How Export Compliance Due Diligence Can Mitigate Compliance Risks in Mergers and Acquisitions

Mergers and acquisitions (M&A) play a crucial role in business growth and market expansion. However, the integration of another company’s operations brings complex export compliance risks. M&As can expose organizations to unexpected liabilities, including successor liability for previous export control violations, which can lead to regulatory scrutiny and severe penalties.  

These risks should not be overlooked, as regulators like the U.S. Office of Foreign Assets Control (OFAC) and the Bureau of Industry Security (BIS) have repeatedly shown their willingness to pursue aggressive enforcement actions for inherited compliance violations originating from acquisition due diligence failures. A proactive trade and export compliance review during M&A due diligence helps uncover hidden liabilities and prevent financial and reputational damage. 

Key Takeaways 

• M&A deals may expose companies to export compliance risks, including successor liabilities. 

• The acquiring company could inherit any past export control violations from the selling company. 

• Robust due diligence plays a key role in ensuring compliance before, during, and after an M&A. 

• Leveraging export compliance software can help uncover hidden liabilities in acquisitions and mitigate future risks. 

Successor liability in export compliance refers to the legal responsibility an organization acquires for the export compliance violations of a company it has purchased or merged with. This legal principle means that an acquiring company can inherit any past violations of export regulations. Even if the buying firm is unaware of these violations at the time of purchase, it could still be held accountable. 

If any export control violations come to light during an M&A, they should be reported promptly. Ideally, the target company should disclose these voluntarily. However, if the target company fails to disclose the violations, the acquiring company may need to consider reporting and reassessing the deal. 

M&A deals can be risky from an export compliance perspective, especially since many risks are not readily apparent. What liabilities should a company look for when examining another’s compliance practices? 

Here are a few commonly overlooked M&A export compliance risks: 

• Inherited Non-Compliance – Purchasing a company without investigating its past transactions may inadvertently expose the acquiring company to risks associated with past violations of trade sanctions. This can result in fines, penalties, and restrictions on future business activities. 

• Regulatory compliance risks – Merging companies may have varying trade restrictions, export control standards, or licensing requirements. Misaligned compliance processes can leave regulatory gaps, exposing the organization to risk. For instance, if a U.S. company acquires a foreign firm and takes on its operations, the acquired firm immediately becomes subject to U.S. sanctions and export controls, even if it wasn’t previously.  

• Inadequate Export Controls and Compliance Processes – Lack of robust due diligence or trade control mechanisms in the acquired company can allow unmonitored activities to persist, exposing the new owner to ongoing violations. Additionally, failing to conduct thorough export compliance due diligence or lack of detailed records can hide past infractions, making it difficult to assess liabilities accurately. 

• Supply Chain Risks – Third-party relationships such as vendors, partners, clients, and foreign employees could include restricted or sanctioned entities. Scrutiny of all acquired third parties is essential to identify sanctions compliance risk. 

• Credibility Concerns – Export control violations can tarnish a company's reputation, leading to negative publicity on an international scale and damage to relationships with stakeholders, customers, and partners.  

Successor liability in mergers and acquisitions can lead to serious repercussions when export compliance issues are overlooked. From creating unexpected costs to facing reputational damage, here are a few sanctions and export control violation cases that underscore the risk and consequences of neglecting proper due diligence in business acquisition deals.  

• Significant Regulatory Penalties: An aerospace and defense technology company recently settled with the U.S. Department of State and agreed to pay a $200 million penalty for 700 violations under the International Traffic in Arms Regulations (ITAR). The violations occurred due to jurisdiction and export classification errors, including unauthorized exports of defense articles and technical data to restricted countries. The majority of violations were committed by a previously acquired company before the sale. The remainder of the violations which occurred post-acquisition were based on historical misinterpretations from the original company. This example demonstrates the severity of fines and penalties organizations can face when they inherit export compliance violations through an M&A transaction and fail to align their compliance processes appropriately. 

• Legal Obligations: A biotech company encountered export compliance issues after acquiring a subsidiary with past Export Administration Regulations (EAR) violations for exporting controlled substances without licenses. The buyer was held responsible for these violations under successor liability since the acquired firm was now defunct. This case highlights how regulators enforce export controls through successor liability, underscoring the importance of thorough due diligence and compliance reviews in M&A to avoid inheriting penalties from previous violations. 

• Financial Loss: An American financial services company was fined $30 million by OFAC for sanctions violations involving legacy software acquired through an M&A. The software provided services in sanctioned regions, which continued for seven years after acquisition due to oversight gaps. The lesson to be learned from this case is the importance of implementing strong internal trade controls when integrating acquired systems to avoid prolonged regulatory infractions and high financial costs. 

• Operational Disruptions: A U.S.-based tool manufacturer faced penalties of nearly $2 million due to violations committed by a Chinese subsidiary. Addressing the compliance lapses that occurred pre- and post-acquisition involved restructuring leadership and conducting extensive training which impacted operations. Similarly, a travel services company faced backlash after its newly acquired subsidiary failed to comply with U.S. regulations. The remedial measures put in place limited their activities. 

