Financial Sanctions: A Minefield for Business
Things can change bewilderingly quickly in the world of financial sanctions.
On 21st September 2017, HM Treasury’s Office of Financial Sanctions Implementation (‘OFSI’), updated the financial sanctions relating to Ukraine’s sovereignty and territorial integrity. On 27th September 2017, it was Syria. On 29th September 2017, it was North Korea. On 2nd October 2017, it was ISIL (Da’esh) and Al Qaida Organisations. On 5th October 2017, the General Court of the European Union rejected two applications to annul listings on the EU’s Tunisia sanctions. On 6th October 2017, the Trump Administration announced that it would revoke sanctions on Sudan in return for their cooperation in relation to a ‘5 track plan’ that covered issues including counterterrorism co-operation, ending domestic hostilities and improving humanitarian access. Chief among US concerns was suspected Sudanese support for North Korea, seemingly now assuaged. The same administration continues publicly, almost daily, to prevaricate over the renewal of the Joint Comprehensive Plan of Action (‘JCPOA’) in relation to Iran, despite the fact that Iran appears to have honoured its commitments. On 10th October 2017, the Financial Times reported that, “Mr Trump is expected to refuse to certify the deal to Congress by an October 15 deadline and initiate stronger moves against Iran.” 
Blink and you’ll miss it.
OFSI was established in April 2016 and is responsible for implementing and enforcing financial sanctions in the UK. Other government departments play different roles. The National Crime Agency investigates breaches of financial sanctions. The Export Control Organisation, within the Department for International Trade, implements trade sanctions and embargoes but it is HMRC that enforces them. [Trade Sanctions, in particular import and export embargoes, will be explored in a separate article, coming soon.]
In the United States, The Office of Foreign Assets Control (‘OFAC’), within the US Department of the Treasury, plays a role similar to OFSI’s, administering and enforcing ‘economic and trade sanctions based on US foreign policy and national security goals against targeted foreign countries and regimes, terrorists, international narcotics traffickers, those engaged in activities related to the proliferation of weapons of mass destruction, and other threats to the national security, foreign policy or economy of the United States.’
In the eighteen months since OFSI’s inception – only weeks before the UK decided to leave the EU – HM Treasury has been busy. Given that the Council of the European Union (‘CoEU’) is one of the two principal sources of financial sanctions implemented in the UK (the other being the United Nations Security Council (‘UNSC’)) and that EU regulations currently take direct effect in the UK (they are implemented pursuant the Common and Foreign and Security Policy objectives) Brexit created an urgent need for a new mechanism for the implementation of sanctions.
Further, given the geopolitical issues listed above and a general escalation in the deployment of financial and other sanctions, including travel bans and import and export embargoes, it might be said that OFSI has been rushed off its feet.
In Q2 and Q3 of 2017, a welter of change was implemented or signalled:
- Part 8 of the Policing and Crime Act 2017 was brought into force, changing the legal framework for enforcing financial sanctions. Among other things, the 2017 Act: imported UNSC financial sanctions directly into UK domestic law; and, created powers for HM Treasury to impose monetary penalties for breaches of financial sanctions
- HM Treasury published its response to the consultation in relation to the process for imposing monetary penalties for breaches of financial sanctions
- OFSI published Guidance on Monetary penalties for breaches of financial sanctions;
- OFSI published more general Guidance on Financial Sanctions
- the government passed secondary legislation relating to disclosure within the financial sanctions version of the regulated sector, creating an offence of failing to report breaches of financial sanctions
- the government published its response to the public consultation on the United Kingdom’s future legal framework for imposing and implementing sanctions – the Foreign Secretary has promised to introduce a Bill ‘when parliamentary timetabling permits’
- the House of Lords EU External Affairs Sub-Committee inquiry into UK sanctions policy after Brexit, heard extensive oral evidence, and continues to receive written submissions, on the challenges and opportunities afforded by the UK’s withdrawal from the EU
So far so bewildering. Add to that the, often, discordant approaches taken by the CoEU, the UNSC and OFAC, there exists the very real possibility of confusion leading to paralysis for businesses:
“Those that are sanctioned are very good at changing their spots and stripes to avoid sanctions … in the United States, sanctions maintenance—keeping them updated and moving against the target—is a matter of course … You might be based in the UK and you might want to interact with Syria, let us say, but you will have one eye on the OFAC listing … If you look at the re-engagement with Iran, there are banks in continental Europe that are regional or domestic and are happily doing business with Iran because they are not concerned with what is going on in the United States.”
