Sanctions Enforcement: Lessons Learned from 2022 and How to Prepare Going Forward Authored by Jeremy Zucker, John Bedford, Darshak Dholakia, Hrishikesh Hari, Navpreet Moonga and Tom Stroud February 2023 Sanctions Enforcement: Lessons Learned from 2022 and How to Prepare Going Forward February 2023 / Authored by Jeremy Zucker, John Bedford, Darshak Dholakia, Hrishikesh Hari, Navpreet Moonga and Tom Stroud Key Takeaways Key takeaways from Sanctions Enforcement Activity in 2022 and Outlook for 2023: In 2022, the US, UK and EU all escalated their sanctions enforcement rhetoric. For example, senior US enforcement officials went so far as to describe sanctions as “the new FCPA” (referring to the US. Foreign Corrupt Practices Act), signaling an expected “sea change” in the intensity with which sanctions violations will be prosecuted. Although the UK and EU continue to lag behind the US in pursuing sanctions enforcement actions, legislative and procedural changes in the UK and EU, including the UK’s introduction of strict liability for civil sanctions breaches, will strengthen their respective enforcement regimes going forward. The UK also significantly increased the resources available to its financial and trade sanctions enforcement agencies, which should translate into an uptick in enforcement. In addition, enforcement agencies have cooperated at an unprecedented cross-agency and cross-jurisdictional level over the past year. The US Treasury Department’s Office of Foreign Assets Control (“OFAC”) and UK’s Office of Financial Sanctions Implementation (“OFSI”) entered into an “enhanced” partnership, and the touted creation of an EU-wide sanctions body would be a step-change for the EU enforcement regime. We anticipate a wave of enforcement activity – across agencies and jurisdictions – will follow the sanctions implemented in the wake of Russia’s invasion of Ukraine last year. Companies in the virtual currency and crypto realm also should expect increasingly aggressive enforcement. As in the realm of anti-corruption compliance, companies should meet the moment with a risktailored, best practices approach to sanctions compliance, with programs designed to avoid and/or detect violations and to provide a reasonable basis for negotiation should violations occur notwithstanding best efforts. Companies should take steps now to mitigate the risk of being subject to an enforcement action, including by conducting or refreshing risk assessments (particularly as the sanctions risk landscape has changed significantly over the past year), reviewing and updating compliance policies and procedures, and conducting training of key personnel. Dechert LLP February 2023 Page 2 United States Highlights US Enforcement Activity in 2022 The number of OFAC enforcement actions remained steady in 2022, with 16 actions totaling penalty and settlement amounts of over USD 42 million compared to 16 enforcement actions with total settlement amounts of nearly USD 21 million in 2021. These figures are significantly lower than a 2019 peak of 26 actions giving rise to penalty and settlement payments of over USD 1.2 billion. The 2022 increase from 2021 is mainly attributable to USD 24 million payable by cryptocurrency exchange Bittrex Inc. (“Bittrex”) in the largest OFAC settlement to date with a cryptoasset firm. Having appropriate compliance procedures in place – and ensuring such procedures are implemented and followed appropriately – remains the most significant factor influencing OFAC’s response to an alleged violation of sanctions. Continued Focus on Cryptocurrency President Biden’s March 9, 2022 Executive Order on Ensuring Responsible Development of Digital Assets flagged crypto assets as a tool for circumventing sanctions and advocated a multi-agency approach to enforcement. Since its publication, there have been a range of developments in the enforcement of sanctions against persons involved with crypto assets. OFAC’s 2021 guidance for the virtual currency industry stresses the need for customized compliance programs that carefully consider exposures and controls using a range of factors, including client base, products and services, geographical locations, and what information is available to a company when screening for risks. OFAC’s settlements with Bittrex and Payward, Inc. (“Kraken”) in October and November 2022, respectively, illustrate OFAC’s expectations for the sector in light of this guidance. Both are global virtual currency exchanges established in the United States. Both companies maintained procedures to screen for designated persons but allegedly failed to implement adequate controls to prevent persons located in comprehensively sanctioned jurisdictions from transacting with US persons. In the Bittrex action, the majority of alleged breaches took place while the company was nascent and involved low value transactions making up a small percentage of Bittrex’s annual transaction