UK Fintech Company Becomes Fifth Company to Receive OFSI Monetary Penalty for Sanctions Breaches

On August 5, 2021, HM Treasury’s Office of Financial Sanctions Implementation (“OFSI”) announced a GBP 50,000 monetary penalty against TransferGo Limited (“TransferGo”) for multiple breaches of The Ukraine (European Union Financial Sanctions) (No. 2) Regulations 2014 (the “UK Regulations”). According to OFSI’s penalty report, TransferGo, a fintech company, transferred funds to accounts held by non-designated persons with the Russian National Commercial Bank (“RNCB”), an entity subject to an asset freeze.  This resulted, according to OFSI, in 16 transactions made between March 20, 2018, and December 18, 2019, in which TransferGo “made funds available to a person designated under Council Regulation (EU) No 269/2014” (the “EU Regulation”) (i.e., RNCB). The TransferGo case represents the fifth use of OFSI’s civil monetary penalty powers since they were introduced under Part 8 of the Policing and Crime Act 2017 (“PACA”).  While OFSI’s enforcement priorities remain somewhat unclear given the relatively limited use of its powers to impose monetary penalties, the TransferGo case provides some useful hints. OFSI is not only interested in traditional financial institutions The TransferGo enforcement action underscores that OFSI has its sights set on fintech and other companies, “not just traditional financial institutions.”  The TransferGo case – like OFSI’s 2019 enforcement action against Telia Carrier UK Limited (“Telia”) – suggests that OFSI’s investigations may continue to cover a broad range of sectors. The value of OFSI's penalties is fluctuating, but OFSI’s discretion as to what is “reasonable and proportionate” is at least as important when calculating penalties as the value of the funds/resources at issue Under the PACA, OFSI has the discretion to determine the amount of a penalty up to the greater of GBP 1,000,000 or 50 percent of the value of the funds or resources involved in a sanctions breach.  The version of OFSI’s Monetary Penalties for Breaches of Financial Sanctions Guidance (the “Guidance”) applicable to the TransferGo case states that, in calculating a penalty, OFSI has regard to what is “reasonable and proportionate.” TransferGo’s penalty of GBP 50,000 related to transactions with a combined value of GBP 7,764.77.  The maximum possible penalty was therefore GBP 1,000,000.  TransferGo did not receive any voluntary disclosure discount on its penalty, as some of the pertinent transactions were only disclosed in response to information requests issued by OFSI. The GBP 50,000 penalty imposed on TransferGo was therefore based on what OFSI considered to be a reasonable and proportionate penalty, taking into consideration a range of factors, including that TransferGo:

• is a FCA regulated authorized payment institution with knowledge of sanctions;
• issued instructions to send payments to accounts of individuals resident in Crimea using a Russian Bank Identification Code that identified RNCB as the receiving financial institution for the payments;
• demonstrated a poor understanding of financial sanctions throughout its engagement with OFSI;
• failed to inform OFSI of the breaches as soon as practicably possible, despite being a relevant institution under the UK Regulations; and
• fully cooperated with OFSI and promptly provided all information which was requested of it during OFSI’s investigation.

The approach to penalty calculation in the TransferGo enforcement action appears to echo OFSI’s move toward the more holistic assessment of cases, as reflected in recent revisions made to the Guidance concerning the connection between the value of a sanctions breach and the available penalty amount. The importance of due diligence The TransferGo enforcement action communicates OFSI’s position that a person transferring funds to accounts held by non-designated persons with designated banks breaches the prohibition in the UK Regulations on making funds available to a designated person if the person knew, or had reasonable cause to suspect, he/she/it was doing so. OFSI’s penalty report makes clear its expectation that companies and individuals must ensure that they carry out due diligence on both the parties to transactions and the banks and financial institutions involved in those transactions to ensure that financial sanctions are not breached. There is not always benefit to be derived from appealing OFSI’s initial penalty Both Standard Chartered and Telia benefited from appealing OFSI’s initial penalty decision in previous enforcement actions.  After challenging OFSI’s penalty decision through ministerial review, the Economic Secretary to the Treasury (the “Minister”) reduced Standard Chartered’s total penalty by GBP 11,030,000 (approximately 35 percent), having concluded that OFSI should have given greater weight to certain mitigating factors when calculating the penalty.  Telia also had its penalty reduced on appeal by over 50 percent.  These cases suggested that the subjects of OFSI enforcement actions may achieve significant penalty reductions by exercising their right to ministerial review under Section 147 of the PACA. The TransferGo enforcement action goes against that nascent trend.  Having reviewed the case materials, the Minister upheld OFSI’s decision both to impose the penalty on TransferGo and on the amount of the penalty, concluding that the initial penalty was “within the range of reasonable and proportionate options open to OFSI.” It also is worth noting that the Minister rejected TransferGo’s request for anonymity in the event that its penalty was upheld following the ministerial review process.  The Minister considered anonymizing the penalty to be contrary to the objectives of OFSI’s sanctions enforcement regime and not in the public interest. OFSI will continue to investigate and impose penalties for financial sanctions breaches occurring under EU sanctions regulations The sanctions breaches in the TransferGo case occurred prior to the end of the Brexit transition period in 2018 and 2019 and were therefore breaches of the relevant EU Regulation.  The case underlines OFSI’s commitment to continue investigating and, where appropriate, imposing monetary penalties for breaches occurring under EU sanctions regulations prior to the end of the Brexit transition period on December 31, 2020. Key takeaways

1. Sanctions compliance for fintech and non-financial institutions is of growing importance, as OFSI has demonstrated its appetite for bringing enforcement actions for financial sanctions breaches in a range of sectors.
2. It is crucially important for companies and financial institutions to conduct robust due diligence checks to ensure that they understand with whom they are doing business. Implementing such steps will enable companies/financial institutions to mitigate their potential risk through, among other things, the early identification of designated persons involved in potential transactions.
3. The investigation and disclosure to OFSI of potential breaches of financial sanctions should be undertaken carefully and with appropriate cooperation, to maximize the likelihood of a swift and satisfactory outcome. While OFSI’s penalty report acknowledged TransferGo’s full cooperation with OFSI’s investigation, it also stated that “had TransferGo voluntarily disclosed these transactions it could have received a discount of 50% of the baseline penalty amount.”