On 21 February, the agency responsible for administering the UK’s financial sanctions regime, the Office of Financial Sanctions Implementation (OFSI), used its civil monetary penalty powers for the first time to impose a penalty of £5,000 on Raphaels Bank for failing to freeze a payment of £200.

OFSI's first use of these powers, which it gained in April 2017, had been anticipated for some time, with OFSI stating in its latest annual report that is had received reports of suspected breaches totalling some £1.35bn, and that penalties were likely to be imposed by the first half of 2019. A penalty for a single violation of financial sanctions can be significant in terms of both financial and reputational impact and therefore businesses – banks, in particular – and their lawyers, keenly aware of the sometimes astronomical penalties levied by US agencies for sanctions violations, wanted to know what approach OFSI would take.

The fact, then, that OFSI has used these powers for the first time to levy a very small penalty against a small bank in relation to single, very small transaction, has raised questions about why OFSI selected this particular violation for the first demonstration of its new powers, and what lessons can be drawn about its approach to enforcement.

What powers does OFSI have to impose civil monetary penalties?

Prior to April 2017, violations of financial sanctions in the UK were a matter of criminal law only. Prosecution of companies was difficult because (similar to other kinds of crime) it is necessary to identify one or more individuals involved in the crime who represented the "directing mind and will" of the company. In April 2017, OFSI gained powers under the Policing and Crime Act 2017 (the Act) to impose civil monetary penalties for financial sanctions violations, of up to the greater of £1 million or 50% of the funds or assets involved, employing the lower civil standard of proof (balance of probabilities) rather than the higher criminal standard (beyond reasonable doubt). This contrasts with the United States, where the US Treasury's Office of Foreign Assets Control (OFAC) has long had the power to levy civil fines for sanctions violations.

Why did OFSI select this case for its first civil monetary penalty?

One might have expected OFSI to lead with a high-profile, high-value penalty against a well-known financial institution, to assert its authority and send a message about compliance. However, a case like that would likely be factually complex and burdensome (in terms of investigatory resources and cross-border coordination, e.g.) for the relatively new agency. The Raphaels Bank case, by contrast, is low value and at least appears to be factually very simple, although we do not know if there other potential violations that OFSI chose not to penalise. This perhaps suggests that OFSI wanted to test its powers (and, no doubt, its internal processes) with a relatively straightforward case before moving on to something more significant.
There is a cryptic note in OFSI's notice about Raphaels Bank: it refers to certain ongoing enquiries that which do not concern Raphaels Bank, following the conclusion of which more details may be published about Raphaels Bank. One wonders – although this is speculative – whether the Raphaels Bank case may be linked to an enforcement action against another party, and whether there is bigger picture here that we do not yet see.

What does this case tell us about OFSI's enforcement approach?

This case indicates that OFSI will investigate all apparent violations, and that even those of low value may be penalised. Banks and their lawyers cannot assume that, if they uncover some minor breach, OFSI would not be interested in it. In its annual review, OFSI stated that it “takes action in every instance of reported non-compliance”. Some such instances may not in fact be breaches, and – OFSI continues – the “majority of cases…will be resolved by enforcement activity short of a penalty”.

The available information on the Raphaels Bank case is limited. We know that the amount at issue was £200, and that Raphaels Bank voluntarily disclosed the violation to OFSI and cooperated with OFSI’s investigation. OFSI fined the bank £5,000, having discounted the original £10,000 fine by 50% due to the voluntary disclosure and cooperation. The fact that OFSI levied a financial penalty at all indicates that OFSI regarded the violation as a "serious" one, in accordance with its published guidance, but not a "most serious" one, for which the maximum discount is 30%. Given that the sum involved (£200) is so small, OFSI must have determined that there were other factors at play to make the matter serious, although we are not told what they are. This is in contrast to OFAC practice regarding the information it publishes about civil penalties.

Although the penalty is small in absolute terms, it represents 2,500% of the underlying transaction. Whilst the amount of the penalty itself may not cause bank compliance officers to lose sleep, OFSI's choice to take action in relation to a single and apparently minor transaction, and levy a penalty at a very significant mark-up on the transaction value, may give them to pause to think what OFSI would do if a bank had engaged in multiple violations, even minor ones. The £1,000,000 cap (or 50% of sums at issue, if greater) applies on a per violation basis, and thus a penalty for multiple violations could increase total fines quickly.

Why has this happened now and not earlier?

It has been almost two years since OFSI gained its civil monetary powers in April 2017. Whilst we do not know why OFSI has not used its powers previously, it is worth remembering that only violations committed since April 2017 qualify for civil penalties. It will have taken some time for OFSI to become aware of post-2017 April violations, investigate them, and assess its first penalty. Once OFSI has decided to levy a penalty and has informed the target, the target will then have the opportunity to make representations to OFSI, which OFSI must consider and respond to. OFSI's guidance indicates that this back-and-forth will generally happen within a couple of months, but it may take longer.

Can we expect all civil monetary penalty cases to be reported?

The Act requires that OFSI publish reports about monetary penalties levied pursuant to its civil enforcement powers, and its official guidance states that it will normally publish a summary of individual cases that name the target of the penalty and provides certain details and "other information required to give a true understanding of the case”.

OFSI's notice on the Raphaels Bank case arguably falls short of OFSI’s own published standard, although as noted above more details may be forthcoming. In any case, the Act’s requirement highlights an important dynamic in sanctions enforcement: reputational damage through public shaming. In recent years, OFAC has used its enforcement actions as teaching moments for similarly situated entities, and it appears that it may be OFSI’s intention to do the same.

What can we expect from OFSI in future?

Since OFSI’s establishment, and even more so during the course of Brexit negotiations, the question has been whether the UK will emerge as a serious enforcement authority from a generally inactive European environment. OFAC’s position as the most formidable sanctions regulator seems safe for now, but it now seems certain that UK sanctions will be enforced with more vigour than other EU regimes. What remains unclear is whether OFSI will be a regulator that – at least in the foreseeable future – focuses on assessing small penalties for minor and simpler breaches, or whether the Raphaels Bank matter is a test signal for more significant actions in the future.