UK Sanctions Enforcement

Introduction

Sanctions enforcement is now firmly placed within the United Kingdom’s broader economic crime regime.^[2] The Office of Financial Sanctions Implementation (OFSI) in HM Treasury was established in 2016. It aims to ‘develop as a world leader in financial sanctions implementation and enforcement’^[3] and has signalled an intention robustly to enforce sanctions compliance and to impose significant financial penalties in appropriate cases. In 2017, the maximum term of imprisonment for financial sanctions breaches was increased from two years to seven years.^[4] Under the Sanctions and Anti-Money Laundering Act 2018 (SAMLA), it is further increased to 10 years.^[5] As a result of the developing geopolitical situation following Russia’s invasion of Ukraine and the introduction of the Economic Crime (Transparency and Enforcement) Act 2022, it is anticipated that the UK’s autonomous sanctions regime will continue to expand both in scope and in the number and severity of enforcement actions.

Offences established under sanctions legislation

Regulations for each sanctions regime prohibit certain conduct (see Chapter 4), creating offences that arise when the prohibited activity is conducted with the requisite mental element (principal offences). In each sanctions regime there is also a set of related offences that can be committed in connection with (1) licences applied for or issued to permit otherwise prohibited conduct, and (2) requirements to report or requests to provide information or documents to OFSI.

Principal offences

Examples of principal offences include when a person deals with the funds of a designated person without a licence, knowing or having reasonable cause to suspect that the relevant transaction is prohibited.^[6] A person may be guilty of a circumvention offence when they intentionally participate in activities, knowing that the object or effect is (directly or indirectly) to circumvent any sanctions prohibition or to enable or facilitate the contravention of any such prohibition.^[7]

Related offences

• Licensing offences: (1) failing to comply with any condition of a licence; and (2) knowingly or recklessly providing false information or documentation for the purpose of obtaining a licence.
• Reporting offences: failing to inform HM Treasury as soon as practicable if a relevant firm knows or has reasonable cause to suspect that a person is a designated person or has breached financial sanctions regulations and the information on which the knowledge or suspicion is based came to them in the course of carrying on their business.
• Information offences: (1) failing to comply with a request by OFSI for information or the production of documents without a reasonable excuse; (2) knowingly or recklessly providing materially false information or documentation in response to such a request;^[8] (3) destroying, mutilating, defacing, concealing or removing any document with intent to evade requirements under a request for information or documents; or (4) otherwise intentionally obstructing HM Treasury in respect of its powers to make such a request.^[9]
• Confidentiality offences: a person who is provided with specified confidential information or who obtains it commits an offence by disclosing it without lawful authority if that person knows or has reasonable cause to suspect that the information is to be treated as confidential.^[10]

The reporting offences can only be committed by the classes of persons specified in the legislation. The definition of ‘relevant firms’ subject to specific reporting obligations is broad and includes currency exchange or funds transmission businesses, auditors, accountants and estate agents.^[11]

The offences can only be committed if relevant firms fail to disclose information they are obliged to report.^[12] For example, if the suspicion of a sanctions breach arose solely from information obtained other than in the course of business, such as through media reporting, then neither the reporting requirement nor the offence would arise. The reporting requirement does not require the disclosure of information that is subject to legal professional privilege (LPP), or information that would be prohibited under data protection legislation or the Investigatory Powers Act 2016.^[13] Regulations also provide for exceptions from liability for conduct that would otherwise constitute an offence for breach of the financial restrictions, confidentiality, information or reporting provisions, where a Crown officer acting as such has determined that the conduct would be in the interests of national security or the prevention or detection of serious crime in the UK or elsewhere.^[14]

Liability for secondary parties, inchoate offences, corporates and company officers

The ordinary criminal law principles of accessorial liability, inchoate offences and corporate liability (the identification principle)^[15] apply. When an offence is committed with the consent or connivance of, or is attributable to the neglect of, any director, manager, secretary or other similar officer of the corporation or a person acting in such a capacity, that person is guilty of the offence in addition to the corporation and is liable to prosecution.^[16]

Jurisdiction

Jurisdiction is established on the basis of both territory and nationality (active personality). The sanctions regulations impose prohibitions and requirements and establish related offences in relation to conduct in the United Kingdom or its territorial sea by any person and conduct elsewhere by a ‘United Kingdom person’,^[17] defined as a ‘United Kingdom national’ (which includes British citizens, British subjects and British protected persons)^[18] or body incorporated or constituted under the law of any part of the United Kingdom.^[19]

Investigations into sanctions offences

Commencement

Investigations may commence following: voluntary self-disclosure by a natural or legal person; a report to OFSI or a UK law enforcement agency by a third party such as a whistle-blower; a person’s professional regulator; the filing of a suspicious activity report (SAR) to the National Crime Agency (NCA) under money laundering or counter-terrorism laws; after a UK law enforcement agency receives information from an overseas counterpart or international organisation that violations have or are suspected to have occurred; or following a financial sanctions breach report made in compliance with the reporting obligation discussed above.

