No. 24-6187

D.C. No. 3:21-cv-01799BAS-BJC

Appeal from the United States District Court for the Southern District of California Cynthia A. Bashant, District Judge, Presiding

Argued and Submitted February 9, 2026 Pasadena, California

Filed April 13, 2026

Before: John B. Owens, Lawrence VanDyke, and Holly A. Thomas, Circuit Judges.

Opinion by Judge VanDyke

Page 2SUMMARY *

Affirming the district court's summary judgment in favor of Bank of America, the panel held that the International Emergency Economic Powers Act foreclosed a suit brought by Mohammad Farshad Abdollah Nia, an Iranian citizen living in the United States, after the Bank closed his account.

The Iranian Transactions and Sanctions Regulations (“ITSR”), federal regulations promulgated by the Office of Foreign Asset Control, prohibit U.S. financial institutions from providing financial services to 'accounts of persons who are ordinarily resident in Iran, except when such persons are not located in Iran.” 31 C.F.R. § 560.320. The Bank's Consumer Residency Monitoring ('CRM') policy required accountholders who were citizens of comprehensively sanctioned countries—like Iran—to periodically submit documents to prove that they were not present or permanently resident in sanctioned countries. After the Bank erroneously mixed up whether a residency document counted as permanent or merely temporary proof of residency, Nia’s account was closed.

The International Emergency Economic Powers Act's shield liability provision, 50 U.S.C. § 1702(a)(3), states: “No person shall be held liable for or with respect to anything done or omitted in good faith in connection with the administration of, or pursuant to and in reliance on, this Page 3chapter, or any regulation, instruction, or direction issued under this chapter.” The panel held that this provision does not excuse liability only for actions compelled by ITSR. Rather, given the Act's expansive language, the Bank’s CRM policy, built around the demands of the ITSR, fell comfortably within the liability shield’s ambit. Applying a sanctions compliance program based on citizenship may not be compelled by the ITSR, but it is permitted under the Office of Foreign Asset Control's guidelines, which explicitly allowed the Bank to account for citizenship in a comprehensively sanctioned country in administering its sanctions compliance program.

The panel further held that Nia failed to establish a genuine issue of material fact about the Bank's good faith. Accordingly, the district court properly granted summary judgment to the Bank based on the International Emergency Economic Powers Act’s liability shield provision.

Jason S. Rathod (argued) and Nicholas A. Migliaccio, Migliaccio & Rathod LLP, Washington, D.C.; Benjamin I. Siminou and Jonna Lothyan, Singleton Schreiber LLP, San Diego, California; David M. Hundley, Hundley Law Group, Chicago, Illinois; for Plaintiff-Appellant.

Michael B. Kimberly (argued), Winston & Strawn LLP, Washington, D.C.; Amanda L. Groves and Shawn R. Obi, Winston & Strawn LLP, Los Angeles, California; Linda T. Coberly, Winston & Strawn LLP, Chicago, Illinois; for Defendant-Appellee.

Page 4VANDYKE, Circuit Judge:

As part of the United States’ comprehensive sanctions against Iran, federal regulations prohibit U.S. financial institutions from providing financial services to “accounts of persons who are ordinarily resident in Iran, except when such persons are not located in Iran.” 31 C.F.R. § 560.320. To facilitate compliance, the International Emergency Economic Powers Act ('IEEPA') shields banks from liability for good faith actions taken in order to comply with sanctions regulations.

Citing those regulations, Bank of America (“the Bank”) administers a Consumer Residency Monitoring ('CRM') policy under which prospective and existing accountholders who are citizens of comprehensively sanctioned countries— like Iran—are periodically required to submit documents to prove that they are not present or permanently resident in sanctioned countries. Plaintiff Mohammad Farshad Abdollah Nia, who during the times relevant to this appeal was an Iranian citizen living in the United States, held an account with the Bank. After the Bank erroneously mixed up whether a residency document counted as permanent or merely temporary proof of residency, Nia's account was closed, and Nia brought suit under 42 U.S.C. § 1981, the Equal Credit Opportunity Act ('ECOA'), the California Unruh Civil Rights Act, and the California Unfair Competition Law (“UCL”).

After rejecting Nia's argument that IEEPA's liability shield provision applies only to actions specifically mandated by sanctions regulations, the district court held that IEEPA forecloses Nia’s claims. We affirm.

IEEPA authorizes the President to craft sanctions on foreign countries that pose unusual and extraordinary threats. 50 U.S.C. §§ 1701–1710. To facilitate enforcement, IEEPA shields banks from liability for good faith actions taken in order to comply with sanctions regulations: 'No person shall be held liable in any court for or with respect to anything done or omitted in good faith in connection with the administration of, or pursuant to and in reliance on, this chapter, or any regulation, instruction, or direction issued under this chapter.' Id. § 1702(a)(3).