• Reputational Harm: OFAC settled with a business analytics firm for apparent violations of Ukraine-related sanctions regulations. The violations occurred because its  newly acquired research firm re-issued and re-dated invoices to an entity listed on an OFAC sanctions list. The negative publicity this garnered, along with the sensitivity of the firm’s industry, impacted the business analytics company’s reputation. 

What can organizations going into an M&A do to mitigate successor liability risks? To safeguard against these risks, it is essential to prioritize thorough due diligence processes supported by the right export compliance tools.  

To prevent successor liability for export violations, companies can take several steps pre & post-acquisition to help with a seamless transition. 

Figure 1: 6 Key Steps to Reducing Export Compliance Risks in M&A 

Some of the key factors to consider before the acquisition or merger:  

• Examine Export Activities and Regulatory Risks: Pay attention to export control regulations, especially for foreign parties or controlled goods. It is essential to verify that the company being acquired has obtained all necessary export licenses and permits, including deemed export licenses for foreign national employees. Trade sanctions compliance should be thoroughly investigated during due diligence to uncover any infractions or risks. 

• Review Internal Compliance Programs: Both parties in an M&A must have robust compliance programs with ongoing audits and employee training to stay updated on regulatory changes. Internal policies for screening third parties against denied party lists should be assessed. 

• Check Documentation Thoroughly: Verify the company’s export documentation to ensure compliance with all relevant regulations. Review the documentation for completeness, accuracy, and adherence to regulatory record-keeping requirements. Inaccurate or incomplete documentation can lead to legal consequences. 

If after careful consideration, the M&A deal is finalized, organizations must resolve any outstanding export control violations and establish a robust framework to maintain an optimal compliance posture.  

Integrate export compliance practices into the restructured company culture with the following steps: 

• Implement Robust Integration Plan: The plan should provide an actionable outline of how the restructured company will adapt to maintain compliance and should include in-house compliance training and regular compliance audits to align the newly acquired entity with the parent company’s practices. 

• Seek Legal Expertise: Engage legal professionals with expertise in both M&A and export compliance to navigate international trade laws effectively. Additionally, consulting with trade compliance experts can facilitate ongoing regulatory adherence and improve risk management. 

• Perform Continuous Compliance Checks: It is essential to conduct regular reviews and audits to identify any new risks and maintain adherence to regulatory standards. 

These due diligence measures help protect buyers from post-M&A successor liability. 

Incorporating export compliance software during M&A due diligence enhances accuracy, efficiency, and control over critical assessments. By automating key areas—such as evaluating trade sanctions, verifying compliance programs, and reviewing export documentation—the software helps minimize human error and identifies regulatory risks early. Here are some key tasks that can be performed by such valuable tools:  

• Automated Export Product Classification: Accurately classify products and technologies to ensure compliance with export control regulations. A robust system for regularly reviewing and updating export classifications is essential to stay compliant with evolving regulations. 

• Denied Party Screening: Efficiently screen the business relationship network against official watchlists and denied party lists to identify and mitigate risks. Robust denied party screening solutions provide a variety of capabilities to control when and where you screen for sanctioned parties. This includes bulk screening to check all parties acquired as part of the M&A, and automated rescreening to identify new denied parties.  

• Export License Management: Streamline the management of export licenses, ensuring they are valid, up-to-date, and in compliance with regulatory requirements. Additionally, manage export license applications for future requirements 

• Document Management: Organize and store export-related documents in a centralized, secure location for easy access and auditing. 

• Trade Compliance Training and Resources: Highly-rated solutions and vendors typically provide automated export compliance training and resources to help employees stay informed and ensure adherence to export regulations. 

• Risk Assessment and Reporting: Generate comprehensive reports on potential risks and compliance gaps to support decision-making and identify areas for improvement. Automated reporting dashboards and secure record keeping of compliance activities help organizations stay audit ready and easily prove their due diligence efforts. 

• Integration with Existing Systems: Seamlessly integrate with other business systems to streamline export compliance workflows and improve efficiency. 

• Voluntary Self-Disclosure: If the due diligence process reveals any export compliance violations, robust solutions offer automated capabilities to accurately file a Voluntary Self-Disclosure (VSD) with the appropriate regulatory body.  

The dynamic landscape of mergers and acquisitions demands vigilance in export compliance due diligence to avoid inheriting liabilities. Real-world cases reveal the consequences of overlooking this vital step, underscoring the importance of compliance checks. Combining robust compliance processes with technology helps companies protect global operations and unlock value from their M&A activities. 

Descartes offers a suite of advanced export compliance solutions that enable organizations to easily prioritize due diligence in M&A transactions. Our tools facilitate real-time tracking, streamline audits, and help you confidently assess risk in potential M&A deals, with insights that equip you to move forward with assurance or uncover critical liabilities that could impact your decision.  

Find out more about our export compliance software solutions and contact us to speak to an expert. 

Looking to talk to an expert?

---

Contact Us