Extraterritorial Reach of US and EU Law

Why This Topic Matters

Few areas of the CAMS syllabus have as much real-world consequence as the extraterritorial reach of United States and European Union law. Financial institutions located thousands of miles from Washington or Brussels have paid billions of dollars in penalties for conduct that took place entirely outside those jurisdictions. BNP Paribas (2014, approximately USD 8.9 billion), HSBC (2012, USD 1.9 billion), Standard Chartered, Commerzbank, ING and many others learned that touching the US financial system, employing US persons, or clearing US dollars is enough to bring foreign conduct within the reach of US prosecutors and regulators. Similarly, EU directives, regulations and sanctions bind EU-incorporated entities and their branches and subsidiaries wherever they operate.

For a CAMS candidate, this topic sits in the domain of Regulatory Regimes, Risk Assessments and Collaboration. The exam tests whether you understand what gives a foreign authority jurisdiction, which specific provisions reach across borders, and how a compliance officer should respond when the obligations of multiple jurisdictions overlap or conflict. Compliance professionals who misjudge this exposure expose their institutions to loss of correspondent relationships, inability to clear dollars or euros, criminal prosecution and reputational collapse.

What Extraterritoriality Means

Extraterritorial jurisdiction is the application of a country's laws to persons, entities or conduct located outside its borders. Normally a state regulates only what happens on its own territory. Extraterritorial laws extend that reach on the basis of one or more jurisdictional hooks:

1. Nationality principle – the law follows a country's citizens, residents and incorporated companies wherever they are (US persons, EU nationals and EU-registered entities).
2. Territorial nexus – some part of the conduct passes through the country, even momentarily. The classic example is a US dollar wire transfer that clears through a correspondent account in New York.
3. Effects doctrine – the conduct produces substantial effects inside the country (used in US securities and antitrust enforcement and increasingly in sanctions).
4. Protective principle – the conduct threatens national security or foreign policy, which underpins much of OFAC's authority.
5. Contractual and supervisory reach – a parent company's regulator requires group-wide standards to be applied in every subsidiary and branch.

The US dollar is the single most powerful hook. Because almost all dollar payments between non-US banks are ultimately settled through correspondent accounts at US banks, a transaction between a bank in Dubai and a bank in Singapore can become a US transaction for legal purposes. The euro plays a similar, though less pronounced, role for EU law.

How US Extraterritorial Reach Works

1. The USA PATRIOT Act (Title III – International Money Laundering Abatement and Anti-Terrorist Financing Act of 2001)

This is the backbone of US extraterritorial AML law and is heavily examined. Key sections:

• Section 311 – Special Measures. The Secretary of the Treasury may designate a foreign jurisdiction, foreign financial institution, class of transactions or type of account as a primary money laundering concern and impose one or more of five special measures, ranging from enhanced record-keeping to the fifth and most severe measure: prohibiting US institutions from opening or maintaining correspondent or payable-through accounts for the designated institution. A Section 311 designation effectively cuts a foreign bank off from the US financial system. Examples include Banco Delta Asia, ABLV Bank (Latvia) and FBME Bank.

• Section 312 – Due Diligence for Correspondent and Private Banking Accounts. US institutions must apply risk-based due diligence to correspondent accounts for foreign financial institutions and private banking accounts for non-US persons, with enhanced due diligence where the foreign bank operates under an offshore license or in a jurisdiction of primary money laundering concern. Private banking accounts for senior foreign political figures require enhanced scrutiny for proceeds of foreign corruption.

• Section 313 – Shell Banks. US institutions are prohibited from maintaining correspondent accounts for foreign shell banks (banks with no physical presence in any country and not affiliated with a regulated financial group) and must take reasonable steps to ensure their foreign respondent banks do not allow shell banks indirect access.

• Section 317 – Long-Arm Jurisdiction. US courts have jurisdiction over foreign persons, including foreign financial institutions, who commit money laundering offenses involving a US financial transaction or who maintain accounts at US banks. Courts may restrain or seize property held in the US.

