OFSI updates its enforcement guidance regarding ownership and control by sanctioned persons

On 16 March, the UK's Office of Financial Sanctions Implementation ("OFSI") updated its guidance on monetary penalties and enforcement (the "Guidance") to set out its enforcement approach in cases involving ownership and control by designated persons. This is an issue which has assumed increased prominence during the past year with the escalation of sanctions against Russia and the huge number of additional asset freeze designations made as a result. This has resulted in many companies analysing whether their counterparties may be deemed to be "owned or controlled" by a sanctions target – a question to which there is often no easy answer.

In this briefing we summarise the new guidance provided by OFSI in this regard.

Context – why does ownership and control matter?

As many readers will be aware, asset freezing restrictions can apply both to the designated persons listed by a particular jurisdiction and to companies which are not themselves listed but which are owned or controlled by a designated person. Under the UK sanctions regime, the tests for establishing ownership and control are set out in each set of regime-specific regulations; for instance, the tests are contained in regulation 7 of the Russia (Sanctions) (EU Exit) Regulations 2019 (the "Regulations").

There are two limbs to the test for ownership and control. A company ("C") will be regarded as owned or controlled by a designated person ("P") if:

• P holds (directly or indirectly) more than 50% of C's shares or voting rights, or has the right to appoint or remove a majority of C's board; and/or
• it is reasonable, having regard to all the circumstances, to expect that P would (if they chose to) be able, in most cases or in significant respects, by whatever means and whether directly or indirectly, to achieve the result that the affairs of C are conducted in accordance with their wishes.

The second limb of the test – which is effectively one of de facto control – is inherently vague. One can understand the policy reasons for having a 'safety net' to capture cases where a designated person does not own a company on paper but continues their interest behind the scenes, but when the test is applied in practice it creates obvious difficulties. How can a firm know whether P can achieve the result that the affairs of the company are conducted in accordance with his wishes?  Or to put it another way, where there are links between P and the company, how can the firm prove a negative and conclude that he does not?  The difficulties are exacerbated by the fact that the ownership tests in Schedule 1 to the Regulations require shareholdings which are subject to a control arrangement between the nominal shareholder and P to be treated as shareholdings of P. However, such arrangements are inherently unlikely to be publicly available; to the contrary, they are likely to be concealed.

The assessment of complex and/or opaque corporate structures presents a particular challenge. Concerns about the use of such structures to evade or circumvent sanctions (particularly in the context of the Russia regime) have previously been highlighted by UK law enforcement, and the issue of ownership and control continues to be an area of focus in the sanctions compliance world.

In circumstances where companies can face strict liability for a breach of sanctions (including inadvertently dealing with a company with designated person ownership/control), the question of what steps companies should take to assess whether either of the above conditions is present (particularly given the breadth of the second condition) has taken on increased significance and there have been a number of calls for OFSI to publish more guidance on the topic in order to assist companies in understanding what is expected of them.

New OFSI guidance

The Guidance addresses the situation where a firm has assessed a company not to be owned and controlled by a designated person, and has dealt with it on that basis, but has got the assessment 'wrong'. In such cases, if it subsequently transpires that the company is owned and controlled by a designated person, then a breach of sanctions will have occurred but OFSI will have discretion as to whether to take enforcement action, and what action to take. The Guidance is relevant to OFSI's exercise of that discretion.

The Guidance confirms that, where a sanctions breach has occurred and an incorrect assessment of the ownership and control of an entity is relevant to the commission of that breach, OFSI will consider the degree and quality of research and due diligence conducted on the ownership and control of that entity, although it will not prescribe the level and type of due diligence to be conducted in order to ensure compliance with financial sanctions legislation.

OFSI will consider appropriate due diligence to be a mitigating factor, where the ownership and control determination reached was made in good faith and was a reasonable conclusion to draw from such due diligence. Conversely, a failure to carry out appropriate due diligence or the carrying out of any such due diligence in bad faith may be regarded as an aggravating factor. In each case, the weight to be attributed to the factor will be assessed on a case by case basis.

The Guidance also explains that OFSI will consider whether the level of due diligence carried out was appropriate to the degree of sanctions risk and the nature of the transaction. The nature of the contractual or commercial relationship with the entity will also be relevant. OFSI say that they would expect to see evidence of a decision making process that took account of the sanctions risk and considered what would be an appropriate level of due diligence in light of that risk, and would usually expect these decisions to be made by reference to an internal framework or policy (albeit recognising that there is no one size fits all approach). OFSI expects careful scrutiny of information obtained as part of any ownership and control assessments, particularly where efforts appear to have been made by designated persons to avoid relevant thresholds.

The Guidance lists a series of steps that OFSI will consider as potentially mitigating (see paragraph 3.26), although the list is non-exhaustive and what constitutes appropriate due diligence will depend on the circumstances. These include examining the formal ownership and control mechanisms of an entity as well as the potential for de facto control by a designated person, open source research, the consideration of links to designated persons that might warrant further investigation, and direct contact with the entity in question and/or other relevant entities, including potentially seeking commitments by any relevant UK persons as to the role of any designated person within the structure.

The Guidance also lists examples of the "areas of enquiry" OFSI may expect to be undertaken (again, non-exhaustively). These include: (i) questions around formal ownership and control such as share percentages, voting rights agreements between shareholders and changes in ownership; and (ii) questions around indirect or de facto control such as personal connections to or financial relationships with designated persons, the involvement of proxies, board/management appointments and governance processes, and any benefits conferred to designated persons.

Where a relationship or activity is ongoing, OFSI expects that due diligence and risk assessments will be reviewed at appropriate times. OFSI's consideration of the adequacy of due diligence will consider the regularity of checks and ongoing monitoring, where appropriate.

Takeaway – what should companies be doing?

As the Guidance is at pains to point out, sanctions due diligence will generally need to be risk-based and its appropriateness assessed on a case by case basis, rather than being subject to a one size fits all set of checks that can be carried out in every situation. That said, companies wishing to assess the adequacy of their current processes in light of the Guidance should consider the following points.

• Do we have a formal procedure/framework in place for sanctions due diligence?
• Do we document key elements in the due diligence process (risk assessment, due diligence steps taken, rationale for decisions taken etc.)? Can we demonstrate, if required, why we took particular decisions and that those decisions were reasonable and made in good faith?
• Who is responsible for taking those decisions and do they have all the information they require in order to make an informed decision?
• When considering specific relationships or transactions, do we consider both formal ownership issues and indirect or de facto control? What sources/types of enquiry are carried out in respect of each category?
• Are higher risk or 'red flag' relationships subject to an appropriate level of diligence?
• Do our procedures provide for ongoing monitoring, e.g. the updating of analysis when there are changes to ownership structures or other relevant developments?

It is important to note that, as explained above, the Guidance relates to the circumstances in which OFSI will take enforcement action; strictly speaking, it is not a statement of how OFSI (or indeed the English courts) will interpret ownership and control. Rather, it outlines the factors that will be relevant to OFSI's case assessment process in situations where a company "gets it wrong" and deals with a company which later transpires to be owner or controlled by a designated person. Nonetheless, it may be instructive for companies considering these issues in terms of the sorts of steps that they should consider taking to satisfy themselves of the sanctions status of a counterparty.