UK Sanctions Enforcement

Introduction

Sanctions enforcement is now firmly placed within the United Kingdom’s broader economic crime regime.^[2] The Office of Financial Sanctions Implementation (OFSI) in HM Treasury was established in 2017. It aims to ‘develop as a world leader in financial sanctions implementation and enforcement’^[3] and has signalled an intention robustly to enforce sanctions compliance and to impose significant financial penalties in appropriate cases. In 2017, the maximum term of imprisonment for financial sanctions breaches was increased from two to seven years.^[4] Under the Sanctions and Anti-Money Laundering Act 2018 (SAMLA), it is further increased to 10 years.^[5] Following Brexit, it is anticipated that the UK’s autonomous sanctions regime will expand both in scope and in the number and severity of enforcement actions.

Offences established under sanctions legislation

Regulations for each sanctions regime prohibit certain conduct (see Chapter 4), creating offences that arise when the prohibited activity is conducted with the requisite mental element (primary offences). In each sanctions regime there is also a set of secondary offences that can be committed in respect of (1) licences applied for or issued to permit otherwise prohibited conduct, and (2) requirements to report or requests to provide information or documents to OFSI.

Primary offences

Examples of primary offences include when a person deals with the funds of a designated person without a licence, knowing or suspecting, or having reasonable grounds to suspect that the relevant transaction is prohibited.^[6] A person may be guilty of a circumvention offence when they intentionally participate in activities, knowing that the object or effect is (directly or indirectly) to circumvent any sanctions prohibition or to enable or facilitate the contravention of any such prohibition.^[7]

Secondary offences

• Licensing offences: (1) failing to comply with any condition of a licence; and (2) knowingly or recklessly providing false information or documentation for the purpose of obtaining a licence;
• Reporting offences: failing to inform HM Treasury as soon as practicable if a relevant person knows or has reasonable cause to suspect that a person is a designated person or has breached financial sanctions regulations and the information on which the knowledge or suspicion is based came to them in the course of carrying on their business.
• Information offences: (1) failing to comply with a request by OFSI for information or the production of documents without a reasonable excuse; (2) knowingly or recklessly providing materially false information or documentation in response to such a request;^[8] (3) destroying, mutilating, defacing, concealing or removing any document with intent to evade requirements under a request for information or documents; or (4) otherwise intentionally obstructing HM Treasury in respect of its powers to make such a request;^[9]
• Confidentiality offences: a person who is provided with specified confidential information or who obtains it commits an offence by disclosing it without lawful authority if that person knows or has reasonable cause to suspect that the information is to be treated as confidential.^[10]

The reporting offences can only be committed by the classes of persons specified in the legislation. These are persons subject to anti-money laundering compliance obligations and supervision, and include those carrying on regulated activity under the Financial Services and Markets Act 2000, currency exchange or funds transmission businesses, auditors, accountants and legal professionals.^[11]

The offences can only be committed if relevant persons fail to disclose information they are obliged to report.^[12] For example, if the suspicion of a sanctions breach arose solely from information obtained other than in the course of business, such as through media reporting, then neither the reporting requirement nor the offence would arise. The reporting requirement does not require the disclosure of information that is subject to legal professional privilege (LPP), or information that would be prohibited under data protection legislation or the Investigatory Powers Act 2016.^[13]

Liability for secondary parties, inchoate offences, corporates and company officers

The ordinary criminal law principles of accessorial liability, inchoate offences and corporate liability (the identification principle)^[14] apply. When an offence is committed with the consent or connivance of, or is attributable to the neglect of, any director, manager, secretary or other similar officer of the corporation or a person acting in such a capacity, that person is guilty of the offence in addition to the corporation and is liable to prosecution.^[15]

Jurisdiction

Jurisdiction is established on the basis of both territory and nationality (active personality). The sanctions regulations impose prohibitions and requirements and establish related offences in relation to conduct in the United Kingdom or its territorial sea by any person and conduct elsewhere by a ‘United Kingdom person’,^[16] defined as a ‘United Kingdom national’ (which includes British citizens, British subjects and British protected persons)^[17] or body incorporated or constituted under the law of any part of the United Kingdom.^[18]

Investigations into sanctions offences

Commencement

Investigations may commence following voluntary self-disclosure by a natural or legal person, a report to OFSI or a UK law enforcement agency by a third party such as a whistle-blower, a person’s professional regulator, the filing of a suspicious activity report (SAR) to the National Crime Agency (NCA) under money laundering or counter-terrorism laws, or after a UK law enforcement agency receives information from an overseas counterpart or international organisation that violations have or are suspected to have occurred.

Notification

There is no general requirement to notify a suspect of an investigation. A suspect may not be made aware of a criminal investigation until some overt action, such as:

• arrests of individuals;
• service of production orders or information provision notices;
• execution of search warrants;
• if a third party that holds or controls the assets, such as a bank or a trustee, freezes the assets unilaterally by refusing to execute their directions;
• service of a subsequent court order, such as a restraint order issued in the Crown Court or a bank account freezing order by a magistrates’ court; or
• if a person has self-reported or disclosed a suspected sanctions breach to OFSI or some other enforcement authority, the authority’s response to that disclosure confirming that an investigation has commenced.

Only when OFSI has formed an intention to impose a civil monetary penalty upon a person is it required to inform the person of its intention to do so and provide the person with the opportunity to make representations.^[19]

Enforcement authorities

Although OFSI is the primary organisation responsible for sanctions implementation, other relevant agencies include the NCA, the Crown Prosecution Service (CPS), the Serious Fraud Office (SFO), Her Majesty’s Revenue and Customs (HMRC),^[20] the Export Controls Joint Unit of the Department for International Trade,^[21] and also professional regulators and overseas enforcement agencies.^[22]

OFSI works closely with the NCA, whose sanctions investigations are conducted by its International Corruption Unit.^[23] Typically, the NCA refers cases for prosecution to the CPS.^[24] The SFO may investigate and prosecute cases in which sanctions offences intersect with international bribery or serious or complex fraud.^[25]

In 2009, the SFO prosecuted Mabey & Johnson Ltd and three executives for breaches of UN Iraq sanctions that were linked to the payment of bribes in exchange for oil contracts.

Investigative powers

In a sanctions investigation, OFSI may use its powers to require persons to provide information to detect evasion and to investigate offences. Requests will be made in writing and will specify the period within which the information must be provided.^[26] Many NCA officers have the operational powers of a police constable, immigration and customs officers, for example, to gain entry to property, conduct searches, seize goods or detain and arrest suspects with or without a warrant.^[27]

Criminal prosecutors have powers to require the provision of information. The Director of Public Prosecutions in England and Wales, the Lord Advocate in Scotland and the Director of Public Prosecutions for Northern Ireland (collectively, the Prosecutors) may authorise a specified officer to issue disclosure notices in investigations into offences established in sanctions regulations promulgated under SAMLA 2018.^[28] These may require the addressee to answer questions, provide information or produce documents relevant to the investigation.^[29] The Director of the SFO can issue ‘Section 2 notices’, requiring persons under investigation and any other person that the Director has reason to believe has relevant information to answer questions or provide documents ‘in any case in which it appears to [the Director] that there is a good reason to do so for the purpose of investigating’.^[30] In both cases, the Prosecutors or the Director of the SFO may apply to a court for a warrant to enter and search premises to seize documents in cases where, for example, giving notice for the production of documents might seriously prejudice the investigation.^[31]

Civil or criminal investigations

In most cases, the investigation will gather evidence that would be admissible in criminal proceedings. A decision will be taken subsequently whether OFSI will use its civil enforcement powers (whether by monetary penalty or some other action) or will refer the case, usually to the CPS, for criminal prosecution.^[32] Since OFSI does not have the power to instigate criminal proceedings of its own accord, if it does refer a case for criminal prosecution, it is a matter for the prosecuting authority to determine whether the case should proceed in accordance with its policy.^[33]

Best practice for corporates in an investigation

Once a company becomes aware of a suspected sanctions breach, it should quickly decide on its response strategy. Enforcement authorities place considerable emphasis on timely voluntary disclosure, the extent of a company’s cooperation during an investigation and the remedial actions it puts in place to prevent future sanctions violations when deciding the nature and scope of any enforcement action.^[34] Companies may also be subject to industry regulatory regimes and shareholder or other disclosure requirements. Companies with operations overseas will need to consider whether regulators in those jurisdictions would expect to be informed.

Actions and issues to be considered after the discovery of suspected breaches or during a sanctions investigation include:

• notifying the board of directors;
• the board of directors’ role going forward and protocol for board communications;
• the role of in-house lawyers and the compliance function;
• appointing external counsel (and other consultants and experts);
• preserving all relevant material (e.g., documents, emails, telephone recordings) concerning both the suspected breaches and the response to their discovery;
• an internal investigation into the suspected breaches;
• reviewing other business and transactions for additional breaches;
• identifying remedial compliance measures;
• early engagement with relevant law enforcement authorities;^[35]
• disclosure to other parties (e.g., regulators, shareholders, lenders, insurers, auditors, overseas authorities);
• public relations strategy;
• accounting provision for any anticipated financial penalties and associated costs; and
• disciplinary action against specific employees.