On such shifting sands, it can be difficult for businesses to know what to do and how to plan. Reputational risk and the possibility of blacklisting must be balanced against lost opportunity and the inevitable costs of due diligence in a global economy. The risk of ‘over-compliance’ looms large. In order not to stymy business, sanctions enforcement authorities must do more than enforce. They must: be properly resourced; act swiftly; be consultative with their counterparts in allied states; be consistent; and, offer practical advice and guidance. OFSI claims to do so.
What is the current regime in the UK?
Since 1st April 2017, all UNSC and CoEU sanctions, essentially, become UK domestic law automatically (for detail, see sections 152 to 155 of the Policing and Crime Act 2017). Recently, those sanctions have tended to be:
- targeted asset freezes: these apply to named individuals, entities and bodies, restricting access to funds and economic resources
- restrictions on a wide variety of financial markets and services: these can apply to named individuals, entities and bodies, specified groups, or entire sectors. To date these have taken the form of: investment bans, restrictions on access to capital markets, directions to cease banking relationships and activities, requirements to notify or seek authorisation prior to certain payments being made or received, restrictions on the provision of financial, insurance, brokering or advisory services or other financial assistance
- directions to cease all business: these will specify the type of business and can apply to a specific person, group, sector or country
OFSI publishes guidance and maintains and publishes two lists of those subject to financial sanctions. The first, the ‘consolidated list’, includes all designated persons subject to financial sanctions under EU and UK legislation, as well as those subject to UN sanctions which are implemented through EU regulations. The second, the ‘list of entities subject to capital market restrictions’, relates to entities not on the consolidated list.
Challenging a Designation
A designated person can challenge their listing. While some applicants have been successful (for example, see Safa Nicu Sepahan Co. v CoEU, Case C-45/15 P) many more have not (for example, see Europäisch-Iranische Handelsbank AG v CoEU, Case C‑585/13 P).
A host of interesting issues have arisen in relation to the process of challenge – see Bank Mellat v HM Treasury (Nos. 1 and 2)  UKSC 38 and 39 for an exploration of proportionality, procedural safeguards and the deployment and ambit of the closed material procedure (‘CMP’).
The fact that the EU has increasingly offered individuals and entities an opportunity to challenge their listing has created tension between the UNSC and the EU and may have had impact on intelligence sharing. The USA and the UNSC have shown a marked reluctance to explain and/or offer reasons for designation, principally on the basis that they seek to protect intelligence sources and intelligence gathering methodology. The UNSC was not swift in establishing a mechanism to permit designation challenge and created the Office of the Ombudsperson in 2009 only after the Kadi cases were decided by the EU courts.
Everyone is Sanctioned
Once listed, the sanction then applies to all persons and entities within the territory of the United Kingdom and to all UK nationals and legal entities established under UK law, including their branches, irrespective of where their activities take place.
If a sanction is in place, there is a prohibition on:
- dealing with the funds or economic resources belonging to or owned, held or controlled by a designated person
- making funds or economic resources available, directly or indirectly, to, or for the benefit of, a designated person
- engaging in actions that directly or indirectly circumvent the financial sanctions
If a person knows or has ‘reasonable cause to suspect’ that they are in possession or control of, or are otherwise dealing with, the funds or economic resources of a designated person, they must:
- freeze them
- not deal with them or make them available to, or for the benefit of, the designated person, unless
- there is an exemption in the legislation that they can rely on
- they have a licence from OFSI
- report them to OFSI
A breach of these requirements may result in criminal prosecution or a monetary penalty.
Ownership & Control
An asset freeze and some financial services restrictions will also apply to entities that are owned or controlled, directly or indirectly, by a designated person. Those entities may not be designated in their own right, so their name may not appear on the consolidated list. ‘Target matching’ may not be easy, however, those entities are similarly subject to financial sanctions. Ownership and control are critical and due diligence is necessary.
Reporting & ‘the Regulated Sector’
EU financial sanctions regimes have two reporting components to them. The first is a general obligation that applies to everyone. The second is a more targeted obligation that applies to specified businesses and professions. UK regulations set out specific reporting obligations for a ‘relevant institution’ and a ‘relevant business or profession’.
- a person who has permission under Part 4A of the Financial Services and Markets Act 2000 (FSMA 2000) (permission to carry on regulated activities)
- a European Economic Area (EEA) credit institution authorised by its home state regulator and that has permission under FSMA 2000
- a business that operates a currency exchange office, transmits money (or any representations of monetary value) by any means, or cashes cheques which are made payable to customers
‘Relevant business or profession’
- an auditor
- a casino
- a dealer in precious metals or stones
- an estate agent
- an external accountant
- an independent legal professional
- a tax adviser
- a trust or company service provider
If a relevant institution or relevant business or profession fails to comply with its reporting obligations, it commits an offence, which may result in a criminal prosecution or a monetary penalty.
