The UK’s Office of Financial Sanctions Implementation (OFSI) published updated guidance regarding the enforcement of financial sanctions on 16 March 2023. The guidance, which sits alongside OFSI’s general guidance on financial sanctions, provides that where OFSI determines that a breach of UK financial sanctions has occurred, and an incorrect assessment of the ownership and control of an entity is relevant to that breach, it will consider the degree and quality of due diligence conducted on the ownership and control of that entity when assessing enforcement options.

The updated guidance is important in clarifying what due diligence is expected under the UK’s new strict liability civil enforcement regime, and underlines the importance of performing thorough sanctions screening exercises, especially as the burden of proof for demonstrating that reasonable and appropriate due diligence was undertaken lies with the person against whom OFSI is taking an enforcement action.

Ownership and control due diligence

Under UK sanctions, asset freeze restrictions attach not only to expressly designated persons or entities but also to entities that the designated person “owns” or “controls”. When OFSI determines that a breach has occurred (eg when funds are made available to an entity owned/controlled by a targeted person), OFSI has stated that it will consider the degree and quality of research and due diligence conducted by the offending person on the ownership and control of the sanctioned entity.

When imposing penalties, OFSI has stated that it can consider appropriate due diligence to be a mitigating factor when assessing whether to bring an enforcement action. On the other hand, a failure to carry out appropriate due diligence can be an aggravating factor. Although the guidance does not prescribe a specific due diligence procedure to carry out, careful scrutiny of the information received and evidence of a decision making process that assessed sanctions risks is necessary.

OFSI has noted the following mitigating factors:

• an examination of the formal ownership and control mechanisms of an entity to establish whether there is available evidence of ownership and control by a designated person;
• an examination of actual, or the potential for, influence or de facto control over an entity by a designated person;
• open-source research on an entity and any persons with ownership of, or the ability to exercise control over, the entity, together with an examination of whether such persons are, or have links to, designated persons such that further investigation may be warranted;
• direct contact with the entity and/or other relevant entities to probe into indirect or de facto control, including, where appropriate, seeking commitments by UK persons as to the role of any designated person or person with links to a designated person; and
• regular checks and/or ongoing monitoring of the above where appropriate.

Overall, OFSI’s determination will centre on:

• the facts of the case;
• the degree of the sanctions risk; and
• the nature of the transaction.

Examples of due diligence which OFSI may expect, on a case-by-case basis, include:

• in relation to formal ownership and/or control:

• the percentage of shares and/or voting power of shareholders;
• whether ownership/shareholding has recently been altered or divested, including in possible anticipation or response to the imposition of financial sanctions. If so, consideration of whether this warrants further investigation into the possibility of joint arrangements or indirect or de facto control;
• the composition of shares, and whether shares have been split into different classes, or other structural changes made; and
• whether changes to ownership and/or control were part of a pre-planned or wider business/financial strategy.

• in relation to indirect or de facto control:

• indications of continued influence (or the potential for it) by a designated person, including through personal connections and financial relationships;
• the presence or involvement of proxies, including persons holding assets on behalf of a designated person;
• ownership, holdings of shares, or control by trusts associated with a designated person; and
• if shares or other ownership interests of a designated person have been divested, the nature of any relationships and prior involvement of the person benefitting.

Where relationships are ongoing, due diligence should be reviewed at appropriate times, such as when new information becomes available. In fact, the regularity of reviews is a factor that OFSI will consider.

Implications

OFSI’s updated guidance has clarified its due diligence expectations and, notably, expresses an expectation that companies and financial institutions undertake thorough due diligence on the ownership and control of entities in order to obtain sufficient comfort that they can transact with them.

This high bar contrasts with a recent judgement in PJSC National Bank Trust and another v. Mints and others [2023] EWHC 118 (Comm) (see our recent article on this judgment here) where Mrs Justice Cockerill noted that “it is not the intent for complex investigations to have to be made or evidence gathered” when determining if an entity is targeted or not.

Further, although companies and financial institutions will be reassured that OFSI will consider decisions made in good faith, and reasonably drawn conclusions, to be mitigating factors, OFSI has couched its commentary such that evidence of a reasonable inquiry into ownership and control will not always mean that enforcement action will not be taken or that a discount will be made from a financial penalty.

Accordingly, and especially since the burden of proof for demonstrating that reasonable and appropriate due diligence was undertaken lies with the person against whom OFSI is taking an enforcement action, it is clear that significant due diligence on the ownership and control of entities is required.

Companies should therefore ensure that they are implementing thorough sanctions screening and due diligence exercises and establish and maintain appropriate compliance frameworks so that potential issues are flagged at an early stage and thoroughly assessed before transacting with counterparties that may give rise to sanctions issues.