volume, but OFAC nevertheless pursued an enforcement action against the company. Small businesses and others in emerging technology sectors transacting internationally should therefore take care to implement compliance regimes appropriate to the size and nature of their business from the outset, reviewing these regularly as the business grows or adapts. In each case, the swift implementation of remedial measures once the companies became aware of a potential sanctions non-compliance risk was an important factor in reducing the ultimate penalties. These actions highlight OFAC’s expectation that businesses based in the United States or that process payments through US financial institutions must use all information obtained in the normal course of business (such as IP and geographical addresses) to properly screen for entities and persons located in jurisdictions subject to sanctions. Merely screening against the OFAC List of Specially Designated Nationals and Blocked Persons (“SDN List”) and other applicable sanctions lists is insufficient. The Kraken case also demonstrates the need for crypto businesses to screen on an ongoing basis, not only on account opening, as OFAC found that certain persons geolocated in one jurisdiction at account opening had later transacted from comprehensively sanctioned jurisdictions in breach of multiple sanctions regimes. In addition to coming under investigation for sanctions violations, crypto businesses also could be designated themselves under sanctions regimes targeting cyber-attacks and money laundering. On August 8, 2022, OFAC controversially imposed (and later re-imposed) sanctions on Tornado Cash, a cryptocurrency mixer, leading to ongoing lawsuits on the legality of the designation and questions about the type of organization that can be subjected Dechert LLP February 2023 Page 3 to sanctions (see our prior update). Proponents of Tornado Cash, including major cryptocurrency exchanges, argue that it is an autonomous software that, unlike a natural or legal person, cannot be designated by US sanctions laws. OFAC instead has argued that Tornado Cash falls under the definition of a designable entity in the relevant legislation, being a “partnership, association, trust, joint venture, corporation, group, subgroup, or other organization”. The outcome of this litigation is eagerly awaited and could have a significant impact on the breadth of OFAC’s jurisdiction. Technical advisors have also faced prosecution for sanctions evasion during 2022. One case prosecuted by the US Department of Justice (“DoJ”) involved a US citizen allegedly conspiring to provide North Korea with services including technical advice on using cryptocurrency and blockchain technology to evade sanctions in contravention of the US International Emergency Economic Powers Act. Along with the United Kingdom’s attention falling on “key enablers” (see below), advisors and service providers are very much within the sights of enforcement agencies. Multi-agency Enforcement The Bittrex action was also the first parallel action in the virtual currency space by OFAC and the US Treasury Department’s Financial Crimes Enforcement Network (“FinCEN,” which focuses on money laundering, terrorist financing, and other financial crimes). Since 2019, OFAC has made clear that it will not necessarily give credit for fines paid to other agencies in global or multi-agency settlements. In Bittrex, FinCEN instead credited payments made to OFAC in the calculation of its own civil monetary penalty. While OFAC’s policy therefore notionally increases businesses’ exposure to fines when reaching global settlements, it is only effective if the other agencies involved take a similar stance. If, like FinCEN, they do not, the liability simply shifts between agencies while OFAC protects its own revenues. In Bittrex’s case, both FinCEN and OFAC form part of the US Department of the Treasury, but the policy may cause greater frictions where settlements are increasingly sought to be negotiated with agencies outside the department or abroad. There have been a number of examples of international global settlements in the enforcement of US sanctions to date. Furthering these efforts, in October 2022, OFAC and OFSI announced an “enhanced partnership” including on sanctions enforcement matters. As sanctions become a tool for targeting activities such as cyber crime and money laundering rather than just political or terrorist regimes and the entities which facilitate them, we may expect multiagency, multi-jurisdictional enforcement actions and agreements to increase. Judicial Oversight OFAC has continued to strongly preference negotiated settlements (and the imposition of civil monetary penalties) to prosecution. As with deferred prosecution agreements, the practice continues to raise questions about the propriety of payments made to enforcement agencies only on the basis of “potential” liabilities, without