Denied Party Screening Best Practices

1. Denied Party ScreeningBest Practices by Cindy Peeters Millitech, Inc. Technology Control Officer/Facility Security Officer

2. Screening is the foundation of effective compliance

3. Millitech History • Millitech designs and manufactures millimeter-wave components and systems for both commercial and military applications. Customers include Raytheon, BAE, Lockheed, Boeing, Rockwell, and all the other major defense contractors. • Foreign owned, operate under an SSA so we can maintain our security clearance. • We have a large international business and have many licenses & TAA’s. • Denied party screening is essential in every aspect of our business.

4. KNOW YOUR CUSTOMER • U.S. export controls laws and regulations prohibit exporters from entering into a transaction with knowledge that a violation of those laws has occurred or is about to occur. They also contain prohibitions against doing business with certain specified persons and certain countries; exporting to prohibited end-uses or end-users; and contributing to the proliferation of weapons of mass destruction and delivery systems. To avoid violating these prohibitions, an exporter must make sure they are not dealing with a restricted party or possible proliferators. In short, exporters have a duty to exercise “reasonable care” in investigating the parties involved in, and the nature of, its export transactions.

5. Are you screening? Why are you screening? Who is screening? How are you screening? What are you screening for? Who are you screening? When are you screening? How often are you screening? Questions to ask yourself

6. Suggested Practice

7. As you can see, every visitor in our company has to come through the front door, go through DPS and be badged. We start the process early. FYI – we did not conduct DPS on 3 week old Baby Brody, but we did for his mom.

8. DPS Process

9. Lists to check include: Denied Persons Entity List Unverified List OFAC Lists Nonproliferation Sanctions Debarred List Its burdensome for companies that do not have all inclusive software to check all these lists which makes it easier for people to “forget” to screen. Lists to Check

10. What are Red Flags? • Possible indicators that an unlawful diversion might be planned by the customer • Abnormal or suspicious circumstances • There are obvious red flags and not so obvious red flags. Most people that work in compliance tend to have a gut feel when they think something is fishy. Go with that feeling and do your best due diligence to keep your company out of jeopardy.

11. Examples of Red Flags • The customer or its address is similar to one of the parties found on one of the denied person’s lists. • The customer or purchasing agent is reluctant to offer information about the end-use of the item. • The product's capabilities do not fit the buyer's line of business, such as an order for sophisticated computers for a small bakery. • The item ordered is incompatible with the technical level of the country to which it is being shipped, such as semiconductor manufacturing equipment being shipped to a country that has no electronics industry. • The customer is willing to pay cash for a very expensive item when the terms of sale would normally call for financing. • The customer has little or no business background.

12. Examples of Red Flags (cont’d) • The customer is unfamiliar with the product's performance characteristics but still wants the product. • Routine installation, training, or maintenance services are declined by the customer. • Delivery dates are vague, or deliveries are planned for out of the way destinations. • A freight-forwarding firm is listed as the product's final destination. • The shipping route is abnormal for the product and destination. • Packaging is inconsistent with the stated method of shipment or destination. • When questioned, the buyer is evasive and especially unclear about whether the purchased product is for domestic use, for export, or for re-export.

13. Hits or Matching Records • When DPS Results in “Hits” • Read and check the detailed results • Investigate and exclude any possibility of a coincidence or a similar sounding name or entity. • Review the citation. There are instances where a name/entity and citation may result in a match, but the citation does not prohibit this particular business transaction. • Verify the name/entity, address, and citation using the DPS Verification Statement form to document due diligence. • Verification should include at a minimum the completion of the DPS Verification Statement form in which the name/entity, date, signature and statement of the individual attesting they are not excluded from US government export/import activity and rejecting being a denied party are included along with a copy of a driver’s license, passport, or visa, if applicable. A template is available. • Record and file the verification statement and all relevant communication. • Proceed with the business transaction. • If verification cannot be obtained or the party is unwilling to provide the necessary information, it is suggested to suspend activity until there is cooperation, or terminate the activity.

14. DPS Verification Statement • I,_________________ , certify that I am not the same person(s) or entity listed on the denied party screening performed by Millitech. Further, I certify that I am presently not facing any penalties or have affected privileges with the U.S. Government regarding export/import regulations. Millitech has provided a printout of the list of name(s) and/or address(es) which resulted from conducting my name/entity search, and I verify that the names/entity, residences, and affected privileges have no relation to me. • Prior to entering the facility and/or proceeding with a business transaction/activity, I have provided Millitech a copy of my driver’s license (or Visa/Passport) which Millitech will keep in their files for verification and record keeping purposes only. • Name:__________________________Date:______________ • Signature:_______________________

15. Direct Hits (exact match) • When DPS Results in a “Direct Hit” (name and citation applicable) • Read and check the detailed results. • Verify it is a direct hit. Notify TCO. • Suspend the transaction or activity process • Inform the customer/visitor the transaction is on “hold” pending a further detailed investigation of export/import compliance matters and that there may be a delay or prolonged process times. • Do not approve orders, sign off forms, release shipments or authorize exports or visits. • Record and file all documentation. • Notify the party that this transaction cannot be completed due to export/import compliance matters. • It is recommend that this communication be documented and filed with DPS related records for future reference. • STOP ACTIVITY

16. Example – Employee • Millitech interviewed a potential technician in March 2009. We ran a DPS, no matching records. • Millitech hired this technician in July 2009. We ran a DPS and at this time we had our first direct hit on a person. • The alert was for a HUD (Housing and Urban Development) offense. • We asked the employee about this finding and he admitted that he and his family had been indicted for a HUD crime and that they were waiting for the trial.

17. Example – Employee (cont’d) • Our President, HR, Finance Director and myself called our legal group and talked about this topic and how to proceed. • Our decision was based on his job description: • His job does not entail anything financial • He would have no access to money • He was on a 6 month trial (not because of DPS finding) and if anything came up we would dismiss him at that time • We hired this technician and had no issues with him

18. Example - Visitor • George W. Bush comes to visit and wants to partner with us on a defense RFP we are working on: • George W. Bush is an alias used by many people • George does come up with an alert and you find that this person is not allowed to work on government contracts • Since we know this is not the same George Bush being found on the lists that we are working with we ask him to verify his identity and have him sign the DPS verification statement and we can continue to work with him

19. Example - Supplier • Bharat Electronics Ltd - India • When you look up this company you get a country code alert. • In this example India companies are on a watch list for atomic energy (nukes) products. • If Millitech was selling them components that would fall into this category we would stop the activity or apply for a license.

20. Questions? Cindy Peeters cpeeters@millitech.com