Sanctions: The UK Perspective
Sanctions are restrictive measures aimed at achieving foreign policy or national security objectives. With the creation of the Office of Financial Sanctions Implementation (OFSI) in March 2016 and recent increases to the size and severity of penalties for sanctions breaches, sanctions enforcement is a growing area of economic crime enforcement in the United Kingdom. At the time of writing the United Kingdom is also making preparations for its autonomous sanctions regime following its exit from the European Union on 31 December 2020, which will probably see a continued increase in enforcement activity against corporates and individuals in the United Kingdom.
The United Kingdom currently implements and enforces sanctions implemented by the United Nations, the European Union and its own domestic sanctions regime against individuals, entities and jurisdictions. These include various restrictive measures, such as trade sanctions (e.g., arms embargoes and restrictions on dual-use items); economic or financial sanctions (e.g., asset freezes and restrictions on a variety of financial markets and services); and immigration sanctions (e.g., travel bans). While the Foreign and Commonwealth Office has overall responsibility for UK government policy on international sanctions, trade sanctions are generally monitored and enforced by the Department for International Trade (DIT) (acting through the UK Export Control Joint Unit (ECJU)) or Her Majesty’s Revenue and Customs (HMRC). Financial sanctions are administered and enforced by OFSI (with support from the National Crime Agency (NCA)), and immigration sanctions by the Home Office. In addition to civil enforcement, criminal prosecution of sanctions violations may be pursued by HMRC or the Serious Fraud Office (SFO) upon referral by OFSI, or by the Crown Prosecution Service (CPS) for breaches of trade sanctions. Regulators, such as the Financial Conduct Authority (FCA), also ensure that regulated firms have adequate systems and controls in place to enable them to meet their sanctions obligations.
In this chapter, we set out an overview of the UK sanctions framework, and consider how investigations may arise and best practices when initiating or responding to investigations.
44.2 Overview of the UK sanctions regime
44.2.1 Statutes and official guidance
The United Kingdom has historically followed the United Nations and European Union in applying sanctions. EU sanctions are implemented through regulations with direct legal effect in Member States. The United Kingdom implements EU sanctions into national law through secondary legislation. Individual Member States are responsible for enforcement of EU sanctions. Consequently, the United Kingdom imposes penalties for breaches of EU sanctions through secondary legislation. When the post-Brexit transition period expires, EU sanctions will no longer apply in the United Kingdom. The United Kingdom also has its own terrorist sanctions regime. Entities in the regulated sector are subject to the Anti-Terrorism, Crime and Security Act 2001, the Counter-Terrorism Act 2008 and the Terrorist Asset-Freezing etc. Act 2010. More recently, Parliament has passed the Sanctions and Anti-Money Laundering Act 2018 (SAMLA), which provides the legal basis for the United Kingdom to impose, update and lift sanctions as it sees fit in a post-Brexit era. OFSI has issued guidance regarding its approach to financial sanctions under SAMLA, as well as an enforcement guide that summarises its approach to compliance and enforcement, including the imposition of penalties. Broadly speaking, the guidance issued by OFSI shows that it has high expectations with regard to sanctions compliance. In particular, licensing grounds are interpreted narrowly, and it is clear that general and specific reporting obligations are a key aspect of the United Kingdom’s sanctions enforcement apparatus. When assessing sanctions violations, OFSI will treat each breach on its own merits based on a number of aggravating and mitigating factors; placing substantial value on co-operation and timely voluntary disclosure, but conversely viewing very negatively any actions it considers to have been carried out in bad faith.
44.2.2Persons to whom sanctions apply
EU sanctions broadly apply to all EU nationals, including any entities incorporated or constituted under the laws of a Member State, regardless of where they are located. They also apply to all business conducted in whole or in part within EU territory.
UK nationals and entities established under UK law, as well as their overseas branches, must comply with UK sanctions regardless of where they are located or where their activities take place. UK financial sanctions apply to any individual or entity located within the United Kingdom or that carries out activities in the United Kingdom. In its published guidance, OFSI provides a number of non-exhaustive examples of how a UK nexus might arise, including a UK company working overseas, transactions using clearing services in the United Kingdom, actions by a local subsidiary of a UK company, or actions taking place overseas but directed from within the United Kingdom.
