Governance lessons learned: Experience from implementation of Russian sanctions

UK regulated firms seeking to comply with the Russian sanctions have had to grapple with fast moving legislative and regulatory change, and have inevitably encountered governance challenges along the way. The lessons learned as part of that process have read across which may assist firms in reacting to future develeopments beyond sanctions. Conducting a governance review in this context will enable firms to benefit from recent experience by identifying such lessons and may act as a catalyst for any remediation required so as to ensure the business is better positioned to react and respond to the next set of challenges. We set out below some of the emerging governance themes that we see as being particularly pertinent at the current time.

• Navigating multiple, and potentially conflicting, regimes - in relation to any business line or client relationship, there may be a number of different legal and regulatory regimes that need to be considered both within a particular jurisdiction and also across borders. Whilst these may, at times, be consistent in terms of their scope and approach, there will often be differences in regimes that require firms to take different (and potentially conflicting) steps. Having a process in place to navigate these ovelaps and / or conflicts, is vital. This could involve establishing a steering committee with representatives from different business areas or functions across key jurisdictions and putting in place a communications protocol with clear escalation and decision-making procedures.
• Territorial application and determining where there is a ‘nexus’ to a particular jurisdiction - having a framework for identifying when different regimes apply from a territorial perspective, is important. There may be a number of different factors that need to be considered when determining if a particular activity or scenario is within the territorial scope of a jurisdiction’s regime, which requires having a process in place to navigate these issues and inform any decision-making in that regard. This could involve establishing an internal policy which sets out various criteria employees need to consider when determing how various global sanctions regimes apply to a particular scenario.
• The debate over global policies – some firms may want to take a granular approach to determining how particular requirements such as sanctions law apply to their business, and look to assess, in relation to each business line and service that is relevant, which set (or sets) of law / laws need to be considered. Alternatively, we have seen many firms, particularly those operating under complex multi-jurisdictional operating models where staff in numerous locations may be involved in service delivery, seek to adopt a more global approach. Firms that choose this strategy may seek to develop a global policy which ensures that the firm complies with all relevant laws in respect of its operations worldwide. There are, however, complexities associated with imposing global policies not least because different jurisidictions take different approaches and therefore trying to ‘gold plate’ may be difficult. Irrepsective of the approach taken, firms will need to ensure that they are coordianted at a global level, and have shared best practice standards across the business.
• Understanding client / counterparty ownership chains, and identifing ultimate beneficial owners – regulatory authorities responsible for enforcing the various sanctions regimes take different approaches in terms of how restrictions apply to ultimate beneficial owners. By way of example, whilst the EU and US apply aggregation, this is not automatically the case in the UK. Firms need to have a process for identifying ultimate beneficial owners and overlaying sanctions restrictions in complex group structures, and there are a number of steps that firms will need to consider in this regard:
  • Managing sanctions lists and screening of customers and third-parties across the regimes that are relevant;
  • The processes for conducting due diligence checks to confirm if a client / counterparty has been sanctioned;
  • Considering indirect risks, including to determine the identify of a client / counterparty’s shareholders and UBOs, and whether or not those persons are sanctioned – it can be particularly challenging to validate shareholder information where public registers are not available or in complex offshore structures, where ownership may be concealed; and
  • The method for promptly identifying any changes in ownership and control by sanctions targets, particularly those involving family members and close associates and taking appropriate measures to assess whether or not that impacts the firm’s ability to deal with the client / counterparty.

• Reviewing and updating - risk assessment is at the heart of any effective compliance programme and having a process in place for conducting sanctions risk assessments, which remains effective and up-to-date in light of the developing situation, is vital. Risk management frameworks should be evolving documents that are updated to address the organisation’s needs and risks as they develop over time.
• Escalation frameworks - firms should have a process for identifying issues as they arise, and escalating to the right teams internally. This may involve having an email group / contact list for sanctions escallation, and a clear framework so that individuals know who the correct person is to contact in a particular scenario. Roles and responsibilities need to be clearly allocated and understood across the business. Firms should also have a clear process for managing their regulatory engagement, including having a process for making notifications / disclosures when required.
• Training - all employees, not only those in the sanctions team, need to be aware of risks such as sanctions risks that might arise in their work, and have a comprehensive understanding of the steps they need to take if they identify a potential issue. Firms should have a process in place for ensuring that employees attend regular refresher training when required (e.g. because there is a signficant change in the regime).

Our sanctions and financial services teams have extensive experience of helping clients to navigate these complexities, and would be delighted to assist firms looking for guidance in this area.