Notification

There is no general requirement to notify a suspect of an investigation. In a criminal investigation conducted by criminal law enforcement authorities, a suspect may not be made aware of the investigation until some overt action is taken, such as:

• arrests of individuals or requests to attend interviews as volunteers;
• service of production orders or information provision notices;
• execution of search warrants;
• if a third party that holds or controls the assets, such as a bank or a trustee, freezes the assets unilaterally by refusing to execute their directions; or
• service of a subsequent court order, such as a restraint order issued in the Crown Court or a bank account freezing order by a magistrates’ court.

In an OFSI investigation, if a person has self-reported or disclosed a suspected sanctions breach to OFSI (or some other enforcement authority), the investigation will typically come to the attention of the person following the authority’s response to that disclosure confirming that an investigation has commenced.

Only when OFSI has formed an intention to impose a civil monetary penalty upon a person is it required to inform the person of its intention to do so and provide the person with the opportunity to make representations.^[20] In practice, however, OFSI investigations will come to the attention of suspects and witnesses at a much earlier stage, as a result of OFSI requesting information or material.

Enforcement authorities

Although OFSI is the primary organisation responsible for sanctions implementation, other relevant agencies include the NCA, the Crown Prosecution Service (CPS), the Serious Fraud Office (SFO), Her Majesty’s Revenue and Customs (HMRC),^[21] the Export Control Joint Unit of the Department for International Trade,^[22] and also professional regulators and overseas enforcement agencies.^[23]

OFSI works closely with the NCA, whose sanctions investigations are conducted by its International Corruption Unit.^[24] Typically, the NCA, like HMRC, refers cases for prosecution to the CPS.^[25] The SFO may investigate and prosecute cases in which sanctions offences – typically those intersecting with international bribery or serious or complex fraud – satisfy their take-on criteria.^[26]

Investigative powers

In a sanctions investigation, OFSI may use its powers to require persons to provide information to detect evasion and to investigate offences. Requests will be made in writing and will specify the period within which the information must be provided.^[27] Many NCA officers have the operational powers of police constables and immigration and customs officers, for example, to gain entry to property, conduct searches, seize goods or detain and arrest suspects with or without a warrant.^[28]

Criminal prosecutors have powers to require the provision of information. The Director of Public Prosecutions in England and Wales, the Lord Advocate in Scotland and the Director of Public Prosecutions for Northern Ireland (collectively, the Prosecutors) may authorise a specified officer to issue disclosure notices in investigations into offences established in sanctions regulations promulgated under SAMLA.^[29] These may require the addressee to answer questions, provide information or produce documents relevant to the investigation.^[30] The Director of the SFO can issue ‘Section 2 notices’, requiring persons under investigation and any other person that the Director has reason to believe has relevant information to answer questions or provide documents ‘in any case in which it appears to [the Director] that there is a good reason to do so for the purpose of investigating’.^[31] In both cases, the Prosecutors or the Director of the SFO may apply to a court for a warrant to enter and search premises to seize documents in cases where, for example, giving notice for the production of documents might seriously prejudice the investigation.^[32]

Civil or criminal investigations

In many cases, OFSI will investigate using its own powers first. A decision will then be taken on whether OFSI will use its civil enforcement powers (whether by monetary penalty or some other action) or will refer the case, usually to the CPS, for criminal prosecution.^[33] Because OFSI does not have the power to instigate criminal proceedings of its own accord, if it does refer a case for criminal prosecution, it is a matter for the prosecuting authority to determine whether the case should proceed in accordance with its policy.^[34] Where the prosecuting authority decides not to proceed to prosecution, the case may revert to OFSI.

Best practice for corporates in an investigation

Once a company becomes aware of a suspected sanctions breach, it should quickly decide on its response strategy. Enforcement authorities place considerable emphasis on timely voluntary disclosure, the extent of a company’s cooperation during an investigation and the remedial actions it puts in place to prevent future sanctions violations when deciding the nature and scope of any enforcement action.^[35] Companies may also be subject to industry regulatory regimes and shareholder or other disclosure requirements. Companies with operations overseas will need to consider whether regulators in those jurisdictions would expect to be informed.