• Section 319(a) – Forfeiture of Funds in US Interbank Accounts. If funds are deposited in a foreign bank that maintains a correspondent account in the US, the US government may seize an equivalent amount from that correspondent account. The funds are deemed to have been deposited in the correspondent account, and the foreign bank, not the US government, bears the burden of recovering from its customer. This is one of the most direct extraterritorial tools.

• Section 319(b) – The 120-Hour Rule and Records Requests. A US institution must provide, within 120 hours of a regulator's request, records relating to any account opened or maintained in the US, including foreign correspondent accounts. The Treasury Secretary or Attorney General may issue a summons or subpoena to any foreign bank with a US correspondent account for records related to that account, including records held abroad. If the foreign bank fails to comply, the US institution must terminate the correspondent relationship within 10 business days of notice or face civil penalties of up to USD 10,000 per day. Foreign banks must also designate a US agent for service of process.

• Section 318 extends the definition of financial institution in money laundering statutes to include foreign banks.

2. The Anti-Money Laundering Act of 2020 (AMLA 2020)

AMLA 2020 dramatically expanded Section 319(b). US authorities may now subpoena records from a foreign bank with a US correspondent account relating to any account at that bank, not only the correspondent account, if the records relate to a violation of US criminal law, a civil forfeiture action, or a Bank Secrecy Act investigation. Crucially, foreign banks cannot refuse on the sole ground that compliance would conflict with foreign bank secrecy or confidentiality law. AMLA 2020 also extended whistleblower protections and strengthened FinCEN's ability to pursue foreign conduct.

3. US Money Laundering Statutes (18 U.S.C. 1956 and 1957)

Section 1956(f) provides explicit extraterritorial jurisdiction over money laundering where the conduct is by a US citizen, or by a non-US citizen where the conduct occurs in part in the United States, and the transaction or series of transactions exceeds USD 10,000. A single dollar-clearing step in New York satisfies the in-part-in-the-US requirement. These statutes also criminalize laundering the proceeds of specified unlawful activities, which include certain foreign offenses such as foreign bribery, bank fraud and narcotics trafficking.

4. OFAC Sanctions

The Office of Foreign Assets Control administers US economic sanctions. Their extraterritorial reach operates on two levels:

• Primary sanctions apply to US persons: US citizens and permanent residents wherever located, entities organized under US law and their foreign branches, and any person physically in the United States. Under certain programs (Cuba, Iran) foreign subsidiaries owned or controlled by US companies are also bound. Any transaction that passes through the US financial system, including US dollar clearing, is subject to OFAC jurisdiction even if neither counterparty is American. US persons may not facilitate transactions by non-US persons that they could not perform themselves.

• Secondary sanctions target non-US persons who have no US nexus at all. They threaten foreign institutions with loss of access to the US financial system, designation on the Specially Designated Nationals (SDN) list or restrictions on correspondent accounts if they engage in significant transactions with sanctioned parties (for example under the Iran, Russia, North Korea and Hezbollah programs). Secondary sanctions are the purest form of extraterritorial pressure because compliance is induced through threat of exclusion rather than direct legal obligation.

• The 50 Percent Rule extends blocking to any entity owned 50 percent or more, individually or in aggregate, by one or more blocked persons, even if the entity itself is not listed.

OFAC applies a strict liability standard for civil penalties, so a foreign bank that strips or omits sanctioned-party information from dollar payment messages (as in the BNP Paribas, Standard Chartered and Commerzbank cases) can be penalized regardless of intent, though willfulness drives penalty severity.

