees, we voluntarily notified the relevant authorities. We cooperated fully in their investigation and are happy with the resolution,” said David. Cuddy is a Microsoft spokesperson.