facing any standard of proof. Settlement remains preferable for both businesses and agencies on account of the costs and time involved, but the absence of judicial oversight may become a more significant issue if OFAC pursues a greater number of actions on more challenge-prone grounds in the context of a tightening economy. Export Control Enforcement Activity Alongside an intensification of OFAC enforcement, the year has seen a parallel strengthening of trade sanctions enforcement. On June 30, 2022, the U.S. Department of Commerce’s Bureau of Industry and Security (“BIS”) announced four significant policy changes to strengthen its enforcement of export controls. BIS stated that it would: (i)ºuse existing authority to impose significantly higher monetary penalties and be more aggressive in doing so; (ii)ºoffer non-monetary settlement agreements for less egregious violations; (iii)ºcease use of “no admit, no deny” Dechert LLP February 2023 Page 4 settlements, instead requiring an admission of underlying factual conduct; and (iv)ºcreate a separate fast-track for minor and technical voluntary self-disclosures to more efficiently close out these cases. Penalty and conviction data from BIS is not yet available, and the effects of its policy changes are likely to be seen in the course of 2023. Expected Focus on Russia Sanctions Violations OFAC enacted numerous complex sanctions related to Russia and Ukraine during 2022. The agency did not, however, settle any public enforcement actions in 2022 involving violations of Russia- or Ukraine-related sanctions. We expect OFAC and other enforcement agencies will focus on penalizing violations of these sanctions regimes in 2023 and beyond. European Union Highlights In 2022, sanctions enforcement by Member States has, with certain exceptions, been limited. Sanctions are imposed at the EU level, but Member States are responsible for implementation and enforcement. The European Union is, however, focused on increasing coordination of sanctions-related enforcement amongst Member States, driven by the extensive sanctions introduced in response to the Russian invasion of Ukraine. In an enforcement landscape where even the Dutch National Coordinator for Sanctions Compliance and Enforcement (“Dutch NCSCE”) described its own internal supervision of sanctions compliance as “fragmented” in June 2022, it is likely to take time for increased coordination to take effect. One such game-changing initiative would be the creation of an EU-wide sanctions authority. Strengthening National Enforcement Laws Certain Member States have bulked up their national sanctions enforcement laws to ensure effective implementation of EU sanctions packages. Germany adopted Sanctions Enforcement Act I in May 2022, with proposals for Sanctions Enforcement Act II published in October 2022. The acts increase the powers of authorities to access information critical to investigations, clarify ownership issues, and establish a national register for frozen assets and assets of unclear origin. In June 2022, the Dutch NCSCE also called for legislative changes to strengthen the legal basis for data sharing. Notable Enforcement Actions While there have been limited reports of enforcement by Member States, notable enforcement actions across the European Union this year include: In June 2022, Munich prosecutors reportedly seized assets from a Russian politician and his wife, in the first German case to deal with alleged breaches of Russian sanctions. Subsequently, in September 2022, German police reportedly conducted raids at 24 properties across Germany as part of a sanctions evasion investigation targeting a Russian national. Prosecutors allege that the Russian national breached EU sanctions imposed against him shortly after the Russian invasion of Ukraine. In October 2022, the French cement producer Lafarge and its Syrian subsidiary pled guilty to paying designated terrorist organizations ISIS and ANF, and was subject to a USD 776 million penalty after investigations involving US, French and Belgian authorities. This action demonstrates the commitments of authorities in multiple jurisdictions in the US and Europe to work together to prosecute sanctions violations. Dechert LLP February 2023 Page 5 In November 2022, the Amsterdam District Court ruled that squatters occupying a home belonging to a sanctioned individual, Arkady Volozh, were not required to vacate the property. Volozh argued that he had been renovating the house in order to move in with his family, but the squatters pointed out that Volozh was prohibited from entering or transacting in the Netherlands as a result of his designation, and that there were signs that the property was being renovated for sale or rent. The case is one of a number which raise interesting questions of what should be done with frozen assets, both generally and to support enforcement efforts. Ebbs and Flows in the Harmonization of