OFSI announces £20.47 million penalty in first major sanctions enforcement action

On 31 March 2020, HM Treasury's Office of Financial Sanctions Implementation (OFSI) announced the imposition of a £20.47 million civil monetary penalty against Standard Chartered Bank (SCB) for multiple breaches of EU sanctions, following the bank’s voluntary self-disclosure¹. This is OFSI’s fourth and highest-value civil monetary penalty to date and reinforces the direction of travel in OFSI enforcement we described in our previous Legal Update.

This case illustrates that the value of OFSI’s penalties is increasing and squarely puts OFSI at the forefront of sanctions enforcement in Europe.  It underlines the importance of the effective implementation of sanctions compliance measures, a point relevant to financial institutions and corporates alike.  It also provides new insights into the ministerial review process, and highlights that even a violation by a party acting in good faith can be considered to be “most serious” by OFSI.

The facts

Article 5(3) of EU Council Regulation 833/2014 (the Regulation) prohibits EU persons from making loans or credit, or being part of an arrangement to make loans or credit, available to sanctioned entities, where those loans or credit have a maturity of over 30 days.  Article 5(3)(a) of the Regulation creates an exemption which permits loans or credit that have purpose of financing the import or export of non-prohibited goods between the EU and any third country (the so-called trade finance exemption).

According to OFSI’s penalty report, between April 2015 and January 2018, SCB made a series of 102 loans to Denizbank A.Ş., an entity that was subject to Article 5(3) by virtue its ownership by Russian financial institution Sberbank.  OFSI found that 70 of those loans, with an estimated transaction value of over £266 million, did not involve goods coming into or going out of the EU, and were therefore in breach of the Regulation.

OFSI’s power to impose civil monetary penalties applies only to sanctions violations that occur from 1 April 2017, the date on which the Policing and Crime Act 2017 (PACA) came into effect.  OFSI determined that 21 of the loans in breach of the Regulation were issued after that date, with a transaction value of £97.4 million.  OFSI’s penalty was assessed on the basis of these 21 loans.

Key learnings

1. This case reinforces the need for effective implementation of sanctions compliance measures.

SCB initially ceased all trade finance business with Denizbank when it became subject to restrictive measures, but later introduced “dispensations” to enable loans to be made where the trade finance exemption applied.  OFSI stated that these dispensations were not appropriately implemented because some loans related to trade that did not involve the movement of goods into and out of the EU.  Ultimately, the dispensations enabled loans to be made to Denizbank in breach of the Regulation over an extended period of time.

OFSI’s findings underscore the importance of effective implementation of sanctions compliance measures.  The details of SCB’s “dispensations” are not clear from OFSI’s notice.  The terms of the dispensations themselves may have been compliant – we note that OFSI states that SCB acted in good faith and intended to comply with the Regulation.  As some 70% of loans issued under these dispensations were non-compliant, and the loans were issued over a nearly three-year period, problems may have existed from an early stage, and there may have been ineffective monitoring over time.

This case may therefore serve to emphasise the importance of ongoing monitoring and review of compliance processes after their initial implementation, with appropriate testing and assurance and clear trigger points for escalation to the legal/compliance functions.

2. Does this case give further insight into the ministerial review process?

Under section 147 of PACA, where OFSI imposes a civil penalty on a person, they are entitled to seek a ministerial review, as SCB did in this instance.  This case is the second time in which the ministerial review process has been called upon, the first being the Telia Carrier UK Limited case.²

The Minister agreed with OFSI that SCB’s violations were “most serious” (see further below), but “found that [SCB] did not wilfully breach the sanctions regime, had acted in good faith, had intended to comply with the relevant restrictions, had fully co-operated with OFSI and had taken remedial steps following the breach.”  While the Minister acknowledged that OFSI had taken these factors into account, he concluded that “they should have been given more weight in the penalty recommendation.”  On this basis, the Minister reduced the overall monetary penalty by around £10.4 million – or around 33% – from OFSI’s initial penalty amounts.

It is difficult to draw immediate conclusions as to whether this is the start of a trend, but the penalty reductions enjoyed by SCB and Telia would suggest that OFSI’s initial assessments may be tending toward a more exacting approach.  Moreover, as we noted in our prior updates³, enforcement precedent to date has not revealed a consistent method by which OFSI calculates penalty amounts.  Parties taking advantage of the review process may therefore find it worthwhile in terms of penalty reductions, as Telia and SCB did.  Such a trend could affect OFSI’s approach to case assessment and administration of penalties in the future. 

3. Does this case give practical insights into what OFSI considers to be a “most serious” case?

In its guidance, OFSI states that every case that meets the criteria for a monetary penalty is by definition serious. It also places in a “most serious” category particularly egregious cases, stating that:

‘Most serious’ type cases may involve a very high value, blatant flouting of the law, or severe or lasting damage to the purposes of the sanctions regime.  OFSI will decide this based on the facts of the case.  The most serious cases are likely to attract a higher penalty level.   It will generally be obvious why we regard a case as ‘most serious’, but we will explain this to the person we intend to penalise and when we publish a case summary (if we do)...” ⁴

An effect of a violation being deemed “most serious” is that the maximum penalty reduction for cases that are voluntarily disclosed to OFSI is 30%, rather than 50% in cases OFSI considers to be merely “serious”.

Both OFSI and the Minister decided that this case should be considered “most serious”, which is interesting given their findings that SCB “did not wilfully breach the sanctions regime, had acted in good faith, had intended to comply with the relevant restrictions.”  Furthermore, OFSI’s penalty notice does not explain the basis for the “most serious” finding, as OFSI’s guidance suggests it ought.  It appears likely that the seriousness of the breach was informed at least in part by the value of the loans in question (more than £97 million) and the facts that they were made “directly available” to a sanctioned party.

The case therefore demonstrates that even a party acting in good faith and intending to comply with relevant sanctions can still engage in violations that are classified as “very serious.”  It is therefore critical for companies to actively assess whether their programmes are in fact effective at preventing violations of sanctions laws, which is a matter of proper design based on robust risk assessment as well as effective implementation and periodic testing of their legal effectiveness.

Takeaways

1. Effective implementation of sanctions compliance measures requires more than just technically correct standards. Compliance measures must be based on robust, bespoke risk assessment exercises, and processes must include escalation to legal/compliance based on appropriate trigger events.
2. OFSI is still refining its approach to enforcement as it continues to develop as an enforcement agency, as the second consecutive use of the ministerial review process suggests. What is clear from this case, however, is that OFSI is prepared to impose multi-million pound monetary penalties for sanctions violations.
3. OFSI has given its first indication of what it considers to be a “most serious” case. Companies should be mindful that good faith efforts to comply with sanctions may be insufficient to prevent a breach from being assessed as “most serious”. In-fact effectiveness is key, which is best assured through periodic testing of the legal effectiveness of compliance measures.