New Guidance Issued by OFSI: What Companies Need to Know

On 16 March 2023, the Office of Financial Sanctions Implementation (“OFSI”) published updated guidance on enforcement and monetary penalties for breaches of financial sanctions (the “Guidance”). The Guidance now specifies that OFSI will consider ownership and control due diligence as an aggravating or mitigating factor when assessing breaches of financial sanctions.

Ownership and Control

In summary, financial sanctions apply not only to “designated persons” (i.e., the targets of asset freezes and other financial sanctions) but also to entities that are owned or controlled, directly or indirectly, by designated persons. Appropriate checks must therefore be performed to determine whether a company is subject to ownership or control by a designated person.

Key points to note from the Guidance are as follows:

1. Where OFSI considers that a sanctions breach has occurred, it will look at efforts and checks undertaken by the company in breach. In particular, “the degree and quality of research and due diligence conducted on… ownership and control”.
   
   
2. The Guidance does not prescribe the type or level of due diligence that must be undertaken by a company. Instead, it states that when determining whether the level of due diligence performed is appropriate, OFSI will consider the degree of sanctions risk, the nature of the transaction and the contractual or commercial relationship with the entity in question. OFSI expects to see evidence of a decision-making process regarding ownership and control which takes into account the sanctions risk (normally by reference to a sanctions policy or framework).
   
   
3. The type of due diligence conducted on an entity may serve as a mitigating factor where the determination reached was made in good faith and was a reasonable conclusion to draw from the due diligence. Conversely, where the due diligence carried out was not appropriate or the determination of ownership or control was made in bad faith, this will serve as an aggravating factor.
   
   
4. The Guidance provides a non-exhaustive list of efforts which could serve as mitigating factors in the event of a sanctions breach, which include examining formal ownership and/or control mechanisms of an entity, and actual or potential influence which a designated person might have over an entity. The Guidance helpfully lists “areas of enquiry” which OFSI may expect a company to undertake in these respects.
   
   
5. Importantly, the Guidance specifies that where relationships and activity is ongoing, OFSI also expects that due diligence is, and assessments are, reviewed at appropriate times. OFSI will therefore consider, in appropriate circumstances, matters such as the regularity of checks and whether monitoring was appropriate.
   
   

How Will This Affect Companies?

Since the implementation of the Economic Crime (Transparency and Enforcement) Act 2022, companies have faced a strict civil liability test for breaches of the UK financial sanctions regime, including circumstances where a company has incorrectly assessed whether an entity is owned or controlled by a designated person. The Guidance makes it clear that reaching that determination in good faith, and on a reasonable basis, may act as a mitigating factor. However, the onus will be on a company to establish that an incorrect assessment was reached in these circumstances. This makes it especially important for companies to ensure that their decision-making process regarding ownership and control is proportionate to the sanctions risk which they face, well-documented, and kept under review (where appropriate).