Restrictive sanctions measures apply to named individuals, entities or bodies, groups, sectors, or countries. OFSI maintains a list of individuals and entities subject to financial sanctions to help individuals and businesses comply with those sanctions. Consistent with EU guidance, OFSI considers that if a designated person owns more than 50 per cent of, or otherwise controls, an entity (directly or indirectly), financial sanctions will apply to that entity as well.
Unlike the US, the EU/UK sanctions regime does not include secondary sanctions. Council Regulation (EC) No. 2271/96, known as the ‘Blocking Statute’, prohibits EU residents and companies from complying with certain extraterritorial legislation, specifically in relation to US sanctions on Cuba and Iran, unless they are exceptionally authorised to do so by the European Commission. The Blocking Statute also allows EU residents and companies to recover damages arising from such legislation from the persons or entities causing them, and prevents any foreign court rulings based on the blocked legislation from having effect in the European Union.
44.2.3Exemptions and licensing
Both the United Kingdom and EU sanctions regimes provide for certain exceptions from the restrictive measures imposed under sanctions legislation in the form of exemptions or licences. With respect to exemptions, in certain limited situations and conditions as set out in the legislation, particular activities are automatically exempt, meaning that parties may engage in the activity without a licence or authorisation. Alternatively, for activities that would otherwise be prohibited, parties may apply for a licence. OFSI oversees applications for licences in relation to financial sanctions, and DIT for trade sanctions. OFSI will only grant a licence where it falls within the specific grounds identified in the underlying legislation. Generally these cover areas such as basic needs, legal fees and disbursements, fees or charges relating to frozen accounts and other economic resources, payment of court judgments or arbitration decisions against a designated person, satisfaction of contractual obligations, and other extraordinary expenses.
OFSI also has a general power to grant licences in accordance with the United Kingdom’s domestic terrorist sanctions regimes (without the need for specific licensing grounds), and can issue licences specific to individuals or generally applicable to all persons designated under particular domestic terror sanctions regimes. OFSI has issued a small number of general licences under the ‘Terrorism and Terrorist Financing’ and ‘Al-Qaida’ sanctions regimes. These can be used without making an application to OFSI, but there is an obligation to report their use without delay.
Where an individual or entity seeks to import or export goods restricted by sanctions, such as dual-use goods (items with both a military and civilian use), a licence may be required by the ECJU alongside a licence from OFSI.
44.2.4 Key jurisdictions
While a number of jurisdictions are sanctioned by the European Union and the United Kingdom, three are particularly significant: Iran, North Korea and Russia/Ukraine.
On 16 January 2016, the European Union lifted all of its economic and financial sanctions in connection with the Iranian nuclear programme pursuant to the Joint Comprehensive Plan of Action (JCPOA) between the E3/EU+3 (France, Germany and the United Kingdom, plus Russia, China and the United States) and Iran.
There are, however, certain measures and restrictions relating to proliferation that remain in place, including an arms embargo, restrictive measures relating to missile technology, restrictions on nuclear-related transfers and activities, and an authorisation regime for certain metals and software.
Separate restrictive measures independent of the JCPOA still apply. These were imposed by the European Union in relation to serious human rights violations in Iran, and include asset freezes, travel bans and a ban of exports to Iran of equipment that may be used for internal repression or equipment for monitoring telecommunications. Following the withdrawal of the United States from the JCPOA and the re-implementation of US secondary sanctions on Iran, the European Union amended the Blocking Statute to include the list of extraterritorial US sanctions on Iran. Accordingly, EU residents and companies are prohibited from complying with US secondary sanctions unless they are exceptionally authorised to do so by the European Commission. The UK Parliament has also passed draft Regulations which will incorporate the provisions of the Blocking Statute into UK domestic law.
220.127.116.11 North Korea
North Korea is subject to a number of counter-proliferation measures imposed by the European Union, aimed at preventing individuals and entities from obtaining funds, goods or services that could contribute to North Korea’s nuclear proliferation programme. These measures are wide-ranging and include, for example, asset freezes, travel bans, sectoral financial sanctions, restrictions on particular services and financial assistance, prohibitions on the export and procurement of arms and on the export of luxury or dual-use goods.
