U.K. Gets Tougher in Penalising Financial Sanctions Breaches – New OFSI Guidance

Background

The U.K. Office of Financial Sanctions Implementation (“OFSI”) has recently published an update of its Monetary Penalties for Breaches of Financial Sanctions Guidance (the “Guidance”) which is due to come into effect from 1 April 2021.

Key issues for firms to consider are:

• OFSI’s updated Guidance takes a broader approach to the territorial application of U.K. financial sanctions laws;
• Businesses or transactions with a more limited nexus to the U.K. might now be regarded by OFSI as falling within its remit;
• OFSI indicates that it will take a less tolerant approach where firms with otherwise good sanctions controls are involved in a contravention. A one-off breach is now more likely to result in formal enforcement action;
• OFSI stresses the need for full disclosure where a firm voluntarily reports a breach. An absence of full transparency may mean that a reduction in level of penalty will not be available in the case of voluntary disclosure;
• The tougher stance that OFSI sets out in the Guidance is consistent with more recent cases brought by OFSI, notably the £20.47 million imposed on Standard Chartered in February 2020; and
• The introduction of new unilateral sanctions powers under the Sanctions and Money Laundering Act 2018 creates the potential of the U.K. imposing a broader range of sanctions (as it has already done).

For firms in the U.K., the new Guidance highlights the need to have effective controls in place to comply with sanctions requirements. The combination of new legislation and a less benign enforcement environment means that the risks for firms have increased.

The updated Guidance clarifies how OFSI will exercise its powers to impose penalties for contraventions of sanctions requirements. These powers are conferred on OFSI by the Policing and Crime Act 2017 (“2017 Act”) as amended by The Sanctions and Anti Money Laundering Act 2018, and OFSI can exercise these powers for breaches of financial sanctions.

1. Introduction to the guidance and on whom a penalty can be imposed

Chapter 1 of the Guidance introduces the basic information about financial sanctions and sets out the powers created by s.146 of the 2017 Act.

The most notable change to the introduction is the deletion of the wording in paragraph 1.22, which states that “OFSI will not normally impose a penalty on any person who has already been prosecuted”. This deletion may indicate that OFSI intends to use monetary penalties in conjunction with other powers. Breaches of sanctions requirements are criminal offences which can be prosecuted. The above amendment to the Guidance indicates that OFSI might exercise powers to impose financial penalties even where the same party has been criminally prosecuted.

The remainder of paragraph 1.22 is unchanged which leaves OFSI to use its discretion to impose a penalty on “one person involved in a case and for another to be prosecuted criminally”.

2. Compliance and enforcement approach

OFSI confirms that it still intends to take a holistic approach in ensuring compliance with the U.K. financial sanctions regime, but it is worth noting the minor change to the language in paragraph 2.2 of the Guidance, where OFSI states that it aims to provide messages its audience can “understand and respond to”. The emphasis here is to ensure that the whole “lifecycle of compliance” is considered in an attempt to promote understanding of the guidance and to pre-empt potential breaches.

3. Case Assessment

Chapter 3 contains the most wide-ranging changes to the Guidance compared with the previous version and indicates the tougher stance on enforcement that OFSI is taking. It provides an overview of the considerations that OFSI will take into account when assessing potential breaches.

Paragraph 3.2 sets out the steps that OFSI may take in response to potential breaches and now states that it “may undertake several of these actions in any particular case”. This re-iterates the point implied by the deletion at paragraph 1.22 (see above) and suggests it might impose a monetary penalty as well as refer the case to law enforcement agencies for criminal investigation for example—this is a notable change from the previous guidance.

The drafting around responses to potential breaches has also been tightened. Rather than “issuing correspondence requiring details of how a party proposes to improve their compliance practices”, OFSI may now simply “issue a warning”. This suggests a potential escalation in the relationship with firms where a contravention is identified and a greater likelihood that there will be an enforcement outcome, even if this is just a warning.

The changes made to the Guidance also suggest that OFSI will show a greater interest in matters with a non-U.K. connection. OFSI’s previous Guidance stated, “We will not artificially bring something within UK authority that does not naturally come under it”. This statement has now been deleted at paragraph 3.8, which may suggest a greater desire to take on cases with a limited U.K. jurisdictional nexus and provide a wider scope under which OFSI may catch sanctions breaches. An example of this could possibly include payment flows through U.K. banks but it is still unclear the extent to which this wider net may be cast.

The Guidance has also removed wording that OFSI is “likely to treat a case that directly and openly involves a designated person more seriously than one that is a breach of financial sanctions but does not make funds or economic resources available to a designated person” (paragraph 3.16). When read in conjunction with the lowering of the threshold for ‘most serious’ cases (see paragraph 3.46), this might suggest a greater scope within which more individuals could be caught for breaches that are more serious.

