New legislation has given the UK Office of Financial Sanctions Implementation (OFSI) significant additional powers to impose financial penalties for breach of financial sanctions measures. Penalties of the greater of £1 million pounds or 50% of the value of funds or resources involved in a breach (if it is possible to make such an estimation) can now be imposed by OFSI.
It is expected that these new powers will see a significant increase in the number of companies and individuals in the UK who are fined for breaches of sanctions measures. In addition to fining companies, the powers allow OFSI to extend fines in certain circumstances to directors, officers or managers of companies that have acted in breach of sanctions measures.
This alert considers the new monetary penalty regime and what you should be doing to ensure compliance.
Breaches of financial sanctions are criminal offences. To date, the number of breaches that have been prosecuted in the UK are relatively small given the time and complexity of successfully pursuing criminal convictions. Part 8 of the Policing and Crime Act 2017 (the Act), which came into force on 1 April 2017 and which introduces the monetary penalties regime. provides an alternative to criminal prosecution for breaches of financial sanctions legislation.
Fines will be available to OFSI where, on the balance of probabilities, there has been a breach of a prohibition or a failure to comply with an obligation and the company or person responsible either knew or had reasonable cause to suspect that they were acting in breach.
The new power is similar in effect to the ability of HMRC to impose a Compound Penalty for breach of export controls in lieu of a criminal prosecution - a tool which they have deployed with some enthusiasm as being quicker and less costly than bringing a criminal prosecution.
To accompany the entering into force of the Act, OFSI has published guidance to explain the new penalty regime ("Monetary penalties for breaches of financial sanctions - guidance", the Guidance)
The Guidance clarifies both the circumstances in which OFSI may consider it appropriate to impose a monetary penalty for breaches of financial sanctions and how the amount of that penalty will be determined.
The Guidance confirms that:
- A penalty may be imposed on "a person", which includes a body of any type or an individual. Where a company receives a penalty, any "director, manager, secretary or other similar officer" of the company could also receive a penalty if the breach took place with the "consent or connivance" of, or due to the "neglect" of, that individual
- OFSI need only satisfy itself that "on the balance of probabilities" a person has breached financial sanctions and that the person knew, or had reasonable cause to suspect, that they were acting in breach. OFSI, therefore, need only make a judgment that it was more likely than not that there had been a breach in order to impose a monetary penalty
- The concept of "reasonable cause to suspect" is a an objective test that asks "whether there were factual circumstances from which an honest and reasonable person should have inferred knowledge or formed the suspicion that the conduct amounted to a breach of sanctions". This is useful clarification, as there has not previously been guidance on this term that is used widely in UK and EU financial sanctions legislation
- If OFSI concludes that a person did not know and did not have reasonable cause to suspect that they were acting in breach, it cannot impose a monetary penalty. However, it may take other action, such as requesting information on how the person intends to improve compliance in the future
- A breach does not have to occur within the UK for OFSI to impose monetary penalties. To come within the remit of OFSI's enforcement of sanctions, there need only be a "connection to the UK". Such a connection, or nexus, may result from a UK company working overseas, transactions being cleared in the UK, the actions of a local subsidiary of a UK parent, action taking place overseas but directed from the UK and so on. OFSI will assess whether there is a UK connection on a case-by-case basis. This is not a new concept as the scope of application of UK sanctions measures has always extended to activities beyond UK borders. However, the inclusion of this reference in the Guidance should serve to remind companies with global operations of the importance of assessing the scope of application of UK and EU sanctions measures to their commercial activities
- When OFSI has licenced an activity, the licence will be subject to conditions and may include reporting requirements. Breach of the terms of a licences is an offence that can attract a monetary penalty
- There are a number of aggravating and mitigating factors that OFSI will take into account when determining the level of monetary penalty. These include:
- Whether the breach makes funds or economic resources directly available to a designated person subject to asset freezing provisions - OFSI are likely to treat a case that directly and openly involves a designated person more seriously than one that is a breach of financial sanctions, but does not make funds or economic resources available to a designated person
- Whether the breach involves intentional circumvention of relevant sanctions provisions
- The estimated value of the breach
- The harm, or risk of harm, done to the objectives of the particular sanctions regime
- The compliance systems and processes that the business has in place. OFSI notes in the Guidance that, "some businesses have more in-depth knowledge of sanctions and better-developed compliance systems and processes than others, because of the kind of work they do. Businesses should make their own assessment of what is reasonable and necessary for their particular circumstances
- The behaviour of the party, including whether the breach was deliberate, whether there has been evidence of neglect or whether a simple mistake had been made
- Whether the party is a repeated or persistent offender
- Whether a voluntary disclosure has been made to OFSI in relation to a breach
The Guidance contains useful details in relation to OFSI's view on voluntary disclosures - a topic which OFSI has not commented widely on in public before.
OFSI confirms that breaches of financial sanctions "must" be reported to OFSI and that they expect all disclosures to "be materially complete on all relevant factors that evidence the facts of a breach of financial sanctions, and to truthfully state these facts in good faith".
OFSI sates that:
- It regards avoluntary disclosure of a breach of financial sanctions as a mitigating factor when it assesses a case
- A voluntary disclosure will have a "real effect" on any subsequent decision to apply a penalty
- If it identifies that a party has dealt with it in bad faith when making a voluntary disclosure and if the case is not criminally prosecuted, it will normally impose a monetary penalty
- It expects breaches to be disclosed in "a timely fashion, as soon as reasonably practicable after discovery of the breach". OFSI notes that it would support the approach of a company making an early disclosure with partial information and confirming that it is investigating the breach, taking legal advice and intends to make a further fuller disclosure
It is therefore clear that voluntarily disclosing sanctions breaches to OFSI after careful consideration with your legal advisors is a way of mitigating the risk of significant monetary penalties.
In addition to monetary penalties, the Act also increases the maximum criminal sentence for breach of sanctions from two to seven years imprisonment.
Furthermore, breach of financial sanctions has been brought within the scope of Deferred Prosecution Agreements and Serious Crime Prevention Orders. More details on Deferred Prosecution Agreements can be accessed in DLA Piper's briefing note here. As demonstrated by the recent high profile DPA's for Rolls Royce and Tesco such arrangements are likely in practical terms to be reserved for the most serious and complex cases.
In addition to imposing monetary penalties, OFSI have also confirmed in the Guidance that they can respond to a breach of financial sanctions in several ways, including:
- Issuing correspondence requiring details of how a party proposes to improve their compliance practices
- Referring regulated professionals or bodies to their relevant professional body or regulator in order to improve their compliance with financial sanctions
- Referring the case to law enforcement agencies for criminal investigation and potential prosecution
In summarising the changes to sanctions under the Act, HM Treasury Minister Simon Kirby said that the Government will "continue to place more emphasis on compliance and we will take tough action against those who deliberately flout the law".
As part of any financial sanctions risk assessment and compliance effort, companies should:
- Ensure that you have an appropriate trade compliance policy/procedures in place that are proportionate to the risk faced by your business and which your employees understand and implement
- Ensure that you know who you're doing business with - is your counterparty designated under sanctions measures? Is your counterparty owned or controlled by a person or entity designated under sanctions measures?
- Ensure your sanctions screening processes are working effectively - how are false positives dealt with? What is your internal escalation procedure if a sanctions hit is identified?
- Ensure that any funds or assets that you are holding for or on behalf of a sanctioned person or entity are frozen and reported as necessary to the relevant competent authority
- Consider the options for obtaining a licence to authorise commercial activity in line with exemptions and derogations provided for in sanctions measures