Demystifying sanctions

Organisations are having to scramble to comply with the largest package of sanctions ever imposed against a G20 nation. Read on to find out the what, the why and the how.

In the wake of Russia’s invasion of Ukraine on the 24th of February 2022, the EU, UK and the US, among other governments, quickly executed the largest package of sanctions ever imposed against a G20 nation against Russia.

Organisations are now having to make sure that they are complying with the fast-changing sanctions landscape. Failure to comply with the host of new international sanctions regimes will mean severe legal and financial penalties for organisations. In the UK, it can also lead to imprisonment for up to 10 years.

The risk is not just legal and financial penalties, but that compliance holds up the normal course of business, preventing organisations from serving and onboarding the right clients. Read on to learn what exactly sanctions are, penalties for breaches, the complexities of compliance, and the solutions.

What are sanctions?

Sanctions can be:

• Economic
• Diplomatic
• Military

The primary form of sanctions being levied against Russia are economic ones:

“Penalties levied against a country, its officials or private citizens, either as punishment or in an effort to provide disincentives for policies or actions.”

UK Regulation

In the UK, those who are sanctioned have their assets in the UK frozen and no UK citizen or company can do business with them.

This includes UK nationals outside of the UK and organisations incorporated or constituted under the law of the UK.

These sanctions also apply in British Overseas Territories such as the British Virgin Islands.

EU Sanctions

EU sanctions apply to any legal person, entity or body inside or outside the territory of the EU which is incorporated or constituted under the law of an EU Member State. EU sanctions also apply to trade between Northern Ireland and Russia.

The primary EU sanctions being issued against Russia are asset freezes against individuals and organisations and sectoral trade/investment sanctions. For example, new investment in the Russian energy sector is now prohibited.

After leaving the EU, the UK is no longer under the scope of EU sanctions. Generally, however, banking and insurance agreements require compliance with UK, EU, US and other sanction regimes.

US Sanctions

Economic sanctions administrated by the US Department of Treasury’s Office of Foreign Asset Control (OFAC) generally prohibit transactions by persons and organisations inside the US, and US citizens outside of the country.

They also extend to parties subject to US jurisdiction wherever located.

This includes foreign companies that (1) have a branch in the United States; (2) have a subsidiary in the United States; or (3) do business in the United States.

Unlike UK and EU sanctions, these sanctions have extraterritorial reach, and could reach parties not located in the US — such as foreign organisations processing payments in US dollars through US banks.

OFAC sanctions typically include asset freezes and trade restrictions.

Asset freezes

Asset freezes mean that it is prohibited to deal with the funds or economic resources belonging to or controlled by a designated person, or to engage in actions that ‘directly or indirectly circumvent the financial sanctions.’

Indirect breaches

The possibility of ‘indirectly’ breaching the sanctions highlights that organisations are under the risk of unknowingly failing to comply with sanction rules.

Checking names on a list of sanctioned entities enables you to see directly sanctioned individuals and entities. But the risk of indirect breaches mean it is important also to detect and map out any potential association with sanction-related entities.

This means more thorough due diligence on partners, supply chains and clients that goes beyond watchlist screening.

Adverse media checks and screening has become vital to ensure complete protection. This can be time-consuming, complex work that requires painstaking attention to detail. But if done right, it enables organisations to stay on top of those who may be sanctioned in future.

None of the recent sanctions were a surprise. There was already plenty of information available about individuals’ connections to Russia and the Kremlin – for those who knew where to look.

To further complicate matters, there are implicitly related sanctioned entities, as well as explicitly listed ones. In the US, OFAC’s 50% rule states that an entity is implicitly sanctioned if one or more sanctioned individuals own 50% or more of that entity. The EU has a similar rule.

Where there are significant ownership stakes under 50% by a sanctioned individual, OFAC ‘urges caution’. It remains unclear exactly what this ‘caution’ entails. This lack of clarity from regulators poses another challenge to organisations that may have some distant affiliation to a sanctioned entity.

Penalties

Failure to comply with sanctions rules can lead to severe penalties, typically heavy fines but in some cases even imprisonment.

In 2020, UK regulators issued a record £20.47mn fine to Standard Chartered for breaching EU sanctions, after it lent money to the Turkish bank Denizbank, which was majority-owned by Russia’s Sberbank.

Personal accountability

Increasingly the individual decision-makers are personally held accountable. In the UK for example, the Senior Managers Regulation, was put in place following the 2008 financial crisis which increases the focus on individual responsibility among senior managers in the financial services industry. An individual can therefore be held personally accountable through financial penalties for breaching sanctions regulations.

As well as financial penalties, the reputational risk that come from association with sanctioned individuals or organisations is severe. It can also be a significant deterrent to future clients and partners. Anyone seen to be associated with illicit or sanctioned money could be subject to negative press with long-lasting adverse reputational and financial impact.

The challenge

Identifying sanctioned entities

Different countries are under the jurisdiction of different sanction lists. This makes the task of identifying the ones which your organisation must comply with hugely challenging. Most businesses with global supply chains, even aside from large multinational corporations, have to deal internationally on some level. Regulations in another jurisdiction may well affect your course of business. A globalised world means globalised risks.

In addition, sanction lists are updated constantly, and tools that provide database searches don’t always update them in real-time.

Many of these tools also have a huge issue with false positives. These stem from limitations in translingual name matching, fuzzy name matching and entity resolution technology.

False positives and the costs entailed with having to sift through them and detect which ones are your subject can be a significant pain point for organisations. Companies have to balance being compliant with the need to keep costs under control. The time wasted going through false positives delays client onboarding which risks alienating a valuable client base. In a competitive, global world a delay in the onboarding process can mean that banks and other organisations lose valuable clients to competitors.

Complex, rapidly evolving regulation

As can be seen from the penalties associated with direct and indirect breaches, in the UK and EU, checking lists and databases, though necessary, is not sufficient. The burden is on institutions to map out networks and associations of sanctioned entities in order to prevent association with any implicitly related entities.

This is also necessary to cut through strategies used to hide ultimate beneficiaries and sources of funds. This network mapping requires going beyond sanctions lists, using open-source data and media articles.

The solution

Traditional methods

Step 1: It is necessary to make sure that the tools you are using for your PEPs and Sanctions checks are updated in real-time. ComplyAdvantage, for example, is an automated PEPs and Sanctions provider that can update its databases more quickly than one powered by manual researchers.

Step 2: It is then essential to go through and apply an analyst’s mind to screen out false positives, by applying other contextual information known about your subject. This costs time and money, but it is work that can’t be rushed as the stakes are high if an analyst makes a mistake.

---