Self-reporting

Overview

In its first financial year (2017–2018), OFSI received 122 reports of suspected breaches of financial sanctions with a reported value of around £1.35 billion.^[36] In its second financial year (2018–2019), OFSI received 99 reports of suspected breaches with a reported value of £262 million.^[37]

The ability of sanctions authorities to perform their monitoring and enforcement roles depends, in large part, on the provision of information about potential sanctions violations by those within the private sector. Therefore, the UK sanctions framework both imposes reporting requirements on certain persons and rewards voluntary disclosure of suspected sanctions breaches.

Self-reporting should be considered by all putative defendants. It is a significant mitigating factor when enforcement authorities decide what action, if any, to take in relation to a sanctions breach and the extent of any penalties.^[38] To qualify as ‘self-reporting’, individuals or entities cannot rely on self-reporting by another party involved in the suspected breach. If multiple parties are involved, OFSI expects voluntary disclosure from each.^[39]

EU sanctions regulations require persons to report any information that would ‘facilitate compliance’ with the sanctions regulations, although a failure to do so will not necessarily constitute an offence under UK legislation.^[40] OFSI interprets the phrase ‘any information that would facilitate compliance’ as including information about suspected sanctions breaches.^[41]

Considerations before self-reporting^[42]

Whether to self-report

If a person has a legal duty to report to OFSI, failure to self-report is a criminal offence. OFSI, the CPS and the SFO identify in their respective guidance the potential weight they will attach to a genuine self-report as a mitigating factor in all their case disposal decisions.

When to self-report

OFSI expects suspected sanctions breaches to be reported reasonably promptly.^[43] It recognises that it may be reasonable for a person to take ‘some time’ to assess the nature and extent of the breach or to seek legal advice but emphasises that this should not delay an effective response.^[44] In the Standard Chartered Bank case, OFSI accepted that it was reasonable for the company to report initially the existence of a potential breach and then to provide further information in stages during its internal investigation.^[45]

Delaying a self-report risks the law enforcement authority (1) receiving prior notification of the breach from a third party, or (2) concluding that the delay has been unreasonably lengthy, with the result that it will not be a factor weighing against prosecution, in favour of entering into a deferred prosecution agreement (DPA), or justifying a civil penalty discount.^[46] If a breach was only discovered as a result of a separate regulatory or law enforcement investigation, the enforcement authority could, potentially, be persuaded that the reporting party should retain the mitigation benefit of voluntary disclosure if it can demonstrate that it quickly instigated a wide-ranging and thorough review of sanctions compliance, cooperated with any external investigation and implemented meaningful remedial actions.^[47]

How to self-report

OFSI and the SFO provide information about how to make a report on their respective websites. In both cases, there is a form to be completed and electronically submitted. In practice, an accompanying letter may set out greater detail than is contained within the standard form. The consequences of making an inaccurate disclosure or a disclosure that omits important information can be severe.^[48]

To whom else to self-report

Companies should consider whether disclosure should also be made to other domestic regulators or to sanctions authorities in other jurisdictions. This latter point is particularly important if an entity operates in multiple jurisdictions or the breaches took place outside the United Kingdom, since enforcement action in the UK may trigger corresponding investigations overseas and vice versa.^[49]

Where the suspected conduct would be in breach only of a non-UK sanctions regime, companies and relevant individuals should still consider whether there are relevant UK regulators to whom a report should be made.^[50] Such violations can be indicative of wider institutional control failures even though there has been no breach of applicable UK sanctions. UK anti-money laundering supervisors would expect to be informed of such situations by those they regulate.^[51]

Those regulated persons are obliged to make a SAR to the NCA under the UK’s anti-money laundering (AML) legislation if they have reasonable grounds to suspect assets are the proceeds of crime. This obligation may be engaged when they suspect sanctions breaches have occurred.^[52] Breaches of financial sanctions may also amount to or be linked to other criminal offending, such as the funding of terrorism or bribery and corruption. In such cases, individuals and corporations may have obligations to report information to the police under Section 19 of the Terrorism Act 2000, or reporting obligations under the Terrorist Asset Freezing Act 2010 or the Anti-Terrorism, Crime and Security Act 2001.^[53] In cases of international bribery and corruption, companies may consider it is in their best interests also to self-report to the SFO.

Other notification requirements

Companies may have contractual obligations to notify counterparties of their involvement in sanctions offences, or in suspected criminal conduct or criminal investigations more generally. These types of clauses are often included in insurance policies, loan and other facility agreements, bank covenants and contracts for international trade. When a company is considering notifying third parties, whether voluntarily or as a requirement, it should also consider informing OFSI and any other relevant law enforcement or regulatory agency of its intention to do so. This is to avoid an allegation of breaching the confidentiality of, or even unlawfully prejudicing, a sanctions investigation.

Anti-money laundering

Introduction

In a suspected sanctions breach,^[54] two AML questions arise: (1) has a money laundering offence also been committed? and (2) is the suspected sanctions breach evidence of failings in mandatory AML compliance standards?

The UK’s AML legislative regime:^[55]

• creates three principal money laundering offences, criminalising:
  • ‘concealing, disguising, converting, transferring or removing criminal property from the jurisdiction’;^[56]
  • ‘entering into or becoming concerned in an arrangement known or suspected to facilitate by whatever means the acquisition, retention, use or control of criminal property by or on behalf of another person;^[57] and
  • ‘acquiring, using or possessing criminal property’;^[58]
• creates ‘supplementary’^[59] money laundering offences for failing to disclose suspicious transactions,^[60] prejudicing an investigation^[61] and tipping off;^[62] and
• obliges specified private sector entities (e.g., banks and other financial institutions) to establish and maintain appropriate AML policies and procedures.^[63]

Money laundering offences

There are three questions that will determine whether a money laundering offence has been committed: (1) What predicate sanctions offence has been committed? (2) Has ‘criminal property’ been generated as a result of, or in connection with the sanctions offence? (3) Has there been any distinct or subsequent activity in respect of the ‘criminal property’, such that an offence under Sections 327 to 329 of the Proceeds of Crime Act 2002 (POCA) has been committed?^[64]

Fees received as payment for the unauthorised provision of goods or services to a designated person or otherwise in circumstances that constitute a sanctions offence will be criminal property.^[65] The subsequent use, transfer to a third party, or disposal of those fees with the requisite mens rea would constitute a money laundering offence under the appropriate provision of Sections 327 to 329 of the POCA.^[66]

Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017

UK financial sanctions law does not, directly, require the establishment of sanctions policies and procedures.^[67] Nevertheless, a sanctions breach may demonstrate a failure to comply with more general AML compliance obligations under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLR) such as the obligation to conduct ordinary or enhanced customer due diligence or transaction monitoring.^[68] Failing to operate adequate compliance systems to address AML and to combat the financing of terrorism is a breach of Regulation 19 of the MLR, that is to say the requirement under the MLR to adopt ‘proportionate’ systems and controls.^[69] This, in turn, constitutes an offence under Regulation 86 of contravening a relevant requirement, which is punishable by an unlimited fine or imprisonment for two years (or both) following conviction on indictment and three months on summary conviction.

Rather than bring criminal proceedings, the designated supervisory authorities under the MLR, such as the Financial Conduct Authority (FCA), HMRC or various professional bodies,^[70] may elect to use their powers to impose civil penalties of fines and issue public statements of censure, prohibit individuals from having a management role in ‘a named relevant person or payment service provider’, suspend or remove a person’s permission to carry on a regulated activity, deny applications for authorisation or registration, or impose other limitations or restrictions on such persons.^[71]

The civil fines can be sizable.^[72]

In 2020, the FCA fined Commerzbank AG £37.8 million for failing to put adequate AML systems and controls in place between October 2012 and 2017. Although these failings were not specific to sanctions controls, the FCA did note that they occurred ‘against a background of heightened awareness within Commerzbank . . . ​following action taken by US regulators in 2015’ in relation to sanctions and AML failings, which the bank settled for a total of US$1.452 million

In 2010, the Royal Bank of Scotland Group was fined £5.6 million for failing to have adequate systems and controls in place to prevent breaches of UK financial sanctions, as required under the Money Laundering Regulations 2007.

Enforcement actions for breach of AML compliance requirements have extended to cases in which the sanctions issues have been breaches of US but not EU or UK sanctions law.^[73]

In 2019, Standard Chartered Bank was fined £102 million by the FCA for breaches of the MLR 2007, which was part of US$1.1 billion total financial penalties arising from breaches of US sanctions.

AML supervisory bodies will expect their regulated populations to notify them of suspected sanctions breaches.^[74]

In 2017, the Prudential Regulation Authority [PRA] of the Bank of England imposed a £17.85 million fine on The Bank of Tokyo-Mitsubishi UFJ Ltd [BTMU] and an associated fine of £8.925 million on MUFG Securities EMEA plc (MUS(EMEA)) for failing to be open and cooperative with the PRA in relation to sanctions enforcement action into BTMU by the New York Department of Financial Services.

