UK: OFSI Issues Long-Awaited Guidance On Ownership And Control

Introduction

The UK Office of Financial Sanctions Implementation (OFSI) has issued long-awaited further guidance on ownership and control of entities by sanctioned persons.

The new guidance was issued in an updated version of OFSI's guidance on enforcement and monetary penalties for breaches of financial sanctions¹ ("Enforcement Guidance") and supplements OFSI's previous guidance on ownership and control contained in its general guidance for financial sanctions ("General Guidance")². The new guidance is generally applicable to all UK financial sanctions regimes and will assist companies in complying with financial sanctions, particularly sanctions involving Russian persons.

The new guidance details OFSI's approach when considering ownership or control due diligence as a mitigating or aggravating factor when it has determined that an entity is owned and controlled by a designated person and there has been dealing with that entity in breach of sanctions regulations made under the Sanctions and Anti-Money Laundering Act 2018³.

This guidance will be particularly welcomed by the private sector, which, since June 2022, has faced strict liability for civil breaches of UK sanctions, including for engaging in transactions with a sanctioned entity on the basis of an incorrect assessment of ownership and control. Certain aspects of the guidance will not, however, provide a great deal of comfort to companies facing difficult ownership and control determinations, not least because the guidance confirms that appropriate due diligence conducted in good faith does not necessarily provide a safe harbour from enforcement action.

In this alert we break down the key elements of the new guidance and its implications for those required to comply with UK financial sanctions.

UK rules on ownership and control

UK financial sanctions apply not only to persons designated for such purposes, but also to persons "owned or controlled directly or indirectly" by a designated person. For example, a wholly owned subsidiary of a designated company must be treated as subject to the same sanctions as its designated parent company.

The UK regime provides that an entity will be deemed owned or controlled by a sanctioned person where (i) the sanctioned person holds directly or indirectly more than 50% of the shares or voting rights in the entity, or has the right directly or indirectly to appoint or remove a majority of the board of directors of the entity (the "Ownership Test"); or (ii) it is reasonable to expect that the sanctioned person would be able to ensure that the affairs of entity are conducted in accordance with the sanctioned person's wishes (the "Control Test")⁴.

Whilst the Ownership Test is relatively straightforward to apply in certain cases, the Control Test has caused significant practical difficulties for companies when trying to assess whether an entity is owned or controlled by a designated person, given its potential to capture a wide variety of formal and, more significantly, informal arrangements. Although OFSI provides examples of arrangements that could satisfy the Control Test in its General Guidance⁵, these examples are non-exhaustive and are often not of assistance to companies dealing with the practical difficulties in applying the Control Test. The Red Alert⁶ on financial sanctions evasion typologies issued by the National Crime Agency and OFSI in July 2022 has provided additional reasons for companies in the private sector to take a cautious approach to ownership and control determinations, as it warns, for example, that "[designated persons] are using associates, including family members and close contacts, via enablers to [...] [t]ransfer assets such as shareholdings in holding companies to trusted proxies such as relatives or employees" and that "[a]lthough a [designated person] may claim to have relinquished the asset, it is highly likely that they will retain their influence through trusted proxies and enablers". The difficulty in making ownership and control determinations is clear from instances we are aware of where a company has concluded that a recent transfer of shares to a close family member indicated continued ownership and control of the entity by the transferor, but OFSI has subsequently reached the opposite conclusion.

New guidance on ownership and control

The new guidance in the updated Enforcement Guidance confirms that ownership and control due diligence is one of the factors that OFSI will take into account when assessing what action to take in respect of a breach and how serious the breach is, although the guidance is clear that the significance of any such due diligence will be assessed on a case-by-case basis, depending on, for example, the nature of the transaction and sanctions risks faced. OFSI has indicated that one relevant factor may be the nature of the relationship between the breaching company and the sanctioned entity, with an indirect relationship potentially giving rise to lower due diligence expectations.

