Sanctions: new monetary penalties for breaches of financial sanctions

The Office of Financial Sanctions Implementation (OFSI) was established on 1 April 2016 (see our previous article here). Exactly a year later, Part 8 of the Policing and Crime Act 2017 came into force, which creates powers for HM Treasury to impose monetary penalties for breaches of financial sanctions. OFSI will apply these powers.

OFSI has published general guidance and monetary penalties guidance on how it will use these powers. The guidance is extensive and should be a ‘must read’ for compliance teams. We summarise some key points in this article.

1.  What are OFSI’s new powers?

Previously, breaches of sanctions could only be punished by way of criminal proceedings, which were subject to the requisite criminal standard of proof. However, OFSI now has the power to impose financial sanctions on a person if it is satisfied, on the balance of probabilities (the civil standard rather than the criminal standard), that:

• the person has breached a prohibition, or failed to comply with an obligation, that is imposed by or under financial sanctions legislation; and
• that person knew, or had reasonable cause to suspect, that they were in breach of the prohibition or had failed to comply with the obligation.

A ‘person’ in this context includes individuals and corporate entities. Separate penalties can also be imposed on a legal entity and the officers who run it provided that OFSI is satisfied of the requisite levels of involvement by the individual in the transaction. It is also possible for OFSI to impose a penalty on one person involved in a case and for another person to be prosecuted criminally.

The monetary penalties regime created by the Policing and Crime Act provides an alternative to criminal prosecution for breaches of financial sanctions legislation. Following the coming into force of the Act, the maximum custodial sentence for breaches of financial sanctions has been increased to a maximum of seven years.

2. How will OFSI apply its powers?

The first step the OFSI will take is to establish whether there has been a breach of a prohibition or a failure to comply with an obligation.

To come within OFSI’s enforcement powers, there has to be a ‘UK nexus’. Although not prescriptive, the guidance states that the ‘UK nexus’ might be satisfied by factors such as:

• the company being a UK company operating overseas;
• transactions taking place using clearing services in the UK;
• relevant actions by a foreign subsidiary of a UK company (depending on the governance structure in place); or
• relevant action taking place overseas but being directed from within the UK.

UK companies should therefore be mindful that transactions carried out overseas may still be considered by OFSI to have a UK nexus.

The guidance states that OFSI will take several factors into account when determining how seriously it views a case.

• The conduct of those involved. OFSI will consider whether the breach seems to be deliberate; whether there is evidence of neglect or failure to take reasonable care; whether there has been a systems and controls failure or an incorrect legal interpretation; whether the person seems unaware of their actions; or whether there has simply been a mistake.
• Whether a case involves a designated person. Cases involving ‘designated persons’ (individuals identified as being subject to sanctions) will be treated more seriously than those that involve a breach of financial sanctions, but which do not make funds or economic resources available to a designated person.
• Whether there has been a circumvention of the offence. OFSI takes circumvention seriously and will normally impose at least a monetary penalty, if not a criminal prosecution.
• The value of the breach. A high-value breach is generally more likely to result in enforcement action, although OFSI recognises that there are circumstances involving lower-value breaches where enforcement action is also justified.
• Whether there is evidence of repeat, persistent or extended breaches. Repeated breaches will tend to result in OFSI taking more serious action.

The guidance also stresses that breaches of financial sanctions must be reported to OFSI.

3. What will the new penalties look like?

OFSI will adopt a 5-stage process to arrive at the penalty recommendation:

• Step 1: Determine the value of the breach;
• Step 2: Determine the maximum penalty: (£1m or 50% of the value of the breach – whichever is higher);
• Step 3: Apply the seriousness determination. This will either be ‘serious’ or ‘most serious’ depending on the facts;
• Step 4: Determine the baseline. This is based on the facts of the case and what level of penalty under the relevant maximum would be reasonable and proportionate; and
• Step 5: Determine if a reduction applies and, if so, apply the relevant percentage reduction to the baseline.

Enforcement action can also lead to reputational damage that in some cases will be as harmful as (if not more harmful than) the penalty itself. OFSI will normally publish details of all monetary penalties it imposes as well as a summary of the case, with the intention of driving future compliance. The penalty may also be publicised in the form of press releases.

4. What should I do next?

Although the more proactive approach to sanctions compliance and the provision of clear and up-to-date guidance will be welcomed by many, it is unclear how the powers of OFSI will be implemented in practice, in particular, how it will operate alongside criminal investigations.

Nevertheless, the UK government has clearly indicated that it intends to punish failures to comply with sanctions legislation more severely, both on the criminal and civil side going forward. If they are not already doing so, companies should review their sanctions compliance policies and procedures to ensure they stand up to scrutiny in light of the new powers now available to OFSI.