5. The Foreign Corrupt Practices Act (FCPA)

The FCPA's anti-bribery provisions apply to issuers (companies with securities listed on US exchanges, including foreign companies with American Depositary Receipts), domestic concerns (US citizens, residents and businesses) and any person who commits an act in furtherance of a bribe while in US territory. Using US mail, wires, banks or dollar accounts is sufficient. The accounting provisions require issuers to maintain accurate books and internal controls, and they apply to the issuer's foreign subsidiaries. Foreign bribery is a predicate offense for US money laundering, which means a bank that processes bribe proceeds can face exposure even where the FCPA itself does not apply directly to the bank.

6. Other US Tools

• Foreign Account Tax Compliance Act (FATCA) compels foreign financial institutions worldwide to identify and report US account holders or suffer a 30 percent withholding tax on US-source payments.
• Kingpin Act and Global Magnitsky Act designations reach foreign narcotics traffickers and human rights abusers.
• Geographic Targeting Orders and FinCEN advisories shape foreign bank behavior through their US correspondents.

How EU Extraterritorial Reach Works

1. EU Anti-Money Laundering Directives and the New AML Package

The Fourth, Fifth and Sixth Anti-Money Laundering Directives (4AMLD, 5AMLD, 6AMLD) and the 2024 AML Package (the AML Regulation or AMLR, the Sixth Directive and the regulation establishing the Anti-Money Laundering Authority, AMLA, in Frankfurt) create obligations with cross-border effect:

• Group-wide policies. EU obliged entities must implement group-wide AML policies and procedures, including information sharing, in all branches and majority-owned subsidiaries, including those in third countries. Where a third country's law does not permit implementation of EU-equivalent standards, the entity must apply additional measures and inform its home supervisor, and supervisors may ultimately require the group to cease operations there.
• Third-country branches and subsidiaries of non-EU groups operating in the EU are fully subject to EU rules, so a US or Asian bank with a Frankfurt branch must comply with the AMLR and national transposing law.
• High-risk third countries. The European Commission maintains a list of third countries with strategic AML/CFT deficiencies; EU obliged entities must apply enhanced due diligence to relationships and transactions involving those countries.
• 6AMLD harmonized predicate offenses, extended criminal liability to legal persons, and requires member states to establish jurisdiction where the offender is a national or the offense is committed in their territory, with optional jurisdiction over habitual residents and entities established in the member state.
• Beneficial ownership registers and the Transfer of Funds Regulation (the EU travel rule, extended to crypto-asset transfers) apply to any payment entering or leaving the EU.

2. EU Sanctions (Restrictive Measures)

EU sanctions regulations, adopted under the Common Foreign and Security Policy and directly applicable in all member states, apply:

• within EU territory, including its airspace;
• on board any aircraft or vessel under a member state's jurisdiction;
• to any national of a member state, wherever located;
• to any legal person or entity incorporated or constituted under the law of a member state, wherever it operates; and
• to any legal person in respect of business done in whole or in part within the EU.

Unlike the US, the EU has historically not imposed secondary sanctions and does not generally bind non-EU subsidiaries of EU companies, though the Russia sanctions packages introduced best efforts obligations for EU parents to ensure their non-EU subsidiaries do not undermine sanctions, an anti-circumvention clause, and a no-Russia clause for certain exports. The EU also prohibits circumvention and has criminalized sanctions violations through a 2024 directive. Enforcement is carried out by national competent authorities, leading to less uniform penalties than OFAC.

3. The EU Blocking Statute (Council Regulation 2271/96)

This is a classic exam topic because it illustrates conflict of laws. The Blocking Statute, updated in 2018 after the US withdrawal from the Iran nuclear deal, prohibits EU operators from complying with specified US extraterritorial sanctions laws (principally the Cuba and Iran measures listed in its annex), nullifies in the EU any foreign court judgment based on those laws, and allows EU operators to recover damages caused by their application. EU operators may request authorization from the Commission to comply where non-compliance would seriously damage their interests. In practice this places EU banks between two conflicting legal regimes: US secondary sanctions threaten exclusion from the dollar system, while the Blocking Statute forbids compliance. Most institutions resolve this through commercial risk appetite decisions rather than legal certainty, and several national courts have ruled that terminating a relationship purely to comply with US sanctions may breach the statute.