Since March 2014, the European Union has imposed numerous economic, trade and financial restrictive measures on Russia in response to the annexation of Crimea and Sevastopol, and actions that undermine or threaten the territorial sovereignty and independence of Ukraine. Alongside asset freezes and travel bans, it is also prohibited to:
- import or export arms and related material to or from Russia;
- sell, supply, transfer or export dual-use goods and technology for military use in Russia or to specific designated persons;
- provide loans or credit with a maturity exceeding 30 days to specific designated persons;
- export certain equipment, or provide technical and financial assistance or other services, in connection with the export, sale or transfer of such equipment without prior authorisation; and
- provide services for particular forms of oil exploration and production.
44.3 Offences and penalties
The various regulations for each sanctions regime set out the conduct that is prohibited and make it an offence to engage in such activity. Offences typically arise from dealing with funds or economic resources belonging to, owned, controlled or held by a designated person without a licence while knowing or suspecting that the transaction is prohibited. This can include making funds or economic resources available to a designated person, dealing with funds or economic resources that must be frozen, circumventing an asset freeze, or breaching licensing conditions. For example, OFSI imposed a monetary penalty on Telia Carrier UK Limited for indirectly facilitating international phone calls to a designated Syrian entity, which counted as making funds and economic resources indirectly available to it. The sanctions regime allows criminal or civil cases to be brought for sanctions violations depending on the facts and the conduct in question.
44.3.1 Criminal penalties
Criminal prosecutions can only be brought if there is sufficient evidence to provide a realistic prospect of conviction, and the prosecution is in the public interest. Criminal prosecutions of corporates for sanctions breaches are, however, unlikely, not least due to the difficulty of establishing corporate criminal liability in the United Kingdom. Civil breaches are enforced by OFSI, and criminal breaches are enforced by the SFO, HMRC and the CPS.
The penalties for breaches of sanctions in the United Kingdom are set out in the relevant statutory instruments. Criminal violations typically include unlimited criminal fines, and up to seven years’ imprisonment for sanctions violations, as set by the Policing and Crime Act (PACA).
Criminal breaches of sanctions may also implicate money-laundering. The Proceeds of Crime Act 2002 (POCA), which broadly prohibits the handling of criminal property (defined as any benefit resulting from criminal conduct) has extraterritorial application, and even property resulting from criminal conduct that occurs abroad may be caught by POCA. For example, any payments received in the United Kingdom as part of a transaction that would constitute a sanctions offence would fall within the definition of ‘criminal property’ in POCA. The subsequent handling of those funds with the knowledge that they were criminal property would then constitute a money laundering offence. The maximum penalties for breaching POCA include an unlimited fine and up to 14 years’ imprisonment.
The Serious Crime Act 2007 also allows a High Court judge to impose a serious crime prevention order on an individual or entity that has been involved in a serious crime, which includes breaches of financial sanctions.
For breaches of sanctions that satisfy the civil standard of proof, OFSI also has the power to impose monetary penalties of up to £1 million or 50 per cent of the value of the breach, whichever is higher.
44.4 Sanctions investigations
Sanctions investigations can arise in a number of ways. Internally, a company may become aware of a whistleblower report, red flags arising from automated compliance systems and controls, or findings from internal or external audits. A company may also receive notification from a bank of a blocked payment. UK authorities also increasingly commence investigations based on suspicious activity reports (SARs) filed with the NCA, or voluntary self-reports by the company itself  or reports from other individuals, entities, or enforcement agencies. There is no general notification requirement to inform a suspect that they are under investigation. As a result, a suspect may not become aware of an investigation absent an overt act such as the service of production orders, the arrest of one or more individuals, an asset freeze or the execution of a search warrant.
OFSI has broad investigative powers to require any person located in or resident in the United Kingdom to produce or provide information or documents to allow it to establish the extent of funds and economic resources linked to a designated person, obtain information concerning the disposal or transfer of such funds or economic resources, monitor compliance with or evasion of sanctions, or obtain evidence of the commission of an offence. Failure to comply with such requests without a reasonable excuse or obstructing OFSI in its investigation is a criminal offence.
Although OFSI is the primary agency responsible for sanctions, it may also refer a matter to other government agencies, such as the SFO or HMRC, both of which may also potentially pursue a criminal prosecution. The SFO and HMRC also have broad powers to request or require information, with HMRC having an additional power to make arrests.
