OFSI Updates Enforcement and Monetary Penalty Guidance to Address the Assessment of Ownership and Control

On March 16, 2023, HM Treasury’s Office of Financial Sanctions Implementation (“OFSI”) published an updated version of its Enforcement and Monetary Penalties for Breaches of Financial Sanctions Guidance (“OFSI Guidance”).  The OFSI Guidance outlines OFSI’s compliance and enforcement approach as well as providing an overview of the civil monetary penalty regime and how potential financial sanctions breaches are assessed.  The latest update to the OFSI Guidance sets out the framework within which OFSI will assess breaches of UK financial sanctions that flow from, or involve, an incorrect assessment of the ownership and control of an entity by a UK designated person. 

The publication of the updated OFSI Guidance follows repeated calls for clarity regarding the ownership and control test and OFSI’s enforcement stance in relation to it, particularly following the significant expansion of the Consolidated List in response to Russia’s invasion of Ukraine in February 2022 and the UK’s introduction of strict civil liability for financial sanctions breaches in June 2022.

OFSI’s Monetary Penalty Powers

OFSI acquired the ability to impose civil monetary penalties for breaches of UK financial sanctions in April 2017 pursuant to the Policing and Crime Act 2017 (“PACA”).  The civil monetary penalties powers allow OFSI to impose a monetary penalty per breach of up to £1,000,000 or 50% of the estimated value of the funds or economic resources relating to the breach, whichever is greater.  In cases involving multiple breaches, the regime offers OFSI the power to impose very significant monetary penalties against both entities and individuals.

On March 15, 2022, the Economic Crime (Transparency and Enforcement) Act 2022 amended the civil monetary penalty powers under PACA to permit the imposition of monetary penalties by OFSI on the basis of strict liability. 

Update to the OFSI Guidance

While the structure and scope of the OFSI Guidance is largely unchanged, the “Case Assessment” chapter has been expanded to include a new section on “Ownership and Control.”  The new section addresses the factors that OFSI will consider when assessing breaches of financial sanctions that involve the incorrect assessment of an entity’s ownership and control by a UK designated person.  The test for establishing ownership and control of an entity is set out in each of the UK’s thematic and geographic sanctions regulations, and is summarised in Chapter Four of OFSI’s General Guidance.

In determining how seriously to view such a breach, OFSI will consider “the degree and quality of research and due diligence conducted on the ownership and control of that entity.”  While OFSI does not specify the level or type of due diligence that should be undertaken to ensure compliance with UK financial sanctions, the OFSI Guidance states that the performance of appropriate due diligence will be considered a mitigating factor, provided that the ownership and control determination resulting from those due diligence efforts was made in “good faith” and was a “reasonable conclusion” to draw from the due diligence that was performed. 

OFSI may deem it an aggravating factor if there has been a failure to carry out appropriate due diligence on the ownership and control of an entity, or where such due diligence was carried out in “bad faith.”  The weight to be ascribed to these mitigating or aggravating factors will be assessed by OFSI on a case-by-case basis.

According to the OFSI Guidance, whether due diligence conducted in to the ownership and control of an entity is considered “appropriate” will depend on the nature of the particular activity or transaction and the level of sanctions risk it poses.  In assessing the appropriateness of the due diligence performed, OFSI will take into consideration the nature of the alleged offender’s contractual, or commercial, relationship with the entity. 

In practice, OFSI expects to see the adoption of a proportionate and risk-based approach, with evidence of a decision-making process that measures the level of sanctions risk posed by the activity or transaction and considers the appropriate level of due diligence in light of the sanctions risk identified.  According to the OFSI Guidance, these decisions typically should be made by reference to a sanctions compliance policy or framework.  Additionally, OFSI expects the information obtained as part of any ownership and control assessment to be carefully scrutinised, particularly when “efforts appear to have been made by designated persons to avoid relevant thresholds.”