Sanctions Enforcement The most significant move towards EU enforcement harmonization would be the establishment of a central EU sanctions authority, similar to OFAC, enabling greater oversight of sanctions enforcement across the European Union and improving information flows between national enforcement authorities. EU officials aired such a proposal during the summer of 2022, in a push for tougher and more consistent enforcement of Russian sanctions, but we are yet to see concrete proposals for any such body. Certain tools to enhance coordination have nevertheless been implemented, with the EU introducing the Sanctions Whistleblower Tool in March 2022. The tool facilitates the reporting of sanctions violations or circumvention to the EU Commission, which passes information to relevant national authorities after a preliminary credibility review. The EU Council has also allocated a budget of EUR 450,000 up to the end of 2024 for the development and implementation of sanctions-related IT tools to support information exchanges between EU bodies, Member States and other stakeholders. For Russia-related sanctions, Member State authorities, Europol, Eurojust and Frontex have cooperated since April 2022 through the umbrella Operation Oscar, to share information relating to economic crime and circumvention of sanctions across the European Union. Centralization of reporting and information-sharing functions are a significant step towards EU-wide enforcement, but reliance on national authorities to take those reports and information forward leaves open the risk of inconsistent enforcement activity, whether due to national variations in resources or appetite. Criminalization of Sanctions Violations The major legislative proposal affecting sanctions enforcement in the European Union during 2022 has been the criminalization of sanctions breaches across the bloc. The European Union has published proposals criminalizing a wide range of conduct including failure to freeze funds and circumvention of EU sanctions, setting minimum penalties including fines of no less than 5% of the total worldwide turnover of an entity in the business year preceding the imposition of the fine. While sanctions violations are currently a criminal offence in 25 out of 27 EU Member States, their definitions and penalties can vary greatly, increasing the risk of circumvention. The European Union has decided that sanctions violations are of equivalent seriousness to other crimes already listed in the EU’s foundational treaties, which include terrorism and money laundering, as breaches can threaten international peace and security, support for democracy, the rule of law and human rights. A Backwards Step on Beneficial Ownership 2022 has also witnessed new challenges in the area of corporate transparency. On November 22, 2022, the European Court of Justice ruled that a provision under EU anti-money laundering laws granting unfettered public access to beneficial ownership registers infringed fundamental rights to privacy and private and family life, enshrined in the Charter of Fundamental Rights of the European Union. In the immediate aftermath of the judgment, nations including Luxembourg, the Netherlands, Austria and Belgium removed public access to national registers, with a lack of clarity on how those with legitimate interests could continue to view records. While certain organizations which are Dechert LLP February 2023 Page 6 required by law to conduct anti-money laundering checks are still entitled to access the registers, the decision creates difficulties for numerous organizations that rely on beneficial ownership checks as an everyday risk mitigation measure. United Kingdom Highlights Mirroring the EU Member States’ limited enforcement record, OFSI imposed only two civil monetary penalties during 2022, relating to violations of Crimean and Syrian financial sanctions. However, OFSI notes in its recent Annual Review that it has “enhanced its enforcement capabilities, demonstrating its position as a world leader in responding to breaches of financial sanctions,” foreshadowing a potential increase in UK enforcement activity in 2023. UK Enforcement Activity in 2022 OFSI’s 2022 enforcement actions, while not including significant financial penalties, emphasize the breadth of issues that sanctions compliance programs must deal with, including intangible economic resources (such as publicity and IP) and ancillary transactions such as business travel: In May 2022, OFSI took action against Tracerco Limited, which indirectly breached Syria sanctions by making payments to a designated Syrian airline totaling just under GBP 3,000, through a travel agency and as part of an employee’s remuneration package. The monetary penalty, despite being reduced by 50% for voluntary disclosure, was five times the value of the payments made. In April 2022, OFSI imposed a fine of GBP 30,000 on Hong Kong International Wine