4. The General Data Protection Regulation (GDPR)

Article 3 gives GDPR extraterritorial scope: it applies to any organization, anywhere in the world, that processes personal data of individuals in the EU in connection with offering goods or services or monitoring their behavior. For AML this creates tension with US record requests under Section 319(b) and AMLA 2020, because transferring customer data to US authorities may require a lawful basis and an adequate transfer mechanism. Compliance officers must balance the obligation to cooperate with foreign authorities against data protection restrictions, often by relying on legal obligation, public interest or specific derogations and by seeking guidance from supervisors.

5. Other EU Instruments

• The Markets in Crypto-Assets Regulation (MiCA) and the Transfer of Funds Regulation reach crypto-asset service providers serving EU clients from abroad.
• Mutual legal assistance, the European Investigation Order and Europol and Eurojust cooperation extend investigative reach within and beyond the EU.
• Although the UK Bribery Act 2010 is no longer EU law, candidates should know it reaches any company carrying on business in the UK for failure to prevent bribery anywhere in the world, as questions sometimes contrast it with the FCPA.

Practical Consequences for Financial Institutions

Understanding extraterritoriality changes how an institution designs its program:

• Correspondent banking is the channel through which US and EU law travels. Respondent banks must expect requests for information, certifications (such as the USA PATRIOT Act Section 313 and 319(b) certification), periodic due diligence questionnaires (the Wolfsberg CBDDQ), and potential termination (de-risking) if they cannot satisfy their correspondent.
• Sanctions screening must cover US, EU, UN and UK lists at a minimum for any institution that clears dollars, euros or sterling, regardless of where it is located.
• Payment message integrity is critical. Stripping, omitting or altering originator or beneficiary information to avoid US filters is treated as willful evasion and has produced the largest penalties in history.
• Group-wide standards must be applied at the highest common denominator across jurisdictions, with documented gap analyses where local law conflicts.
• Conflict-of-law protocols should set out how the institution handles collisions between, for example, US subpoenas and EU data protection, or US secondary sanctions and the EU Blocking Statute, including escalation to senior management, legal counsel and regulators.
• Deferred Prosecution Agreements and independent monitors imposed by US authorities frequently require foreign banks to overhaul global compliance, demonstrating that the remedy, like the jurisdiction, is extraterritorial.

Exam Tips: Answering Questions on Extraterritorial Reach of US and EU Law

Tip 1 – Always look for the jurisdictional hook. When a scenario describes a non-US bank, ask: does it hold a correspondent account in the US, clear US dollars, have US-listed securities, employ US persons, or use US-based servers or wires? Any one of these is sufficient. If a question asks why a bank in a non-US country must worry about US law, the best answer almost always involves the US dollar correspondent account.

Tip 2 – Memorize the PATRIOT Act section numbers and their functions. The exam frequently names a section or describes its effect and asks you to match them. Build a mental table: 311 = special measures and primary money laundering concern; 312 = correspondent and private banking due diligence; 313 = shell bank prohibition; 317 = long-arm jurisdiction; 319(a) = forfeiture from correspondent accounts; 319(b) = 120-hour rule, subpoenas to foreign banks, 10-day termination requirement.

Tip 3 – Know the numbers. 120 hours to produce records. 10 business days to terminate a correspondent relationship after notice of a foreign bank's non-compliance. USD 10,000 per day in penalties. USD 10,000 threshold for extraterritorial money laundering jurisdiction under 18 U.S.C. 1956(f). 50 percent ownership threshold under OFAC's aggregation rule. 30 percent FATCA withholding.

Tip 4 – Distinguish primary from secondary sanctions. Primary sanctions bind US persons and transactions touching the US. Secondary sanctions target non-US persons with no US nexus by threatening them with exclusion or designation. If a question describes a foreign bank being cut off from the US financial system for dealing with Iran, the concept is secondary sanctions, not primary.

