Amazon on Friday disclosed Iranian business ties that may have violated US sanctions, warning that it may be penalised after a regulatory review of the activities.

The company said in a regulatory filing that from 2012 to 2016 it “processed and delivered orders of consumer products for certain individuals and entities located outside Iran covered by the Iran Threat Reduction and Syria Human Rights Act (ITRA).”

Amazon said it reported the transactions to the US Treasury Department’s Office of Foreign Assets Control and the Department of Commerce’s Bureau of Industry and Security. The world’s biggest e-commerce retailer said it will cooperate with a review by the agencies, and added that this could result in “penalties,” according to the filing.

In 2012, President Barack Obama signed the ITRA to strengthen trade restrictions on Iran and try to persuade the country to stop its nuclear activities.

This law imposes civil penalties and takes other action against foreign subsidiaries of US companies engaging in transactions with Iran. In January 2016, the US lifted some of the economic sanctions tied to the nuclear program.

Amazon said Friday it sold a variety of consumer products to individuals and unspecified groups controlled or owned by the Iranian government.

The goods ranged from apparel to software to pet products and cost $50 to about $2,400, according to the filing. Amazon said it doesn’t plan to sell to these accounts in the future.

“Our review is ongoing and we are enhancing our processes designed to identify transactions associated with individuals and entities covered by the ITRA,” Amazon said.