OFSI also works closely with the NCA and may receive information on suspected breaches from the NCA’s International Corruption Unit. The NCA typically refers cases for prosecution to the CPS, which also has the power to prosecute breaches of trade sanctions pursuant to the Crown and Excise Management Act 1979.
Regulated entities may also be subject to enforcement action by the FCA for failure to maintain effective systems and controls to address the risk of sanctions violations, and for failures to maintain systems and controls relating to compliance, financial crime and money laundering, as well as adequate policies and procedures to counter the risk of financial crime.
The FCA may issue notices to authorised persons requiring them to produce specified documents or provide specified information. The FCA may choose to request that documents be provided on a voluntary basis in the first instance. Although regulated entities are not legally obliged to comply with voluntary requests, they must deal with the FCA ‘in an open and cooperative way’ and ‘disclose to the FCA appropriately anything relating to the firm of which that regulator would reasonably expect notice.’
Once the FCA has formally commenced an investigation, it may require the subject of the investigation (or a person connected to the subject) to produce documents, attend interviews and answer questions, or otherwise provide information required by the investigator, where the documents or information sought are reasonably relevant to the investigation. Furthermore, the FCA may seek answers and documents from persons who are not actually subject to investigation or connected to a person subject to investigation, where ‘necessary or expedient for the purposes of the investigation.’
44.5 Best practices in investigations
44.5.1 Factors to consider
The creation of OFSI in 2016 and recent enforcement activity in the United Kingdom demonstrates that sanctions enforcement is increasingly a priority area in the prosecution of economic crime. There is also a pronounced emphasis by UK enforcement authorities on voluntary disclosure and ongoing cooperation, with the FCA noting that ‘the requirement on firms to deal with their regulator openly and cooperatively is a central part of the Authority’s regulatory regime’ and the SFO similarly stating that ‘co-operation will be a relevant consideration in the SFO’s charging decisions.’ For that reason, it will be important for a company to move quickly, but also to balance speed against substance to ensure that it understands the nature of the alleged violation and the risks it presents. Issues for consideration may include:
- to whom and when to give notice of the issue or investigation;
- identifying who was involved in or responsible for the alleged breach;
- preserving relevant information regarding the alleged breach and the company’s response;
- conducting an internal investigation into the alleged breach and potentially any related transactions or departments;
- dealing with auditors;
- disciplinary action; and
- external communication strategy.
Co-operation with a UK authority may be mandatory where, for example, the authority has exercised its investigative powers and has issued notices requiring the provision of information or production of documents.
Where cooperation is voluntary, an individual or entity subject to investigation may still wish to co-operate fully with the UK authority for various reasons. OFSI has stated that ‘if we discover parties have dealt with us in bad faith and if the case is not criminally prosecuted, we will normally consider imposing a monetary penalty.’ Co-operation may result in a more positive outcome, such as a civil rather than criminal penalty, or conclusion of a criminal investigation by way of a deferred prosecution agreement (DPA). It may also result in a faster resolution of the matter, which may reduce legal fees and valuable management time.
Other tangible benefits to co-operation include being able to work with the authority in shaping any public announcements as well as internal communications associated with the investigation, or the ability to gently influence an investigation through increased contact and rapport with the relevant authorities.
Under EU sanctions legislation, individuals and entities have a general obligation to report to OFSI as soon as practicable any information that would ‘facilitate compliance’ with the sanctions regulations. Specific reporting obligations also apply to ‘relevant institutions’ and ‘relevant businesses or professions’ as explained in further detail below. Given the potential benefits, self-reporting is an important consideration when faced with a potential sanctions violation.
When assessing the seriousness of a case, authorities will take self-reporting into account as a factor, and may consequently offer a more lenient outcome. Any delay in making a self-report risks the authorities discovering the violation through other sources. This may prevent a person from qualifying for the penalty reduction given by OFSI for prompt and complete voluntary self-disclosures, although OFSI does consider it reasonable for a person to take ‘some time to assess the nature and extent of the breach, or seek legal advice’ as long as this does not delay an effective response to the breach. By way of example, in its investigation of Standard Chartered Bank, OFSI allowed the bank first to disclose the suspected breaches, followed by interim updates of its internal investigation as it progressed and then the provision of a final report at the conclusion of the bank’s internal investigation.
