In the high-stakes world of international trade, the most dangerous threat to a company’s longevity is often not the initial regulatory inquiry, but the way it chooses to respond. A recent enforcement action by the U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) serves as a stark, cautionary tale for cross-border businesses: the process of defending against a sanctions investigation can, if mishandled, generate a secondary and arguably more damaging enforcement problem.
On October 9, 2026, OFAC announced a $175,015 settlement with Pegasus Worldwide Logistics, a boutique logistics firm with approximately a dozen employees. While the underlying sanctions violations were significant, the case gained prominence for a different reason: the company’s failure to provide a complete and accurate response to an administrative subpoena. This failure led to a series of reporting violations that underscored a growing trend in federal oversight—the increasing emphasis on the integrity of the investigative process itself.
The Chronology of an Enforcement Failure
The Pegasus case highlights how easily an administrative response can spiral into a compounding legal liability. The trouble began when OFAC identified apparent sanctions violations related to a shipment of equipment facilitated by Pegasus for a designated supplier. Crucially, this supplier had undergone a name change, a common tactic in attempts to obfuscate sanctioned entities from logistics providers.
The Initial Inquiry
OFAC served an administrative subpoena on Pegasus, providing a roadmap for the investigation. The subpoena specifically identified multiple aliases for the supplier, a dedicated email address, and a specific telephone number. These identifiers were intended to help Pegasus query its internal records and determine if it had facilitated any transactions involving the restricted party.
The Deficient Response
On February 1, 2024, Pegasus submitted its formal response to OFAC. Under oath, the company denied possessing any information responsive to the subpoena. This assertion was not merely a mistake; it was a certified statement that essentially claimed the company had no involvement with the parties in question.
The Regulatory Rebuttal
OFAC’s investigative unit, however, was already in possession of import-related documentation that directly contradicted Pegasus’s claims. The agency held records identifying Pegasus as the freight forwarder for the very shipments the company had denied facilitating. Faced with this direct evidence, Pegasus was forced to pivot.
The Correction and Consequences
Upon revisiting its internal records, the company discovered that it had indeed facilitated the shipments. Pegasus admitted that the failure to disclose this information earlier was due to a breakdown in communication between the company and its legal counsel; specifically, the firm had failed to provide its attorneys with the necessary information to conduct a proper review.
A revised response was finally submitted on August 8, 2024. In the intervening six months, OFAC had accrued six separate reporting violations—each one representing an independent legal failure. This failure to provide a timely, accurate, and complete response significantly weakened the company’s position, ultimately contributing to the $175,015 settlement figure.
Anatomy of the Enforcement Action: Supporting Data
The Pegasus settlement is a textbook example of how the "General Factors" of OFAC’s Enforcement Guidelines interact with actual business conduct. OFAC assesses penalties based on a matrix that weighs the nature of the violation against the "cooperation" provided by the subject.
In its enforcement release, OFAC made it clear that Pegasus failed to meet the threshold for effective cooperation. The agency’s guidelines prioritize:
- Promptness: The speed with which a company identifies and reports potential violations.
- Completeness: The willingness to disclose all relevant information, including "bad facts."
- Accuracy: The reliability of the evidence and certifications provided to the agency.
By submitting a certified denial that was later proven false, Pegasus triggered a negative inference regarding its compliance culture. OFAC explicitly stated that failure to cooperate in a "complete and satisfactory" manner not only results in the loss of mitigation credit but can lead to standalone penalties under the Reporting, Procedures and Penalties Regulations. For a small firm of twelve employees, the financial impact of $175,015—combined with the legal fees associated with the protracted investigation—is substantial, potentially threatening the firm’s continued operations.
Official Responses and Regulatory Guidance
In the wake of the settlement, OFAC issued a pointed reminder regarding the "Compliance Considerations" that all businesses must adopt. The message from the Treasury is unambiguous: when a company receives a request for information, it is entering a formal legal process, not a casual dialogue.
OFAC emphasized that recipients of such requests must "conduct a thorough inquiry and make sure they are providing all responsive records." The agency clarified that its ability to resolve investigations depends on the transparency of the subject. When a company fails to provide complete information, it complicates the agency’s work, which is viewed as an aggravating factor.
Furthermore, the agency reminded the industry that 31 C.F.R. § 501.602 mandates the provision of complete information under oath. The definition of "records" is expansive, covering not just formal contracts, but emails, text messages, metadata, invoices, and bills of lading. The agency’s position is that a defensible response cannot be built on a "single database search" or a superficial review. It requires a deep dive into the company’s operational history, often involving data that may be siloed or archived in ways that standard administrative procedures might overlook.
Strategic Implications for Cross-Border Businesses
The Pegasus case provides a blueprint for what not to do, but it also offers a roadmap for best practices. For companies involved in global trade, the following pillars of compliance are now essential to surviving an OFAC inquiry:
1. Mapping Information Before Answering
Before a single word is drafted for an OFAC response, the company must map its data. This includes identifying every employee involved in the transaction, reviewing archived communications across all platforms (including encrypted messaging apps if used for business), and securing records held by third-party service providers. In the logistics sector, searching by customer name is rarely sufficient. Companies must search by shipment numbers, vessel names, port identifiers, and any alias or contact detail provided by the regulator.
2. Radical Transparency with Counsel
The failure at Pegasus was largely one of information flow. If counsel does not know the full extent of the facts, they cannot provide competent advice. Companies must establish a clear protocol where internal subject-matter experts work directly with outside counsel to disclose all responsive material—even if that material appears damaging. An attorney’s certification is only as good as the facts provided by the client; the attorney cannot "guess" the facts, and if they are misled, the client bears the ultimate regulatory burden.
3. Proactive Scope Management
If a subpoena is overly broad or confusing, the solution is not to guess or provide a "best effort" answer. Instead, businesses should communicate with OFAC to clarify the scope of the request. If the company realizes it cannot meet a deadline or that its initial inquiry was insufficient, it should move to disclose the deficiency and supplement the response immediately. Voluntary, proactive correction is viewed far more favorably than a "gotcha" moment where the regulator presents the company with its own overlooked evidence.
4. Challenging the "No Responsive Records" Finding
Finally, companies must exercise extreme caution before certifying that they have no responsive information. OFAC rarely issues an administrative subpoena without a basis in intelligence. If the agency is asking for records regarding a specific counterparty or shipment, it is highly probable that such records exist. If a search yields nothing, the company should perform a "second-look" review before signing off on the response. A certification of "no records" is a high-risk statement that invites intense scrutiny.
Conclusion: Compliance as a Core Business Function
The Pegasus Worldwide Logistics settlement serves as a final reminder that compliance is not merely an administrative hurdle; it is a core business function that requires the same level of attention as sales or logistics operations. In an era where digital footprints are permanent and regulatory tools are increasingly sophisticated, the "I didn’t know" or "we couldn’t find it" defense is increasingly obsolete.
For the modern cross-border enterprise, the ability to respond to an OFAC inquiry with speed, accuracy, and total candor is a competitive advantage. It protects the company from the secondary enforcement traps that can be more destructive than the original sanctions issues. As the Pegasus case illustrates, the most important document in a sanctions investigation is the one that is filed under oath—and the integrity of that document is the ultimate measure of a company’s compliance health.