and Spirits Competition Ltd, which received bottles of wine worth just under GBP 4,000 from and provided publicity for a designated Crimean winery. Publicity was considered by OFSI to be an intangible economic resource covered by the sanctions regime, reflected in the size of the penalty. In its latest Annual Review (covering the period from April 2021 to August 2022), OFSI confirmed that it had received 236 sanctions breach reports in the six months from the February 2022 invasion of Ukraine to August 2022, a significant increase from the 132 breach reports received by OFSI in the entire 2020-2021 financial year (from April 2020 to March 2021). How this will translate into enforcement activity, and whether OFSI is equipped to handle the caseload, remains to be seen. Increased Resourcing of Sanctions Enforcers In line with a UK commitment to prioritize enforcement, OFSI, responsible for civil enforcement of financial sanctions, and HM Revenue and Customs (“HMRC”), responsible for enforcement of trade sanctions, have both significantly increased their staff numbers. OFSI began 2022 with 45 staff but aimed to increase this to 100 by the end of the year. HMRC’s Economic Crime Supervision function similarly saw a significant increase in headcount. The National Crime Agency (“NCA”) has also launched a Combatting Kleptocracy Cell, dedicated to investigating sanctions evasion by “corrupt elites” and key enablers and supporting enforcement efforts by the NCA and other agencies. The new team has reportedly carried out close to 100 “disruptions” of persons linked to Russia sanctions. In July 2022, for example, the NCA arrested 10 individuals, including lawyers, on suspicion of helping “corrupt elites” evade sanctions. Dechert LLP February 2023 Page 7 Strict Liability and Enhanced Powers In a push to step up UK enforcement efforts, in June 2022, OFSI obtained powers to impose civil monetary penalties for financial sanctions breaches on a strict liability basis. This removes the requirement for OFSI to prove that a person had knowledge or reasonable cause to suspect that they were in breach of sanctions before a penalty can be imposed and brings the United Kingdom into alignment with the strict liability approach taken in the United States. OFSI guidance nevertheless states that it will still take into account knowledge and reasonable cause for suspicion in deciding on the appropriate enforcement action. No penalties have yet been issued under the amended rules, but we expect OFSI to seek to rely on these new powers in the near future. Other powers granted to OFSI include the ability to “name and shame” individuals and firms who have breached financial sanctions legislation but not received fines, which highlights the reputational risks of non-compliance with sanctions even in circumstances where a monetary penalty is not considered appropriate. Multi-agency Enforcement In July 2022, the NCA and OFSI jointly published a Red Alert to highlight typologies of sanctions evasion for the private sector. In light of the Red Alert’s emphasis on this area, there is likely to be a focus on issues of circumvention which concern movement of assets shortly before and after designations in the near future. OFSI’s 2021-2022 Annual Review noted that “OFSI is working with partner organizations such as the Financial Conduct Authority and National Crime Agency more closely than ever to provide joined-up enforcement across government. Cross-government liaison has become increasingly important in every corner of OFSI’s work.” In addition to cooperation with the NCA and other UK bodies, OFSI’s new partnership with OFAC (see above) seeks to exchange best practices and develop shared approaches to priorities such as cyber threats and crypto assets. Ownership and Control Differences The EU court’s decision on beneficial ownership registers has not affected the UK and seems unlikely to do so, but ownership and control has been at the center of tensions in navigating compliance with sanctions regimes and therefore managing enforcement risk. The UK has diverged from the US and EU by not aggregating asset freeze targets’ holdings in an entity unless the holdings are subject to a “joint arrangement” or are held jointly or one asset freeze target “controls” the entity. In contrast, the US and EU do aggregate holdings to determine whether an entity is sanctioned. This misalignment adds to the compliance challenges for businesses navigating the fraught and evolving sanctions landscape. New Focus on Cryptocurrency As indicated by the partnership priorities between OFSI and OFAC, cryptocurrency is also an area of heightened interest for the UK. OFSI, the FCA and Bank of England released a Joint Statement in March 2022, reiterating the need for the cryptoasset sector to comply with sanctions and setting out steps for cryptoasset firms to take to ensure compliance with sanctions obligations. At the end of