This £26.78 million in total fines issued to UK Bank of Tokyo-Mitsubishi entities illustrates the importance UK financial regulators place on international financial institutions making them aware of overseas enforcement actions so that they may assess the implications for the systems and controls of UK affiliates.^[75]

Suspicious activity reports

POCA imposes reporting obligations on private entities in the regulated sector and creates offences for non-reporting.^[76] These arise when a relevant person knows or suspects or has reasonable grounds for knowing or suspecting that another person is engaged in money laundering when that knowledge came to them in the course of business.^[77] Failing to report suspicions of money laundering or terrorist funding to a firm’s nominated officer or to file a SAR as soon as practicable may also demonstrate AML compliance failings that amount to a breach of the MLR.^[78] Filing a SAR does not absolve a person in the regulated sector of their obligation to report suspected assets of designated persons or breaches of sanctions laws to OFSI.^[79] SARs are submitted to the NCA via the NCA SAR Online System.^[80]

Once a SAR has been filed, POCA prohibits the carrying out of any transaction in relation to the subject property without NCA consent, or the expiry of the prescribed time limits.^[81] A person in the regulated sector may not disclose that a SAR has been filed or that a related investigation is being contemplated or is being carried out.^[82] A disclosure that is ‘likely to prejudice’ an investigation amounts to a tipping off offence.^[83] Even if no SAR has been filed, if a person knows or suspects that a confiscation investigation, a civil recovery investigation or a money laundering investigation is being or about to be conducted, that person commits an offence by making a disclosure that is likely to prejudice the investigation.^[84] This offence is not limited to persons in the regulated sector.^[85]

Effect on investigations

The filing of a SAR may be the precursor to a range of investigative orders or civil or criminal asset recovery orders on the application of law enforcement authorities such as the NCA, the police, SFO, HMRC and FCA. These may include:

• Crown Court production orders,^[86] search warrants,^[87] restraint orders^[88] and, in post-conviction cases, confiscation orders;^[89]
• magistrates’ courts’ arrest warrants,^[90] search warrants,^[91] and bank and building society account freezing and forfeiture orders;^[92] and
• High Court property freezing orders, civil recovery orders^[93] and unexplained wealth orders.^[94]

Duties of counsel and privilege

Overview

The role of lawyers in sanctions and AML regimes requires special consideration. The starting point is that LPP applies.^[95] A professional legal adviser continues to be exempt from the reporting obligations (and related offences) under sanctions legislation and POCA if the information or other matter comes to him or her in legally privileged circumstances.^[96]

OFSI recognises that LPP may constitute a reasonable excuse for not disclosing information or documents when otherwise required under sanctions regulations.^[97] OFSI’s Guidance on Financial Sanctions notes that it ‘expects legal professionals to carefully ascertain whether legal privilege applies, and which information it applies to’ and observes that OFSI may challenge blanket assertions of privilege.^[98]

English law does not distinguish between in-house and independent external counsel for the purposes of LPP.^[99] LPP is subject to the ‘fraud exception’: it does not apply to information or any other matter that is communicated or given to the professional legal adviser with the intention of furthering a criminal purpose.^[100]

Resolution

Overview

OFSI has the power to respond to breaches of financial sanctions by taking action with increasing levels of severity, ranging from low-level outcomes such as issuing correspondence about compliance practices, to imposing a civil financial penalty or, in the most serious cases, referring the case for criminal investigation and prosecution.^[101] Criminal prosecutions can only be brought where a prosecutor has determined that the proceedings would meet the ‘full code test’, namely that in respect of each defendant, there is sufficient evidence to provide a realistic prospect of conviction on each charge and that the prosecution would be in the public interest. In contrast, OFSI applies a civil standard to its enforcement actions.

This section starts with an overview of criminal proceedings relating to sanctions offences, including prosecution, DPAs and agreements that individuals may reach with prosecutors. It then describes OFSI’s civil penalty regime. It concludes by identifying some of the ancillary measures that may be imposed following a sanctions violation.

Criminal prosecution

Primary sanctions offences and licensing offences are punishable upon conviction on indictment by a fine or imprisonment for up to seven years (increased to 10 years under SAMLA).^[102] Reporting and information offences are summary offences punishable by a fine or the maximum term of imprisonment that magistrates’ courts can impose (six months).^[103] Confidentiality offences may be punishable following conviction on indictment by a fine or up to two years’ imprisonment.^[104]

To secure a conviction, the prosecution must prove beyond reasonable doubt that the person has committed the actus reus (conduct) with the requisite mens rea (mental element) of the relevant sanctions offence, whether as a principal, a secondary party or as a conspirator. As described above, both companies and corporate officers may be liable for criminal offences.^[105]

Historically, UK financial sanctions enforcement by way of criminal prosecution has been limited.^[106] Two groups of prosecutions, the Mabey & Johnson and Weir Group cases, concerned bribes paid in the context of the UN Iraq Oil-For-Food programme.^[107]

In 2009, Mabey & Johnson Ltd pleaded guilty to charges including ‘making funds available’ in violation of Article 3 of the Iraq (United Nations Sanctions) Order 2000. The company was sentenced to total financial penalties, including costs, confiscation, reparations and monitoring costs, of about £6.6 million. Two ex-directors of the company were subsequently tried and convicted for their roles and were sentenced to terms of immediate imprisonment. An ex-sales manager cooperated with the SFO, pleaded guilty and gave evidence against the directors at their trial; he was sentenced to a suspended term of imprisonment.

In 2010, Scottish company Weir Group plc pleaded guilty to breaching sanctions in relation to Iraq through the payment of kickbacks in return for contracts from Saddam Hussein’s government. It was sentenced to financial penalties of £3 million and received a confiscation order for £13.9 million.

Deferred prosecution agreements

DPAs are a mechanism by which organisations (typically companies) make an agreement with either the CPS or SFO, under the supervision of a judge, that a criminal prosecution will be suspended for a defined period if the organisation meets certain conditions, which may include financial penalties, compensation, cooperation in the prosecution of individuals and the implementation of appropriate compliance programmes.^[108] Since 2017, DPAs have been available in respect of sanctions offences.^[109] There has been a small number of DPAs since they were introduced in 2013, most of which have related to significant corporate offending.^[110]

The financial penalty levied upon the defendant company must be broadly comparable to the fine that a court would have imposed following conviction after a guilty plea.^[111] The non-prosecution, however, may enable the company to avoid significant, consequential financial effects that might flow from a conviction. Airbus, for example, assessed the loss of global revenue that might follow from debarment from public tendering as US$200 billion.^[112]

The CPS and SFO DPA Code of Practice governs, among other things, the factors the prosecutor may take into account when deciding whether to enter into a DPA, the process for negotiations, terms of a DPA, including the financial penalty, applying for court approval of a DPA and overseeing a DPA after its approval.^[113] Voluntary self-reporting, subsequent cooperation and restorative measures are public interest factors tending away from prosecution and towards a DPA.^[114] The DPA Code will apply in sanctions breach cases, as will the Code for Crown Prosecutors, the CPS/SFO Joint Prosecution Guidance on Corporate Prosecutions and, where corruption offences may also have occurred, the Joint Prosecution Guidance on the Bribery Act 2010.

Arrangements between prosecutors and individual defendants

Frequently there are plea arrangements between defendants and prosecutors, which may take various forms. In some, the defendant pleads guilty to part of an indictment and the prosecution offers no evidence on the remaining counts on that indictment or asks the court to allow those counts to lie on the file. In others, the defendant pleads guilty to a lesser offence or to the indicted offence but on a less serious factual basis than that originally alleged against them.^[115]

When a defendant offers to provide information or to give evidence about the criminal activities of others, they may enter into a formal written arrangement with a specified prosecutor known as a ‘SOCPA agreement’.^[116] In return for providing information or giving evidence in accordance with the agreement, a defendant could potentially achieve immunity from prosecution^[117] but more likely would receive a reduced sentence in respect of his or her own criminality.^[118] The level of sentence reduction will depend on the timing, nature, extent and value of the assistance offered or provided. In cases of genuine and substantial assistance, it could be a reduction of between one-half and two-thirds of the sentence that they would otherwise receive.^[119]

Civil monetary penalties

When OFSI was established in 2017, HM Treasury was given a power to impose monetary penalties for sanctions breaches on companies and officers of companies.^[120] It may impose a monetary penalty if satisfied, on the balance of probabilities, that a person has breached a prohibition or failed to comply with an obligation imposed by or under financial sanctions legislation and that the person knew or had reasonable cause to suspect that he or she was in breach of the prohibition or had failed to comply with the obligation.^[121] When a monetary penalty is payable by a legal person, HM Treasury may also impose a monetary penalty on an officer of the body if satisfied, on the balance of probabilities, that the legal person’s breach or failure took place with the consent or connivance of the officer or was attributable to any neglect by the officer.^[122] If OFSI can estimate the value of the funds involved in the breach, the maximum penalty is the greater of £1 million or 50 per cent of the estimated value. In all other cases, the maximum penalty is £1 million.^[123]

OFSI must observe various procedural steps before imposing a monetary penalty. They include providing the target with (1) written notice of OFSI’s intention to impose a monetary penalty, (2) an opportunity to make representations about any relevant matters, including the circumstances of the breach, mitigation and the effect of a potential penalty and, if a penalty is imposed, (3) the right to a ministerial review.^[124] There is then a right of appeal to the Upper Tribunal.^[125]

When deciding how to dispose of a case and the size of any monetary penalty, OFSI applies a three-step process: (1) penalty threshold; (2) baseline penalty matrix; and (3) penalty recommendation.^[126] The penalty threshold is met if the statutory threshold for imposing a penalty has been met and a monetary penalty would be appropriate and proportionate. The ‘appropriate and proportionate’ limb will most likely be met if (1) funds or economic resources were made available directly to a designated person, (2) the sanctions prohibitions were circumvented, or (3) there was non-compliance with a requirement to provide information.^[127] If none of these factors is present, OFSI may still conclude that a monetary penalty is appropriate and proportionate.^[128]