However, self-reporting is not without risk. A self-report, especially if incomplete, may lead authorities to conduct further investigations of the company’s activities, which could be expensive, lengthy and expose new issues. There is also no guarantee of a lenient approach, especially if the violations were carried out knowingly, were egregious, or were avoidable with an effective compliance programme. It is best practice, therefore, to consider making a self-report with the guidance of experienced legal counsel and after a preliminary investigation of the facts has been carried out.
All individuals and entities subject to UK sanctions must report any information that would ‘facilitate compliance’ with the sanctions regulations to OFSI. This includes information that would identify a designated person, information about a sanctions violation, or details of funds and economic resources that have been frozen.
Specific reporting obligations also apply to the following types of persons:
- ‘Relevant institutions’ – (1) persons with permission to carry out regulated activities; (2) EEA credit institutions that are authorised by their home state regulators and that have permission under the Financial Services and Markets Act 2000; and (3) businesses that transmit money by any means, operate a currency exchange office or cash cheques payable to customers.
- ‘Relevant businesses or professions’ – (1) auditors; (2) casinos; (3) a dealer in precious metals or stones; (4) estate agents; (5) external accountants; (6) independent legal professionals; (7) tax advisers; and (8) trusts or company service providers.
These persons must report to OFSI if they have knowledge or reasonable cause to suspect that a third party is designated, or has committed an offence under the regulations. If such a person knows or has reasonable cause to suspect that a third party is a designated person, and is also a customer of the person, then the person must also state the nature and amount or quantity of any funds or economic resources held for that customer.
Additional reporting to other authorities may be necessary, such as to the FCA or the NCA. Specific reporting obligations may also arise under section 19 of the Terrorism Act 2000 for any act known or suspected to be linked to terrorist financing, as well as under the statutory scheme for each sanctions regime. Where the violation also involves complex fraud or international bribery and corruption, a person may also consider making a self-report to the SFO.
OFSI has discretion in how it responds to breaches of financial sanctions. For example, it may simply require a company to provide additional information about its compliance practices. It may also impose monetary penalties or refer a matter to other regulators or criminal authorities for prosecution.
Criminal breaches of sanctions are eligible for deferred prosecution agreements (DPAs) with the CPS and SFO, allowing an organisation to make reparations for its behaviour without many of the consequences of a conviction. A DPA allows organisations that have co-operated with authorities during an investigation to have the proceedings against them suspended for a set period. The DPA will contain provisions that address the payment of a monetary penalty, compensation, or both; the implementation of a compliance programme; and an agreement for future co-operation with the relevant authority. Upon expiry of the DPA, assuming all obligations are fully met, the prosecution will be discontinued. A code of practice setting out guidance in relation to DPAs has been jointly issued by the CPS and SFO. Since the United Kingdom introduced its DPA programme in 2014, the SFO has entered into eight DPAs.
For breaches that only satisfy the civil standard and would incur a monetary penalty from OFSI, it is also possible to minimise penalties by making a voluntary self-report in the first instance, making representations during the penalty decision process and appealing OFSI’s penalty recommendation through the ministerial review process.
In reaching a penalty decision, OFSI will assess the seriousness of a case based on a number of mitigating and aggravating factors, including but not limited to:
- whether funds or economic resources were provided directly to a designated person;
- whether there was an intentional circumvention of sanctions;
- the value of the breach;
- knowledge of sanctions and compliance systems (although ignorance is no defence);
- the behaviour at issue, including, for example, whether the breach was deliberate or negligent, or any management involvement in the breach;
- repeated, persistent or extended breaches; and
- reporting of breaches to OFSI, including whether the disclosure was voluntary, materially complete and made in good faith.
Where OFSI concludes that the threshold for imposing a civil penalty has been met, it will begin with the statutory maximum penalty it can impose, which will be the greater of £1 million or 50 per cent of the value of the breach. OFSI then decides what level of penalty, between zero and the maximum, is reasonable and proportionate, based on the aggravating and mitigating factors set out above. Up to a 50 per cent reduction in the final penalty is available to persons who provide a prompt and complete voluntary disclosure. This applies to cases assessed as ‘serious’, while a 30 per cent reduction is available for cases assessed to be ‘most serious’. OFSI then produces a penalty recommendation, in respect of which the company can make representations.