Actions and issues to be considered after the discovery of suspected breaches or during a sanctions investigation include:

• notifying the board of directors;
• the board of directors’ role going forward and protocol for board communications;
• the role of in-house lawyers and the compliance function;
• appointing external counsel (and other consultants and experts);
• preserving all relevant material (e.g., documents, emails, telephone recordings) concerning both the suspected breaches and the response to their discovery;
• an internal investigation into the suspected breaches;
• reviewing other business and transactions for additional breaches;
• identifying remedial compliance measures;
• early engagement with relevant law enforcement authorities;^[36]
• disclosure to other parties (e.g., regulators, shareholders, lenders, insurers, auditors, overseas authorities);
• public relations strategy;
• accounting provision for any anticipated financial penalties and associated costs; and
• disciplinary action against specific employees.

Self-reporting

Overview

In its first financial year (2017–2018), OFSI received 122 reports of suspected breaches of financial sanctions with a reported value of around £1.35 billion.^[37] In its second financial year (2018–2019), OFSI received 99 reports of suspected breaches with a reported value of £262 million.^[38] In its third financial year (2019–2020), OFSI received 140 reports of suspected breaches with an estimated value of £982.34 million.^[39] In its fourth financial year (2020–2021), OFSI received 132 reports of potential financial sanctions breaches, but the organisation has stated, ‘generally the number of cases considered remains on an upwards trajectory’.^[40]

The ability of sanctions authorities to perform their monitoring and enforcement roles depends, in large part, on the provision of information about potential sanctions violations by those within the private sector. Therefore, the UK sanctions framework both imposes reporting requirements on certain persons and rewards voluntary disclosure of suspected sanctions breaches.

Self-reporting should be considered by all putative defendants. It is a significant mitigating factor when enforcement authorities decide what action, if any, to take in relation to a sanctions breach and the extent of any penalties.^[41] To qualify as ‘self-reporting’, individuals or entities cannot rely on self-reporting by another party involved in the suspected breach. If multiple parties are involved, OFSI expects voluntary disclosure from each.^[42]

OFSI requires disclosures to include ‘all evidence relating to all the facts of the breach’.^[43]

Considerations before self-reporting^[44]

Whether to self-report

If a person has a legal duty to report to OFSI, failure to self-report is a criminal offence. OFSI, the CPS and the SFO identify in their respective guidance the potential weight they will attach to a genuine self-report as a mitigating factor in all their case disposal decisions.^[45]

When to self-report

OFSI expects suspected sanctions breaches to be reported reasonably promptly.^[46] It recognises that it may be reasonable for a person to take ‘some time’ to assess the nature and extent of the breach or to seek legal advice but emphasises that this should not delay an effective response.^[47] In the Standard Chartered Bank case, OFSI accepted that it was reasonable for the company to report initially the existence of a potential breach and then to provide further information in stages during its internal investigation.^[48]

Delaying a self-report risks the law enforcement authority (1) receiving prior notification of the breach from a third party, or (2) concluding that the delay has been unreasonably lengthy, with the result that it will not be a factor weighing against prosecution, in favour of entering into a deferred prosecution agreement (DPA) or justifying a civil penalty discount. If a breach was only discovered as a result of a separate regulatory or law enforcement investigation, the enforcement authority could, potentially, be persuaded that the reporting party should retain the mitigation benefit of voluntary disclosure if it can demonstrate that it quickly instigated a wide-ranging and thorough review of sanctions compliance, cooperated with any external investigation and implemented meaningful remedial actions.^[49]

How to self-report

OFSI and the SFO provide information about how to make a report on their respective websites. In both cases, there is a form to be completed and electronically submitted. In practice, an accompanying letter may set out greater detail than is contained within the standard form. The consequences of making an inaccurate disclosure or a disclosure that omits important information can be severe.^[50]

Self-reporting to others

Companies should consider whether disclosure should also be made to other domestic regulators or to sanctions authorities in other jurisdictions. This latter point is particularly important if an entity operates in multiple jurisdictions or the breaches took place outside the United Kingdom, because enforcement action in the UK may trigger corresponding investigations overseas and vice versa.^[51]

Where the suspected conduct would be in breach only of a non-UK sanctions regime, companies and relevant individuals should still consider whether there are relevant UK regulators to whom a report should be made.^[52] Such violations can be indicative of wider institutional control failures even though there has been no breach of applicable UK sanctions. UK anti-money laundering supervisors would expect to be informed of such situations by those they regulate.^[53]