A ‘baseline penalty matrix’ is used to calculate the appropriate penalty. First, OFSI will calculate the statutory maximum: the greater of £1 million or 50 per cent of the breach. Second, it will identify a ‘reasonable and proportionate’ penalty based on its view of the seriousness of the case. This is the ‘baseline penalty level’. This could be any amount between the maximum and zero. Third, it will consider whether a penalty reduction for ‘prompt and complete voluntary disclosure of the breach’ is warranted. In ‘serious’ cases, this reduction can be up to 50 per cent of the baseline penalty. In the ‘most serious’ cases, the potential reduction is capped at 30 per cent.^[129] ‘Most serious’ cases are those that have clear aggravating factors, such as deliberate or flagrant breaches, a high financial value or a severe impact on the purposes of the sanctions regime.^[130]

When assessing the seriousness of a case, deciding whether or what type of enforcement action is required and identifying aggravating or mitigating factors to determine an appropriate monetary penalty, OFSI will generally take into account the following:^[131]

• the value of the breach;^[132]
• harm or risk of harm to the objectives of the sanctions regime;^[133]
• whether the breach is deliberate, negligent or the result of an error;^[134]
• whether the breach is the result of broader systems failures;
• repeated or persistent breaches;^[135]
• voluntary self-disclosure of suspected breaches;^[136] and
• the public interest in responding to the breaches.^[137]

In 2017 and 2018, OFSI did not impose any civil monetary penalties. Between January 2019 and March 2020, it imposed four monetary penalties, two of which were subject to a ministerial review.^[138]

In 2020, Standard Chartered Bank received penalties of £20.47 million from OFSI for breaches of Ukraine-related sanctions by granting loans worth £97.5 million to the subsidiary of a designated Russian entity.

Although caution must be exercised in drawing conclusions from this limited pool of cases, the Standard Chartered Bank case marks a significant step change and signals a preparedness by OFSI to issue substantial penalties. It also demonstrates the value placed by OFSI on self-reporting, cooperation and remedial action following suspected sanctions breaches. The Raphael Bank case suggests that even self-reported breaches of modest value may be considered sufficiently ‘serious’ for the OFSI to determine that a civil monetary penalty is ‘appropriate and proportionate’.

Ancillary orders and additional consequences of sanctions breaches

Asset recovery

Recovery of property obtained as a result of sanctions offences may be pursued through confiscation proceedings following prosecution and conviction^[139] or in separate civil proceedings.^[140]

Monitorships

Monitors are independent third parties, generally law firms, risk consultancies or professional service firms, appointed by the court to oversee and report on a company’s internal controls and compliance functions following a criminal or regulatory investigation. A monitor may be appointed voluntarily by a company (e.g., to demonstrate cooperation during an investigation) or agreed between the company and the investigating agency as part of a negotiated settlement and presented for court approval.^[141] A monitor may also be appointed under the terms of a DPA^[142] or as part of a serious crime prevention order (SCPO)^[143] or civil recovery order.^[144]

Serious crime prevention orders

SCPOs are designed to prevent, restrict or disrupt involvement in serious crime. They may be made in respect of sanctions offences.^[145] SCPOs can be made against natural or legal persons and may, among other things, impose restrictions or requirements in relation to financial, property or business dealings or holdings, and require a person to answer questions or provide information.^[146] When a SCPO is made against a legal person (usually a company or a partnership), it can include the appointment of an authorised monitor, paid for by that legal person.^[147] SCPOs may be imposed for up to five years.^[148]

SCPOs can be made by the Crown Court during sentencing^[149] or in separate civil proceedings in which a conviction is not a prerequisite, if the court is satisfied that a person has been involved in serious crime, whether in the United Kingdom or elsewhere, and it has reasonable grounds to believe that the order would protect the public by preventing, restricting or disrupting involvement by the person in serious crime in the relevant part of the UK.^[150]

SCPO proceedings in both the Crown Court and the High Court are civil proceedings and the civil standard of proof is applied.^[151] Breach of an SCPO without reasonable excuse is a criminal offence punishable with imprisonment for a term not exceeding five years or a fine, or both.^[152]

Debarment

A breach of sanctions may result in debarment from tendering for public sector contracts in the United Kingdom and elsewhere.^[153] In the UK, tendering for public sector contracts is governed by the Public Contracts Regulations 2015, which implement the EU Procurement Directive.^[154] Sanctions breaches may result in discretionary debarment.^[155]

Directors’ disqualification and regulatory measures

Upon conviction for an offence in connection with, inter alia, the promotion or management of a company, the court may make a disqualification order for up to 15 years.^[156] Breach of a disqualification order is a criminal offence.^[157]

Even without a conviction, a sanctions breach will be relevant to the FCA’s and HMRC’s assessment of the continuing ‘fitness and propriety’ of approved persons and may result in withdrawal of approval.^[158]

Footnotes

¹ Rachel Barnes, Saba Naqshbandi, Patrick Hill and Genevieve Woods are barristers at Three Raymond Buildings, London.

² HM Treasury and HM Home Office ‘Economic Crime Plan, 2019 to 2022’, 13 September 2019, para. 1.12, at https://www.gov.uk/government/publications/economic-crime-plan-2019-to-2022. This chapter focuses primarily on financial sanctions enforcement.

³ OFSI, Annual Review April 2018 to March 2019 (October 2019) p. 1, at https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/838178/Annual_Review_2018-19_FINAL.pdf.

⁴ Policing and Crime Act 2017 s 144(3)(a), giving government the power to provide for a maximum term of imprisonment in the case of conviction on indictment of seven years in sanctions regulations made under the European Communities Act 1972. The maximum term of imprisonment provided in regulations made under that Act had been two years – see European Communities Act 1972 Sched. 2 para. 1(1)(d) (unamended).

⁵ Sanctions and Anti-Money Laundering Act [SAMLA] s 17(5)(a).

⁶ Exceptions and defences are set out in the regulations for each regime. See, e.g., Democratic People’s Republic of Korea (Sanctions) (EU Exit) Regulations 2019, reg. 81.

⁷ For a discussion of the limitations of circumventing offences, see R v. R [2015] EWCA Civ 796.

⁸ As described below, both the Crown Prosecution Service [CPS] and the Serious Fraud Office [SFO] also have powers to compel the provision of information and documents which may be applicable in investigations of suspected offences under sanctions legislation (see section titled ‘Investigative powers’ below). Along with those powers, the relevant legislation also establishes secondary offences of failing to comply with disclosure or production notices issued by the CPS or SFO and knowingly or recklessly providing materially false or misleading information or documents in response to such notices – see Serious Organised Crime and Police Act [SOCPA] 2005, s 67; Criminal Justice Act [CJA] 1987 s 2(13), (14).

⁹ Such conduct would amount to a common law offence of perverting the course of justice in the context of an anticipated criminal investigation or when one is known to have commenced. Vreones [1891] 1 QB 360; Government of the USA v. Dempsey [2018] 4 WLR 110. For the comparable offence in respect of SFO investigations, see CJA 1987 s 2(16).

¹⁰ See, e.g., Democratic People’s Republic of Korea (Sanctions) (EU Exit) Regulations 2019, reg. 9.

¹¹ A ‘relevant firm’ is defined in the interpretation provision of each set of sanctions regulations (see, e.g., Democratic People’s Republic of Korea (Sanctions) (EU Exit) Regulations 2019), reg. 2.

¹² OFSI’s Guidance on Financial Sanctions [Financial Sanctions Guidance] contains a list of examples of the kind of information that must be reported to OFSI: see Table 5.A. The precise requirements are set out in each set of financial sanctions regulations.

¹³ For further discussion of legal professional privilege [LPP], see ‘Duties of counsel and privilege’ below. See also, e.g., Democratic People’s Republic of Korea (European Union Financial Sanctions) Regulations 2017, sched. 1 para. 6; Democratic People’s Republic of Korea (EU Exit) Regulations 2019, reg. 109.

¹⁴ Also known as the attribution theory of corporate liability. The primary rules of identification may be subject to a more purposive interpretation in respect of regulatory offences, such as sanctions offences, in which the conduct and mens rea of a corporate officer other than the directing will and mind of the company as a whole may be attributed to the company to establish liability: see Meridian Global Funds Management Asia Ltd v. Securities Commission [1995] 2 AC 500 (PC); Bilta (UK) Ltd (In Liquidation) v. Nazir [2016] AC 1; Serious Fraud Office v. Barclays plc [2020] 1 Cr App R 28.

¹⁵ See, e.g., Democratic People’s Republic of Korea (Sanctions) (EU Exit) Regulations 2019, reg. 111.

¹⁶ SAMLA s 21. For pre-SAMLA regulations, see, e.g., the Democratic People’s Republic of Korea (European Union Financial Sanctions) Regulations 2017, which provide that an offence could be committed by conduct wholly or partially outside the United Kingdom by a UK national or a body incorporated under the law of the UK (reg. 1).

¹⁷ SAMLA s 21(3).

