Russian sanctions evasion – key indicators for regulated firms

Our previous blogpost mentioned the recent red alert on sanctions evasion typologies issued by various law enforcement and financial sector partners. In this post we look at this update in more detail to identify potential indicators of sanctions evasion, and the steps that the alert indicates that financial sector and other anti-money laundering ("AML") regulated firms should be taking in this regard.

Background – key sanctions evasion typologies

The red alert (the "Alert") was issued by the National Economic Crime Centre, a multi-agency unit in the National Crime Agency (the "NCA") on 12 July 2022, in partnership with the Joint Money Laundering Intelligence Taskforce, and the Office of Financial Sanctions Implementation ("OFSI"). The red alert process is the way in which the NCA provides information to non-law enforcement bodies, including the private sector, to combat and disrupt serious crime – in this case, common techniques that designated persons ("DPs") and their UK enablers are suspected to be using to evade financial sanctions imposed on Russia in response to the invasion of Ukraine.

The principal focus of the Alert is the transfer of assets from a DP prior to asset freezing sanctions being imposed, particularly where the staggered imposition of asset freezes across a number of jurisdictions gives DPs the opportunity to move assets. Although asset freezing sanctions are generally imposed with immediate effect, a DP who suspects that they may be about to be put on the UK's asset freeze list (either because of press speculation or designations in another jurisdiction) may have the opportunity to act before the UK authorities do so. The Alert also indicates that some transfers have occurred shortly after designation.

According to the Alert, DPs are using associates, including family members and close contacts, via "enablers" such as lawyers, financial managers/advisers, estate agents, and trust and company service providers to:

• transfer assets such as shareholdings in holding companies to trusted proxies such as relatives or employees;
• sell or transfer assets at a loss in order to realise their value before sanctions take effect; and
• divest investments to ensure their ownership stakes are below 50%, or relinquish previous controlling stakes.

It is important to recognise that, prior to designation, a DP will generally be free to transfer and deal with their assets as they see fit. Although this is not clearly stated in the Alert, at a point in time at which relevant sanctions do not exist, it is very difficult to see how they could be characterised as being breached or evaded. Further, if a DP genuinely divests ownership and control prior to the imposition of sanctions, such that a company which was previously owned or controlled by that person no longer meets the relevant regulatory ownership/control test, then its historic ownership should not cause it to be subject to sanctions.

As the Alert rightly recognises, however, there is a potential for sanctions offences to be committed in circumstances where, notwithstanding the apparent divestment, a person who is designated as a DP in fact retains control over a particular asset. Indeed, the Alert suggests that "although a DP may claim to have relinquished the asset, it is highly likely that they will retain their influence through trusted proxies and enablers".  If this is the case, then the DP and/or others who, post designation, seek to disguise the fact that a given asset is within scope of the asset freeze, may breach sanctions. In particular, the Alert notes that a circumvention offence may be committed where enablers are seeking to obstruct other parties from carrying out the necessary due diligence to meet their own sanctions obligations, for example by misrepresenting entities that are owned/controlled by the DP[i].

Indicators of sanctions evasion

In general, the Alert summarises the following key "methods" of sanctions evasion, arising from case studies identified through financial intelligence and other sources:

• transfer of assets and funds to jurisdictions where sanctions are not in place (e.g. UAE, Turkey, China, Brazil, India and certain states of the former Soviet Union);
• use of alternative payment methods, including cryptoassets; and
• opportunities arising from states that continue to support Russia through the purchase of oil and gas or the supply of military hardware/other controlled goods or services (the Alert does not further explain the nature of these opportunities).

The Alert also lists a range of detailed indicators of sanctions evasion, setting out indicators for: (i) detection of frozen asset transfers, (ii) detection of "enablers", and (iii) detection of suspicious payments. We have set out some key examples below, and a full list can be found at pages 10 to 12 of the Alert. This is an important element of the Alert.

A number of the items may indicate behaviour that firms would regard as potentially suspicious from a money laundering perspective in any event, and, conversely, some are items which, in and of themselves, may not be suspicious. Firms should therefore review the sanctions-evasion specific lists in full and in the round, and consider whether the various red flags are sufficiently detected and/or addressed by existing sanctions compliance processes. In circumstances where red flags are present, they should consider if these suggest that there has been sanctions evasion.

• Indicators for detection of frozen asset transfers are stated to include:
  • communication of changes to the beneficial ownership of DPs' corporate structures, in particular transfers to non-Russian/dual national family members or associates, or nominee directors/shareholders prior to or shortly after sanctions taking effect: "these new individuals are likely to be a front, with the DP maintaining indirect control";
  • changes to ownership of a corporate holding to reduce to below 50% shortly before or after sanctions designations, in particular where the transfer does not appear to be at arm's length;
  • use of trusts/complex ownership structures;
  • new equity ownership secured by a long-dated loan to former equity owners; and
  • ownership transfers to previously unknown individuals where that person's financial footprint does not correspond with their newly reported wealth.
• Indicators for detection of enablers are stated to include:
  • beneficial ownership changes notified to other regulated firms accompanied by an opinion of external counsel as to new sanctions disposition;
  • numerous transfers of shares from sanctioned to non-sanctioned entities involving corporations incorporated by the same service provider (often with a registered office at the same physical address);
  • material indicating that an enabler's own due diligence relies on a further layer of due diligence not actually conducted by themselves, or relies on an apparently trusted (but unsubstantiated) source; and
  • use of a complex trust structure overseen by a trust company and its trustees for no apparent legitimate reason.
• Indicators for detection of suspicious payments are stated to include:
  • holding companies based in jurisdictions that are offshore and/or historically linked to assets in the former Soviet Union;
  • payments via fintechs with Russian investor nexus; and
  • payments received by UK businesses (again, often in innovative areas such as fintechs) owned in part by Russian nationals and/or others implicated in previous major trade-based money laundering schemes.