Those regulated persons are obliged to make a SAR to the NCA under the UK’s anti-money laundering (AML) legislation if they have reasonable grounds to suspect assets are the proceeds of crime. This obligation may be engaged when they suspect sanctions breaches have occurred.^[54] Breaches of financial sanctions may also amount to or be linked to other criminal offending, such as the funding of terrorism or bribery and corruption. In such cases, individuals and corporations may have obligations to report information to the police under Section 19 of the Terrorism Act 2000, or reporting obligations under the Counter-Terrorism (Sanctions) (EU Exit) Regulations 2019 or the Anti-Terrorism, Crime and Security Act 2001.^[55] In cases of international bribery and corruption, companies may consider it is in their best interests also to self-report to the SFO.

Other notification requirements

Companies may have contractual obligations to notify counterparties of their involvement in sanctions offences, or in suspected criminal conduct or criminal investigations more generally. These types of clauses are often included in insurance policies, loan and other facility agreements, bank covenants and contracts for international trade. When a company is considering notifying third parties, whether voluntarily or as a requirement, it should also consider informing OFSI and any other relevant law enforcement or regulatory agency of its intention to do so. This is to avoid an allegation of breaching the confidentiality of, or even unlawfully prejudicing, a sanctions investigation.

Anti-money laundering

Introduction

In a suspected sanctions breach,^[56] two AML questions arise: (1) has a money laundering offence also been committed? and (2) is the suspected sanctions breach evidence of failings in mandatory AML compliance standards? As noted above, shortly after taking up his post in 2021, the new Director of OFSI emphasised the ‘large overlap in threats, issues and stakeholders’ in financial sanctions and broader economic crime,^[57] and it is anticipated that this understanding will inform both sanctions enforcement policy and OFSI’s approach to compliance standards.

The UK’s AML legislative regime:^[58]

• creates three principal money laundering offences, criminalising:
  • ‘concealing, disguising, converting, transferring or removing criminal property from the jurisdiction’;^[59]
  • ‘entering into or becoming concerned in an arrangement known or suspected to facilitate by whatever means the acquisition, retention, use or control of criminal property by or on behalf of another person;^[60] and
  • ‘acquiring, using or possessing criminal property’;^[61]
• creates ‘supplementary’^[62] money laundering offences for failing to disclose suspicious transactions,^[63] prejudicing an investigation^[64] and tipping off;^[65] and
• obliges specified private sector entities (e.g., banks and other financial institutions) to establish and maintain appropriate AML policies and procedures.^[66]

Money laundering offences

There are three questions that will determine whether a money laundering offence has been committed in connection with a known or suspected sanctions breach: (1) What predicate sanctions offence has been committed? (2) Has ‘criminal property’ been generated as a result of, or in connection with, the sanctions offence? (3) Has there been any prohibited dealing with the ‘criminal property’, such that an offence under Sections 327 to 329 of the Proceeds of Crime Act 2002 (POCA) would be found to have been committed if the relevant mens rea is established?^[67]

Fees received as payment for the unauthorised provision of goods or services to a designated person or otherwise in circumstances that constitute a sanctions offence will be criminal property.^[68] The subsequent use, transfer to a third party, or disposal of those fees with the requisite mens rea would constitute a money laundering offence under the appropriate provision of Sections 327 to 329 of POCA.^[69]

Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017^[70]

UK sanctions law does not, directly, require the establishment of sanctions policies and procedures.^[71] Nevertheless, a sanctions breach may demonstrate a failure to comply with more general AML and counterterrorist financing compliance obligations under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLR), such as the obligation to conduct ordinary or enhanced customer due diligence or transaction monitoring.^[72] Failing to operate adequate compliance systems to address AML and to combat the financing of terrorism is a breach of Regulation 19 of the MLR, that is to say the requirement under the MLR to adopt ‘proportionate’ systems and controls.^[73] This, in turn, constitutes an offence under Regulation 86 of contravening a relevant requirement, which is punishable by an unlimited fine or imprisonment for two years (or both) following conviction on indictment and three months on summary conviction.