¹⁸ SAMLA s 21(2). Jurisdiction may be specifically extended to include bodies incorporated or constituted under the laws of any of the Channel Islands, the Isle of Man, or any of the British overseas territories (SAMLA s 21(4)).

¹⁹ This procedure is described below in the section titled ‘Civil monetary penalties’.

²⁰ Her Majesty’s Revenue and Customs [HMRC] is primarily responsible for the investigation and enforcement of trade sanctions.

²¹ See Chapter 14.

²² See section titled ‘To whom else to report’, below.

²³ See https://nationalcrimeagency.gov.uk/what-we-do/crime-threats/bribery-corruption-and-sanctions-evasion.

²⁴ The CPS Specialist Fraud Division has experience in prosecuting trade sanctions and export control cases following HMRC investigations: see https://www.cps.gov.uk/specialist-fraud-division.

²⁵ The power of the Director of the SFO to accept cases for investigation and prosecution is limited to those of serious or complex fraud, or bribery and corruption (CJA 1987, ss 1(3) and 2A(5)). See footnotes 107, 140 and 141, below, for details of the Mabey & Johnson case.

²⁶ OFSI Financial Sanctions Guidance, § 5.6. If no period is specified, compliance must take place ‘within a reasonable time’. (See, e.g., Democratic People’s Republic of Korea (Sanctions) (EU Exit) Regulations 2019, reg. 104(1)(a).) As set out above (in the section titled ‘Secondary offences’) failure to comply with a request for information without a reasonable excuse is a criminal offence, as is providing false information, destroying documentation or otherwise intentionally obstructing OFSI.

²⁷ Crime and Courts Act 2013 s 10, sched. 5.

²⁸ SAMLA s 17(8), amending SOCPA s 61. The Prosecutors’ powers are contained within SOCPA s 60. The specified officers are a constable, a designated National Crime Agency [NCA] officer or an HMRC officer.

²⁹ SOCPA, s 62(3). They may only be issued when, among other things, the relevant prosecutor has reasonable grounds for (1) suspecting a specified offence has been committed, (2) suspecting that the target has information that relates to a matter relevant to the investigation of that suspected offence, and (3) believing that the information sought is likely to be of substantial value to that investigation.

³⁰ CJA 1987 s 2(1).

³¹ SOCPA s 66(2); CJA 1987 s 2(4).

³² The distinction between a civil or criminal investigation may only be relevant when the enforcement authority forms an early view that criminal proceedings against any person are unlikely.

³³ Note that: ‘OFSI will work closely with law enforcement agencies to ensure that breaches of financial sanctions are dealt with in the most appropriate way. We will seek to reach agreement with them where possible, but recognise that sometimes an independent prosecutor may choose not to take forward a prosecution. The 2017 Act also provides additional options for prosecutors when dealing with financial sanctions breaches.’ (OFSI Consultation Response on the Process for Imposing Monetary Penalties for Breaches of Financial Sanctions, April 2017, § 1.13.)

³⁴ OFSI Financial Sanctions Guidance, § 7.1; Director of Public Prosecutions and SFO Joint Guidance on Corporate Prosecutions at p. 8.

³⁵ For example, the Deferred Prosecution Agreements Code of Conduct identifies as a factor that a prosecutor may take into account when deciding whether to enter into a deferred prosecution agreement [DPA], the extent to which the company involves the prosecutor in the early stages of an internal investigation thereby giving the prosecutor the opportunity to give direction as to its scope and the manner in which it is conducted. CPS/SFO Deferred Prosecution Agreements Code of Practice (11 February 2014) [DPA Code] § 2.9.2.

³⁶ See https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/746207/OFSI_Annual_Review_2017-18.pdf.

³⁷ See https://ofsi.blog.gov.uk/2019/10/15/ofsi-releases-2018-to-2019-annual-review/.

³⁸ OFSI Monetary Penalties for Breaches of Financial Sanctions (May 2018) [Monetary Penalties Guidance], § 3.30: ‘OFSI values voluntary disclosure. Co-operation is a sign of good faith and makes enforcing the law simpler, easier, quicker and more effective. Voluntary disclosure of a breach of financial sanctions by a person who has committed a breach may be a mitigating factor when we assess the case. It may also have real effect on any subsequent decision to apply a penalty.’ For further discussion, see section titled ‘Civil monetary penalties’, below.

³⁹ OFSI Monetary Penalties Guidance, § 3.31.

⁴⁰ See Chapter 3, at ‘Regulatory reporting’. If a person fails to provide information in breach of EU law but that failure does not constitute an offence under UK law, OFSI will nonetheless treat it as an aggravating factor when making its enforcement decision (OFSI Monetary Penalties Guidance § 4.15).

⁴¹ OFSI Blog, 22 May 2018, at https://ofsi.blog.gov.uk/2018/05/22/reporting-to-ofsi-how-working-together-helps-makes-sanctions-more-effective/.

⁴² In addition to the actions and issues listed above, in section titled ‘Best practice for corporates in an investigation’.

⁴³ OFSI Monetary Penalties Guidance, § 3.33: disclosure should occur ‘as soon as reasonably practicable after discovery of the breach’ and ‘what this means will differ in each case’. See also CPS/SFO Corporate Prosecutions: ‘Failure to report wrongdoing within reasonable time of the offending coming to light’ is an additional public interest factor in favour of prosecution and self-reporting is an additional public interest factor against prosecution; and CPS/SFO DPA Code §§ 2.8.1(v), 2.9.2 and 2.9.3.

⁴⁴ OFSI’s position is that it is reasonable for a person to take ‘some time’ to assess the nature and extent of the breach or to seek legal advice, but that doing so should not delay an effective response (OFSI Monetary Penalties Guidance, § 3.33).

⁴⁵ If there is good reason for delaying the reporting of a breach or for providing partial disclosure, OFSI is able to receive and consider representations (OFSI Monetary Penalties Guidance, § 3.37). For a description of the Standard Chartered Bank case, see footnote 138, below.

⁴⁶ OFSI Monetary Penalties Guidance, § 3.36.

⁴⁷ See, e.g., although it was not a sanctions case, SFO v. Rolls-Royce Plc, Rolls-Royce Energy Systems Inc [2017] 1WLUK 189, [19] to [22]; see also https://www.sfo.gov.uk/cases/rolls-royce-plc/.

⁴⁸ For example, OFSI will respond to incomplete or misleading disclosures by imposing a financial penalty (OFSI Monetary Penalties Guidance, § 3.35).

⁴⁹ Pre-SAMLA UK sanctions regulations typically include provisions empowering HM Treasury to disclose any information obtained under sanctions regulations to any person for the purpose of facilitating or ensuring compliance with corresponding EU sanctions regulations. See, e.g. Democratic People’s Republic of Korea (European Union Financial Sanctions) Regulations 2017/218, sched 5. This power is extended under SAMLA promulgated regulations to allow disclosure of information to, among other parties, the government of any country. See, e.g., Democratic People’s Republic of Korea (Sanctions) (EU Exit) Regulations 2019/411, reg. 108(3)(i).

⁵⁰ Although it is outside the scope of this chapter, it is important to note that overseas investigations and prosecutions may give rise to mutual legal assistance and extradition proceedings in the UK. For example, the US has successfully requested the extradition of individuals wanted for prosecution under US sanctions laws, see Diri v. Government of the United States of America [2015] EWCA 2130 (Admin); Tappin v. Government of the United States of America [2012] EWHC 22 (Admin)

⁵¹ See section titled ‘Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017’, below.

⁵² See section titled ‘Suspicious activity reports’, below.

⁵³ Section 19 applies when a person believes or suspects that someone has committed an offence under the Act (such as money laundering, the possession or use of funds for terrorism or fund raising for the purposes of terrorism) based on information they obtain in the course of their employment, trade, profession or business. When Section 19 applies, the person must disclose the information to a constable as soon as is reasonably practicable. Failure to disclose information under Section 19 is a criminal offence punishable by a fine or up to five years’ imprisonment. There are several exceptions and defences available. For example, it is a defence for the person to show that he or she had a reasonable excuse for failing to disclose the information.

⁵⁴ A sanctions breach may also lead to criminal confiscation or civil recovery proceedings in respect of assets obtained through the predicate conduct or any subsequent money laundering offence. See section titled ‘Asset recovery’, below.

⁵⁵ The principal money laundering legislation is the Proceeds of Crime Act 2002 [POCA] and the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (SI 2017/692) [MLR], as amended.

⁵⁶ POCA s 327. Criminal property is defined, widely, in POCA s 340 as property that constitutes or represents a person’s benefit from criminal conduct when the alleged offender knows or suspects that it constitutes such a benefit. ‘Property’ includes all forms of property wherever situated and in whatever form, including money, real or personal property, things in action, and other tangible or incorporeal property. An individual will have ‘obtained’ property if he or she acquires an interest in it, including an equitable interest or power in relation to land in England and Wales, or a right (including a right to possession) in relation to property other than land.

⁵⁷ POCA s 328.

⁵⁸ POCA s 329. A conviction for any of the principal offences in POCA ss 327, 328 and 329 carries the following maximum penalties: on summary conviction, six months’ imprisonment or a fine (or both) and, on indictment, 14 years’ imprisonment or a fine (or both).

⁵⁹ As described in R v. GH [2015] 2 Cr App R 12 (SC) at [14].