The key points from the new guidance include the following:

• Where OFSI determines that a breach has occurred, it will take into account any relevant efforts and checks undertaken by the breaching party. Specifically, it will consider the "degree and quality of research and due diligence" conducted in respect of the ownership and control of an entity, although the guidance is clear that OFSI does not prescribe the level or type of due diligence to be undertaken to ensure compliance with financial sanctions.
• OFSI will consider whether the level of due diligence conducted was "appropriate to the degree of sanctions risk and nature of the transaction". As noted above, one factor feeding into the question of whether due diligence is appropriate is the nature of the breaching company's contractual or commercial relationship with the entity in question.
• OFSI will expect to see evidence of a decision-making process that accounts for the sanctions risk and considers the appropriate level of due diligence in light of that risk. Normally such decisions would be made by reference to an internal framework or policy, but the guidance notes that there is no one-size-fits-all approach.
• The due diligence conducted in respect of ownership and control may be a mitigating or aggravating factor for OFSI when assessing a breach. Appropriate due diligence may be a mitigating factor if the ownership and control determination was reached in good faith and was a reasonable conclusion to draw from such due diligence. Conversely, a failure to carry out appropriate ownership and control due diligence, or the carrying out of such due diligence in bad faith, may be considered an aggravating factor by OFSI.
• Where relationships or activities are ongoing, OFSI expects that due diligence is, and assessments are, reviewed at appropriate times.
• For consideration of due diligence as a mitigating factor, the onus for demonstrating that reasonable and appropriate ownership and control due diligence was undertaken, that the determination reached was made in good faith and was a reasonable conclusion to draw from such diligence, rests with the breaching party.

The new guidance also provides examples of due diligence efforts that OFSI may consider as potentially mitigating, as well as examples of areas of enquiry that OFSI may expect to be undertaken by persons seeking to establish whether an entity is owned or controlled by a designated person.

Comment

Ownership and control determinations are among the aspects of the UK sanctions regime causing the most difficulty for companies. The new guidance from OFSI offers some practical guidance for how companies should be approaching such determinations. That said, this guidance does not provide any further assistance to firms making determinations regarding ownership and control, rather the guidance provides insight into the extent to which ownership and control due diligence can mitigate (or, as the case may be, aggravate) a breach of financial sanctions when OFSI determines that there has been a breach.

Perhaps the most helpful aspect of the guidance is in providing clarity on the internal compliance measures that companies should have in place regarding ownership and control determinations. In line with the guidance, companies should ensure that their decision-making regarding ownership and control is appropriate and proportionate to the nature of the sanctions risks faced. Notably, particularly for larger and more sophisticated companies, ownership and control decisions should be made by reference to an internal framework or policy, and companies should ensure that decisions are made in good faith and are reasonable based on the diligence conclusions. The non-exhaustive examples of areas of enquiry may be of assistance in this regard.

However, there are aspects of the guidance that may be less comforting for companies struggling with ownership and control determinations:

• The guidance sets out general due diligence principles only, rather than prescriptive measures. This is likely driven by the fact that OFSI intends the guidance to apply to the full spectrum of entities that must comply with financial sanctions, from large to small, and sophisticated to unsophisticated.
• It remains the case that appropriate due diligence carried out in good faith does not necessarily provide a safe harbour for a breach of financial sanctions as a result of incorrect ownership and control determinations, rather due diligence is one factor among many that OFSI will take into account when assessing what action to take in respect of an identified breach.
• Certain aspects of the guidance do not provide practical assistance to companies struggling with difficult questions of ownership and control. In particular, the illustrative "areas of enquiry" in respect of indirect or de facto ownership or control (an issue giving rise to difficulties for companies) may remain difficult to conduct diligence for in practice, for example "[i]ndications of continued influence (or the potential for it) by a designated person, including through personal connections and financial relationships".

Ultimately, until we see enforcement action from OFSI based on incorrect ownership and control determinations, the guidance may provide limited comfort to companies confronted with unclear and difficult ownership and control decisions. Nonetheless, the new guidance helps to establish a compliance standard that companies' internal functions can benchmark themselves against, which is something that has not been available to date.

Footnotes

1. OFSI enforcement and monetary penalties for breaches of financial sanctions.

2. General guidance for financial sanctions under the Sanctions and Anti-Money Laundering Act 2018.

3. For example, the Russia (Sanctions) (EU Exit) Regulations 2019.

4. See, for example, regulation 7 of the Russia (Sanctions) (EU Exit) Regulations 2019.

5. See section 4.1.

6. Financial Sanctions Evasion Typologies: Russian Elites and Enablers.