On 1 April, HM Treasury received new powers to impose potentially significant monetary penalties on companies and individuals for breaches of financial sanctions law. These are an alternative to criminal enforcement, which remains an option. The new monetary penalties regime will be administered by the Office of Financial Sanctions Implementation within HM Treasury (OFSI), which has published guidance on how it intends to administer its new powers.
One key aspect of the guidance is the emphasis it places on voluntary self-disclosure of known and suspected breaches. Where OFSI intends to impose a monetary penalty, if there has been voluntary self-reporting this may result in a substantial reduction in the amount of the penalty (up to 50% depending on the circumstances). And it is one of the mitigating factors OFSI will consider in weighing up whether or not to impose a penalty at all. On the flip side of this, failure to disclose materially complete information or otherwise dealing with OFSI in bad faith will be an aggravating factor that may lead to a higher penalty or even a referral to the criminal authorities.
The maximum penalty that may be imposed under the monetary penalties regime is the greater of £1m or 50% of the estimated value of any funds to which the breach relates.
Our briefing below sets out in more detail how OFSI intends to exercise its powers and approach the issue of penalty reductions for voluntary disclosures.
These new powers are part of a package of changes to UK civil and criminal enforcement of financial sanctions law, which was introduced by the Policing and Crime Act 2017. See our earlier briefing for more on the other changes introduced by the Act.
Who may be subject to such penalties?
OFSI may impose a monetary penalty on any person it believes breached financial sanctions law where that person knew or had reasonable cause to suspect it was in breach. In determining this, OFSI will apply a balance of probabilities test, which is lower than the criminal standard of proof.
Senior management should pay particular attention to the new guidance because directors/officers/managers may face individual penalties if the breach took place with their consent or was attributable to any neglect on their part. This is in addition to any separate penalties levied on the company for the same breach.
What kinds of breaches will the penalties relate to?
For these purposes, a breach could be a failure to adhere to a prohibition—such as dealing with funds subject to an asset freeze—but it may also be a failure to comply with a positive obligation (such as the requirement that financial institutions disclose any dealings with persons targeted by asset freezing measures).
Not all breaches will be pursued. OFSI says it intends to take a ‘common sense’ approach and will not spend public resources pursuing minor or trivial matters—although repeated low-value breaches will be considered as serious rather than minor/trivial.
Whilst each case will be assessed individually, some categories of breach will, as a general rule, attract a monetary penalty (absent criminal enforcement). These include where deliberate action has been taken to circumvent sanctions, where the party in question has not been fully open in its dealings with OFSI, or, in the case of a regulated professional, where they have facilitated a breach of another.
It is also worth bearing in mind that OFSI has statutory powers to require the provision of information, and failure to provide information when required to do so may of itself give rise to a criminal offence. In this regard, OFSI may decide to impose a monetary penalty for not providing information when required to do so.
What mitigation is available? And in what circumstances?
A key mitigating factor is whether the party has made a timely, voluntary, and materially complete disclosure to OFSI and has dealt with OFSI in good faith. If it has, it may lead to a reduction of up to 50% in the final penalty amount where the person concerned has given prompt and complete voluntary disclosure of a (suspected) breach of financial sanctions that is assessed by OFSI as a ‘serious’ case, and a reduction of up to 30% for cases assessed as the ‘most serious’. And OFSI may take voluntary disclosures into account when deciding whether to use its discretion not to take any action at all.
In terms of the timing of (voluntary) disclosures, OFSI recognises some time may be necessary to assess the nature and extent of the breach, or to seek legal advice. But it will expect parties to make an early and full disclosure, based on the information available at the time, which can then be supplemented following further investigation.
What other factors will OFSI take into account in making its decision?
Some of the other factors OFSI will take into account when assessing a case are:
- the value of the breach and the level of harm caused;
- the root cause of the breach—whether it was deliberate, due to neglect, a systems and control failure, a misinterpretation of the law, or some other mistake; and
- whether the person is a regulated professional—those in the regulated sector are expected to have robust compliance systems in place and so a failure to meet regulatory standards may be an aggravating factor.
These factors will be considered in determining whether to impose a penalty, the seriousness of the case, and the level of the baseline penalty, following which any discount for voluntary disclosure would be applied.
Does the monetary penalties regime only relate to conduct in the UK?
No. But OFSI will only take action if there is a UK nexus to the misconduct. According to the guidance, examples of a UK nexus include: a UK company working overseas, transactions using clearing services in the UK, actions by a local subsidiary of a UK company (depending on the governance arrangements); actions taking place overseas but directed from within the UK, and/or financial products or insurance bought on UK markets but held or used overseas. These examples are not exhaustive, and each case would be assessed on its particular facts.
Does OFSI have the final say?
No. Persons subject to a penalty will have the opportunity to make representations to OFSI following its initial assessment of the case and level of penalty. If they disagree with OFSI’s final assessment, they can refer the matter for ministerial review and, if dissatisfied with the minister’s decision, they may appeal to an independent tribunal, whose decision is final.
What are the key takeaways from the guidance?
The new ‘balance of probabilities’ test for assessing whether there has been a sanctions breach that merits monetary penalties is likely to make it easier for the UK authorities to impose penalties on companies and individuals for sanctions breaches.
- The guidance places emphasis on the proactive (voluntary) disclosure of information concerning known/suspected breaches. It points out that a failure by relevant financial institutions to notify HM Treasury if they have dealings with a designated person or if they suspect that financial sanctions are being breached, is a criminal offence in its own right. But the guidance seeks to encourage voluntary disclosure even for businesses that do not provide financial services.
- Whilst OFSI has a good deal of discretion (e.g. it might challenge whether a disclosure really is voluntary, or whether full disclosure of all material facts was made on a timely basis), the guidance goes further than that produced by some other authorities who deal with financial crime in indicating OFSI’s commitment to using penalty mitigation to encourage self-reporting (the SFO, for example, encourages self-reporting of financial crimes but stops short of saying it gives rise to any automatic access to mitigation).
- Voluntary disclosure of potential breaches of the law should always be approached carefully. The guidance states that OFSI “expect all disclosures to be materially complete on all relevant factors that evidence the facts of a breach of financial sanctions, and to truthfully state these facts in good faith. If evidence later emerges that a disclosure was not materially complete for any reasons except a mistake or new facts emerging, or was made in bad faith, we will take this very seriously.” So care should be taken even in relation to an early (partial) disclosure to ensure that the facts it presents are correct and not misleading.
- Even if OFSI determines that criminal prosecution is more appropriate, the issue of whether there has been voluntary self-reporting could be a factor in determining a company’s suitability for a deferred prosecution agreement, which is now also a potentially available remedy for sanctions breaches as an alternative to prosecution. It would also be a relevant mitigating factor were a prosecution to proceed.
- Companies should ensure they have appropriately designed policies and procedures in place—not only aimed at ensuring compliance with financial sanctions but also to identify and respond to potential breaches if they occur. These should include suitable escalation and investigation procedures (involving legal input as appropriate) designed to address any known or suspected breaches in a timely manner.