Nineteen video calls. That was the whole footprint.
The person on the other end co-founded the company in 1987, kept an ownership stake through a holding company, and by 2019 their involvement had shrunk to a calendar invite. They dialed in from the United States, talked strategy with the chief executive and the board chair, and for some of those meetings they wrote the agenda.
On September 10, OFAC announced that this person agreed to pay $1,427,230 to settle 39 apparent violations of Iran sanctions. The agency called the case egregious. The management consulting and advisory services were counted as a service exported to Iran, one violation per meeting.
Michael Volkov's write-up names the defense this case demolishes, and it is one you have heard in a different accent inside your own company: I just give advice.
You think the line is at execution. It is at influence.
Here is the mental model most governance programs run on. Accountability attaches to the hand that acts. The person who signs, the system that writes to the database, the account that moves the money. Everyone upstream of that hand is context.
OFAC does not read it that way, and OFAC is right.
Read the enforcement release closely and notice what it counts first. Not the wire transfers. The meetings. Nineteen occasions of "substantive advice, analysis, and information" to the people who did act. Drafting the agenda counted. Deciding what the room would decide about was itself the service.
That is the reframe. Governance is not a property of who executes. It is a property of who shapes what gets executed. The consultant was outside the org chart and inside the decision. The org chart was never the perimeter.
Now look at the actors you have quietly filed under "just advice."
The vendor whose reviewer recommends, your team approves, and nobody can remember a recommendation being declined. The dashboard that ranks the options before anyone looks at them. The AI agent that drafts the plan, drafts the memo, drafts the agenda, and hands it to a human who clicks approve because it is 4:50 on a Friday.
Every one of those is a consultant on a video call. Not operating. Shaping. And the defense you are holding in reserve for them is the one OFAC just priced.
The math on "just advice"
Do the arithmetic the way an enforcement office does.
The base penalty on the schedule was $14.7 million. It landed at $1.4 million after credit for having stopped before the subpoena arrived and for an inability to pay more. Spread the settlement across the nineteen meetings alone and it is about $75,000 a call. On the schedule amount, ten times that.
Nineteen meetings over fifteen months. Now count how many of your advisory actors produce more than nineteen recommendations in fifteen months. Your agents do that before lunch.
The point is not that a regulator will bill you per prompt. The point is that when something goes wrong, nobody will accept that the thing which set the agenda was outside your governance because it never pressed the button. If it shaped the decision, it was in the decision.
So the Monday move is small and a little uncomfortable. Take your list of governed systems, the one with owners, controls and a review cadence. Add a second column: which of these only recommends. Then ask whether the recommenders have a commitment on record. Who they may advise. What they may not. Who answers for the advice.
If that column is blank, your perimeter is drawn at execution, and every drafter, ranker and agent sitting outside it is one bad outcome away from being described the way OFAC described this consultant.
Where is your line: at the hand that acts, or at the thing that decided what the hand would do?
Sources
- An Individual Settles with OFAC for $1,427,230 Related to Apparent Violations of Iran-related Sanctions Regulations, U.S. Department of the Treasury, OFAC
- OFAC's $1.4 Million Penalty Against a US Consultant: Why "I Just Give Advice" Doesn't Work as an Iran Sanctions Defense, Volkov Law, Corruption, Crime & Compliance