August 2022, sanctions reporting obligations were explicitly extended to cryptoasset firms in the UK, expanding the basis on which OFSI can take enforcement action against cryptoasset exchange providers and custodian wallet providers. Unlike in the US, there has been no reported enforcement activity in the UK against a cryptoasset firm to date. Such scrutiny on the crypto sector by sanctions and financial regulators is expected to increase even further in the wake of the collapse of FTX. For example, HM Treasury recently launched its first consultation on the future regulatory regime for cryptoassets (see our recent update for additional details). Dechert LLP February 2023 Page 8 Looking Beyond 2022: How to Mitigate Enforcement Risks On June 16, 2022, US Deputy Attorney General Lisa Monaco warned that the DoJ was approaching sanctions enforcement with “unprecedented intensity,” shifting its gaze away from evasion and beyond financial institutions. As unprecedented sanctions packages have come into force over the course of 2022, 2023 promises a shift towards heightened enforcement activity across the US, EU and UK, making use of increased cooperation and informationsharing tools planned and put in place both nationally and internationally. While the United States continues to dominate the enforcement landscape with its broad jurisdiction over cases with a US nexus, growing headcounts at UK agencies and increasing centralization in the European Union may prompt a swell in the actions taken outside the United States. Going into 2023, companies can take steps now to mitigate potential enforcement risks. In particular, companies should consider: Conducting and refreshing risk assessments to identify activities most likely to raise sanctions compliance issues; Reviewing compliance policies and procedures to identify potential gaps and implementing enhancements as appropriate; Conducting training of key personnel; Reviewing credit agreements, subscription agreements, or other agreements with key business partners to identify potential disclosure or waiver obligations related to sanctions breaches; and Assessing whether a company’s auditors or other service providers might be subject to their own obligations to disclose potential sanctions violations committed by the company to government authorities. If sanctions violations are identified during the course of a review, companies might need to consider conducting a more thorough investigation to determine the scope of potential concerns. Where appropriate, companies may need to consider a voluntary disclosure to relevant authorities. Regardless, taking these steps now to identify and manage risks not only helps prevent sanctions violations from occurring, but also demonstrates a commitment to compliance that could help mitigate potential penalties in an enforcement action or even lead to government agencies declining to bring an action even if violations have occurred. Dechert regularly assists clients in developing and implementing measures to mitigate the risk of sanctions violations. We also assist clients in investigating potential sanctions violations and responding to government inquiries related to the same. Dechert LLP February 2023 Page 9 This update was authored by: Jeremy Zucker Partner Washington, D.C. +1 202 261 3322 [email protected] John Bedford Partner London +44 20 7184 7379 [email protected] Darshak Dholakia Partner Washington, D.C. +1 202 261 3467 [email protected] Hrishikesh Hari Partner Washington, D.C. +1 202 261 3347 [email protected] Navpreet Moonga Solicitor London +44 207 184 7354 Washington, D.C. +1 202 261 3332 [email protected] Tom Stroud Associate London +44 20 7184 7827 [email protected] The authors are grateful to Jennifer Hutchings, trainee solicitor in London, for her valuable contribution to this OnPoint. © 2023 Dechert LLP. All rights reserved. This publication should not be considered as legal opinions on specific facts or as a substitute for legal counsel. It is provided by Dechert LLP as a general informational service and may be considered attorney advertising in some jurisdictions. Prior results do not guarantee a similar outcome. We can be reached at the following postal addresses: in the U.S.: 1095 Avenue of the Americas, New York, NY 10036-6797 (+1 212 698 3500); in Hong Kong: 31/F Jardine House, One Connaught Place, Central, Hong Kong (+852 3518 4700); and in the UK: 160 Queen Victoria Street, London EC4V 4QQ (+44 20 7184 7000). Dechert internationally is a combination of separate limited liability partnerships and other entities registered in different jurisdictions. Dechert has more than 900 qualified lawyers and 700 staff members in its offices in Belgium, China, France, Germany, Hong Kong, Ireland, Luxembourg, Singapore, the United Arab Emirates, the UK and the U.S. Further details of these partnerships and entities can be found at dechert.com on our Legal Notices page.