In 2021, the Financial Conduct Authority (FCA) brought its first criminal prosecution for breaches of the MLR. This resulted in NatWest bank pleading guilty and being fined £264,772,619.95.^[74] As an alternative to bringing criminal proceedings, the designated supervisory authorities under the MLR, such as the FCA, HMRC or various professional bodies,^[75] may elect to use their powers to impose civil penalties of fines and issue public statements of censure, prohibit individuals from having a management role in ‘a named relevant firm or payment service provider’, suspend or remove a person’s permission to carry on a regulated activity, deny applications for authorisation or registration, or impose other limitations or restrictions on such persons.^[76] In March 2021, the FCA had 42 investigations ongoing into firms and individuals.^[77]

The civil fines can be sizeable.^[78]

Enforcement actions for breach of AML compliance requirements have extended to cases in which the sanctions issues have been breaches of US but not EU or UK sanctions law.^[79]

Financial services regulators will expect their regulated populations to notify them of known or suspected sanctions breaches.^[80]

This £26.78 million in total fines issued to UK Bank of Tokyo-Mitsubishi entities illustrates the importance UK financial regulators place on international financial institutions making them aware of overseas enforcement actions so that they may assess the implications for the systems and controls of UK affiliates.^[81]

Suspicious activity reports

POCA imposes reporting obligations on private entities in the regulated sector and creates offences for non-reporting.^[82] These arise when a relevant firm knows or suspects or has reasonable grounds for knowing or suspecting that another person is engaged in money laundering when that knowledge came to them in the course of business.^[83] Failing to report suspicions of money laundering or terrorist funding to a firm’s nominated officer or to file a SAR as soon as practicable may also demonstrate AML compliance failings that amount to a breach of the MLR.^[84] Filing a SAR does not absolve a person in the regulated sector of their obligation to report subject assets^[85] of designated persons or breaches of sanctions laws to OFSI.^[86] Both those in and outside the regulated sector may file SARs. Irrespective of the obligations upon those within the regulated sector to do so, which are described above, regulated and non-regulated entities may wish to file a SAR in respect of assets with which they intend to deal in order to obtain a Defence Against Money Laundering (DAML) from the NCA; in other words, authorisation to deal with the subject assets. SARs are submitted to the NCA via the NCA SAR Online System. The offences under POCA Sections 330 and 331 carry a maximum sentence of five years’ imprisonment.^[87]

Where a DAML request is filed, POCA prohibits the carrying out of any transaction in relation to the subject property without NCA consent, or the expiry of the prescribed time limits.^[88] A person in the regulated sector may not disclose that a SAR has been filed or that a related investigation is being contemplated or is being carried out.^[89] A disclosure that is ‘likely to prejudice’ an investigation amounts to a tipping-off offence.^[90] Even if no SAR has been filed, if a person knows or suspects that a confiscation investigation, a civil recovery investigation or a money laundering investigation is being or about to be conducted, that person commits an offence by making a disclosure that is likely to prejudice the investigation.^[91] This offence is not limited to persons in the regulated sector.^[92]

Effect on investigations

The filing of a SAR may be the precursor to a range of investigative orders or civil or criminal asset recovery orders on the application of law enforcement authorities such as the NCA, the police, the SFO, HMRC and the FCA. These may include:

• Crown Court production orders,^[93] search warrants,^[94] restraint orders^[95] and, in post-conviction cases, confiscation orders;^[96]
• magistrates’ courts’ arrest warrants,^[97] search warrants,^[98] and bank and building society account freezing and forfeiture orders;^[99] and
• High Court property freezing orders, civil recovery orders^[100] and unexplained wealth orders.^[101]

Duties of counsel and privilege

Overview

The role of lawyers in sanctions and AML regimes requires special consideration. The starting point is that LPP applies.^[102] A professional legal adviser continues to be exempt from the reporting obligations under sanctions legislation and POCA if the information or other matter comes to them in legally privileged circumstances.^[103]

OFSI recognises that LPP may constitute a reasonable excuse for not disclosing information or documents when otherwise required under sanctions regulations.^[104] OFSI’s Guidance on Financial Sanctions notes that it ‘expects legal professionals to carefully ascertain whether legal privilege applies, and which information it applies to’ and observes that OFSI may challenge blanket assertions of privilege.^[105]

English law does not distinguish between in-house and independent external counsel for the purposes of LPP.^[106] LPP is subject to the ‘fraud exception’: it does not apply to information or any other matter that is communicated or given to the professional legal adviser with the intention of furthering a criminal purpose.^[107]

Resolution

Overview

OFSI has the power to respond to breaches of financial sanctions by taking action with increasing levels of severity, ranging from low-level outcomes such as issuing a warning, to imposing a civil financial penalty or, in the most serious cases, referring the case for criminal investigation and prosecution.^[108] Criminal prosecutions can only be brought where a prosecutor has determined that the proceedings would meet the ‘full code test’, namely that in respect of each defendant, there is sufficient evidence to provide a realistic prospect of conviction on each charge and that the prosecution would be in the public interest. In contrast, OFSI applies a civil standard to its enforcement actions.

