UK and EU sanctions enforcement: a change of gear

July 2023 | SPOTLIGHT | RISK MANAGEMENT

Financier Worldwide Magazine

July 2023 Issue

While the risks of stiff US penalties for sanctions violations have long been legendary, UK and European Union (EU) enforcement has been less serious. In 2022, the UK imposed total penalties of £45,000 for two sanctions violations; there have been none so far in 2023. By contrast, so far in 2023 the US Office for Foreign Assets Control (OFAC) has imposed six fines totalling over $540m.

However, there are signs that the times are changing. Stimulated in particular by efforts to increase the effectiveness of sanctions on Russia, there has been a shift in both the UK and the EU from the relentless expansion of sanctions to more robustly enforcing the measures that are now in place.

This includes closer alignment of sanctions policies and cooperation on their implementation between G7 countries, highlighted at the G7 Summit in Japan in May. The UK and US issued a joint statement on this last October, and the US and EU agreed in the week leading up to the summit to further boost their collaboration.

At the summit, the G7 agreed not only to reinforce cooperation among themselves but also to engage with third countries to ensure sanctions are not circumvented and to coordinate action against third country actors that materially support Russia’s war, including preventing third country branches of Russian banks from being used to avoid sanctions.

Official action

In the UK, the Office of Financial Sanctions Implementation (OFSI) doubled its staff during 2022 and is appointing a second director focused specifically on enforcement. This is in addition to changes made in mid-2022 that saw a breach of financial sanctions become a strict liability offence, such that OFSI may issue a monetary penalty without needing to demonstrate that a person had knowledge or reasonable cause to suspect they were in breach of a financial sanction.

The Financial Conduct Authority expects firms to have established systems to ensure compliance with sanctions and can take enforcement action in the event of deficiencies in those systems. The UK has also issued new guidance on preventing the circumvention of trade sanctions, making clear that traders are expected to ensure they consider the risks as part of their due diligence on counterparties, both when onboarding and then repeated at intervals to ensure the risk has not changed.

The EU has appointed a special envoy for sanctions implementation, set up a ‘Freeze and Seize Taskforce’ to ensure EU-level coordination of sanctions on oligarchs and is considering extending the role of the European Public Prosecutor’s Office to include the investigation of sanction violations. Such violations now constitute an “EU crime”, alongside offences such as terrorism, money laundering and corruption.

The European Parliament and the Council are considering a draft directive to harmonise and stiffen penalties for sanctions’ violations across all EU member states. These would include up to five years in prison for individuals and, for companies, measures including exclusion from access to public funding, disqualification from business, placing under judicial supervision, judicial winding-up or a fine of up to 5 percent of total worldwide turnover of the corporate group concerned.

This is also reflected in a much more robust approach to sanctions compliance and enforcement at the EU member state level. To take just one example, Germany adopted two Sanctions Enforcement Acts last year. These enhance cooperation among the various agencies and establish the Central Office for Sanctions Enforcement, which has primary responsibility for the investigation and seizing of assets of sanctioned persons.

In 2022, at least 150 cases were reportedly under investigation for alleged violations, and it is expected that this number has since increased significantly. In February 2023, three companies were raided under suspicion of having supplied electronic components which could also be used for military purposes, to Russia via a Turkish company.

There are also examples of regulators in different jurisdictions pressing others to crack down on circumvention. While the EU special envoy is visiting a range of countries, particularly in the Middle East and Asia, to encourage them to close sanctions loopholes, in April the US and the UK imposed coordinated designations of ‘professional enablers’ suspected of helping Russian oligarchs to hide their assets, including a number of lawyers and others based in Cyprus. The US subsequently provided the Cypriot government with substantial dossiers detailing the alleged activities of these individuals to assist with its investigations.

The EU Summit in March 2023 underlined the importance of stepping up efforts to ensure the effective implementation of sanctions within the EU and preventing circumvention by third countries. At the time of writing, the EU is finalising details of its 11th package of Russia sanctions to follow this up, with a number of new measures which it is understood may include restricting certain exports to third countries if there is a clear risk of circumvention and expanding the EU list of entities to which stricter export restrictions apply, including those in third countries involved in circumvention.

Reporting

In addition to oversight and enforcement conducted directly by the regulators themselves, they have enlisted others to act as their eyes and ears through broad, mandatory reporting obligations.

There are, of course, the well-known obligations on banks to provide detailed reports on frozen assets, on entities owning, holding or controlling frozen assets, and on any credits to frozen accounts or transfers of frozen funds.

The obligation now goes much broader. In the UK, relevant firms – not only banks but others such as auditors, estate agents, metal exchanges and cryptoasset exchange providers – must inform OFSI if a customer is a known or suspected designated person and provide any information they hold about the designated person by which they can be identified and the nature and amount or quantity of any funds or economic resources held on behalf of the customer.

