UK Sanctions: OFSI Publishes New Guidance on Ownership and Control

On 16 March 2023, the Office of Financial Sanctions Implementation (“OFSI”) updated its Enforcement and Monetary Penalty Guidance (the “Guidance”).¹ The Guidance offers new and welcome insight into OFSI’s expectations around sanctions ownership and control assessments under UK sanctions. Among other things, the Guidance:

• Provides a more detailed framework to inform the policies and procedures and decision-making process companies should follow in making an ownership and control assessment;
• Offers a non-exhaustive list of due diligence steps a company may take to assess whether a UK sanctions target exercises (i) formal ownership and/or control; and (ii) indirect or de facto control over a company; and
• Sets out certain factors that OFSI will consider as aggravating or mitigating in an enforcement context where an incorrect assessment of ownership and control is a relevant factor. 

The Guidance states that OFSI “does not prescribe the level or type of due diligence” a company should undertake in making an ownership and control assessment.  However, the Guidance also states that OFSI will consider as a mitigating factor in the event of a breach an “ownership and control determination reached… in good faith” where such determination is a “reasonable conclusion” based on the due diligence conducted.  In practice, the examples of due diligence enquiries set out in the Guidance will form a helpful part of a company’s toolkit in conducting an ownership and control assessment.

Ownership and control – better understanding OFSI’s expectations

It is well-established under UK sanctions that asset freeze restrictions targeting a designated person extend to any person the designated person owns or controls.  OFSI has previously set out guidance in its OFSI’s General Sanctions Guidance²

(“OFSI’s General Sanctions Guidance”) on the ownership and control test.  Assessing a party’s control status under UK sanctions, however, has presented practical compliance challenges for companies, for example, where a sanctions target holds a significant minority share in a company or previously held a majority interest in a company and has divested some portion of the stake to family members or business associates.

The Guidance provides new insight into OFSI’s expectations of companies making an ownership and control assessment under UK sanctions.  While these expectations may reflect the existing sanctions compliance framework a company may have in place, the Guidance provides a helpful guide against which companies can assess the adequacy of their existing sanctions compliance policies and procedures.  The Guidance states that, in assessing whether the level of due diligence conducted by a company was appropriate to the degree of sanctions risks and nature of the transaction, OFSI expects, among other things:

• To see evidence of a decision-making process that took account of the sanctions risk and determined the appropriate level of due diligence in light of that risk;
• That such decisions be made by reference to an internal framework or policy;
• A company to carefully scrutinise information obtained as part of any ownership and control assessment, particularly where efforts appear to have been made by designated persons to avoid the effects of UK sanctions, such as by reducing ownership below 50%; and
• That due diligence and ownership and control assessments are reviewed at appropriate times.

Assessing ownership and control in practice

The Guidance offers a non-exhaustive list of due diligence steps a company may take to assess whether a UK sanctions target exercises (i) formal ownership and/or control; and (ii) indirect or de facto control over a company.  These include:

As to formal ownership and/or control:

• Whether ownership / shareholding has recently been altered or divested, including in possible anticipation or response to the imposition of financial sanctions;
• Whether changes to ownership and/or control were part of a pre-planned or wider business/financial strategy;
• Any commercial justifications for complex ownership and control structures;
• Agreements between shareholders or between any shareholders and the entity (e.g., shareholders’, joint venture, operating, or guarantee agreements).

As to indirect or de facto control:

• Indications of continued influence (or the potential for it) by a designated person, including through personal connections and financial relationships;
• Ownership, holdings of shares, or control by trusts associated with a designated person;
• If applicable, how recent transfers of shares were funded and whether this was done at an accurate and true valuation;
• Any operational steps taken to ensure that the designated person cannot exercise control over the entity and/or that the designated person cannot benefit from, or use, corporate assets;
• The running of board meetings and governance processes, including board or shareholders’ meeting minutes concerning recent changes in the entity’s ownership and control relating to the designated person.

OFSI’s enforcement approach

The Guidance states that an appropriate assessment of ownership and control may be a mitigating factor in an enforcement context.  Other measures OFSI may consider include: conducting open source research on a third party, making direct contact with the third party in making due diligence enquiries, and conducting regular checks and/or ongoing monitoring of the third party where appropriate.  OFSI will consider a failure to carry out appropriate due diligence or the conduct of due diligence “in bad faith” as aggravating factors.

While an ownership and control assessment is always fact-specific, the overall message for companies is clear: conduct reasonable and appropriate due diligence based on the level of identified risk, keep a record of those steps and the decision-making process, and monitor and review your ownership and control assessment on an ongoing basis, where appropriate. 

For further information on sanctions developments from the UK, EU, US and other jurisdictions, please visit our Sanctions & Export Controls page.