What can we learn from Toyota's sanctions compliance approach?

August 27, 2021 09:30
Pickup trucks have been widely used by militants in the Middle East and North Africa region, as they are fast, manoeuvrable, and they can be retrofitted with different weapons. Photo: Reuters

Afghanistan has fallen to the Taliban. Countless discussions on the event have been made from various angles, but one item particularly caught my attention - Toyota pickup trucks.

The pickup trucks have been so widely used by militants in the Middle East and North Africa (MENA) region that, out of sanctions compliance concern, Toyota recently changed its policy requesting purchasers of its latest 2022 model of Land Cruisers to sign a contract promising not to resell the vehicle within a year.

This sheds light on Toyota’s risk-based approach of its sanctions compliance programme regarding pickup truck sales.

Why are pickup trucks popular in MENA?

It is not only Toyota pickup trucks that are popular amongst government troops and militants in MENA but just any pickup truck. Pickup trucks are fast, manoeuvrable and essentially provide air-con in the scalding desert environment. More importantly, pickup trucks provide flexibility to meet various tactical needs in battles. They can be used for transporting soldiers for sure. They can also be retrofitted with different weapons, including heavy machine guns, anti-aircraft guns and recoilless guns.

That said, Toyota pickup trucks are arguably the most popular amongst other brands because of their reliability and sturdiness. In fact, a past war was named after Toyota because of its famed pickup trucks - the Toyota War in 1987. It was a border conflict between Libya and Chad, in which the latter achieved a decisive victory against the larger and better-equipped Libyan army thanks to the large-scale deployment of Toyota pickup trucks.

More so, the Islamic State’s affection towards Toyota pickup trucks is also well known. The pickup trucks were not only deployed in battles but also widely featured in the terrorist group’s propaganda.

Assisting investigations

In 2015, the US government asked Toyota to help determine how the Islamic State had managed to acquire such a large quantity of pickup trucks. Ed Lewis, Toyota’s US-based director of public policy and communications, then took an interview with ABC News, making comments that highlighted the key elements of the risk-based approach in sanctions compliance.

What is a risk-based approach?

The risk-based approach is an essential risk management component in a sanctions compliance programme. The approach consists of four elements: risk appetite; inherent risk; control effectiveness; and residue risk.

Risk appetite is about the amount of risk a business is willing to accept in pursuit of a business opportunity. This is also in part a function of how many resources a business is willing to invest in risk control measures.

Inherent risk is the level of sanction risk that exists before any mitigation measures are applied. Inherent risk can be grouped in four categories: customers, products and services, countries, delivery channels. To exemplify this, a US-registered multinational bank has a much higher sanctions compliance risk than a store selling hotdogs in New York as the bank has a much broader customer base, with various financial products and services available. As such, the bank has much bigger chances providing services, willingly or inadvertently, to sanctioned customers who are otherwise barred from the dollar-based global financial system under the US sanctions regime.

Control effectiveness refers to the quality of control measures applied to reduce the identified inherent risks. These control measures usually include due diligence and internal policies and procedures.

Residue risks are remaining risks after controls are applied. A risk-free world never exists, and as such there are always residue risks to be dealt with. To give a day-to-day example, no one can say with complete certainty that he/she can come home safe after heading out. Bad things happen, and therefore we first calculate the inherent risks and then apply control measures. We take control measures to avoid accidents by, say, observing traffic rules or taking a safe route home. And yet there are still residue risks, such as a reckless driver. We ultimately determine if the residue risks still exceed our risk appetite, from which point we decide to either bring in more controls or to move away from the action in question.

Ed Lewis’ remarks

Back to Ed Lewis’ ABC News interview, his remarks on Toyota’s sanctions compliance policy on pickup truck sales present to us what a risk-based approach should look like.

Lewis told ABC News that “we [Toyota] briefed [the US] Treasury on Toyota’s supply chains in the Middle East and the procedures that Toyota has in place to protect supply chain integrity.” He continued to emphasise that Toyota “has a strict policy to not sell vehicles to potential purchasers who may use or modify them for paramilitary or terrorist activities.”

Toyota appears to know the inherent risks that terrorists in MENA are potential ultimate customers of its pickup trucks, and as such Lewis said that the company had policies and procedures in place to guard against questionable purchases. However, despite these controls, in 2012, when knowing the residue risks were still higher than the risk appetite, Toyota made a sensible move to divest its business in Syria, completely ceasing its operations there.

In addition, Toyota understands that militants have acquired pickup trucks through second hand markets, and hence it introduced the above-mentioned policy of making purchasers sign a contract not to resell their brand new vehicles in a year, even though such policy could dent the initial sales figures.

Lewis, however, ultimately conceded that it would be “impossible for Toyota to completely control indirect or illegal channels through which our vehicles could be misappropriated.” He simply said that no control measures are perfect. As the famous saying goes - “If you really want to do something, you will find a way.” Even Toyota’s new policy can only hold up the sale of a Land Cruiser for a year. But still, Toyota has shown to regulators its commitment on sanctions compliance.

Toyota’s sanctions compliance policy on the pickup truck sales seems sufficient in the eyes of the US government, in that at least the company has never been formally investigated or penalised for the sales practices.

A good lesson

The story of Toyota gives us a vivid example on the risk-based approach to sanctions compliance. Businesses should start applying the approach in their compliance programmes.

In the context of a rapid deterioration of China-US relations in the past few years, we have witnessed an ever expanding list of targets in mainland China and Hong Kong sanctioned by the US and the EU. In response, Beijing has counter-sanctioned Western targets, and more importantly institutionalised its anti-foreign sanctions measures by rolling out a couple of legislations and regulations, including the anti-foreign sanctions law which has unsettled many foreign businesses in Hong Kong. Sanctions as a compliance matter will only grow in importance in corporate management in the foreseeable future. Businesses should start equipping relevant knowledge and reviewing their compliance programmes to keep up.

-- Contact us at [email protected]

Founder of Richard Ip Consultancy, a due diligence and sanctions compliance advisory business, the writer is a global political and compliance risk consultant with a special focus on Asia.