New sanctions reporting requirements for non-financial sector businesses

With effect from 8 August, the Government has introduced significant new reporting requirements in relation to EU asset freeze regimes. Previously, only businesses in the financial sector were subject to the obligations, found in UK financial sanctions instruments, to report specified information to the Office of Financial Sanctions Implementation ("OFSI") in Her Majesty's Treasury ("HMT"). From 8 August, further sectors, including auditors, external accountants, tax advisers and lawyers, have been brought within the scope of these obligations and may commit a criminal offence if they fail to comply with the relevant reporting requirements.

The European Union Financial Sanctions (Amendment of Information Provisions) Regulations 2017 (the "Regulation") implements this change, and applies in respect of information received on or after 8 August.

OFSI has updated its guidance (the "Guidance") on financial sanctions to take account of this change. A number of other amendments have also been made to the Guidance, and we will report on these in a separate briefing.

Who is subject to the reporting obligation?

EU sanctions regulations typically contain a general (but vague) obligation requiring all natural or legal persons, entities and bodies subject to the regulations to report any information which would "facilitate compliance" with financial sanctions. As EU regulations are directly effective, these obligations have legal effect in the UK. However, in the absence of any domestic implementing measures there is no penalty for breach of the requirements. Further, the EU reporting obligations are typically expressed to be "without prejudice to appropriate rules concerning reporting, confidentiality and professional secrecy" (which would include legal professional privilege).

To complement the EU obligations, prior to 8 August UK financial sanctions instruments imposed reporting obligations on "relevant institutions". These were defined to include (in summary) firms authorised under Part 4A of the Financial Services and Markets Act 2000, EEA-passported firms, and money services businesses.

Separately, anyone dealing with frozen funds and economic resources (whether within or outside the regulated sector) would have been required to apply to HMT for a licence (subject to applicable exemptions) in order to do so. However, apart from that practical issue, there was no UK ability to 'police' the reporting provisions in the EU regulations and no reporting obligation, as a matter of domestic law, for non-financial sector firms.

In a significant development, the Regulation now extends the provisions which applied to relevant institutions to also cover "relevant businesses or professions", which are defined to comprise:

• auditors;
• casinos;
• dealers in precious metals or stones;
• external accountants;
• independent legal professionals;
• tax advisers; and
• trust and company service providers.

The scope of the reporting obligation largely reflects the scope of the 'regulated sector' for the purposes of the anti-money laundering ("AML") legislation. There are, however, some notable differences. These include the extension of the reporting obligation to all independent legal professionals, who are only subject to AML-related compliance obligations when participating in certain financial or real estate transactions.

What must be reported?

The reporting requirements, which apply in respect of financial (and not trade) sanctions, are triggered if a relevant institution, business or profession knows, or has reasonable cause to suspect, that: (i) a person has committed an offence under the EU financial sanctions or domestic asset seizure regimes; or (ii) a person is subject to financial sanctions (a "designated person"). In either situation, they must make a report to OFSI as soon as practicable.

It is important to note that the scope of the second limb of the obligation is potentially very broad. The drafting appears on its face to be a requirement for a relevant institution, business or profession to make a report where they know, or have reasonable cause to suspect, that any person (ie. any third party, not just a client) is subject to financial sanctions. It appears that the obligation would therefore be triggered by assisting a client on a matter relating to a counterparty who is designated, and may potentially apply in a much broader range of circumstances. The Guidance provides an example of making a report to OFSI where a customer or client is a designated person; however, this example is not exhaustive.

The Guidance indicates that a report to OFSI should include the information or other matter on which the knowledge or suspicion is based, and any information held about the person or designated person, by which they can be identified. Where applicable, it must also include details of the nature and quantity of any funds or economic resources held for that person or designated person.

Impact of the Regulation on legal professional privilege

The Regulation does not provide a specific exemption for information acquired by legal professionals in a privileged context. The Law Society has, rightly, raised serious concerns about this issue: if legal professionals are required to make a report to OFSI based on such information, this would go further than the obligation under EU regulations, and further than existing reporting obligations in connection with money laundering and terrorism offences (which contain express caveats for legally privileged information). It could also prejudice the ability of clients to take advice on sanctions compliance and sanctions breaches, impeding access to justice and potentially infringing the privilege against self-incrimination.

The Guidance, which was published after the Law Society expressed its initial concerns, states that the reporting requirements under the Regulation do not apply to information which is subject to legal professional privilege. Whilst this clarification is helpful, it does not resolve all the difficulties to which the new Regulation gives rise. In particular, there is now a mismatch between the privilege reporting exemption for the purposes of sanctions reporting and AML reporting, and, given the current uncertainties in aspects of the laws of privilege, scope for considerable uncertainty in the extent of the information lawyers must report.

Conclusion

It is very disappointing that the Government decided not to undertake any formal consultation or impact assessment prior to the implementation of the Regulation. The Government had indicated that it was considering extending the scope of the reporting obligation, but the Regulation appeared without warning and without consultation during the holiday period, on 17 July 2017, coming into force just three weeks thereafter. Extraordinarily, the reason given in the Explanatory Note for the failure to conduct an impact assessment is that the impact on businesses will be "negligible", apparently based on a view that the Regulation merely provides a new enforcement mechanism in respect of pre-existing EU reporting obligations (but ignoring the significant disparity between the information which falls to be reported under EU regulations and under the new UK Regulation, and the issues around confidentiality and privilege). This seems particularly difficult to reconcile with the Government's formal commitment to consult with stakeholders where UK implementation exceeds the minimum requirements under EU laws. The lack of any formal consultation process has exacerbated the uncertainty with respect to the scope of reporting obligations.

Somewhat more positively, the Explanatory Note states that OFSI is now engaging with affected sectors, with a view to ensuring that they fully understand the implications of the change, and have an opportunity to give feedback on guidance and reporting mechanisms.

In the interim, relevant businesses and professions should now carefully consider their policies and procedures to ensure that they provide systems and controls for the reporting of information concerning any: (i) potential breach of EU financial sanctions or domestic asset seizure regimes; and (ii) designated person matches.

If you would like to discuss the change to financial sanctions reporting requirements, please contact Susannah Cogman, Partner, Daniel Hudson, Partner, Elizabeth Head, Senior Associate or your usual Herbert Smith Freehills contact.