Reporting requirements do not apply to information to which legal professional privilege attaches. However, OFSI “expects legal professionals to carefully ascertain whether legal privilege applies, and which information it applies to. OFSI may challenge a blanket assertion of legal professional privilege where it is not satisfied that such careful consideration has been made.”
Regulated firms must also consider their obligation to report to the Financial Conduct Authority (‘FCA’). The Joint Money Laundering Steering Group (‘JMLSG’) guidance states that the FCA has indicated that it would be appropriate for firms to report breaches of financial sanctions (but not ‘target matches’, which appear to remain the sole preserve of OFSI) to the FCA.
OFSI has a discretion to grant licences to allow particular activities, transactions or types of transactions that might otherwise be prohibited under the sanctions regime. Those familiar with the EU Money Laundering Directives, and the UK Regulations implementing them, will see old friends. There are clear parallels with Suspicious Activity Reports under the Proceeds of Crime Act 2002. In addition, the licensing regime closely resembles that relating to trade sanctions and export licensing, administered by the Export Control Organisation.
Enforcement and Compliance
OFSI’s assessment of breaches is informed by an overall approach to financial sanctions compliance. OFSI states that it takes an “holistic approach to ensure compliance rather than simply waiting until the law is broken and responding to the breach”.
A breach does not have to occur within UK borders for OFSI’s authority to be engaged. To come within OFSI’s enforcement of sanctions, there has to be a connection or ‘nexus’ to the UK. A UK nexus might be created through a UK company working overseas, transactions using clearing services in the UK, actions by a local subsidiary of a UK company, action taking place overseas but directed from within the UK, or financial products or insurance bought on UK markets but held or used overseas.
The maximum term of imprisonment for offences relating to EU financial sanctions regimes was increased, on 2nd May 2017, to seven years. Corporate liability is expressly catered for.
Breaches of financial sanctions legislation are included on the lists of offences for which a Deferred Prosecution Agreement (‘DPA’) can be made and in relation to which a Serious Crime Prevention Order may be imposed.
OFSI has the power to impose monetary penalties for breaches of financial sanctions under powers in Part 8 of the Policing and Crime Act 2017. The value of a monetary penalty may range from 50% of the total breach up to £1m – whichever is greater. OFSI will take several factors into account when considering the value of any penalty which will be: proportionate; based on the facts of each case; with reductions being applied “particularly in cases that have been voluntarily disclosed to OFSI”.
Seasoned observers will again swiftly see the parallels with the value placed on self-reporting bribery and corruption to the Serious Fraud Office.
OFSI may respond to a breach of financial sanctions by:
- issuing correspondence requiring details of how a party proposes to improve their compliance practices
- referring regulated professionals or bodies to their relevant professional body or regulator in order to improve their compliance with financial sanctions
- imposing a monetary penalty
- referring the case to law enforcement agencies for criminal investigation and potential prosecution
Where OFSI has imposed a monetary penalty for a breach of a financial sanction, the person or entity against whom the penalty is ordered has a ‘Right of Ministerial Review’ and, if still not satisfied, has a right of appeal to the Upper Tribunal.
OFSI is not responsible for the prosecution of sanctions breaches. In the past, prosecutions have been brought by the SFO and HMRC. In the financial services sector, the Financial Conduct Authority has regulatory oversight of the systems and controls that regulated firms must have in place to reduce the risk that a breach might occur. Thus, the FCA may bring enforcement actions against firms that have committed breaches of financial sanctions under the Principles for Businesses and Rules of the Senior Management Arrangements, Systems and Controls sourcebook, which require firms to have effective systems and controls to counter the risk that the firm might be used for the purposes of financial crime.
What are the problems associated with Brexit?
The UK will no longer automatically be part of a scheme – the EU sanctions regime implemented under the Common and Foreign and Security Policy – that largely works well. The implementation of an independent UK regime will:
“add another complex layer of bureaucracy to an already highly confusing environment for businesses, when facing multiple autonomous sanctions regimes, sometimes overlapping with UN measures … could lead to over-compliance in some cases, with associated unintended consequences. In the case of Syria sanctions, for example, banks tend to refuse funding to humanitarian organisations seeking to operate in the country, including leading non-governmental organisations (NGOs) and some UN bodies, in spite of exemptions in place, making their work challenging and costly. In other cases, over-compliance among banks could make it hard for business relations to resume in cases where some or all sanctions have been lifted (such as in the case of Iran); risking jeopardising the success of the diplomatic initiatives underlying the sanctions … Increased investment and staffing would be required to enable UK government officials to liaise with, and provide information to, businesses and other affected parties in the UK.”
