Hot topics in sanctions compliance for financial services firms, and broader considerations

Sanctions compliance

A number of important themes are emerging in terms of sanctions compliance, including a patchwork approach across jurisdictions, interpretation issue and concerns around individual liability for sanctions compliance.

Patchwork approach across jurisdictions

Vital differences are beginning to emerge across the EU, the UK and U.S. regimes, notably in relation to the scope of designations of individuals and entities and the approach to the way in which the prohibitions are drafted. The authors have also seen inconsistent approaches being applied to the various wind-down periods, general licences and guidance from the authorities, or no guidance in many circumstances.

This patchwork approach is making it difficult for regulated firms to map their potential exposure and address their sanctions risk across jurisdictions. Firms will need to conduct a detailed analysis to compare the prohibitions across the EU, UK and the United States, and continually monitor developments.

Interpretation issues

There are also complexities concerning how certain of the broadly drafted provisions should be interpreted, and precisely what activities and services of regulated firms are considered to be in scope. One of the general issues causing considerable uncertainty for firms, is how they should treat non designated entities whose shareholders or executives are designated.

This is ultimately a question of "ownership" and "control" but it is further complicated in a scenario where company ownership and information on ultimate control is difficult to establish.

Different regulators have also taken different approaches to how the sanctions restrictions apply. By way of example, in terms of the approach taken to aggregation, the Office of Financial Sanctions Implementation has confirmed that it does not simply aggregate different designated person's holdings in a company. On the other hand, the EU has clarified in guidance that one should look at the aggregated ownership of the company which is a similar approach to that taken by the Office of Foreign Assets Control in the United States.

The effect of this is that you have a different analysis that applies depending on the applicable jurisdictions even though the underlying concepts are quite similar.

In addition, we are seeing instances where it might be permissible under the so-called sectoral sanctions to deal in certain securities of a sectoral sanctions target, but not permissible where that sectoral sanctions target is also subject to asset freeze prohibitions. This needs to be looked at very closely across the different regimes and may result in immediate restrictions over certain securities (including in the secondary market) which were not previously an issue.

Absent an applicable general licence, regulated firms could be left holding these securities and unable to deal with them for the period that the asset freeze prohibitions remain in place. This is also an area where we have seen some lack of clarity and inconsistencies in regulators' guidance across the EU, UK and U.S. regimes.

Individual accountability

Turning to individual liability, in addition to the obligations on regulated firms to comply with applicable sanctions regimes, individuals also need to think about their own compliance with sanctions restrictions. From a territorial perspective, individuals must comply with the sanctions regimes in their home jurisdiction wherever in the world they are located — for example, EU, UK and U.S. nationals are still required to comply with their respective sanctions regimes regardless of their location.

In circumstances where the sanctions regime prevents an individual from carrying on certain functions, that person may need to recuse themselves from activities on specific transactions (e.g., board discussions, approvals and signing of documents) that could expose them to individual liability. An example of where this issue may arise is where you have a transaction which an EU bank would be permitted to undertake, but not the UK individual. Firms are finding it increasingly difficult to navigate these complexities as the EU, UK and U.S. sanctions expand in different ways.

Historic issues

The authors have seen some instances where reviewing the new restrictions and assisting with risk assessments has highlighted issues with how the business has been complying with prior sanctions regimes. Where this is the case, regulators would expect firms and senior managers to undertake a review of historic issues that are identified so that appropriate action can be taken, including notifications and/or disclosures, remediation and any enhancements made to procedures. Failure to do so is often a major aggravating factor in any enforcement action, or conversely firms can benefit from mitigation where appropriate investigative and remedial steps have been taken.

Broader considerations

In addition to the considerations above, financial services firms need to be alive to risks other than non-compliance with sanctions. For example:

• Market conduct issues: In recent weeks, international markets have been disrupted by the impact of the Russian invasion on Ukraine, particularly in relation to commodities where there has been high volatility. In these market conditions, there is a heightened risk of market manipulation and firms need to be particularly vigilant to ensure that they are complying with regulatory requirements. Determining whether or not a particular action is actually abusive can be a complicated analysis. Relevant firms and individuals should retain an audit trail explaining why they have acted in a particular way, and what process they went through to conclude that their behaviour was lawful. They should also think about what impact their activity is actually having on the market given evolving market events.
• Systems and controls: The FCA has made it clear that it expects firms to have established systems and controls to counter the risk that they might be used to further financial crime, and this includes compliance with financial sanctions obligations. If the FCA identifies failings in these systems and controls then it can impose restrictions or take enforcement action; the authors have seen an increase in the imposition of restrictions by the supervision teams.
• Outsourcing: Outsourcing is an area of heightened risk, for example, could third-party service providers be affected by Russian sanctions that might affect their ability to provide critical services?
• Cyber-attacks: The authors have also seen concerns raised about the heightened risk of cyber-attacks, and firms should ensure they have plans in place and have thought about issues that might arise in the event of an incident.

Firms can get ahead of regulatory scrutiny by, among other things, ensuring that they have a strong governance framework in place, ensuring effective communication and decision-making and a coordinated and consistent approach.