The Office of Foreign Assets Control (“OFAC”) promulgates the Iranian Transactions and Sanctions Regulations ('ITSR'). 31 C.F.R. pt. 560. The ITSR prohibit U.S. financial institutions from exporting financial services to Iran by 'performing services with respect to Iranian accounts.” Id. § 560.427(b); see id. § 560.204. The ITSR define “Iranian accounts” as “accounts of persons who are ordinarily resident in Iran, except when such persons are not located in Iran, … maintained on the books of … a United States depository institution or a United States registered broker or dealer in securities.' Id. § 560.320.

OFAC issues sanctions compliance guidance to banks, 'strongly encourag[ing]' them to 'employ a risk-based approach to sanctions compliance by developing, implementing, and routinely updating a sanctions compliance program.” U.S. Dep’t of the Treasury Off. of Foreign Assets Control, A Framework for OFAC Compliance Commitments 1 (2019) [hereinafter OFAC Framework ], https://ofac.treasury.gov/recent-actions /20190502_33 [https://perma.cc/CF3F-HCEM]. APage 6 “fundamental element” of such a program “is the assessment of specific clients, products, services, and geographic locations in order to determine potential OFAC sanctions risk' based on a risk matrix provided by OFAC. Id. ; 31 C.F.R. pt. 501 app. A, annex. Among other things, OFAC’s risk matrix lists “nonresident aliens” and “foreign customers” as “high-risk customers” for compliance program purposes. 31 C.F.R. pt. 501 app. A, annex. When OFAC assesses penalties for ITSR violations, it accounts for “the existence, nature and adequacy” of a sanctions compliance program. 31 C.F.R. pt. 501 app. A. OFAC has penalized banks for failing to sufficiently collect and account for citizenship data in administering their sanctions compliance programs. See, e.g. , U.S. Dep’t of the Treasury Off. of Foreign Assets Control, OFAC Settles with TD Bank, N.A. for $115,005.04 Related to Apparent Violations of the North Korea Sanctions Regulations and the Foreign Narcotics Kingpin Sanctions Regulations (Dec. 23, 2021), https://ofac.treasury.gov/media/917121/download?inline [https://perma.cc/L8HX-NWYQ].

Citing OFAC sanctions, Bank of America adopted a CRM policy that requires prospective and existing accountholders who are citizens of comprehensively sanctioned countries––like Iran––to periodically submit documents as proof of 'physical presence' in the U.S., “permanent U.S. residence,” or “presence in a third country (outside the U.S. and outside a sanctioned country).” These documents are classified as either permanent or temporary. Permanent documents may be reused for subsequent document requests, but temporary documents may be used only once. Temporary documents expire on their printed expiration date or, if no expiration date is listed, on a date Page 7internally assigned by the Bank. Before that expiration date, the Bank informs customers by letter that they will soon need to submit new documents to prove their presence or residency in the U.S. and that their account may be restricted or closed if they fail to provide the necessary documents. If OFAC removes sanctions on a country, the Bank updates the CRM policy accordingly.

Nia opened a credit card account with the Bank in 2015. Since he was an Iranian citizen at the time, Nia was covered by the Bank’s CRM policy. Between 2015 and 2019, Nia submitted his driver’s license as proof of residency. In April 2019, a few months before Nia’s latest driver’s license was set to expire, the Bank sent Nia a letter requesting updated proof-of-residency documentation. The letter mistakenly listed a Form I-797C (an application for permanent U.S. residency) as permanent proof of residency. Nia submitted his Form I-797C. Since the form lacked an expiration date, the Bank assigned an internal expiration date pursuant to the CRM policy: November 7, 2019, six months after the date on the Form I-797C.

In August 2019, a few months before the assigned November expiration date, the Bank sent Nia a letter notifying him that “[t]he temporary residency documentation you provided will soon expire” and asking for updated documents by October. This letter again mistakenly listed a Form I-797C as permanent proof of residency. When Nia returned a missed call from the Bank in September, a Bank representative told him that she did not see anything concerning about his account that the Bank would have called him about and informed him that all important communication would be done by mail. ShortlyPage 8 afterward, Nia resubmitted his Form I-797C, prompting another letter from the Bank informing him that his submission was insufficient and requesting updated documents. Nia assumed the request was mistaken and ignored it. The Bank restricted Nia’s account on October 1 and closed it on October 21. On subsequent calls between Nia and the Bank, the Bank explained that it could not accept Nia’s Form I-797C because he had submitted it before and because it was expiring soon.