The EU has significantly expanded its reporting obligations under Russian sanctions measures. Previously, all EU persons were required to report any information “which would facilitate compliance with the Regulation” – primarily, information on frozen assets. They must now also report any information in their possession about assets not yet treated as frozen. This could include, for example, assets that have been concealed by a designated person or assets that have not been correctly frozen. This requirement now applies “notwithstanding the applicable rules concerning reporting, confidentiality and professional secrecy”.

Furthermore, EU persons are now also required to report on the assets of designated persons which were subject to any move, transfer, alteration, use of, access to, or dealing in the two weeks preceding their designation as subject to an EU asset freeze.

This may affect not only those still holding the accounts of a designated person or entity, but could also capture those who no longer have any involvement with the frozen assets, for instance a notary who registered the sale of an estate or a lawyer who placed the assets under a new legal arrangement. In such cases, records should be checked to assess whether there was any interaction with the assets of the person who was subsequently designated and if such interaction led to the movement of the assets in the two weeks preceding the designation.

The new EU rules will considerably extend the capacity of the national regulators to identify not only suspicious transactions but also sanctions violations committed inadvertently by firms that were, for any reason, unaware of the restrictions in place.

It is worth highlighting that while operators may reasonably expect a reputable bank to prevent them from breaching sanctions by receiving funds from a designated person, if an operator attempts to make a payment to a person whom they have failed to identify as designated, their bank will be obliged not only to freeze such funds but also to report the attempted payment, which would constitute a sanctions violation.

Reputational risks

Even where no penalties are imposed, the authorities or the media may ‘name and shame’ a firm, potentially inflicting serious reputational damage.

In France, for example, energy group Total decided to continue operations in Myanmar, despite the impositions of sanctions following the military coup in 2021. The media and non-governmental organisations (NGOs) questioned its presence, arguing that it would be financing the state structures responsible for the repression.

Total claimed that it did not contribute either directly or indirectly to the violation of human rights in Myanmar and that its motives for maintaining its operations were humanitarian in nature. But continued pressure by NGOs and the threat of judicial action led Total to withdraw in 2022.

Changes to UK legislation in 2022 also gave OFSI the power to publicly name organisations that had breached sanctions, even where it had decided not to impose a penalty.

Litigation

At the other end of the spectrum, firms that adopt an unmitigated, conservative approach to sanctions and terminate contracts on the grounds that the counterparties might be subject to sanctions can face, and lose, litigation. This could be due to the fact that counterparties themselves or the activities covered by the contract are not in fact sanctioned. Or, even if they are sanctioned, contracts with only standard force majeure provisions or material adverse change clauses may not adequately provide for suspension or termination under such circumstances.

Compliance

While the UK has adopted a strict liability threshold for financial sanctions, the EU regime only imposes liability where a person knew or ought to have known that their actions violated sanctions. In both cases, however, ensuring compliance is the best way to fend off costly and damaging investigations and enforcement action by regulators.

Businesses that have not done so recently would be well-advised to review their sanctions policies and procedures, and ensure that they are dedicating sufficient resources, proportionate to the increased levels of risk. Key elements to consider include those outlined below.

First, identifying which jurisdictions apply to which transactions, including in particular whether there is any US nexus or secondary sanctions risk, and where necessary establishing effective recusal measures for staff concerned.

Second, rigorous screening for onboarding and continuing relationships with all business partners, including financial intermediaries, against all relevant sanctions lists, including assessment of whether undesignated business partners may be owned or controlled by a designated person.

Third, fulfilling the reporting obligations in respect of any business partners that are subject to an asset freeze.

Fourth, determining whether other financial or trade sanctions apply to a proposed transaction, such as granting new loans or credit, dealing in certain transferable securities and money market instruments, making new investments, conducting transactions with certain entities, exporting or importing listed goods and technology, or providing certain services.

Fifth, considering whether general licences or exceptions may be available to enable transactions to go ahead and if so under what conditions (e.g., reporting, record keeping) or whether there may be grounds to apply for a specific licence.

Sixth, ensuring that staff have up to date guidance and training, and robust internal reporting and audit procedures are in place.

Finally, checking that contracts can be suspended or terminated without liability or serious risk of judicial challenge, in the event that sanctions prevent their performance.

With the UK, EU and G7 gearing up their enforcement efforts and arming themselves with the resources and regulatory firepower they need to make their sanctions fully effective, now is a good time for all companies to ensure they in turn have dedicated proportionate resources to manage these risks.

Andrew Hood and Vivien Davies are partners and Richard Tauwhare is an adviser at Fieldfisher. Mr Hood can be contacted on +44 (0)330 460 6968 or by email: andrew.hood@fieldfisher.com. Ms Davies can be contacted on +44 (0)330 460 6695 or by email: vivien.davies@fieldfisher.com. Mr Tauwhare can be contacted on +44 (0)770 311 0880 or by email: richard.tauwhare@fieldfisher.com.

Andrew Hood, Vivien Davies and Richard Tauwhare

Fieldfisher