This section begins with an overview of criminal proceedings relating to sanctions offences, including prosecution, DPAs and agreements that individuals may reach with prosecutors. It then describes OFSI’s civil penalty regime. It concludes by identifying some of the ancillary measures that may be imposed following a sanctions violation.

Criminal prosecution

Primary sanctions offences and licensing offences are punishable upon conviction on indictment by a fine or imprisonment for up to 10 years.^[109] Reporting and information offences are summary offences punishable by a fine or the maximum term of imprisonment that magistrates’ courts can impose (six months).^[110] Confidentiality offences may be punishable following conviction on indictment by a fine or up to two years’ imprisonment.^[111]

To secure a conviction, the prosecution must prove beyond reasonable doubt that the person has committed the actus reus (conduct) with the requisite mens rea (mental element) of the relevant sanctions offence, whether as a principal, a secondary party or a conspirator. As described above, both companies and corporate officers may be liable for criminal offences.^[112]

Historically, UK financial sanctions enforcement by way of criminal prosecution has been limited.^[113] Two groups of prosecutions, the Mabey & Johnson and Weir Group cases, concerned bribes paid in the context of the UN Iraq Oil-For-Food programme.^[114]

Following the introduction of the Economic Crime (Transparency and Enforcement) Act 2022, a new cell was announced within the NCA to target ‘kleptocracy’ and sanctions evasion. The increased focus on the imposition of sanctions against Russia in 2022 may lead to greater criminal enforcement of sanctions, including criminal proceedings for circumvention of sanctions.

Deferred prosecution agreements

DPAs are a mechanism by which organisations (typically companies) make an agreement with either the CPS or SFO, under the supervision of a judge, that a criminal prosecution will be suspended for a defined period if the organisation meets certain conditions, which may include financial penalties, compensation, cooperation in the prosecution of individuals and the implementation of appropriate compliance programmes.^[115] Since 2017, DPAs have been available in respect of sanctions offences.^[116] There has been a small number of DPAs since they were introduced in 2013, most of which have related to significant corporate offending.^[117]

The financial penalty levied upon the defendant company must be broadly comparable to the fine that a court would have imposed following conviction after a guilty plea.^[118] The non-prosecution, however, may enable the company to avoid significant, consequential financial effects that might flow from a conviction. Airbus, for example, assessed the loss of global revenue that might follow from debarment from public tendering as US$200 billion.^[119]

The CPS and SFO DPA Code of Practice governs, among other things, the factors the prosecutor may take into account when deciding whether to enter into a DPA, the process for negotiations, terms of a DPA, including the financial penalty, applying for court approval of a DPA and overseeing a DPA after its approval.^[120] Voluntary self-reporting, subsequent cooperation and restorative measures are public interest factors tending away from prosecution and towards a DPA.^[121] The DPA Code will apply in sanctions breach cases, as will the Code for Crown Prosecutors, the CPS/SFO Joint Prosecution Guidance on Corporate Prosecutions and, where corruption offences may also have occurred, the Joint Prosecution Guidance on the Bribery Act 2010.

Arrangements between prosecutors and individual defendants

Frequently, there are plea arrangements between defendants and prosecutors, which may take various forms. In some, the defendant pleads guilty to part of an indictment and the prosecution offers no evidence on the remaining counts on that indictment or asks the court to allow those counts to lie on the file. In others, the defendant pleads guilty to a lesser offence or to the indicted offence but on a less serious factual basis than that originally alleged against them.^[122]

When a defendant offers to provide information or to give evidence about the criminal activities of others, they may enter into a formal written arrangement with a specified prosecutor, known as a ‘SOCPA agreement’.^[123] In return for providing information or giving evidence in accordance with the agreement, a defendant could potentially achieve immunity from prosecution^[124] but more likely would receive a reduced sentence in respect of their own criminality.^[125] The level of sentence reduction will depend on the timing, nature, extent and value of the assistance offered or provided. In cases of genuine and substantial assistance, it could be a reduction of between one-half and two-thirds of the sentence that a defendant would otherwise receive.^[126]

Civil monetary penalties

Following the establishment of OFSI in 2016, HM Treasury was given a power to impose monetary penalties for sanctions breaches on companies and officers of companies.^[127] Prior to the introduction of the Economic Crime (Transparency and Enforcement) Act 2022 on 15 March 2022, OFSI could impose a monetary penalty if satisfied, on the balance of probabilities, that a person has breached a prohibition or failed to comply with an obligation imposed by or under financial sanctions legislation and that the person knew or had reasonable cause to suspect that they were in breach of the prohibition or had failed to comply with the obligation.^[128] Once these provisions have been brought into force, OFSI will be able to impose monetary penalties on a strict liability basis.^[129]

OFSI describes its approach to deciding whether to impose a monetary penalty as the application of its ‘holistic’ compliance and enforcement model: ‘promote, enable, respond, change’.^[130] This means that OFSI seeks to: ‘promote’ compliance by publicising financial sanctions and engaging with the private sector; ‘enable’ compliance by giving guidance and alerts on responsibilities; ‘respond’ to non-compliance by intervening to disrupt attempted breaches and tackling completed breaches; and to ‘change’ behaviour by preventing future non-compliance.