D.

Nia filed suit in state court in August 2021, and the Bank removed to federal court. In February 2023, Nia filed an amended class action complaint, asserting violations of 42 U.S.C. § 1981, ECOA, the California Unruh Civil Rights Act, and the UCL. The parties filed cross motions for summary judgment. The district court denied Nia’s partial motion for summary judgment and granted in part the Bank’s motion for summary judgment, concluding that the IEEPA liability shield foreclosed all of Nia’s claims except his ECOA notice claim and associated UCL claim. Nia voluntarily dismissed both surviving claims and brought this appeal.

We have jurisdiction under 28 U.S.C. § 1291. We review a decision on cross motions for summary judgment de novo. Marable v. Nitchman , 511 F.3d 924, 929 (9th Cir. 2007).

This case turns on the interpretation of the IEEPA liability shield provision: “No person shall be held liable in any court for or with respect to anything done or omitted in Page 9good faith in connection with the administration of, or pursuant to and in reliance on, this chapter, or any regulation, instruction, or direction issued under this chapter.' 50 U.S.C. § 1702(a)(3). Nia argues that this provision only excuses liability for actions ' compelled by ITSR.' We disagree.

Nia’s argument has no root in the text of the statute. In 1977, when IEEPA was enacted, 'pursuant' meant 'in accordance with' or 'by reason of.' Pursuant , Black’s Law Dictionary (4th rev. ed. 1968); Pursuant , Black's Law Dictionary (5th ed. 1979) (same). 'Reliance' meant “dependence.” Reliance , Ballentine's Law Dictionary (3d ed. 1969); Reliance , Oxford English Dictionary (2d ed. 1989). Neither term suggests compulsion. And the liability shield extends to actions taken pursuant to and in reliance on 'instruction[s]' or 'direction[s],' neither of which imply compulsion either. 50 U.S.C. § 1702(a)(3). That language affords financial institutions like the Bank some discretion on how best to comply with the ITSR.

Neither Silesian American Corp. v. Clark , 332 U.S. 469 (1947), nor McGrath v. Cities Service Co. , 189 F.2d 744 (2d Cir. 1951), clashes with the straightforward text of the statute. Nia contends that these cases, which interpreted a functionally identical liability shield provision in IEEPA’s predecessor statute, indicate that IEEPA immunizes only compelled actions. We again disagree. Both cases focused on the powers of the Alien Property Custodian-a World War II-era office--to order U.S. companies to transfer security interests held by German citizens to the Alien Property Custodian. Silesian , 332 U.S. at 471; McGrath , 189 F.2d at 745. Both cases involved corporations compelled to act in accordance with a specific directive, and both cases concluded, in dicta, that the liability shield Page 10applied. Silesian , 332 U.S. at 477-79; McGrath , 189 F.2d at 747–48. But neither case makes sweeping claims (or any claims at all) about the meaning of the “pursuant to and in reliance on' language. At most, Silesian and McGrath suggest that a specific directive’s compulsion is a sufficient condition—but not a necessary one—to trigger the liability shield.

Given IEEPA's expansive language, the Bank's CRM policy falls comfortably within the liability shield’s ambit. The policy is clearly built around the demands of the ITSR. The Bank requests “[p]roof of United States (U.S.) physical presence,” “[p]roof of permanent U.S. residence,” or “[p]roof of presence in a third country (outside the U.S. and outside a sanctioned country)'-precisely the information most helpful in assessing whether the Bank might be servicing “accounts of persons who are ordinarily resident in Iran.” 31 C.F.R. § 560.320. Both the CRM policy and the Bank’s internal sanctions compliance guidance inform employees that the policy was adopted to comply with OFAC’s sanction regime.

Applying the CRM policy based on citizenship in a comprehensively sanctioned country is done 'pursuant to and in reliance on' sanctions guidance as well. OFAC “strongly encourages organizations subject to U.S. jurisdiction … to employ a risk-based approach to sanctions compliance by developing, implementing, and routinely updating a sanctions compliance program.” OFAC Framework , supra , at 5. Under OFAC's 'Economic Sanctions Enforcement Guidelines,' financial institutions are allowed to account for citizenship in a comprehensively sanctioned country as a risk factor, so the Bank’s adherence to that guidance directly accords with a “regulation, instruction, or direction' issued under IEEPA. 50 U.S.C.