Further, the UK’s leaving the scheme will adversely affect the integrity of the regime it leaves:
“The UK is one of the most important promoters of the use of sanctions at the EU level. After the withdrawal of the UK, few Member States would support the use of these measures. This leaves us in particular with the Netherlands, which is quite supportive of the use of these measures, but also with a large number of Member States that are unhappy about the use of sanctions, particularly when the regimes are quite protracted. Now that the EU is going to lose one of the most important advocates of the use of sanctions, I expect it to become less active in the use of these measures”.
What are the features of any likely new regime?
In its response to the consultation, the government has stated the Sanctions Bill will, when published, provide as follows:
- The ‘reasonable grounds to suspect’ test will remain (as endorsed by the General Court of the European Union in Mohammed Al-Ghabra v European Commission, Case T 248/13).
- Each time the government wishes to establish a sanctions regime it will table secondary legislation in Parliament, including details of the activities that the sanctions seek to address.
- The UK will continue its policy of ensuring that the Overseas Territories and Crown Dependencies apply sanctions. The Sanctions Bill will include powers for the UK to continue to legislate directly where appropriate.
- It will specify the measures that may be included in a specific sanctions regime but will also give the government a degree of flexibility to suggest other measures.
- Evidential grounds for designation will be assessed independently by the UK in accordance with the threshold established in the bill.
- The increased criminal and civil penalties for breaches of financial sanctions under Policing and Crime Act 2017 will not be further increased. The bill will not create any additional power for OFSI or the courts to ‘blacklist’ those persons or entities who breach financial sanction. The “suitability of applicants for government contracts can be assessed through procurement processes”.
- The government will review, on an annual basis, whether each UK autonomous sanctions regime remains appropriate. Every individual listing under each autonomous UK regime will be subject to review by the government at least every three years. The government will have the ability to review UK autonomous sanctions regimes in response to significant events.
- UN sanctions regimes and the individual listings under them will not be subject to regular unilateral reviews as they are agreed at the UN level, and the UK does not have the unilateral power to suspend or lift them.
- Those subject to UK sanctions will be protected by the ability to request an administrative reassessment of the government’s decision at the time they are designated or re-designated. They will be able to request an administrative reassessment, at any other time, on fresh evidence.
- Designated persons will also be able to challenge their designation in the High Court under a statutory procedure applying judicial review principles (consistent with provisions for challenges in many other areas relating to UK national security).
- Where sensitive intelligence material is deployed in order to support a listing, a CMP will be adopted. Special Advocates will represent designated persons in closed hearings. An unclassified statement of reasons for designation will always be provided, but only after designation, to prevent the risk of asset flight.
- The bill will not create an office of ‘Independent Reviewer’ or ‘Ombudsperson’.
- OFSI will be given greater licensing powers to improve efficiency and flexibility. Licences will enable persons affected by sanctions to pay for their basic needs, access justice, and make payments under contracts and judgments.
- The bill will create a power enabling general licences to be introduced in certain circumstances to authorise specific activities, for example to facilitate humanitarian aid to regions affected by sanctions.
- The broad reporting obligations will remain – ‘everyone’ will be subject to financial sanctions. (That will not be the case with trade sanctions which will have separate reporting requirements broadly in line with those in the Export Control Act 2002.)
- Licensing procedures will not be reviewed annually but on an ongoing basis. There will be no statutory appeal mechanism for licensing decisions – the possibility of Judicial Review will remain.
- Since licence applications and the documents associated with them contain commercially sensitive information, the bill will not introduce disclosure requirements for entities with trade licences.
- The Sanctions Bill will contain an express power to seize funds and assets in order to freeze them.
- Powers relating to information sharing will be consistent with other legal obligations, notably in relation to data protection and commercial and banking confidentiality requirements.
“Our starting point here is that the Government recognise that imposing sanctions carries a cost to business when they are implemented. Ultimately it is a judgment that the Government make that that cost is necessary to meet the foreign policy objectives behind the sanctions. Having said that, we are equally committed to ensuring that those costs are kept to an absolute minimum and are proportionate, and we engage with industry to help us to achieve that … the aim of the new Bill is largely a question of replicating the current legal powers that we have as a member of the EU when we exit from it. As such, we would not anticipate imposing significant additional burdens on business; indeed, we have the ambition of reducing burdens on business where we can with any additional flexibility that we may have once we exit the EU.”
