Intelligence and evidence are vital in sanctions assesments - Stacy Keen

It is good news that enforcement action will not be taken in relation to every breach, but companies doing business with people or organisations with connections to those who are sanctioned will, if there is a breach, need to justify the steps taken to assess ownership and control, and demonstrate that the due diligence and assessments undertaken were risk-based and supported by a decision-making process.

The OFSI guidance said that it “will consider appropriate due diligence conducted on the ownership and control of an entity to be a mitigating factor where the ownership and control determination reached was made in good faith and was a reasonable conclusion to draw from such due diligence”.

“OFSI may also consider a failure to carry out appropriate due diligence on the ownership and control of an entity, or the carrying out of any such due diligence in bad faith, as an aggravating factor. The weight to be attributed to the mitigating or aggravating factor (as applicable) will be assessed on a case by case basis.”

It continues: “OFSI would expect to see evidence of a decision-making process that took account of the sanctions risk and considered what would be an appropriate level of due diligence in light of that risk. OFSI would usually expect these decisions to be made by reference to an internal framework or policy, but recognises that there is no ‘one size fits all’ approach.”

Companies should be aware not only of the quality of their investigations when initially doing business, but of their processes for reviewing the position over time. The updated guidance is explicit that ownership and control is not static and OFSI expects assessments to be reviewed and refreshed at appropriate intervals.

It is clear that OFSI expects scrutiny of information obtained as part of any ownership and control assessments, particularly where efforts appear to have been made by sanctions targets to avoid the relevant ownership and control thresholds. Any prior ownership or ostensive control by sanctions targets should be identified and the validity of divestments scrutinised.

This confirms the need for a risk-based due diligence approach to be applied when conducting ownership and control checks. Applying simple screening processes, without any reasonable and evidenced due diligence, may fall short of this expectation so it is important that sanctions assessments are led by intelligence and evidence.

A well-considered due diligence process may need to involve various elements, such as open-source investigation of public records and media sources, as well as iterative and bespoke questionnaires for counterparties.

Stacy Keen, Senior Associate, and financial crime specialist at Pinsent Masons