Overview
On August 30, 2022, further amendments to the UK’s nine thematic and 29 geographic sanctions regulations came into effect, which expand financial sanctions reporting obligations to cryptoasset exchanges and custodian wallet providers. The amendments, which were introduced under the Sanctions (EU Exit) (Miscellaneous Amendments) Regulations 2022 and the Sanctions (EU Exit) (Miscellaneous Amendments) (No.2) Regulations 2022 (Amending Regulations), revise the definition of a “relevant firm” to which mandatory financial sanctions reporting obligations apply.
For more information on how these developments could impact your organization, contact Alexandra Melia, in Steptoe’s Economic Sanctions team in London.
Which Crypto Providers Are Now Subject to the Mandatory Reporting Obligation?
The Amending Regulations expand the definition of a “relevant firm” to include cryptoasset exchange providers and custodian wallet providers.
The Amending Regulations define a “cryptoasset exchange provider” as a firm or sole practitioner that by way of business provides one or more of the following services, including where the firm or sole practitioner does so as creator or issuer of any of the cryptoassets involved:
- exchanging, arranging, or making arrangements with a view to the exchange of, cryptoassets for money or money for cryptoassets;
- exchanging, arranging, or making arrangements with a view to the exchange of, one cryptoasset for another; or
- operating a machine that utilises automated processes to exchange cryptoassets for money or money for cryptoassets.[1]
A “custodian wallet provider” is defined as a firm or sole practitioner that by way of business provides services to safeguard, or to safeguard and administer:
- cryptoassets on behalf of its customers; or
- private cryptographic keys on behalf of its customers in order to hold, store and transfer cryptoassets.[2]
For the purpose of the foregoing definitions, a “cryptoasset” is defined as a cryptographically secured digital representation of value or contractual rights that uses a form of distributed ledger technology (DLT) and can be transferred, stored or traded electronically.[3]
The language used for the aforementioned definitions is familiar as it derives from the Money Laundering Regulations 2017 and regulations made under the Sanctions and Anti-Money Laundering Act 2018.
Following this legislative development, on the same day, HM Treasury’s Office of Financial Sanctions Implementation (OFSI) updated Chapter 5 of its “General Guidance on Financial Sanctions” (General Guidance), which addresses reporting obligations to OFSI, in line with the new definition. The definition of “relevant firm” under Chapter 5.1.2 now includes the additions “cryptoasset exchange provider” and “custodian wallet provider”.[4]
What Information Must Crypto Providers Now Report?
If a cryptoasset exchange provider or custodian wallet provider knows, or has “reasonable cause to suspect” that it is in possession or control of, or is otherwise dealing with, the funds or economic resources of a designated person it must:
- freeze the relevant funds or economic resources;
- not deal with the funds or economic resources or make them available to, or for the benefit of, the designated person, unless an exception exists in the legislation that the firm can rely on or it has a licence from OFSI; and
- report the designated person to OFSI.
To use Regulation 70(2) of the Russia (Sanctions) (EU Exit) Regulations 2019, as amended, as an example, when reporting the designated person to OFSI a cryptoasset exchange provider or custodian wallet provider must include the following:
- the information or other matter on which its knowledge or suspicion is based; and
- any information the provider holds about the person by which the person can be identified.[5]
Additional guidance on this point also can be found in OFSI’s General Guidance, which states that when a designated person is a customer of a relevant cryptoasset exchange provider or custodian wallet provider, that provider must also state the nature and amount of any funds or economic resources that it holds for the customer.[6]
To coincide with the extension of reporting obligations to crypto providers, OFSI published a blog entitled, “Reporting to OFSI: what do I need to do?,” which outlines the mandatory reporting obligations, for both individuals and entities, and how they can be met, including how to report that a person is a designated person, the details of any funds or economic resources held in relation to a customer that is a designated person, and that a person has committed a financial sanctions offence.
In addition, on March 11, 2022, OFSI, the Financial Conduct Authority (FCA) and the Bank of England published a joint statement encouraging “relevant firms” to also consider their reporting obligations to the UK Financial Intelligence Unit (UKFIU) at the National Crime Agency under the Proceeds of Crime Act 2002.[7]
What Are “Offences”?
This ultimately will depend on the relevant sanctions regulations, however, the offences that need to be reported can include:
- making funds or economic resources available to, or for the benefit of, a designated person;
- dealing with funds owned, held or controlled by a designated person; and
- knowingly circumventing sanctions or enabling/facilitating the contravention of sanctions.
If a cryptoasset exchange provider or custodian wallet provider fails to file a report with OFSI when required then that firm itself commits a criminal offence, which can attract a maximum penalty of an unlimited fine. However, this obligation only applies in respect of information received by relevant firms on or after August 8, 2017.
What Form Should Reporting to OFSI Take?
OFSI provides a form that cryptoasset exchange providers and custodian wallet providers can use to report suspected designated persons, suspected financial sanctions breaches, and frozen assets. The sections included within the form are as follows and should be completed, as applicable:
- Part A – General information (to be completed in all cases);
- Part B – Reporting a suspected designated person;
- Part C – Information on frozen assets; and
- Part D – Information about a suspected breach.
For many of the above sections, the cryptoasset exchange provider or custodian wallet provider will be asked to note the relevant financial sanctions regime that the offending conduct has breached. The list of all financial sanctions regimes in effect in the UK can be found here.
Once completed, the form (and any accompanying documents) should be sent to ofsi@hmtreasury.gov.uk with “SUSPECTED DESIGNATED PERSON”, “FROZEN ASSETS”, or “SUSPECTED BREACH” as applicable in the subject line. Alternatively, completed forms can be posted to OFSI at HM Treasury, 1 Horse Guards Road, London, SW1A 2HQ.
Endnotes
[1] The Sanctions (EU Exit) (Miscellaneous Amendments) (No. 2) Regulations 2022, Amendment of the Iran (Sanctions) (Human Rights) (EU Exit) Regulations 2019, section 2(2)(b).
[2] The Sanctions (EU Exit) (Miscellaneous Amendments) (No. 2) Regulations 2022, Amendment of the Iran (Sanctions) (Human Rights) (EU Exit) Regulations 2019, section 2(2)(b).
[3] “Cryptoassets: our work”, The Financial Conduct Authority, 23 January 2019.
[4] UK Financial Sanctions, General guidance for financial sanctions under the Sanctions and Anti-Money Laundering Act 2018, Chapter 5.1.2, page 21, August 2022.
[5] The Russia (Sanctions) (EU Exit) Regulations 2019, section 70(2).
[6] UK Financial Sanctions, General guidance for financial sanctions under the Sanctions and Anti-Money Laundering Act 2018, Chapter 5.1.1, page 21, August 2022.
[7] Bank of England, “Joint statement from UK Financial Regulation Authorities on Sanctions and the Cryptoasset Sector”, 11 March 2022.
