European financial institutions navigating evolving Russian sanctions compliance

June 2024 | SPOTLIGHT | BANKING & FINANCE

Financier Worldwide Magazine

June 2024 Issue

European financial institutions (EFIs) have been facing an increasingly complex sanctions compliance environment since 2014, and most recently since the conflict in Ukraine in 2022.

Senior management at EFIs currently face a complex regulatory and enforcement environment with regard to Russian sanctions, which require dedicated budgets and human resources to address preventive, investigative and remediation measures to tackle potential issues as they arise.

For EFIs to effectively navigate evolving Russian sanctions, a multifaceted approach is needed. Sanctions compliance policies and procedures must be periodically reviewed and updated based on evolving guidance from regulators, especially with regard to periodically changing contravention risks and red flags relating to Russian sanctions.

Sophisticated technology solutions targeting transaction monitoring against sanctions lists, client due diligence and identifying patterns of potentially suspicious transactions have now become the industry standard. As problems arise, experienced counsel may be necessary to handle potentially conflicting rules in multiple jurisdictions, to minimise enforcement risks.

Ongoing training and education for frontline staff is similarly necessary to ensure adherence to existing policies and identifying evolving risks. Additionally, maintaining ongoing dialogue with regulatory authorities – either directly or through external counsel – can help EFIs better anticipate enforcement risks.

Based on advice of experienced counsel, EFIs may need to determine where voluntary disclosures or specific licence requests may be advisable. Finally, benchmarking against efforts made by peer institutions can be useful in gaining perspective and sharing best practices.

Complex regulatory landscape

The regulatory landscape for Russian sanctions compliance is fundamentally complex and continues to evolve. EFIs are regularly confronted with rapidly changing regulations, guidelines and best practices issued by the European Union (EU) and national authorities of individual European countries.

Most importantly, for EFIs that may be subject to US jurisdiction (e.g., presence of a US branch, correspondent banking activities or US person employees), adherence to complex US sanctions laws necessitates specialised expertise.

For EFIs operating across multiple jurisdictions, these can sometimes involving navigating these diverse and sometimes conflicting requirements, especially in higher risk situations, such as where an EFI may need to serve European clients doing legitimate non-sanctioned business with Russia.

To navigate these risks, EFIs must typically develop a strong team consisting of both in-house sanctions experts familiar with the nature of the business as well as external counsel who can advise the EFI on applicable laws or seek licences where necessary.

Where potential violations have been identified, external counsel can advise on whether they may merit a voluntary self-disclosure, especially in situations where the potential penalties could be significant.

Extraterritorial application of foreign law

Sanctions imposed by one jurisdiction may have extraterritorial implications, requiring compliance from entities outside the sanctioning authority’s jurisdiction. EFIs operating globally must navigate these complexities, ensuring compliance with both EU and non-EU sanctions regimes while respecting local laws and regulations in multiple jurisdictions.

While US and EU sanctions have been increasingly aligned for Russia, several key distinctions may arise, especially in situations where a counterparty or beneficial owner entity is sanctioned by one jurisdiction but not in another.

Experienced counsel capable of advising on both US and EU law can help EFIs mitigate this risk, especially where such risks can be avoided by structuring a transaction by avoiding the application of the law of a particular jurisdiction, especially the US.

Absence of a single licensing authority

Unlike the US and the UK, where a single sanctions regulator is responsible for issuing licences for derogations from applicable sanctions regulations, EFIs may need to seek licences from individual authorities depending on their country of incorporation.

Since national sanctions regulatory authorities are not similarly resourced with similar response times, obtaining a sanctions licence can be time consuming and unpredictable. The creation of a single sanctions regulatory authority in the EU is unlikely in the short term, so it is important for EFIs to develop ongoing dialogue with relevant national regulatory authorities and maintain a channel of communication where urgent requests could be escalated.

Unequal enforcement risks

When faced with potential sanctions risks that cannot be fully eliminated, EFIs may need to assess the likelihood of enforcement actions by the applicable regulatory authorities, as well as the severity of the penalties.

For instance, while the EU is seeking to harmonise penalties by criminalising violations of restrictive measures, the current sanctions enforcement landscape can vary widely – ranging from administrative or civil sanctions to criminal penalties.

However, the historic enforcement penalties in most EU jurisdictions for violations of economic sanctions have been relatively limited. On the other hand, the US and UK have robust sanctions enforcement mechanisms, which may present more pressing risk of criminal and civil penalties. The US has a long history of imposing multibillion-dollar penalties on EFIs for historic violations of US sanctions laws.

Growing complexity of sanctions lists

Compliance with the evolving Russian sanctions requires constant monitoring of multiple sanctions lists issued by different jurisdictions. These lists can include individuals, entities and corporate groups subject to sanctions, each with its own criteria and implications.

Ensuring accurate screening against these lists poses a significant operational challenge, especially for large financial institutions with extensive customer bases. EFIs typically seek assistance from external sanctions screening providers who can also create customised tools to help the EFI manage its specific risks.

Transaction monitoring

Following a wave of enforcement actions driven by the US, most EFIs have implemented robust transaction monitoring systems to detect and report any suspicious activity that could potentially raise sanctions issues.

However, distinguishing legitimate transactions from potentially illicit ones, especially in complex international networks, requires sophisticated technological solutions and considerable human resources. EFIs must ensure that their transaction monitoring technology (including Russian sanctions lists) is consistently updated, typically by an external vendor.

Customer due diligence

Conducting thorough due diligence on customers and counterparties is crucial for Russian sanctions compliance, especially where beneficial ownership information may be difficult to obtain.

However, gathering accurate and up to date information on clients with potential ties to Russia, particularly in cross-border transactions or dealings with Russian politically exposed persons (PEPs), can be challenging, especially if the EFI has a private banking business.

Implementing effective customer due diligence procedures while minimising inconveniences for legitimate customers can be a sensitive issue. Effective training of frontline staff at EFIs is crucial. They must be made aware of evolving guidelines provided by EU and foreign authorities regarding Russian sanctions contravention techniques and higher-risk jurisdictions (such as the United Arab Emirates, Turkey and Georgia) which have been implicated in Russian sanctions violations schemes.

Ambiguity over ownership and control

EU sanctions include considerations of both ownership and control by sanctioned subjects. Even where ownership interests can be determined (e.g., an entity is 50 percent owned by a sanctions target), determining ‘control’ by a target of sanctions can be a much more subjective and fact-specific exercise.

In such instances, experienced external counsel can provide guidance based on a risk assessment, or alternatively, seek guidance from regulators if appropriate.

Resource constraints

Achieving and maintaining Russian sanctions compliance requires significant financial and human resources. Smaller financial institutions and private banks may struggle to invest in the necessary technology, expertise and training to effectively manage compliance obligations, leading to potential vulnerabilities.

In such cases, risk assessment exercises may be helpful in isolating higher-risk activities and clients, and ensuring targeted resources are dedicated to monitor these relationships.

Joydeep Sengupta is a counsel at Mayer Brown. He can be contacted on +33 1 5353 3949 or by email: jsengupta@mayerbrown.com.

Joydeep Sengupta

Mayer Brown