⁶⁰ POCA ss 330 and 331. The sentences on summary conviction are six months’ imprisonment or a fine (or both), and on indictment, five years’ imprisonment or a fine (or both).

⁶¹ POCA s 332.

⁶² POCA s 333A-E.

⁶³ MLR, reg. 19.

⁶⁴ Those three questions must be addressed separately because the conduct that amounts to a predicate sanctions offence cannot at the same time amount to an offence under POCA ss 327 to 329; R v. GH [2015] 2 Cr App R 12 (SC) at [20], per Lord Toulson: ‘[I]t is a prerequisite of the offences created by sections 327, 328 and 329 that the property alleged to be criminal property should have that quality or status at the time of the alleged [money laundering] offence . . . Criminal property . . . means property obtained as a result of or in connection with criminal activity separate from that which is the subject of the [money laundering] charge itself.’

⁶⁵ R v. McDowell [2015] 2 Cr App R (S) 14 (CA). Separately, having been obtained through criminal conduct, those fees will be liable to confiscation or civil recovery under POCA.

⁶⁶ In R (Golfrate Property Management Ltd) v. Southwark Crown Court) [2014] 2 Cr App R 12 at [104] and [105], the Court of Appeal analysed two factual situations in which a designated person outside the UK transfers funds to a person in the UK. In the first, although the transfer may not, without more, constitute a breach of the asset freezing provisions of the relevant sanctions regime, if the designated person retained a property interest in the funds after the transfer, any subsequent unauthorised movement of the funds may constitute a sanctions offence. In this first situation, any further use, transfer, etc. of the funds could amount to a money laundering offence. In the second situation, the funds are transferred to a person in the UK with the intent of circumventing the relevant sanctions regulations and a sanctions offence would have been committed at that stage. In this second situation, any subsequent possession, use, transfer, etc. of the funds with the requisite mens rea would constitute a money laundering offence.

⁶⁷ Following the 2018 Financial Action Task Force Mutual Evaluation Report for the UK, HM Treasury is considering whether new powers or guidance are necessary to enable all anti-money laundering [AML] supervisors to take enforcement action when there are deficiencies in their regulated populations’ financial sanctions systems and controls. HM Treasury, Home Office Economic Crime Plan, 2019-2022, Action 17, para. 4.13. The MLR contain scant reference to economic sanctions although Regulation 33 specifies that when assessing whether there is a high risk of money laundering or terrorist financing for the purpose of applying enhanced due diligence measures and enhanced ongoing monitoring, one of the risk factors relevant persons must take into account is whether the customer is resident in a country ‘subject to sanctions, embargos or similar measures issued by, for example, the European Union or the United Nations’ (reg. 33(6)(a)(i), (c)(iii)).

⁶⁸ The MLR’s compliance obligations relating to AML and countering the financing of terrorism apply to ‘relevant persons’, i.e., persons acting in the course of business carried on by them in the United Kingdom who are credit institutions, financial institutions, auditors, insolvency practitioners, external accountants, tax advisers, independent legal professionals, trust or company service providers, estate agents, letting agents, high-value dealers, casinos, art market participants, cryptoasset exchange providers, custodian wallet providers or auction platforms (reg. 8).

⁶⁹ In considering what is appropriate or proportionate with regard to the size and nature of its business, a relevant person may take into account any guidance that has been issued by the FCA or issued by any other supervisory authority or appropriate body and approved by HM Treasury. Reference should be made, inter alia, to the guidance published by the FCA, the Joint Money Laundering Steering Group (JMLSG), the Office for Professional Body Anti-Money Laundering Supervision, the Law Society and other sources. In addition to a breach of the MLR, a regulated person may be in breach of general compliance obligations established under its particular regulatory scheme. For example, FCA regulated entities that fail to adopt appropriate policies and procedures for screening and reporting sanctions breaches may be in breach of general FCA compliance obligations and, in particular: ‘Principle 3 of the FCA’s Principles for Businesses, which requires regulated firms to take reasonable care to organise their affairs responsibly and effectively, with adequate risk management systems; and SYSC 3.2.6 and related provisions contained in the FCA’s Senior Management, Arrangements, Systems and Controls Sourcebook (SYSC) that require firms to establish and maintain effective systems and controls to counter the risk that the firm might be used to further financial crime’. See also, FCA, ‘Financial crime: a guide for firms. Part 1: A firm’s guide to preventing financial crime’ (April 2015) ch. 7 pp. 65 to 72.

⁷⁰ The UK has 25 AML/CTF supervisors appointed by HM Treasury under the MLR. There are three statutory supervisors (FCA, HMRC and Gambling Commission) and 22 professional body accountancy and legal supervisors. For a complete list, see MLR, reg. 7(1)(b), (2) and sched. 1.

⁷¹ MLR regs 76 to 78. See also HMRC Guidance ‘Money laundering supervision: Civil Measures’ (updated 24 January 2019), at https://www.gov.uk/government/publications/money-laundering-supervision-enforcement-measures/money-laundering-supervision-civil-measures (accessed 22/5/20).

⁷² In 2017, the FCA imposed its largest penalty to date, of £163 million, on Deutsche Bank AG for failing to maintain adequate AML controls, finding that the breaches of the MLR obligations also amounted to a breach of Principle 3 and SYSC rules 6.1.1 R and 6.3.1 R (FCA press release 31 January 2017, at https://www.fca.org.uk/news/press-releases/fca-fines-deutsche-bank-163-million-anti-money-laundering-controls-failure); FCA Final Notice, 30 January 2017, at https://www.fca.org.uk/publication/final-notices/deutsche-bank-2017.pdf. For details of the FCA’s action against Commerzbank, see FCA Final Notice 2020 § 2.7, at https://www.fca.org.uk/publication/final-notices/commerzbank-ag-2020.pdf; Commerzbank AG press release of 12 March 2015, at https://www.commerzbank.com/en/hauptnavigation/aktionaere/service/archive/ir-nachrichten_1/2015_2/ir_nachrichten_detail_15_49802.html. For details of the Financial Services Authority [FSA] action against the Royal Bank of Scotland Group, see FSA press release of 3 August 2010, at https://www.fca.org.uk/news/press-releases/fsa-fines-royal-bank-scotland-group-%C2%A356m-uk-sanctions-controls-failings; FSA Final Decision Notice (2 August 2010), at https://webarchive.nationalarchives.gov.uk/20130202120729/http://www.fsa.gov.uk/static/pubs/other/rbs_group.pdf (accessed 22/5/2020).

⁷³ See https://www.fca.org.uk/news/press-releases/fca-fines-standard-chartered-bank-102-2-million-poor-aml-controls. In its Decision Notice, the FCA noted that ‘inadequate Due Diligence and ongoing monitoring not only exposed SCB to sanctions evasion but also increased the risk of SCB receiving and/or laundering the proceeds of crime’: FCA Decision Notice, para. 2.8, at https://www.fca.org.uk/publication/decision-notices/standard-chartered-bank-2019.pdf . In 2012, HSBC Group received a ‘requires action’ notice in coordination with but separate to the US$1.92 billion financial penalties imposed by US authorities for breaches of US sanctions laws that had highlighted HSBC’s AML and sanctions compliance failings (FSA press release, 11 December 2012, ‘FSA requires action of the HSBC Group’ (FSA/PN/111/2012), at https://www.fca.org.uk/publications/documents/fsa-requires-action-hsbc-group; FSA Notices (and statements re: firms, individuals) 2012 p. 34.)

⁷⁴ For FCA regulated firms, this is expressed in Principle 11 of the FCA’s Principles for Businesses: ‘A firm must deal with its regulators in an open and cooperative way, and must disclose to the FCA appropriately anything relating to the firm of which that regulator would reasonably expect notice.’

⁷⁵ See https://www.bankofengland.co.uk/news/2017/february/pra-imposes-fine-on-the-bank-of-tokyo-mitsubishi-ufj-limited-and-fine-on-mufg-securities-emea-plc. Note: Conversely, in 2019, British Arab Commercial Bank reported to and involved the PRA in its negotiations with the US Treasury’s Office of Foreign Assets Control [OFAC] in respect of apparent breaches of US sanctions. This led to the immediate penalty imposed by OFAC being reduced from US$228.4 million to US$4 million with the remainder suspended because the PRA confirmed that enforcement would lead to the bank becoming insolvent.

⁷⁶ The offences under POCA ss 330 and 331 carry a maximum sentence of five years’ imprisonment on indictment. Similar provisions are contained within the Terrorism Act 2000 s 21A in relation to knowledge or suspicion of terrorist financing offences.

⁷⁷ The threshold of ‘suspicion’ engaging the requirement to make a SAR is low. In Da Silva [2006] EWCA Crim 1654, [16] and [17], ‘suspecting’ means the person ‘must think there is a possibility, which is more than fanciful, that the relevant facts exist. A vague feeling of unease would not suffice’. In an appropriate case, the suspicion ‘must be of a settled nature; a case might, for example, arising in which a defendant did entertain a suspicion in the above sense but, on further thought, honestly dismissed it from his or her mind as being unworthy or as contrary to such evidence as existed or as being outweighed by other considerations’. The test expressed in Da Silva is widely replicated in statutory guidance. See, e.g., the Law Society guide on ‘Suspicious Activity Reports’, last updated 19 December 2019, at https://www.lawsociety.org.uk/support-services/advice/articles/making-a-suspicious-activity-report/. The JMLSG Guidance describes suspicion as ‘more than subjective and falls short of proof based on firm evidence [it is] beyond mere speculation and based on some foundation’ – see JMLSG ‘Prevention of money laundering/combating terrorist financing’ (December 2017) § 6.11.