When a monetary penalty is payable by a legal person, HM Treasury may also impose a monetary penalty on an officer of the body if satisfied, on the balance of probabilities, that the legal person’s breach or failure took place with the consent or connivance of the officer or was attributable to any neglect by the officer.^[131] If OFSI can estimate the value of the funds involved in the breach, the maximum penalty is the greater of £1 million or 50 per cent of the estimated value. In all other cases, the maximum penalty is £1 million.^[132]

OFSI must observe various procedural steps before imposing a monetary penalty. They include providing the target with: (1) notice of OFSI’s intention to impose a monetary penalty;^[133] (2) an opportunity to make representations about any relevant matters, including matters of law, the facts of the case, how OFSI has followed its process and whether the penalty is fair and proportionate;^[134] and, if a penalty is imposed, (3) the right to a ministerial review.^[135] There is then a right of appeal to the Upper Tribunal.^[136]

When deciding how to dispose of a case and the size of any monetary penalty, OFSI applies a three-step process: (1) penalty threshold; (2) baseline penalty matrix; and (3) penalty recommendation.^[137] The penalty threshold is met if the statutory threshold for imposing a penalty has been met and a monetary penalty would be appropriate and proportionate. The ‘appropriate and proportionate’ limb will most likely be met if (1) funds or economic resources were made available to a designated person, (2) the sanctions prohibitions were circumvented, or (3) there was non-compliance with a requirement to provide information.^[138] If none of these factors is present, OFSI may still conclude that a monetary penalty is appropriate and proportionate.^[139]

A ‘baseline penalty matrix’ is used to calculate the appropriate penalty. First, OFSI will calculate the statutory maximum: the greater of £1 million or 50 per cent of the breach. Second, it will identify a ‘reasonable and proportionate’ penalty based on its view of the seriousness of the case. This is the ‘baseline penalty level’. This could be any amount between the maximum and zero. Third, it will consider whether a penalty reduction for ‘prompt and complete voluntary disclosure of the breach’ is warranted. In ‘serious’ cases, this reduction can be up to 50 per cent of the baseline penalty. In the ‘most serious’ cases, the potential reduction is capped at 30 per cent.^[140] The ‘most serious’ cases may involve: a very high value; particularly poor, negligent or intentional conduct; or severe or lasting damage to the purposes of the sanctions regime.^[141]

OFSI will determine whether a penalty is proportionate based on the relationship between the proposed penalty and a ‘holistic assessment’ of all the other factors present in the case. Penalties need not be ‘a specific percentage or multiple of the breach amount’.^[142]

When assessing the seriousness of a case, deciding whether or what type of enforcement action is required and identifying aggravating or mitigating factors to determine an appropriate monetary penalty, OFSI will generally take into account^[143] the following:

• the value of the breach;^[144]
• harm or risk of harm to the objectives of the sanctions regime;^[145]
• whether the breach is deliberate, negligent or the result of an error;^[146]
• whether the breach is the result of broader systems failures;
• repeated or persistent breaches;^[147]
• voluntary self-disclosure of suspected breaches;^[148] and
• the public interest in responding to the breaches.^[149]

In 2017 and 2018, OFSI did not impose any civil monetary penalties. Between January 2019 and March 2020, it imposed four monetary penalties, two of which were subject to a ministerial review.^[150] Two additional penalties were imposed in 2021.

Although caution must be exercised in drawing conclusions from this limited pool of cases, the Standard Chartered Bank case marks a significant step change and signals a preparedness by OFSI to issue substantial penalties. It also demonstrates the value placed by OFSI on self-reporting, cooperation and remedial action following suspected sanctions breaches. The Raphael Bank case suggests that even self-reported breaches of modest value may be considered sufficiently ‘serious’ for OFSI to determine that a civil monetary penalty is ‘appropriate and proportionate’.

