Penalties are coming – OFSI issues first monetary penalty for financial sanctions breaches

• United Kingdom

• Fraud and financial crime

01-03-2019

On 21 January 2019, the Office of Financial Sanctions Implementation (OFSI), part of HM Treasury, issued a monetary penalty of £5,000 against Raphaels Bank for a contravention of regulation 3 of the Egypt (Asset-Freezing) Regulations 2011 (S.I. 2011/887).

This is the first time that OFSI has issued a civil penalty since it was given statutory power to do so in 2017. The penalty was issued in line with its “Monetary Penalties for Breaches of Financial Sanctions Guidance” first published in 2017 and subsequently updated in May 2018. This guidance is set to be reviewed in March 2019.

What are OFSI’s powers?

As the competent authority for financial sanctions, OFSI implements the UK’s international obligations at a domestic level. Under the Policing and Crime Act 2017 (the Act), breaches of financial sanctions can attract both criminal and civil penalties. The maximum sentence for criminal prosecutions is 7 years in prison and OFSI may also impose monetary penalties for ‘serious breaches’ in accordance with s.146 of the Act which states:

“146 Power to impose monetary penalties

(1)  the Treasury may impose a monetary penalty on a person if it is satisfied, on the balance of probabilities, that –

a.   the person has breached a prohibition, or failed to comply with an obligation, that is imposed by or under financial sanctions legislation,

and

b.   the person knew, or had reasonable cause to suspect, that the person was in breach of the prohibition or (as the case may be) had failed to comply with the obligation…”

The maximum fine that can be imposed under these powers is £1,000,000. These powers apply only to cases where the offence occurred after 1 April 2017.

Who can receive a monetary penalty?

A penalty may be imposed on a body of any type or an individual. In addition, under s.148(1) of the Act, separate penalties could be imposed on a legal entity and the officers who run it.

The size of the penalty

As set out in OFSI’s guidance, in deciding whether to impose a monetary penalty and the value of such penalty, OFSI will consider a number of aggravating and mitigating factors, including:

(1)     whether the case involves the direct provision of funds or economic resources to a designated person;

(2)     evidence of activities demonstrating intentional circumvention of sanctions;

(3)     the value of the breach;

(4)     any harm or risk of harm to the sanctions regime’s objectives;

(5)     knowledge of sanctions and compliance systems;

(6)     how each party has behaved e.g. whether the breach seems to be deliberate or whether there is evidence of neglect or a failure to take reasonable care;

(7)     failure to apply for a licence or breach of licence terms;

(8)     whether there was ‘professional facilitation’;

(9)     repeated, persistent or extended breaches;

(10)   whether the breach was reported to OFSI and the level of cooperation;

(11)   failure to provide information;

(12)   public interest; and

(13)   any other relevant factors.

Why have Raphaels Bank received a penalty?

Raphaels Bank dealt with funds valued at £200 belonging to a person designated under regulation 3 of S.I. 2011/887. The bank disclosed the breach to OFSI once they became aware that it had taken place. OFSI reduced the penalty by 50% from £10,000 for the Bank’s “cooperation and disclosure”.

The enforcement notice states “OFSI imposed the monetary penalty because it was satisfied, on the balance of probabilities, that Raphael’s Bank breached a prohibition that is imposed by or under financial sanctions legislation, and knew or had reasonable cause to suspect, that they were in breach of the prohibition”, therefore satisfying the test under s.146 of the Act.

Our thoughts?

OFSI’s decision to issue its first monetary penalty so soon into the new year suggests that the authority will be taking a more aggressive approach to enforcement in 2019 and beyond. This is not completely unexpected given OFSI’s stated compliance strategy set out in its 2017/18 annual review: “we did not impose a penalty in 2017/18 but are investigating a number of cases where a penalty may be an appropriate response…it is likely that OFSI will impose monetary penalties in 2018/19. We will continue to consider the full range of potential action in every case. The majority of cases, as now, will be resolved by enforcement activity short of a penalty”.

Given the low value of the transaction and the fact that the breach came to light through self-disclosure by Raphael’s Bank, it is not immediately clear why the authority found this to be a particularly “serious breach” to warrant issuing its first monetary penalty.

At the moment, OFSI have released limited information in respect of the investigation but state in its enforcement notice that “enquiries remain ongoing into other aspects of this breach which do not concern Raphaels Banks. A fuller summary of the this breach may be published following the conclusion of these enquiries”. It is not yet clear whether any individuals at the Bank will also be receiving monetary penalties, in line with the authority’s powers under the Act, for the events that led to the breach. Financial institutions should continue to monitor this case as it develops to understand the details behind the decision.

In addition, as OFSI seemingly become more active with respect to penalties, global institutions should also take note of the multiple penalties imposed by OFAC in the U.S. in 2019. So far OFAC have issued four penalties since the start of January totalling $7,028,275. Global institutions facing the risk of both UK/EU and US sanctions breaches may have some cause for concern as authorities across the globe start to fully utilise their enforcement powers to ensure financial sanctions compliance. Financial institutions should be reminded that a breach does not have to occur within the UK to fall within OFSI’s enforcement powers as OFSI may impose a monetary penalty against an institution provided there is a UK nexus. Where the breach occurs in another jurisdiction, OFSI may also use its information-sharing powers to pass details to relevant authorities if this is appropriate and possible under UK law.