Section 147 of PACA also confers a right on any subject of OFSI enforcement action to appeal the fine by requesting a ministerial review of the penalty recommendation. Recent OFSI enforcement decisions, set out in more detail below, so far indicate that invoking the right to a ministerial review may result in substantially reduced penalties.
44.6 Trends and key issues
44.6.1 Recent enforcement activity
As at September 2020, OFSI has imposed four monetary penalties for breaches of financial sanctions since it was first given powers to do so in April 2017. Although these fines have steadily increased in size each time, only the two most recent have exceeded £100,000. Standard Chartered Bank (SCB) was fined £20.47 million in February 2020 for violating sanctions targeting Russia/Ukraine, making it the first fine in the United Kingdom relating to the EU Ukraine (Sovereignty and Territorial Integrity) sanctions regime. Based on these violations, OFSI reached a penalty recommendation of £31.5 million. However, this was appealed by SCB through the ministerial review process and the penalty was subsequently reduced. Telia Carrier UK Limited likewise successfully appealed its original penalty recommendation of £300,000 through the ministerial review process, reducing it to roughly half of the original amount in relation to sanctions violations targeting Syria.
In April 2019, the FCA fined SCB £102.2 million for anti-money laundering (AML) breaches connected in part to violations of US sanctions, based on findings of shortcomings in SCB’s internal assessments of the adequacy of its AML controls, its approach to identifying and mitigating money laundering risks and its escalation of money laundering risk. This matter serves as a reminder that even if a particular transaction does not breach UK or EU sanctions, it may still face collateral enforcement action in the United Kingdom for compliance programme failures.
While OFSI’s enforcement activity still pales in comparison to its US counterpart, the US Department of the Treasury’s Office of Foreign Assets Control, which issued $1.29 billion of monetary penalties in 2019, the steadily increasing figures of OFSI’s fines suggests that enforcement activity will only increase in intensity. As an enforcement agency, OFSI continues to mature, and it is likely that OFSI has numerous investigations in the pipeline.
Brexit may also lead to a divergence between the EU and UK sanctions regimes. For example, EU sanctions provide an exemption to restrictions on particular financial activities in Russia for EU-based subsidiaries of designated entities. After 31 December 2020, any UK-based subsidiaries of designated entities under this sanctions regime will only be exempt from the UK equivalent of this restriction, and vice versa. The United Kingdom is also anticipated to expand the prohibition of ‘financial assistance’ relating to the supply of certain goods. While the Court of Justice of the European Union has held that ‘financial assistance’ does not include payment processing, the UK equivalent of this sanctions regime refers to the provision of ‘financial services’ instead, which includes payment processing.
Additionally, OFSI has issued post-Brexit guidance extending the scope of financial sanctions to entities owned or controlled, directly or indirectly, by a designated person. Substantial changes to the designation process are also in train. SAMLA brings with it a lower threshold for the imposition of sanctions as compared with the EU regime, requiring only that it be ‘appropriate’ to designate a person, rather than having to satisfy the ‘necessity test’ under EU law.  It also provides for the designation of persons by description, which does not currently feature in the EU sanctions regime, and which may result in identification challenges for sanctions screening and compliance processes in future. Lastly, instead of seeking redress in the EU courts, a person designated under the United Kingdom’s autonomous sanctions regime post-Brexit may seek variation or revocation of the designation by the Secretary of State or HM Treasury.
SAMLA will also introduce US-style general licence exemptions (separate from OFSI’s existing powers to issue general licences around the United Kingdom’s domestic terror sanctions regime), which allow a person to undertake acts that would otherwise be prohibited without the need to apply for a specific licence.
Further divergence from the European Union can be seen in the United Kingdom’s enactment of the Global Human Rights Sanctions Regulations 2020 (GHRS Regulations) on 6 July 2020, targeting individuals and organisations for serious human rights abuses and violations accompanied by guidance from the Secretary of State. This was the United Kingdom’s first use of Magnitsky-style sanctions. While the European Union has also taken preparatory steps in enacting its own Magnitsky Act, it is unclear what form this will take when it is finalised. This important development demonstrates that the United Kingdom is still able and willing to take the lead on sanctions enforcement, instead of reacting and following in the footsteps of the European Union.