The Economic Crime (Transparency and Enforcement) Act 2022 has introduced an amendment, not yet in force, to Section 149 of the Policing and Crime Act 2017, which allows OFSI to publish reports of cases in which it has not imposed a money penalty but is satisfied, on the balance of probabilities, that a person had breached a prohibition or failed to comply with an obligation.^[151]

Ancillary orders and additional consequences of sanctions breaches

Asset recovery

Recovery of property obtained as a result of sanctions offences may be pursued through confiscation proceedings following prosecution and conviction^[152] or in separate civil proceedings.^[153]

There is also the possibility that property frozen under sanctions regulations (which do not themselves alter the legal rights and interests in the property) may itself be subject to an asset recovery order with a view to forfeiture. This could occur where the frozen assets are the realisable property of a convicted person or the property can be shown to have been obtained through or by unlawful conduct or where a private claimant sought to enforce a judgment debt against the assets. As an example of the latter, in R (Certain Underwriters at Lloyds) v. HM Treasury,^[154] the claimants sought information from HM Treasury in relation to assets frozen pursuant to sanctions against the Syrian regime as a precursor to applying to HM Treasury for a licence to enforce a US judgment debt against those assets. Looking forward, we anticipate that this interplay between property frozen under sanctions regulations and law enforcement asset recovery measures may also emerge. In April 2022, OFSI issued a general licence permitting officers of non-Crown organisations such as the FCA to carry out their duties in respect of asset recovery measures in relation to assets frozen under the Global Anti-Corruption Sanctions Regulations 2021 and the Russia (Sanctions) (EU Exit) Regulations 2019 (officers of Crown organisations such as the CPS and police forces are already able to do so).^[155] Further, while proposed legislation has not yet been published, there have been press reports about proposals to introduce measures allowing for confiscation of property frozen under sanctions regulations and the matter was raised in Parliament on 7 March 2022.^[156]

Monitorships

Monitors are independent third parties, generally law firms, risk consultancies or professional service firms, appointed by the court to oversee and report on a company’s internal controls and compliance functions following a criminal or regulatory investigation. A monitor may be appointed voluntarily by a company (e.g., to demonstrate cooperation during an investigation) or agreed between the company and the investigating agency as part of a negotiated settlement and presented for court approval.^[157] A monitor may also be appointed under the terms of a DPA^[158] or as part of a serious crime prevention order (SCPO)^[159] or civil recovery order.^[160]

Serious crime prevention orders

SCPOs are designed to prevent, restrict or disrupt involvement in serious crime. They may be made in respect of sanctions offences.^[161] SCPOs can be made against natural or legal persons and may, among other things, impose restrictions or requirements in relation to financial, property or business dealings or holdings, and require a person to answer questions or provide information.^[162] When an SCPO is made against a legal person (usually a company or a partnership), it can include the appointment of an authorised monitor, paid for by that legal person.^[163] SCPOs may be imposed for up to five years.^[164]

SCPOs can be made by the Crown Court during sentencing^[165] or in separate civil proceedings in which a conviction is not a prerequisite, if the court is satisfied that a person has been involved in serious crime, whether in the United Kingdom or elsewhere, and it has reasonable grounds to believe that the order would protect the public by preventing, restricting or disrupting involvement by the person in serious crime in the relevant part of the UK.^[166]

SCPO proceedings in both the Crown Court and the High Court are civil proceedings and the civil standard of proof is applied.^[167] Breach of an SCPO without reasonable excuse is a criminal offence punishable with imprisonment for a term not exceeding five years or a fine, or both.^[168]

Naming and shaming

Prior to 2022, OFSI only publicised the imposition of monetary penalties. Where breaches resulted in other enforcement outcomes, this was not made public. As set out above, following the introduction of the Economic Crime (Transparency and Enforcement) Act 2022, OFSI will have the power to publicly name persons who have been found to be in breach of sanctions but who have not received a civil penalty.^[169]

Debarment

A breach of sanctions may result in debarment from tendering for public sector contracts in the United Kingdom and elsewhere.^[170] In the UK, tendering for public sector contracts is governed by the Public Contracts Regulations 2015, which implement the EU Procurement Directive.^[171] Sanctions breaches may result in discretionary debarment.^[172]

Directors’ disqualification and regulatory measures

Upon conviction for an offence in connection with, inter alia, the promotion or management of a company, the court may make a disqualification order for up to 15 years.^[173] Breach of a disqualification order is a criminal offence.^[174]

Even without a conviction, a sanctions breach will be relevant to the FCA’s and HMRC’s assessment of the continuing ‘fitness and propriety’ of approved persons and may result in withdrawal of approval.^[175]

Footnotes