Russian sanctions - after the laws expect the enforcement

Friday 24 February 2023 marks the one year anniversary of Russia's invasion of Ukraine which has led to one of the most significant global sanctions regimes in recent years. Following a year of unprecedented sanctions activity, we have highlighted our key takeaways for firms to consider and look out for in the coming year.

Enforcement in the spotlight

Sanctions authorities across the globe have introduced rapidly evolving measures to target the Russian state, high profile individuals and entities, and large parts of the Russian economy. The majority of the activity over the past year has focused on the implementation of these measures but we expect the focus to shift to enforcement action in 2023.

Enforcement efforts relating to violations of Russian sanctions are likely to be led by the US. Lisa Monaco, the US Deputy Attorney General, made it clear as early as June 2022 that the US Department of Justice (DOJ) would be increasingly focused on enforcement when she described sanctions as "the new FCPA" (see the full speech here). This did not lead to a direct rise in decided US enforcement cases in 2022, as the Office of Foreign Assets Control (OFAC) only took enforcement action in 16 cases, none of which involved Russian sanctions implemented in response to the invasion of Ukraine. This was a decrease from 20 enforcement actions in 2021 (see OFAC's full statistics here). However, as the introduction of new measures has slowed, we expect OFAC to focus this year on investigating and enforcing cases that are perceived to be low-hanging fruit. This may primarily be in the financial services and logistics industries where sanctions risk is particularly acute.

In the UK, the Office of Financial Sanctions Implementation (OFSI) has shown clear intent to tool up and put sanctions enforcement at the top of its agenda. In its 2022 annual review, OFSI announced its intention to scale up to over 100 employees by the end of 2022 in order to move from a "reactive to a proactive compliance and enforcement model" (see our full briefing on OFSI's annual review). OFSI now also benefits from an expanded arsenal of enforcement powers following the passing of the Economic Crime (Transparency and Enforcement) Act 2022. Alongside OFSI, the FCA is increasingly taking enforcement action against firms for systems and controls failings. We expect the FCA to take more enforcement action against firms who are found to have facilitated sanctions breaches.

Sanctions enforcement was also highlighted by the EU in its recent proposal for a 10th package of Russian sanctions. Alongside the new measures, the EU also announced that a Sanctions Coordinators Forum would be convened this week to gather the EU's international partners and Member States to strengthen enforcement efforts. The EU has previously proposed measures to harmonise criminal offences and penalties across the bloc: at present enforcement is a responsibility of individual Member States which has resulted in weak, and fragmented, enforcement. The Commission is also considering whether there may be a role for the European Public Prosecutor's Office which commenced operations in June 2021 and has become increasingly active in investigating financial crime within the EU.

A collaborative approach 

A key feature of sanctions activity in the coming year, particularly in relation to enforcement, will be increased and expanded cooperation between sanctions authorities.

Earlier this month, Deputy AG Monaco delivered a speech in London which reaffirmed the commitment of the US and UK to take a united approach to enforcing the global sanctions regime against Russia. More recently, US Deputy Treasury Secretary Wally Adeyemo announced that a coalition of over 30 countries would be improving information sharing and coordination in relation to sanctions (see the full speech here). This collaboration will underpin a message to corporates and banks that if they do not give effect to the Russian sanctions regimes they will be cut off from access to financial systems and markets.

Cross-European collaboration was enhanced by the establishment of the European Commission's "Freeze and Seize" Task Force in March, and further steps to enhance cooperation between Member States are also likely. Earlier this week, the Dutch Foreign Minister put forward a proposal, supported by a number of other Member States, for the creation of a centralised EU sanctions watchdog in Brussels.

Sanctions compliance

A year on from the start of the unprecedented Russian sanctions regime, regulators in the US, UK and the EU have all signalled that enforcement will be heightened in 2023. The uniform, cross-border message serves as a reminder for firms to review their sanctions compliance frameworks and ensure they are taking all steps to mitigate enforcement risk. With the rate of new sanctions measures slowing, firms have an important opportunity to ensure their current approach to sanctions compliance is fit for purpose.

In particular, firms should have the following points in mind:

• Risk assessment: As with many other compliance areas, firms need to take a proportionate view of the sanctions risk their business activities pose and review this on an ongoing basis. Risk assessments should be calibrated to take account of a firm's customers and supply chain, the products and services it offers and the geographic locations the business, its customers and supply chain operates in.
• Internal controls and screening: The risk assessment can be used to establish internal controls and policies which reflect the areas of a firm's business which are most likely to give rise to sanctions risk. Fundamental to mitigating sanctions risk is having in place an effective screening process which enables firms to check whether current and future counterparties – and those associated with them – are not on sanctions lists. However screening only will take firms so far: a feature of the Russia sanctions is non-entity specific restrictions, like investment bans and services prohibitions. Care must be taken to ensure that these are not breached.
• Due diligence and record-keeping: OFSI is very clear that it expects a party to undertake appropriate due diligence in order to avoid breaching sanctions. However, it does not mandate specific measures. Firms should maintain a detailed record of risk assessments, due diligence and/or decisions taken with respect to transactions with sanctions risk. Although there is now strict civil liability for breach of financial sanctions in the UK, it may be a mitigating factor in any enforcement action if a firm can demonstrate that it has taken all reasonable steps to comply with sanctions.
• Investigation and reporting: Firms should ensure that suspected breaches of sanctions are investigated in a timely manner and appropriate notifications are made to OFSI when a breach is identified. OFSI's enforcement guidance identifies voluntary disclosure as a potential mitigating factor when assessing a case and deciding whether to apply a monetary penalty. Failure to provide relevant information can also be a criminal offence in its own right. It is therefore critical that firms have clear procedures for the investigation of potential sanctions breaches and the determination of when a voluntary disclosure is necessary.
• Contractual protection: The inclusion of appropriate representations and warranties in contractual arrangements should be a focal point in commercial negotiations. Firms should seek contractual representations from counterparties that the counterparty and none of its owners or affiliates are sanctioned. Contractual arrangements should also include representations that counterparties are not engaged in any conduct that would result in a sanctions designation.
• Training: The sanctions risk inherent in a firm's business activities and the risk associated with certain roles should be reflected in the training specific individuals receive in relation to sanctions. As a baseline, sanctions training should provide adequate information to inform employees of the sanctions risks relevant to the business and firm's approach to mitigating these risks. Enhanced training should also be provided to individuals in higher risk roles to uplift their knowledge and ensure the training they receive is commercially relevant.

To keep track of all the latest Russian sanctions developments, access our Russia Sanctions Tracker here.

Authors: Ruby Hamid, Tom Cummins, Sophie Law, Neil Donovan, Anthony Asindi