The Continuing Influence of the USA
The over-arching role of OFAC will persist, no matter what happens.
“The US is playing a role in this because of the currency. Because most international financial transactions need to have clearance to use dollars, that is when the USA exercises its role, not because companies are based there, here or anywhere else. It has influence because most of the companies need US dollars to make international transactions and they have to go via the US. The fines that OFAC imposes on companies are not actually fines but settlements. OFAC picks up the phone and calls a bank or a company and says, “You have violated that”, and the company says, “No”, so the bank says “You can’t use dollars any more”. Then they negotiate how much they can pay to make sure that OFAC is happy.”
OFAC’s published, ‘Changes to the Specially Designated Nationals and Blocked Persons List, Since January 1, 2017, runs to some 145 pages. Those are the just the changes, as of 6th October 2017, the list itself is 1054 pages. (The OFSI Consolidated List for the same date comes in at a meagre 139 pages.) There are other, ‘non-SDN’ lists to consider, although OFAC makes them easily searchable and offers how-to-guides such as: ‘How do I setup a compliance program for my bank?; What are weak aliases (AKAs)?; and, ‘What to do in the event of a target match during a live transaction’.
In the related realm of trade sanctions, significant risks remain for non-U.S. companies given potentially long supply and sales chains that reach back into the United States. By way of example, when non-U.S. Persons (whether or not subsidiaries of U.S. companies) plan to do business involving Iran, no ‘U.S. Persons’ can ‘facilitate’, ‘approve’ or ‘guarantee’ the non-U.S. Person’s activity if the ITSR [Iranian Transactions and Sanctions Regulations] would otherwise prohibit a U.S. Person from engaging in that same activity. While the JCPOA authorised a wide spectrum of activities that were previously prohibited for non-U.S. subsidiaries of U.S. companies under the ITSR, it did not clear away such prohibitions. In any event, as mentioned in the introduction to this article, the JCPOA may not last the year and might conceivably cease to have effect after 15th October 2017.
Blink and you’ll miss it.
 the UK has its own, domestic, financial sanctions, independent of the UN and the EU, under the Terrorist Asset-Freezing etc. Act 2010, Counter Terrorism Act 2008 and the Anti-Terrorism, Crime and Security Act 2001
 Tom Keatinge, Director, Centre for Financial Crime & Security Studies, Royal United Services Institute, oral evidence to the House of Lords Sub-Committee, 20th July 2017
 Kadi I, C-402/05 and C-415/05. Kadi II, joined cases C‑584/10, C‑593/10 and C‑595/10
Reasonable cause to suspect refers to an objective test that asks whether there were factual circumstances from which an honest and reasonable person should have inferred knowledge or formed the suspicion.
For example, see Part 3 of the Iran (European Financial Sanctions) Regulations 2016 and the European Union Financial Sanctions (Enhanced Penalties) Regulations 2017 at http://www.legislation.gov.uk/uksi/2016/36/contents/made and http://www.legislation.gov.uk/uksi/2017/560/regulation/25/made respectively
 European Union Financial Sanctions (Amendment of Information Provisions) Regulations 2017
 See JMLSG Guidance, Part III, paragraph 4.77
 Dr Erica Moret, Senior Researcher, Programme for the Study of International Governance, and Chair of the Geneva International Sanctions Network, Graduate Institute of International and Development Studies, Geneva, written representations to the House of Lords Sub-Committee, 31st July 2017
 Dr Clara Portela, Assistant Professor of Political Science, Singapore Management University, oral evidence to the House of Lords Sub-Committee, 20th July 2017
 There will be some key differences with the Proceeds of Crime Act 2002 (POCA) and the Criminal Finances Act 2017. The CFA applies to funds obtained through criminal conduct, as well as funds intended for use in unlawful conduct. Assets (including funds) that are subject to sanctions may not have been obtained through criminal conduct, or be inherently unlawful in nature. POCA applies to the confiscation of funds after conviction. However, no funds are confiscated as part of an asset freeze; they are simply frozen with no change in their ownership. Given the need to avoid delay when dealing with assets that should be frozen (so that they are not dissipated), and since no question of confiscation arises, there is no need for a court to make such a prior order.
 Mr Giles Thomson, Deputy Director, Sanctions and Illicit Finance, HM Treasury, oral evidence before the House of Lords Sub-Committee, 14th September 2017
 Dr Francesco Giumelli, Assistant Professor in International Relations, University of Groningen, oral evidence before the House of Lords Sub-Committee on 20th July 2017
 Iran: Still a Minefield for non-US Companies, WorldECR, Issue 52, July / August 2016, Ed Krauland and Peter Jeydel