Mitigating Factors

While emphasising that each case will be assessed on its own facts, the OFSI Guidance outlines a series of actions that, if undertaken in whole or part, may be considered potentially mitigating factors by OFSI, as follows:

• an examination of the formal ownership and control mechanisms of the entity to establish whether there is available evidence of ownership and control by a UK designated person;
• an examination of actual influence or de facto control over the entity by a UK designated person, or the potential for such influence or control to exist;
• open-source research on the entity and any persons that own, or have the ability to exercise control over, the entity, as well as an examination of whether those persons are UK designated persons, or have links to UK designated persons, such that further investigation may be warranted;
• direct contact with the entity and/or other relevant entities to probe into indirect or de facto control, including seeking commitments by UK persons as to the role of any UK designated person, or person with links to a UK designated person, when appropriate; and
• performing regular checks, and/or ongoing monitoring, when appropriate.

Areas of Enquiry

The OFSI Guidance includes a non-exhaustive list of areas of enquiry that OFSI may expect to be considered when assessing whether an entity is owned or controlled by a UK designated person.  The extent to which each of these areas should be considered for any particular due diligence exercise to be deemed a mitigating factor by OFSI will depend on the risk posed by the specific activity or transaction.  The OFSI Guidance expressly states that the example areas of enquiry “are not intended and should not be considered thresholds for meeting the ownership and control test in the regulations.”

The list of example areas of enquiry with respect to formal ownership and/or control includes:

• the percentage of shares and/or voting power of shareholders;
• the ownership and distribution of other shares in the company;
• any ownership/shareholding alterations, including in possible anticipation or response to the imposition of financial sanctions.  It may be necessary to give consideration to whether this warrants further investigation into the possibility of joint arrangements or indirect or de facto control;
• the composition of shares, share class splits, or other structural changes made;
• whether changes to ownership and/or control were part of a pre-planned or wider business/financial strategy;
• corporate constitutional documents (e.g., articles of association, byelaws, charters, etc.);
• any commercial justifications for complex ownership and control structures; and
• agreements between shareholders or between any shareholders and the entity (e.g., shareholders’, joint venture, operating, or guarantee agreements).

The list of example areas of enquiry with respect to indirect or de facto control includes:

• indications of continued influence by a UK designated person, including through personal connections and financial relationships, or the potential for such influence to be exerted;
• the presence or involvement of proxies, including persons holding assets on behalf of a UK designated person;
• ownership, holdings of shares, or control by trusts associated with a UK designated person;
• if shares or other ownership interests of a UK designated person have been divested, the nature of any relationships and prior involvement of the person(s) benefitting from the divestment;
• the accuracy of valuations of any recent transfers of shares and how these were funded;
• any operational steps taken to ensure that the UK designated person cannot exercise control over the entity and/or that the UK designated person cannot benefit from, or use, corporate assets;
• information relating to the circumstances of board and/or management appointments, including the backgrounds, relevant experience, and relationships of appointees with UK designated persons;
• the running of board meetings and governance processes, including board or shareholders’ meeting minutes concerning recent changes in the entity’s ownership and control relating to the UK designated person;
• ongoing financial liabilities directly related to a UK designated person (e.g., personal loans, loan guarantees, property holdings, equipment etc.);
• other shareholder agreements, voting agreements, put or call options, or other coordination agreements in place between the entity and the UK designated person or controlled entities; and
• whether there are any benefits conferred on the UK designated person by the entity, or transactions between the entity and the UK designated person.

It should be noted that, when a relationship or activity is ongoing, OFSI expects that the initial due diligence assessment is reviewed, or ongoing monitoring is performed, with a level of regularity that reflects the sanctions risks associated with the relationship or activity. 

Ultimately, the onus for demonstrating that reasonable and appropriate ownership and control due diligence has been conducted falls on the person against which OFSI is considering taking enforcement action. 

Conclusions

By setting out OFSI’s enforcement stance on the issue of ownership and control, and outlining a framework against which due diligence efforts can be calibrated, the updated OFSI Guidance represents a step in the right direction with respect to this vexed question, even if it stops short of offering a definitive answer to the question of how much due diligence is enough when it comes to ownership and control.

In response to this significant development, companies are encouraged to perform a health check of their sanctions compliance policies, due diligence procedures, and other controls to ensure that they take into account the newly announced guidance.  For more information on how these developments could impact your organisation, contact the author of this post, Alexandra Melia, in Steptoe’s Economic Sanctions team in London.