Tip 5 – Remember that OFAC is strict liability. Answers that suggest a bank is safe because it did not intend to violate sanctions are wrong. Intent affects penalty size, not liability.

Tip 6 – Understand AMLA 2020's expansion. If a scenario involves a US subpoena for records of an account at a foreign bank that is not the correspondent account, the correct answer reflects that AMLA 2020 permits this and that foreign bank secrecy is not a valid ground for refusal.

Tip 7 – For EU questions, think incorporation and territory, not secondary sanctions. EU sanctions apply to EU nationals, EU-incorporated entities and conduct within the EU. The EU traditionally does not impose secondary sanctions. The Blocking Statute is the EU's defensive response to US extraterritoriality; it prohibits compliance with listed US sanctions rather than imposing EU sanctions. If a question asks what law prevents an EU company from honoring US Iran or Cuba sanctions, the answer is Regulation 2271/96.

Tip 8 – Group-wide policy questions. When a scenario involves an EU bank's subsidiary in a country with weaker AML laws, the correct response is to apply EU-equivalent standards group-wide, implement additional measures where local law prevents full compliance, and inform the home supervisor. Simply following local law is never the best answer.

Tip 9 – Conflict-of-law scenarios. When US demands collide with GDPR or local bank secrecy, the best answer involves escalating to legal counsel and compliance, seeking a lawful basis or regulatory guidance, and documenting the decision. Avoid answers that ignore one regime entirely or that refuse all cooperation.

Tip 10 – FCPA scope. Remember the three categories: issuers, domestic concerns, and anyone acting within US territory. A foreign company with ADRs on a US exchange is an issuer and is covered. Foreign bribery is also a predicate offense for US money laundering charges, which is how banks become exposed.

Tip 11 – Use the CAMS best answer method. Many questions offer several plausible options. Choose the one that is most comprehensive, risk-based, and consistent with international standards (FATF, Wolfsberg, Basel). Eliminate answers that are absolute (never, always), that rely solely on local law, or that suggest ignoring a foreign request because the bank is outside that country.

Tip 12 – Connect to real cases. Recognizing patterns from BNP Paribas (wire stripping for Sudan, Iran and Cuba), HSBC (Mexican cartel proceeds and sanctions), Standard Chartered (Iranian transactions) and Danske Bank (non-resident portfolio in Estonia with US dollar clearing) helps you identify what the examiner is testing: payment message manipulation, inadequate correspondent due diligence, and the use of US dollar clearing as the basis for US jurisdiction.

Quick Review Summary

• Extraterritoriality means a country's law applies to persons or conduct outside its borders, based on nationality, territorial nexus, effects or protective interests.
• The US dollar and US correspondent accounts are the principal hooks for US jurisdiction over foreign banks.
• PATRIOT Act Sections 311, 312, 313, 317, 319(a) and 319(b), as expanded by AMLA 2020, give the US power to designate, restrict, seize from, and subpoena foreign institutions.
• OFAC primary sanctions bind US persons and US-touching transactions; secondary sanctions pressure non-US persons; the 50 percent rule extends blocking to unlisted subsidiaries; liability is strict.
• The FCPA reaches issuers, domestic concerns and anyone acting in US territory; foreign bribery proceeds trigger US money laundering exposure.
• EU AML directives and the AMLR require group-wide standards in third-country branches and subsidiaries and apply fully to foreign banks operating in the EU.
• EU sanctions bind EU nationals and EU-incorporated entities worldwide and conduct within the EU, with growing anti-circumvention duties for non-EU subsidiaries.
• The EU Blocking Statute forbids compliance with listed US extraterritorial sanctions, creating a genuine conflict of laws.
• GDPR applies extraterritorially and can collide with US information requests.
• In the exam, identify the hook, match section numbers to functions, recall key thresholds, distinguish primary and secondary sanctions, and choose the most comprehensive, risk-based and escalated response.