Page 11§ 1702(a)(3); 31 C.F.R. pt. 501 app. A, annex (listing “nonresident aliens” and “foreign customers” as “high-risk customers” for sanctions compliance purposes). Nia points to other agency guidance cautioning financial institutions against treating “nonresident aliens and foreign individuals” as “automatically represent[ing] a uniformly higher risk of money laundering, terrorist financing, or other illicit financial activity .” Bd. of Governors of the Fed. Rsrv. Sys. et al., Joint Statement on the Risk-Based Approach to Assessing Customer Relationships and Conducting Customer Due Diligence (July 6, 2022) (emphasis added), https://www.federalreserve.gov/frrs/regulations/jointstatement-on-the-risk-based-approach-to-assessingcustomer-relationships-and-conducting-customer-duediligence.htm [https://perma.cc/4JYG-H9EE]; see also Fed. Fin. Insts. Examination Council, BSA/AML Examination Manual: Risks Associated With Money Laundering and Terrorist Financing (2021), https://bsaaml.ffiec.gov/manual /RisksAssociatedWithMoneyLaunderingAndTerrorist Financing/00 [https://perma.cc/C6MX-XZ7P]. But the Bank’s CRM policy addresses a different type of risk: the liability risk of violating the ITSR by inadvertently servicing an 'Iranian account.' Applying a sanctions compliance program based on citizenship may not be compelled by the ITSR, but it is certainly permitted under OFAC’s guidelines.

Of course, the liability shield still only applies to actions taken in good faith. 50 U.S.C. § 1702(a)(3). But Nia fails to identify a genuine issue of material fact about the Bank’s good faith here. He points first to the Bank's mistaken classification of the Form I-797C. While he is correct that the Bank mistakenly listed a Form I-797C as permanent proof of residency in some of its letters to Nia, nothing in the record suggests that the Bank's mistake was not in good Page 12faith. Contrary to Nia’s assertions, the Bank never 'withh[e]ld' the fact that the Form I-797C would expire. Months before the deadline, the Bank’s August 2019 letters informed Nia that “[t]he temporary residency documentation you provided will soon expire.” Nor did the Bank “ignor[e]” the Form I-797C’s internal, November expiration date when it threatened to restrict Nia's account unless he submitted updated documents by an October deadline. The Bank was merely following its consistent practice of asking that new documentation be submitted several months before the previous documents would expire: indeed, in 2016 and 2019, the Bank requested that Nia submit updated documentation a few months before his driver’s license expired.

Second, Nia argues that unnecessarily discriminatory actions inherently lack good faith. To support this assertion, Nia points to two letters sent by third parties complaining about the Bank’s policy as “reliable evidence” that the Bank was not acting in good faith. Cortez Masto, Menendez Criticize Bank of America’s Policy of Questioning Customers' Citizenship Status , Catherine Cortez Masto (Oct. 2, 2018), https://www.cortezmasto.senate.gov/news /press-releases/cortez-masto-menendez-criticize-bank-ofamericas-policy-of-questioning-customers-citizenshipstatus/ [https://perma.cc/BY2F-N7LU]; Nat'l Iranian Am. Council, NIAC Calls for Bank of America to Stop Closures of Iranian American Bank Accounts (July 19, 2019), https:// niacouncil.org/niac-letter-bank-america-discriminatoryaccount-closures/ [https://perma.cc/W2TA-PXKH]. But whether third parties dislike the Bank’s policy says nothing about the Bank’s good faith. The citizenship-based application of the CRM policy that Nia and the letters complain of merely adheres to OFAC guidance on how to comply with sanctions regulations.

Page 13Finally, Nia contends that seven CFPB complaints prove that the Bank’s actions were not taken in good faith. Once again, third-party disapproval has no bearing on the Bank’s good faith. But even accepting Nia's premise that these complaints could create a genuine issue of material fact about the Bank’s good faith, a handful of CFPB complaints (only one of which actually confirms that the complainant is an Iranian citizen) falls far short of proving any sort of widespread lack of good faith motivating the Bank’s CRM policy. The Bank has served 67,000 Iranian citizen accountholders since 2016. Misapplying the CRM policy to one of those 67,000 Iranian citizen accountholders (or even seven, charitably assuming the six other complaints Nia flags were filed by Iranian citizen complainants, which even Nia isn't sure about) does not create a genuine issue of material fact about the Bank’s good faith.¹

The district court properly granted summary judgment to the Bank based on IEEPA’s liability shield provision. The relevant agency guidance explicitly permits the Bank to account for citizenship in a comprehensively sanctioned country in administering its sanctions compliance program, and Nia failed to identify a genuine dispute of material fact about the Bank’s good faith.

AFFIRMED.