In light of the above, individuals and entities are well-advised to stay informed of any developments in this sphere, and to ensure that any sanctions compliance programme is sufficiently robust and agile enough to adapt to the shifting landscape of the United Kingdom’s autonomous sanctions regime.
 Rita Mitchell and Simon Osborn-King are partners, and Yannis Yuen is an associate, at Willkie Farr & Gallagher LLP.
 See, e.g., Council Regulation (EU) 2017/1509 of 30 August 2017 concerning restrictive measures against the Democratic People’s Republic of Korea and repealing Regulation (EC) No. 329/2007 (https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02017R1509-20200603).
 OFSI Financial Sanctions Guidance (https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/862451/OFSI_general_guide_to_Financial_Sanctions.pdf); OFSI SAMLA Guidance (https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/897735/UK_Financial_Sanctions_-_General_guidance__July_2020_.pdf).
 OFSI Enforcement Guidance at paragraph 3.7 (https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/905122/Monetary_Penalties_Guidance__July_2020_.pdf).
 OFSI Enforcement Guidance at section 4 (https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/862451/OFSI_general_guide_to_Financial_Sanctions.pdf).
 Council Regulation (EC) No. 2271/96 (https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:01996R2271-20180807), Articles 4, 5 and 6.
 Financial Sanctions Guidance (https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/862451/OFSI_general_guide_to_Financial_Sanctions.pdf) at para. 6.3.
 For example, see the Terrorist Asset-Freezing etc. Act 2010 (https://www.legislation.gov.uk/ukpga/2010/38/contents), s.17.
 Financial Sanctions Guidance (https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/862451/OFSI_general_guide_to_Financial_Sanctions.pdf) at para. 6.5.
 ‘Financial sanctions, Iran (nuclear proliferation) (https://www.gov.uk/government/publications/financial-sanctions-iran-nuclear-proliferation).
 The Protecting against the Effects of the Extraterritorial Application of Third Country Legislation (Amendment) (EU Exit) Regulations 2019 (https://www.legislation.gov.uk/ukdsi/2019/9780111183229).
 ‘Financial sanctions, Democratic People’s Republic of Korea (https://www.gov.uk/government/publications/financial-sanctions-north-korea-democratic-peoples-republic-of-korea).
 ‘Imposition of Monetary Penalty – Telia Carrier UK Limited’ 9 September 2019 (https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/842548/Telia_monetary_penalty.pdf).
 The Code for Crown Prosecutors (https://www.cps.gov.uk/publication/code-crown-prosecutors).
 This was an increase on the previous maximum penalty of two years. See the European Communities Act 1972 (https://www.legislation.gov.uk/ukpga/1972/68/contents), para. 1(1)(d) of Schedule 2.
 Proceeds of Crime Act 2002 (https://www.legislation.gov.uk/ukpga/2002/29/contents), s.334.
 Policing and Crime Act 2017 (https://www.legislation.gov.uk/ukpga/2017/3/contents/enacted), s.146(3).
 For example, under the Terrorist Asset Freezing etc. Act 2010, certain institutions have an affirmative reporting obligation to the Treasury where they have knowledge or reasonable cause to suspect that someone is a designated person or has committed an offence involving certain prohibitions in relation to designated persons. See Terrorist Asset Freezing etc. Act 2010, s.19.
 For example, see the Criminal Justice Act 1987, s.2.
 FCA’s Principles for Business (https://www.handbook.fca.org.uk/handbook/PRIN/2/1.html), Principle 3.
 FCA’s Senior Management Arrangements, Systems and Controls Sourcebook (https://www.handbook.fca.org.uk/handbook/SYSC/3/2.html), Rule 3.2.6.
 Ibid (https://www.handbook.fca.org.uk/handbook/SYSC/6/1.html), Rule 6.1.1.
 Financial Services and Markets Act (FSMA) (https://www.legislation.gov.uk/ukpga/2000/8/section/165), s.165.
 FCA’s Principles for Business (https://www.handbook.fca.org.uk/handbook/PRIN/2/1.html), Principle 11.
 FSMA (https://www.legislation.gov.uk/ukpga/2000/8/section/171), s.171.
