Related Authors: Jasmin Simpson, Trainee Solicitor at Mayer Brown
The UK Office of Financial Sanctions Implementation, OFSI, has published revised guidance on civil monetary penalties for breaches of financial sanctions (Guidance), which comes into effect on 1 April 2021. The Guidance replaces guidance that was issued in 2017, shortly after OFSI obtained its civil enforcement authority through the Policing and Crime Act 2017.
The changes to the Guidance are more of tone than substance, but taken together they indicate OFSI’s subtle pivot to an agency increasingly more focused on its enforcement role. Removal of numerous references to compliance programmes underscores this turn. Particular changes, as described below, indicate that OFSI is reserving greater discretion over how it will assess and respond to potential violations, and that it will impose a higher burden on companies who make voluntary disclosures and seek to obtain reductions in penalties.
Increased enforcement discretion
A number of changes in the Guidance indicate that OFSI may afford itself more discretion with respect to enforcement in the future. New language also de-emphasises compliance programmes in the Guidance, which previously held a central place.
For example, the revised Guidance no longer states that OFSI "will not normally impose a penalty on any person who already has been prosecuted" (paragraph 1.22). Where OFSI provides an overview of the enforcement actions it can take (paragraph 3.2), it has replaced "issuing correspondence requiring details of how a party proposes to improve their compliance practice" with simply "issue a warning". The Guidance now also states that OFSI can undertake several different kinds of enforcement action in any one particular case.
Similarly, the Guidance now lacks language it previously contained about circumstances in which OFSI reserves the right not to impose a civil monetary penalty (former paragraph 4.21). It was arguably unnecessary to include this language in the first place, since in any case OFSI has the discretion not to impose a penalty, and including it may provide fodder for companies seeking to argue against the imposition of a penalty. By deleting it, OFSI may be seeking to ensure that its hands are not unnecessarily bound.
OFSI can treat voluntary disclosures as a mitigating factor in its assessment of breaches, which can lead to a reduction in any monetary penalty imposed.
The previous Guidance required that voluntary disclosures be "materially complete on all relevant factors that evidence the facts of a breach" (former paragraph 3.34), and noted that "OFSI takes very seriously any disclosures made in bad faith and any evidence that a disclosure was not materially complete" (former paragraph 3.35). OFSI has now made this standard more stringent by stating that it expects disclosures to "include all evidence relating to all the facts of the breach" (paragraph 3.33, emphasis added). This puts an additional premium on obtaining all relevant evidence in the course of an internal investigation and seriously considering the merits of being more, rather than less, inclusive of information in a disclosure.
Assessment of violations
Where OFSI decides that it is appropriate to impose a monetary penalty, it makes a distinction between "serious" and "most serious" breaches for the purposes of determining the level of the penalty: in a "serious" case, a reduction of up to 50% can be made where a person makes a voluntary disclosure, and up to 30% in a "most serious" case.
The previous Guidance stated that "most serious" breaches could involve, among other things, "blatant flouting of the law" (former paragraph 3.49). This has now been deleted and replaced with "particularly poor, negligent or intentional conduct" (paragraph 3.46). This is clearly a much wider range of conduct which includes, notably, conduct that is not intentional.
This was perhaps implicit in the previous Guidance, but the point was recently highlighted by OFSI's £20m civil monetary penalty imposed on Standard Chartered Bank in February 2020. That case involved failures by SCB to properly utilise a certain exemption under sanctions against Russia. SCB sought a Ministerial review of the penalty, and whilst the Minister agreed with OFSI that the breaches were "most serious", he also found that SCB did not wilfully breach the sanctions regime. See our article on the SCB case.
The revised Guidance also clarifies that OFSI might not reduce a penalty even where a person makes a voluntary disclosure. The previous Guidance stated that a person had "automatic access" to a reduction once they affirmed that their voluntary disclosure was materially complete (former paragraph 4.11). The revised Guidance states that, whilst a person will usually be given a reduction for voluntary disclosure, this will be decided on a case-by-case basis, and no reduction will be given if (among other things) a person has not made a "complete disclosure in the course of the investigation", or has only disclosed a matter because they believe OFSI is already aware of it, or has refused to provide information on request (paragraph 4.10).
Finally, OFSI has made a number of other changes that are more subtle but potentially also significant. For example, the revised Guidance states more succinctly and clearly that OFSI, when assessing violations, will take into account the level of a person's actual and expected knowledge of financial sanctions, the kind of work they do and their exposure to financial sanctions risk (paragraph 3.19). Interestingly, OFSI has deleted guidance stating that it will consider whether a penalty is proportionate if they only distinguishing feature in a case is "if a person simply falls below a high standard", and particularly "when the person has acted swiftly to remedy the cause of the breach" (former paragraph 3.22). We see this as an indication that OFSI will hold companies to higher standards of compliance, having perhaps less sympathy for companies that adopt light-touch compliance programmes, or for sophisticated actors who try hard and nonetheless fail.
Calculation of civil monetary penalties
When OFSI calculates a civil monetary penalty, it first calculates the statutory maximum that could be imposed, which is the greater of £1m or 50% of the value of the breach. Within that maximum, OFSI will then decide what is "reasonable", meaning what an ordinary reasonable person would regard as appropriate, and "proportionate". In the original Guidance, "proportionate" meant that there was a "clear relationship between the value of the proposed penalty and both the value of the breach (if known) and how seriously the breach undermined the sanctions regime" (paragraph 4.8).
The revised Guidance gives OFSI significantly more discretion to levy penalties the value of which are not related to the underlying value of the transactions. In the new Guidance, "proportionate" now refers to "a relationship [and so not necessarily a "clear" one] between the value of the proposed penalty and a holistic assessment of all the other factors in the case. This does not mean that penalty should necessarily be either a specific percentage or multiple of the breach amount" (paragraph 4.8) In other words, the penalty should neither be too high or too low, based on all the circumstances, and not just the value of the breach or the impact on the foreign policy objectives of the relevant sanctions regime.