Threat response – what is the UK doing and what are firms' responsibilities?

Government/law enforcement actions

The Alert contains details of the government response to these observed sanctions evasion typologies, reporting that the NCA has "surged" officers into the Combatting Kleptocracy Cell (the "CKC") announced in February (and discussed in our previous post). According to the Alert, the CKC is:

• targeting corrupt elites through their assets in the UK;
• targeting key enablers of these corrupt elites;
• identifying opportunities to strengthen cross-government policy and legislative defences to illicit finance; and
• supporting criminal cross-government sanctions delivery and enforcement.

The Alert also signposts available guidance from OFSI and AML professional body supervisors for regulated firms.

Reporting by regulated firms

Firms should continue to ensure that they file appropriate reports with the NCA where suspicions of money laundering arise, and use the new SAR glossary code XXSNEXX in respect of reporting relating to money laundering linked to sanctioned entities. The Alert requests that the code XXJMLXX is also included when typologies identified in the Alert are identified.

Sanctions-related money laundering is no different to other forms of money laundering in that some predicate criminal conduct is required, giving rise to criminal property, in order for an offence of money laundering to be committed in respect of that property. As the Alert observes, "as sanctions breaches or circumvention of the regulations constitute criminal offences, this means the onward transfer of funds or assets would likely become proceeds of crime and recoverable property under the Proceeds of Crime Act 2002".  Less clearly, the Alert states that "[t]his would also apply to funds transferred for an arrangement intended for use in unlawful conduct, such as a future breach or circumvention of sanctions". The detail of this future breach analysis is not set out (and we would suggest that a transfer prior to sanctions being imposed would not at that point constitute an offence - this appears to be a form of 'pre-crime' in circumstances where sanctions may never be imposed), but may be perhaps intended to describe the scenario where funds are transferred pre-sanctions, the funds are not genuinely divested, sanctions are imposed, and at that point a breach occurs.

Interestingly, the Alert states that the NCA would also welcome any information identified as a result of the Alert which does not constitute a SAR; this can be submitted via email to jmlit@nca.gov.uk.

The Alert also highlights the separate reporting obligations to OFSI which may arise in respect of frozen assets or the breach of financial sanctions. We note that, whilst the proper scope of the first limb of the reporting obligation (that "a person…is a designated person") remains a frustratingly guidance-free zone, it is possible that this could be triggered in respect of information obtained about an entity pre-designation, when that entity is subsequently designated.

Due diligence and other compliance by firms

Firms should also consider the specific industry recommendations contained in the Alert (at page 12) and the extent to which these are (or can be) incorporated into existing sanctions due diligence procedures and other compliance processes.

The recommendations include the documentation of arms-length transactions, not taking these at face value, being aware of different approaches to aggregation of ownership, and the carrying out of appropriate due diligence when presented with evidence of a change in ownership. The Alert states that "a failure to undertake appropriate due diligence, for example wilful blindness in relation to source of funds or wealth checks, should be considered a red flag for complicity and both breach and/or circumvention offences".

It has become relatively common for firms whose ownership is in doubt to provide opinions from external counsel regarding their sanctions status, and the alert suggests that "[i]n instances where companies have provided their own legal assessments regarding the transfer of ownership, firms should also carry out their own legal assessment in order to come to their own determination."

In many cases, the recommendations advise that guidance should be sought from OFSI if firms have any uncertainty. However, firms should be aware that any such guidance may not be received quickly; shortly after the Alert was published, OFSI revised its financial sanctions guidance noting that the current period of exceptionally high demand has meant that OFSI is no longer able to meet its previous target of engaging with all licence applications within four weeks and that it will instead deal with applications as soon as practicable, prioritising them according to humanitarian needs and other grounds. It presumably follows from this that other OFSI correspondence and requests for guidance will be subject to similar timing constraints. It is to be hoped (but perhaps optimistically, and firms should manage their internal stakeholders' expectations accordingly) that OFSI will be able to meet the additional volume of queries that will presumably follow from compliance with the Alert's recommendation that guidance should be sought if there is doubt as to DP ownership and control over an entity.

***

[i] The alert also suggests that a circumvention offence could be committed "by adopting overtly aggressive and litigious strategies to deflect from the DP’s underlying ownership and control". This seems to us more doubtful, although we note the importance of the SRA guidance on the conduct of disputes and so-called Strategic Lawsuits Against Public Participation (https://www.sra.org.uk/solicitors/guidance/conduct-disputes/), which is highlighted in the Alert and in the SRA's Russia guidance (https://www.sra.org.uk/home/hot-topics/impacts-russia/).