Enforcement of UK Compliance Starting to Bite and not just Bark

Andrew Northage, Partner, Walker Morris LLP
January 21, 2023

What’s the point in imposing tough new sanctions without having the enforcement tools to back them up and the capability to deploy the tools available? With Russia’s invasion of Ukraine acting as a catalyst, we’re seeing various concerted efforts to strengthen sanctions enforcement activity. But while increased cross-border collaboration is expected, jurisdictional differences in the approach to sanctions enforcement remain.

The UK Position

In the UK, a breach of financial sanctions may be a criminal offense, punishable on conviction by up to seven years in prison. Both civil and criminal enforcement options are available to remedy a breach of financial sanctions. While the UK’s law enforcement agencies deal with criminal investigations and prosecutions, the Office of Financial Sanctions Implementation (OFSI) has the power to impose civil monetary penalties of up to £1 million or 50% of the value of the breach, whichever is higher.

A strict liability test was introduced last year, removing the requirement for OFSI to show that a person had knowledge or reasonable cause to suspect he or she was in breach. OFSI still needs to show that the breach occurred ‘on the balance of probabilities.’

Importantly, separate penalties can be imposed on a corporate body and its officers. Failure to comply with a reporting obligation or information request is also an offense. OFSI, and the courts, interpret the prohibitions in sanctions laws widely. As well as issuing monetary penalties, OFSI can issue warnings, refer regulated professionals to their regulator, publish information about a breach, and refer the case to law enforcement.

In its enforcement guidance published in June 2022, OFSI says it takes a holistic, proactive approach to ensuring compliance instead of waiting for the law to be broken and then reacting. Each breach is considered case-by-case, with the focus on reaching a ‘fair and proportionate’ outcome. This includes assessing the severity of the breach and the conduct of the individuals. For example, whether they knew or suspected that their conduct amounted to a breach. There is a right of review and appeal.

OFSI will consider various aggravating and mitigating factors and the public interest when deciding how to proceed. Relevant factors include intentional circumvention of sanctions (including professional facilitation); the financial value of the breach; the harm or risk of harm to the sanction regime’s objectives; the level of actual and expected knowledge of sanctions and compliance systems; behavior; failure to apply for a license or breach of license terms; repeated, persistent or extended breaches; breach reporting; voluntary disclosure of a breach; and failure to provide information.

OFSI categorizes the severity of a breach as ‘serious’ or ‘most serious’ and places considerable value on voluntary disclosure. This can result in a reduction of up to 50% of the final penalty amount in ‘serious’ cases and up to 30% in cases deemed ‘most serious.’

The fact is, though, that OFSI has shown a marked reluctance to use the powers in its arsenal. In 2021 and 2022, OFSI issued only four monetary penalties to an aggregate value of £132,000. Only £45,000 of that was in 2022. OFSI does not routinely publicize cases it refers to UK law enforcement, but we have yet to see a criminal prosecution for UK sanctions breaches.

Walker Morris has acted in several recent high-profile cases where it has been necessary to obtain a license from OFSI so that a corporate acquisition does not breach sanctions. In those cases, there was no doubting the diligence, scrutiny and senior-level involvement of OFSI staff in gaining a detailed understanding of the transaction and ensuring the license went no further than strictly necessary. It remains to be seen whether the enforcement team benefits from the same level and degree of resource.

The US Sets the Tone

OFSI is the new kid on the block compared with its US counterpart, the Office of Foreign Assets Control (OFAC). Established in 2016, OFSI was modeled in many ways on the US system. Before then, civil penalties were not available as an enforcement tool.

While the UK and US regimes share similar features – a strict liability test, extraterritorial reach, and the ability to issue civil monetary penalties and general licenses – OFSI hasn’t pursued sanctions enforcement with the same zeal and level of productivity as OFAC. That may be about to change following October’s announcement of the enhanced collaborative partnership between the two.

OFSI is bolstering its headcount following the unprecedented burst of activity in response to the situation in Ukraine. The deeper level of cooperation between OFSI and OFAC is said to “support OFSI’s move to a larger and more proactive organization.”

For most US sanctions programs, the maximum criminal penalty for each violation is $1 million or 20 years in prison. The current maximum civil penalty is the greater of $330,947 or twice the amount of the underlying transaction.

OFAC’s enforcement approach is set out in its Economic Sanctions Enforcement Guidelines. As in the UK, a range of aggravating and mitigating factors will be taken into account on a case-by-case basis. In 2019, OFAC released a Framework for OFAC Compliance Commitments, which “strongly encourages” US and non-US organizations to employ a risk-based approach to sanctions compliance by developing, implementing, and routinely updating a sanctions compliance program. It says each program should be based on and incorporate at least five essential components of compliance: management commitment; risk assessment; internal controls; testing and auditing; and training.

The existence, nature and adequacy of a sanctions compliance program are likely to feature in OFAC’s case assessment in the event of a sanctions violation. Corporates and their officers would be well advised to follow the details set out in the framework when devising, monitoring and updating their compliance programs.

In 2021, OFAC published a special compliance guide for the virtual currency industry, reflecting an increased focus on sanctions enforcement in virtual currencies and other digital assets. The Department of Justice, responsible for criminal enforcement, announced in March 2022 the launch of TaskForce KleptoCapture, an interagency law enforcement task force to enforce the measures imposed in response to Russia’s invasion of Ukraine, including targeting efforts to use cryptocurrency to evade US sanctions.

A Multinational Team Sport

In a speech in June 2022, Lisa Monaco, the US deputy attorney general, attracted attention when she repeated her earlier description of sanctions as “the new FCPA (Foreign Corrupt Practices Act),” saying, “it’s not just the war in Ukraine that has prompted a new level of intensity and commitment to sanctions enforcement. We have turned a corner in our approach.”

Monaco explained that the FCPA and sanctions enforcement are relevant to an expanding number of industries and have extended beyond just US actions to an increasingly multilateral enforcement regime. Describing sanctions enforcement as “more and more a multinational team sport,” she stressed that for any business with an international supply chain, sanctions should be at the forefront of its approach to compliance.

What About Europe?

While the EU has played a central role in imposing Russia sanctions, there are arguments that it lacks the enforcement power of its UK, US and other collaborators. With sanctions enforcement left to the individual member states, there is no consistency of approach, including how the offense is categorized (criminal and/or administrative) and the level of penalties available. This fragmentation threatens to weaken the effectiveness of the sanctions regime and the EU’s position on that multinational team.

In a recent move to help resolve this issue, the European Commission proposed harmonizing criminal offenses and penalties for the violation of EU sanctions across the EU.

Key Takeaways

If anyone doubted the seriousness of sanctions compliance before Russia invaded Ukraine, that ship has well and truly sailed. The message is loud and clear: sanctions enforcement activity is becoming more intense and more joined up across jurisdictions. Having appropriate compliance programs in place is critical, as is voluntary disclosure. In the words of the US deputy attorney general: “Pick up the phone and call us. Do not wait for us to call you.”

Andrew Northage is a member of the ACSS Editorial Task Force and partner in the regulatory and compliance team and head of international trade at UK law firm Walker Morris. Andrew specializes in financial services regulation and financial crime, including bribery, money laundering and sanctions compliance. Andrew has worked for an international firm in London and as an investigator and prosecutor for the Serious Fraud Office.

Recent Articles