OFSI imposes its first monetary penalty — Raphaels Bank sanctions breach

Authors: Daniel Hudson, Partner, London and Daniel Hyde, Associate (Australia), London

On 25 February 2019, the UK Government's Office of Financial Sanctions Implementation ("OFSI") published a notification of its first imposition of a monetary penalty under new powers afforded to it under the Policing and Crime Act 2017 ("the Act"). The £5,000 penalty was imposed on Raphaels Bank for dealing, without a licence, with funds belonging to a designated person in breach of EU financial sanctions in relation to Egypt. The penalty amount represents a 50 per cent reduction of the baseline penalty amount initially assessed by OFSI as a result of Raphaels Bank's voluntary disclosure of the breach and subsequent cooperation.

The notification is brief, seemingly because OFSI is making ongoing enquiries in connection with other aspects of the breach unconnected with Raphaels Bank. However, it is apparent that OFSI determined the penalty amount in accordance with its case assessment process set out in its monetary penalty guidance ("Guidance"), which makes this case a useful, albeit currently limited, illustration of its application of that process.

In this briefing, we discuss the significance of the first monetary penalty imposed by OFSI, particularly:

• the reduction to the final penalty amount as a result of Raphaels Bank's disclosure and co-operation;
• the low-value of the breach;
• the current brevity of the notification;
• possible public interest considerations behind the penalty; and
• the two procedural rights of review available under section 147 of the Act.

The Act

As mentioned in our February 2017 periodic sanctions briefing, OFSI's new powers under Part 8 of the Act allow it to impose a monetary penalty on companies and individuals deemed to have breached financial sanctions on the civil standard of proof. Monetary penalties provide a 'middle-ground' enforcement tool to the alternatives previously available to OFSI of pursuing a criminal prosecution or issuing a warning letter. Under the Act, penalties may be imposed up to a maximum of £1 million, or 50 per cent of the value of the breach in question, whichever is higher. OFSI can impose monetary penalties under section 146 of the Act where:

it is satisfied, on the balance of probabilities, that —

(a) the person has breached a prohibition, or failed to comply with an obligation, that is imposed by or under financial sanctions legislation, and

(b) the person knew, or had reasonable cause to suspect, that the person was in breach of the prohibition or (as the case may be) had failed to comply with the obligation.

OFSI's Guidance to its monetary penalty powers

In our April 2017 briefing, we set out a comprehensive summary of the Guidance, OFSI's penalty determination process and the various aggravating and mitigating circumstances taken into account by OFSI when considering what amounts to a fair and proportionate penalty amount.

In short, once the threshold in section 146 of the Act (as outlined above) has been met, OFSI will impose a penalty in circumstances where: (i) the breach involved funds or economic resources being made available directly to a designated person; (ii) there is evidence of circumvention; (iii) a person has failed to comply with a requirement to provide information; and/or (iv) OFSI otherwise considers that a monetary penalty is appropriate and proportionate. OFSI then determines a baseline penalty amount by reference to the statutory maximum amount, whether OFSI classifies the breach as 'serious' or 'most serious' and based on what is reasonable and proportionate in the circumstances in light of various aggregating and mitigating factors. These factors include:

1. whether there has been the direct provision of funds or economic resources to a designated person — this aggravating factor was present in this case;
2. the value of the breach — notably, the breach of the value in this case was only £200;
3. whether the breaches were repeated, persistent or extended;
4. whether the issues were reported to OFSI — according to the notification, Raphaels Bank made a disclosure to OFSI when they became aware that a breach of financial sanctions had taken place;
5. whether there was any failure to provide information to OFSI — this does not appear to be the case in this instance as the notification expressly states that Raphaels Bank cooperated with OFSI; and
6. whether it is in the public interest to impose a penalty — this is considered further below.

Once the baseline penalty amount has been determined, a reduction may be applied if the breach was voluntarily disclosed to OFSI, as was the case here. The size of the reduction for 'serious' breaches is 50 per cent of the baseline penalty amount and there is a reduction of the baseline penalty amount of up to 30 per cent for 'most serious' breaches. Given OFSI's 50 per cent reduction of the baseline penalty amount it assessed for Raphaels Bank, it is evident that OFSI viewed this breach as 'serious', rather than 'most serious'.