OFSI will still consider the type of work a person does and “their exposure to financial sanctions risk” and “level of actual and expected knowledge” (paragraph 3.20) when determining the action to be taken. However, the deletion of wording from previous guidance (at paragraph 3.22) which suggested that a more lenient approach could be adopted if a person observing a high standard fell below that standard and acted swiftly to remedy the cause of the breach, would otherwise suggest that on balance a stricter, less forgiving approach may be forthcoming.

Furthermore, repeated, persistent or extended breaches will now be considered as an “aggravating factor”, especially when the individual is unresponsive to such previous warning (paragraph 3.26). The wording has become more forceful and suggests a tougher stance to those who do not respond to breaches appropriately, with the indication that all previous breaches will now be taken into consideration, rather than “tend to” as was previously drafted.

Disclosure requirements also seem to have become more onerous. Those self-reporting must report “all evidence relating to all the facts of the breach”, as opposed to information that is “materially complete on all relevant factors”. This removes the ability to decide one’s own materiality threshold and requires all information be disclosed for OFSI to make such assessment for itself.

The threshold for ‘most serious’ type cases has been lowered where “blatant flouting of the law” has been replaced with “particularly poor, negligent or international conduct.” Whether a breach is ‘serious’ or ‘most serious’ affects the monetary penalty amount imposed and so it is possible we may see higher penalties due to this rephrasing of the guidance.

4. The penalty process

OFSI states that it will still assess what level of penalty is “reasonable and proportionate” within the statutory maximum but there has been an amendment to the definition of ‘proportionate’ at paragraph 4.8 of the Guidance. The statutory maximum remains unchanged (i.e., it remains the greater of £1 million or 50% of the value of the breach), but there will now be “a holistic assessment of all the other factors present in the case” instead of the “value of the breach (if known) and how seriously the breach undermined the sanctions regime”. This appears to give greater discretion to OFSI where it has plenty of scope in deciding what factors are relevant.

Voluntary disclosure continues to be encouraged with up to a 50% reduction in the final penalty amount if prompt and complete voluntary disclosure is given. However, OFSI also states that if there have been a series of breaches “where only some were voluntarily disclosed to OFSI”, it “will take that into account when determining any reduction” in the potential penalty for the breach. Paragraph 4.10 makes clear that should there be a failure to make complete disclosure during an investigation (amongst other failures), this voluntary disclosure reduction may not be applied at all. This will be judged on a case-by-case basis and removes the automatic access to the voluntary reduction available previously. The effect this re-drafting has is to reward those who give full and complete voluntary disclosure, whilst removing access to a reduction for those who selectively disclose information simply to seek out a reduction.

Paragraph 4.11 now includes the provision that if there is an offence with no transaction value, OFSI will “impose such penalty as seems reasonable and proportionate to the facts of the case” whilst the permitted maximum for such cases is £1 million. This is a new addition to the guidance.

Paragraph 4.21 in the previous version of the guidance has also been removed from the latest draft. This is notable given that it provided OFSI with discretion not to impose a penalty in some scenarios such as where a penalty would have “no meaningful effect” or if it would be “perverse”. Again, this could hint at a greater appetite for pursuing potential breaches by OFSI.

5. Procedure for imposing a penalty

The guidance on procedure has not changed much other than the granting of a longer period in which a person can make written representations. This has been extended from 28 calendar days to 28 working days. OFSI may also now consider and respond to such representations within 28 working days rather than calendar days.

6. The right of Ministerial review and paying a penalty

Section 147(3)(b) of the 2017 Act states that OFSI must inform the person upon whom it is imposing a penalty that they are entitled to Ministerial Review. Such process and guidance largely remains unchanged in chapter 6 with the exception that the timeframe for seeking such review has been extended from 28 calendar days to 28 working days and that HM Treasury will aim for such reviews to be concluded within two months as opposed to 28 calendar days.

A deadline has also been introduced at chapter 8, which imposes a 28 working day timeframe within which to pay monetary penalties once such penalty has been finalised and payable. This differs from the “reasonable time” within which to pay as previously indicated. Such timeframe starts from the date the penalty is imposed.

7. Publication of penalty details

In accordance with Section 149(2) of the 2017 Act, the Treasury is required to publish reports about monetary penalties. Paragraph 9 of the guidance clarifies that the GBP value of the transactions which are in breach of the regulations will be aggregated if such GBP amount can be identified. This chapter has also been updated to clarify that the summary will only be published after the person has had the opportunity to exercise their right to Ministerial review. It also states that if there is an appeal to the Upper Tribunal and there is quashing or amendment to the penalty, OFSI will publish the amended information.

8. Conclusion

As can be seen from the above, it is apparent that the updated guidance signals a tougher approach to enforcement by OFSI. The changes at chapter 3 in particular signpost where it intends to expand the use of powers granted to it with responses to potential breaches no longer being mutually exclusive. It remains to be seen how the guidance will be implemented but the practical effects on those subject to U.K. financial sanctions, especially those self-reporting, could be significant.