In deciding whether a person has committed an offence under s 330 or s 331, the court must consider whether he or she followed any relevant guidance which was at the time concerned issued by a supervisory authority or any other appropriate body, approved by the Treasury, and published in a manner it approved as appropriate in its opinion to bring the guidance to the attention of persons likely to be affected by it (POCA s 330(8), s 331(7)). A person does not commit an offence under either of these sections if they have a reasonable excuse for not making the required disclosure or the information that otherwise is required to be disclosed came to the person in legally privileged circumstances (s 330(6)(a), (b(7B); s 331(6)). A person will not commit an offence under s 330 on the basis that they had reasonable grounds to know or suspect another person is engaged in money laundering where they have not been specified training by their employer. The scope of the ‘reasonable excuse’ defence is not defined in POCA; it is covered in some of the statutory guidance – see, e.g., The Law Society guide on ‘Suspicious activity reports’, last updated 19 December 2019, at https://www.lawsociety.org.uk/support-services/advice/articles/making-a-suspicious-activity-report/ (last accessed 26/05/20).

⁷⁸ MLR reg. 19(4)(d); see also regs 21(5), 24, 31(1)(d).

⁷⁹ OFSI, HM Treasury ‘Financial Sanctions Guidance’ (January 2020) § 5.7.

⁸⁰ The NCA SAR Online System at https://www.ukciu.gov.uk/(hsacnc55jt4f20ucgkvemfbd)/saronline.aspx. The NCA’s 2019 annual report records that 478,437 SARs were made in 2018–2019 (NCA, UK Financial Intelligence Unit, Suspicious Activity Reports Annual Report 2019, at https://www.nationalcrimeagency.gov.uk/who-we-are/publications/390-sars-annual-report-2019/file).

⁸¹ See POCA ss 335 and 336D. In summary: after an initial period of seven working days, the NCA must either consent to transactions or expressly withhold consent, in which case a moratorium period of 31 days starts to run (s  335). If the NCA does not respond within the initial period, consent is deemed and dealing with the assets would not constitute an offence under ss 330 and 331. If it withholds consent, the NCA may apply to the Crown Court to extend the first moratorium period (the 31 days) for a further (maximum) period of 186 days (s 336A). Only in exceptional circumstances might an account holder be able to seek interim relief requiring a reporting bank to operate an account subject to a SAR during a moratorium period. National Crime Agency v. N [2017] 1 WLR 3938.

⁸² Section 333B protects, subject to conditions, disclosure within the ‘undertaking or group’, e.g., internally within the bank or internally within a law firm. Sections 333C and 333D protect disclosure in other defined circumstances.

⁸³ POCA s 333A.

⁸⁴ POCA s 342(2)(a).

⁸⁵ These provisions do not mean that a SAR may never be disclosed to an account holder but the circumstances in which it will be lawful to do so are limited. Lonsdale v. National Westminster Bank Plc [2018] EWHC 1843 (QB).

⁸⁶ See, e.g., Golfrate [2014] 2 Cr App R 12 (money laundering investigation in relation to suspected breach of EU sanctions imposed against members of Zanu-PF precipitated by a bank filing a SAR).

⁸⁷ In Golfrate, the police applied for search warrants under POCA ss 352(1) and 352(6)(b).

⁸⁸ POCA s 40. A restraint order may be granted if a criminal investigation has begun, there are reasonable grounds to suspect the subject of the restraint order has benefited from his or her criminal conduct, and there is a real risk that the assets will be dissipated if the restraint order is not made.

⁸⁹ See section titled ‘Asset recovery’, below.

⁹⁰ Magistrates’ Courts Act 1980, s 1.

⁹¹ The Police and Criminal Evidence Act 1984 (1984), s 8.

⁹² POCA, ss 303Z1-8 (freezing) and 303Z14-17 (forfeiture). See footnote 140, below.

⁹³ See, e.g., the Mabey & Johnson case, described in footnotes 107, 140 and 141, below.

⁹⁴ A requirement for making an unexplained wealth order is that the respondent is either a politically exposed person or there are reasonable grounds for suspecting that the respondent or a person connected with the respondent is or has been involved in serious crime (POCA s 362B(4)). ‘Serious crime’ includes an offence under UK sanctions legislation (POCA s 362B(9)(a), Serious Crime Act 2007 s 2, Sched. 1 para. 13B).

⁹⁵ See Bowman v. Fels [2005] 1 WLR 3083, 3108F-H, at [78]. For recent Court of Appeal cases considering the scope of the two limbs of LPP, namely litigation privilege and legal advice privilege, see, respectively, Director of the Serious Fraud Office v. Eurasian Natural Resources Corporation Ltd [2019] 1 WLR 791 and R (on the application of Jet2.com Limited) v. Civil Aviation Authority [2020] EWCA Civ 35.

⁹⁶ Typical wording for this exclusion in sanctions regulations is contained in, e.g., Democratic People’s Republic of Korea (Sanctions) (EU Exit) Regulations 2019, s 109(3): ‘Nothing in this Part is to be read as requiring a person who has acted or is acting as counsel or solicitor for any person to disclose any privileged information in their possession in that capacity.’ In POCA, see s 330(6) and (7B).

⁹⁷ OFSI Monetary Penalties Guidance, § 3.40.

⁹⁸ OFSI Financial Sanctions Guidance, § 5.4.

⁹⁹ The English law approach is not reflected in EU law: Case C-550/07P, Akzo Nobel Chemicals Ltd v. Commission of the European Communities [2011] 2 AC 338.

¹⁰⁰ R v. Central Criminal Court, Ex parte Francis & Francis [1989] AC 346, 397 (HL): ‘privilege will only be excluded in so far as it relates to communications . . . made with the . . . intention of furthering a criminal purpose. No other communication will be excluded from the application of the privilege; and the client’s confidence will to that extent be protected’. POCA s 330(11) reflects this exception.

¹⁰¹ OFSI Monetary Penalties Guidance, § 3.2. In its 2018–2019 Annual Review, OFSI stated that ‘we take some form of action in every instance of non-compliance proportionate to the facts of the case’ – see https://ofsi.blog.gov.uk/2019/10/15/ofsi-releases-2018-to-2019-annual-review/.

¹⁰² SAMLA s 17(5)(a).

¹⁰³ This may rise to a maximum term of imprisonment of 12 months for offences committed after s 154(1) CJA 2003 comes into force. SAMLA s 17(5)(b)(i); see, e.g., Burma (European Union Financial Sanctions Regulations 2018/539 reg. 12(2), (3); Burma (Sanctions) (EU Exit) Regulations 2019/136, reg. 51(4).

¹⁰⁴ See, e.g., Burma (Sanctions) (EU Exit) Regulations 2019/136, reg. 51(3).

¹⁰⁵ See section titled ‘Liability for secondary parties, inchoate offences, corporates and company officers’, above.

¹⁰⁶ For discussion of prosecutions for breaches of trade sanctions and export controls, see Chapter 13.

¹⁰⁷ The case against the three senior executives of Mabey & Johnson Ltd was subject to interlocutory appellate proceedings: see R v. Forsyth [2011] 2 AC 69. See also https://star.worldbank.org/corruption-cases/sites/corruption-cases/files/documents/arw/Mabey_Johnson_UK_SFO_Press_Release_Sentencing_Sep_25_2009.pdf (accessed 2/6/20). The parent company was later subject to High Court civil recovery proceedings. (See footnote 140, below.) For details of the prosecution of Weir Group Plc, see https://www.copfs.gov.uk/publications/bribery-act/25-publications/1829-weir-group-plc (accessed 2/6/20).

¹⁰⁸ Crime and Courts Act [CCA] 2013, s 45 and sched. 17. The Act identifies the designated prosecutors that may enter into a deferred prosecution agreement [DPA] as the Director of Public Prosecutions in England and Wales [DPP] and the Director of the SFO and any other prosecutor so designated by the Secretary of State (sched. 17 para. 3).

¹⁰⁹ CCA 2013 sched. 17 para. 26A, introduced by the Policing and Crime Act [PCA] 2017 s150 and subsequently amended to include sanctions offences created by regulations promulgated under SAMLA.

¹¹⁰ See R v. Airbus SE [2020] 1 WLUK 435; SFO v. Rolls-Royce Plc, Rolls-Royce Energy Systems Inc [2017] 1 WLUK 189; Tesco Stores Ltd [2017] 4 WLUK 558; SFO v. XYZ Limited (unrep) 11 July 2016, Sir Brian Leveson P; SFO v. Standard Bank Plc [2015] 11 WLUK 802.

¹¹¹ CCA 2013 sched. 17 para. 5(4); SFO/CPS DPA Code of Practice §§ 7.9(iii), (iv), 8.3, 8.4; Standard Bank Plc [2015] 11 WLUK 804, [16].

¹¹² Director of the Serious Fraud Office v. Airbus SE [2020] 1 WLUK 435 [85].

¹¹³ See https://www.cps.gov.uk/sites/default/files/documents/publications/dpa_cop.pdf.