Significance of this penalty

OFSI stated in its 2017-2018 Annual Review that "it is likely that OFSI will impose monetary penalties in 2018-19" and this penalty represents OFSI's first delivery against that statement. However, in addition to being significant by virtue of it being the first monetary penalty imposed by OFSI, this penalty is noteworthy for other reasons.

First, the circumstances of the penalty imposed on Raphaels Bank show that, although voluntary disclosure of breaches to OFSI and subsequent cooperation with them may significantly reduce the final penalty amount imposed, it does not mean that a penalty will necessarily be avoided altogether. As such, firms and individuals should consider approaching any identified breaches in a proactive manner, approaching OFSI openly and cooperatively as early as possible, if they want to avail themselves of the penalty discounts offered by OFSI. However, disclosure and cooperation alone are insufficient to avoid penalties entirely and so are not substitutes for robust internal sanctions-related policies and procedures to prevent breaches from occurring in the first place. Moreover, such controls may be a relevant mitigating factor taken into consideration by OFSI when assessing a baseline penalty amount.

Second, this penalty demonstrates that OFSI is minded to impose monetary penalties even where the breach is low-value and sends a clear message that sanctions systems and controls should be carefully tuned to identifying and preventing more than simply larger or more egregious breaches. Other than possibly achieving a broader deterrent effect, it is not currently entirely clear why OFSI considered it appropriate to impose a monetary penalty for such a low-value breach. The breach was low in absolute terms as well as in comparative terms, given OFSI's comments in its Annual Review that the 122 reports of suspected breaches it received in the relevant period had a combined reported value of £1.35 billion. The Guidance relevantly states that a high-value breach is generally more likely to result in enforcement action, however it recognises that there are circumstances where penalties are justified for lower-value breaches. An example it gives is where there is a deliberate flouting of sanctions. OFSI's notification is silent on whether that was the case in this instance.

Third, the brevity of the penalty notice itself is notable. The Guidance states that OFSI's publicised summaries of penalties will set out, among other things, compliance lessons that OFSI wishes to highlight in order to help others avoid committing a similar breach, as well as other information required to give a true understanding of the case, neither of which has occurred in this notification. As mentioned above, OFSI has indicated that further information may be forthcoming in time about the breach. If so, this will provide useful guidance for individuals and corporates on OFSI's enforcement priorities and areas of focus for improving sanctions-related systems and controls, which is difficult to glean from this penalty notice.

Fourth, OFSI's decision to impose its first monetary penalty in circumstances where the breach was of such a low value may indicate OFSI's view of when it is in the public interest for these new powers to be exercised. On the one hand, the Guidance elaborates that OFSI's public interest considerations include that justice is being seen to be done and that public resources are wisely used and not spent on minor or trivial matters. On the other, the Guidance states that OFSI may choose to take more serious action than the value of the breach appears to warrant if the integrity of financial sanctions or relevant laws seem to be threatened, or confidence in them needs to be maintained. This perhaps suggests that OFSI hopes this penalty to serve as general deterrence to others and as a timely reminder to individuals and companies connected to or operating a business in the UK of OFSI's increased focus on sanctions enforcement. As stated above, OFSI received 122 reports of suspected breaches of financial sanctions in 2017-18. As such, it is likely that there are also further matters in OFSI's pipeline that are currently being considered for monetary penalties.

Finally, it is also worth mentioning that section 147 of the Act sets out two procedural rights of review by parties on whom OFSI has recommended a monetary penalty be imposed. The first avenue is by way of ministerial review and the second is by way of subsequent appeal to the Upper Tribunal. As the Guidance states that OFSI will not normally publish its summary until after the final stages of the process have been finalised, including any ministerial review and subsequent appeal, and given these timeframes in which Raphaels Bank could invoke these rights now appear to have lapsed, it seems that Raphaels Bank did not attempt to challenge OFSI's penalty assessment in this instance. As such, these avenues, and particularly whether the Minister or Upper Tribunal may emphasise certain aggravating or mitigating factors over others, remain unexplored.