 FSMA (https://www.legislation.gov.uk/ukpga/2000/8/section/172), s. 172.
 Final Notice – Tullett Prebon (Europe) Limited, 11 October 2019 (https://www.fca.org.uk/publication/final-notices/tullett-prebon-europe-limited-2019.pdf), para. 6.45.
 SFO Corporate Co-operation Guidance (https://www.sfo.gov.uk/publications/guidance-policy-and-protocols/sfo-operational-handbook/corporate-co-operation-guidance/).
 OFSI Enforcement Guidance (https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/605884/Monetary_penalties_for_breaches_of_financial_sanctions.pdf) para. 3.35.
 See for example, Council Regulation (EU) No 36/2012 of 18 January 2012 concerning restrictive measures in view of the situation in Syria and repealing Regulation (EU) No. 442/2011 (https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02012R0036-20200530) at Article 29.
 For example, Standard Chartered Bank was able to secure a 30 per cent reduction for its voluntary self-disclosure (https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/876971/200331_-_SCB_Penalty_Report.pdf).
 OFSI Enforcement Guidance (https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/708991/Monetary_Penalties_Guidance_web.pdf), para. 3.33.
 ‘Imposition of Monetary Penalty – Standard Chartered Bank’, 18 February 2020 (https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/876971/200331_-_SCB_Penalty_Report.pdf).
 OFSI Financial Sanctions Guidance (https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/862451/OFSI_general_guide_to_Financial_Sanctions.pdf), Table 5.A.
 Under FSMA (https://www.legislation.gov.uk/ukpga/2000/8/contents), Part 4A.
 Definitions of each of these businesses and professions can be found in the Schedules to the relevant UK regulation for each EU sanctions regime.
 OFSI Enforcement Guidance (https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/708991/Monetary_Penalties_Guidance_web.pdf), para. 3.2.
 ‘Deferred Prosecution Agreements Code of Practice’ 11 February 2014 (https://www.cps.gov.uk/sites/default/files/documents/publications/dpa_cop.pdf).
 Crime and Courts Act 2013 (https://www.legislation.gov.uk/ukpga/2013/22/contents/enacted), Schedule 17.
 ‘Enforcement of financial sanctions’ (https://www.gov.uk/government/collections/enforcement-of-financial-sanctions).
 ‘Imposition of Monetary Penalty – Standard Chartered Bank’ 18 February 2020 (https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/876971/200331_-_SCB_Penalty_Report.pdf).
 ‘Imposition of Monetary Penalty – Telia Carrier UK Limited’ 9 September 2019 (https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/842548/Telia_monetary_penalty.pdf).
 ‘Decision Notice – Standard Chartered Bank’ 5 February 2019 (https://www.fca.org.uk/publication/decision-notices/standard-chartered-bank-2019.pdf).
 2019 Enforcement Information – US Department of the Treasury (https://home.treasury.gov/policy-issues/financial-sanctions/civil-penalties-and-enforcement-information/2019-enforcement-information).
 PJSC Rosneft Oil Company v. Her Majesty’s Treasury and Others (Case C-72/15) (http://curia.europa.eu/juris/celex.jsf?celex=62015CJ0072&lang1=en&type=TXT&ancre=).
 The Russia (Sanctions) (EU Exit) Regulations 2019 (https://www.legislation.gov.uk/uksi/2019/855/contents/made) ss.28, 37, 44, and 52. See also Russia Guidance – Guidance for the financial and investment restrictions in Russia (Sanctions) (EU Exit) Regulations 2019 (https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/892741/OFSI_-_Russia_guidance_-_June_2020.pdf) (noting that financial services includes payment processing).
 Sanctions and Anti-Money Laundering Act 2018 (https://www.legislation.gov.uk/ukpga/2018/13/contents) s. 11.
 Ibid, s.12.
 Ibid, s.23.
 Ibid, s.15.
 Global Human Rights Sanctions: guidance (https://www.gov.uk/government/publications/global-human-rights-sanctions-guidance/global-human-rights-sanctions-guidance).
 ‘EU ministers break ground on European “Magnitsky Act”’, 10 December 2019 (https://www.euractiv.com/section/justice-home-affairs/news/eu-ministers-break-ground-on-european-magnitsky-act/).