¹¹⁴ DPA Code of Practice § 2, in particular § 2.8.1(iii), (iv), (v), § 2.8.2(i), §2.9.1.

¹¹⁵ The principles an English prosecutor should apply in these situations are contained within Section 9 of the Code for Crown Prosecutors and the Attorney-General’s Guidelines on the Acceptance of Pleas and the Prosecutor’s Role in the Sentencing Exercise. Additionally, the Attorney-General’s Guidelines on Plea Discussions in Cases of Serious or Complex Fraud may apply in some sanctions cases.

¹¹⁶ SOCPA ss 71 to 75B. See also, CPS guidance ‘SOCPA 2005 – Queen’s evidence: Immunities, Undertakings and Agreements’ and ‘SOCPA Agreements: Note for those representing assisting offenders’. The DPP and the Director of the SFO are specified prosecutors: SOCPA s 71.

¹¹⁷ SOCPA s 71 empowers a specified prosecutor to issue a written immunity notice with the effect that no proceedings for any offence specified in the notice may be brought against that person except in circumstances specified in the notice. An immunity notice ceases to have effect if the person fails to comply with any conditions specified within it.

¹¹⁸ For a ‘typical example’ of such an agreement, see Blackburn [2008] 2 Cr App R (S) 5, [7].

¹¹⁹ Blackburn [2008] 2 Cr App R (S) 5, [41].

¹²⁰ PCA 2017 ss 146 to 149.

¹²¹ id., at s 146(1).

¹²² id., at s 148.

¹²³ id., at s 146(3).

¹²⁴ id., at s 174. These are reflected in OFSI’s Monetary Penalties Guidance. OFSI will impose a 28-day period in which to make representations unless the person provides evidence showing that a longer period is reasonable (OFSI Monetary Penalties Guidance, § 5.10). If no representations are made within that time frame, the penalty will be finalised and the person will become liable to make payment (§ 5.11). OFSI aims to issue a response within 28 calendar days of the deadline for representations (§ 5.13).

¹²⁵ PCA 2017 s 146(6). The Upper Tribunal may quash the Minister’s decision and (1) quash the decision to impose a penalty or (2) uphold the decision to impose a penalty but substitute a different amount for the amount determined by HM Treasury (s 146(7)).

¹²⁶ OFSI Monetary Penalties Guidance, § 4.1.

¹²⁷ id., at § 4.3.

¹²⁸ id.

¹²⁹ id., at § 4.9; chart 4A at § 4.12.

¹³⁰ id., at § 3.49.

¹³¹ OFSI reserves the right to take into account any factor which it considers relevant, id., at § 3.44.

¹³² OFSI Monetary Penalties Guidance, § 3.18. High-value breaches are more likely to result in enforcement action.

¹³³ id., at § 3.19.

¹³⁴ id., at § 3.24-3.25. OFSI may take into account the level of knowledge of sanctions law within an organisation or in respect of an individual (OFSI Monetary Penalties Guidance, § 3.20). However, a lack of knowledge of sanctions will rarely be a relevant mitigating factor. OFSI considers that sanctions are widely publicised and businesses, particularly those that operate internationally, will have reasonable cause to suspect that sanctions could be engaged (OFSI Financial Sanctions Guidance § 3.1).

¹³⁵ OFSI Monetary Penalties Guidance, § 3.28.

¹³⁶ See section titled ‘Self-reporting’, above.

¹³⁷ OFSI Monetary Penalties Guidance, § 3.41.

¹³⁸ See https://www.gov.uk/government/collections/enforcement-of-financial-sanctions. The penalties were as follows:

(1) Raphael Bank (January 2019): £5,000 penalty for dealing with funds of £200 belonging to a person designated under the Egypt (Asset-Freezing) Regulations 2011. A 50 per cent reduction for voluntary disclosure was applied.

(2) Travelex (UK) Ltd (March 2019): £10,000 penalty for dealing with the same funds as Raphael Bank, despite having access to the designated person’s passport, which clearly identified the individual by name, date of birth and nationality. There was no voluntary disclosure and so no penalty reduction.

(3) Telia Carrier UK Limited (September 2019): £146,341 penalty, reduced from £300,000 following a ministerial review for making economic resources available to a designated person under the Syria sanctions regime by indirectly facilitating international telephone calls to SyriaTel repeatedly and for an extended period. During the review, the value of the breaches was reassessed as approximately £234,000, There was no voluntary disclosure.

(4) Standard Chartered Bank (March 2020): £20.47 million total penalties, reduced from £31.5 million following a ministerial review. A 30 per cent reduction for voluntary disclosure was applied. The Minister substituted a lower penalty figure after finding that although it was a ‘most serious’ case, OFSI had given insufficient weight to facts that Standard Chartered had not wilfully breached the sanctions regulations, acted in good faith, intended to comply with the restrictions, fully cooperated with OFSI and had taken remediation steps. (OFSI Report, ‘Imposition of Monetary Penalty – Standard Chartered Bank’, [14]).

¹³⁹ R v. McDowell [2015] 2 Cr App R (S) 14 (CA). M had negotiated the sale of prohibited items from China to Ghana without a licence in contravention of Articles 4 and 9(2) of the Trade in Goods (Control) Order 2003. In addition to a sentence of two years’ suspended imprisonment, the confiscation order made against M was based on his gross receipts for the trades (approximately £2.5 million) and the commission payments he received.

¹⁴⁰ In Mabey & Johnson, the offending company’s parent company settled civil asset recovery proceedings instituted by the SFO in the High Court under Part 5 of POCA for £130,000 in recognition of sums it had received through share dividends derived from contracts won by Mabey & Johnson Ltd through unlawful conduct: see https://webarchive.nationalarchives.gov.uk/20120314165057/http://www.sfo.gov.uk//press-room/latest-press-releases/press-releases-2012/shareholder-agrees-civil-recovery-by-sfo-in-mabey--johnson.aspx. In 2019, monies received by a niece of Syrian president Bashar al-Assad in breach of the Syrian sanctions regulations were subject to a magistrates’ court bank account forfeiture order. David Brown, ‘Aniseh Chawkat: Police freeze Assad niece’s bank account in London’, The Times, 22 May 2019, at https://www.thetimes.co.uk/article/aniseh-chawkat-police-freeze-assadniece-s-bank-account-in-london-5qr07sxpl.

¹⁴¹ Following its conviction in 2009 for bribery and breaching UN sanctions against Iraq, Mabey & Johnson Ltd was required to instruct an SFO-approved monitor for up to three years, whose costs for the first year were capped at £250,000: see https://star.worldbank.org/corruption-cases/sites/corruption-cases/files/documents/arw/Mabey_Johnson_UK_SFO_Press_Release_Sentencing_Sep_25_2009.pdf (last accessed 13/06/20).

¹⁴² The DPA Code of Practice addresses the potential appointment of compliance monitors. It states that it is important for a prosecutor to consider whether the organisation already has a ‘genuinely proactive and effective corporate compliance programme’ and that the use of monitors ‘should therefore be approached with care’. Ultimately, the guidance explains: ‘The appointment of a monitor will depend upon the factual circumstances of each case and must always be fair, reasonable and proportionate.’

¹⁴³ Serious Crime Act [SCA] 2007, s 39.

¹⁴⁴ For a detailed guide to monitorships, see https://globalinvestigationsreview.com/benchmarking/the-guide-to-monitorships-second-edition/1226581/11-monitorships-in-the-united-kingdom (last accessed 13/06/20).

¹⁴⁵ PCA 2017 s 151.

¹⁴⁶ SCA 2007, s 5(3) to 5(5).

¹⁴⁷ id., at s 39.

¹⁴⁸ id., at s 16(2). See s 22E for the power to extend orders pending the outcome of criminal proceedings.

¹⁴⁹ id., at s 19.

¹⁵⁰ id., at s 1. They can be made by the English High Court, an appropriate court in Scotland or the High Court in Northern Ireland on an application by a specified prosecutor, namely, the DPP or the Director of the SFO in England and Wales, the Lord Advocate for an order in Scotland and the DPP for Northern Ireland in the case of an order in Northern Ireland (s 8).

¹⁵¹ SCA 2007 ss 35 and 36.

¹⁵² id., at s 25.

¹⁵³ See, e.g., Director of the Serious Fraud Office v. Airbus SE [2020] 1 WLUK 435 [84].

¹⁵⁴ Amendments to the Regulation will come into force following Brexit.

¹⁵⁵ Regulation 57 of the Public Contract Regulations 2015; see also, e.g., Director of the Serious Fraud Office v. Airbus SE [2020] 1 WLUK 435 [84].

¹⁵⁶ Company Directors Disqualification Act [CDDA] 1986 s 2.

¹⁵⁷ CDDA 1986 ss 13 and 14.

¹⁵⁸ See section titled ‘Anti-money laundering’, above. See also FCA, ‘Fit and Proper test for Employees and Senior Personnel sourcebook’, at https://www.handbook.fca.org.uk/handbook/FIT.pdf (last accessed 14/06/20) and HMRC, ‘The fit and proper test and HMRC approval technical guidance’, at https://www.gov.uk/government/publications/money-laundering-supervision-fit-and-proper-test-and-approval/money-laundering-supervision-guidance-on-the-fit-and-proper-test-and-hmrc-approval (last accessed 14/06/20).