Sanctions are a tool of choice used by the international community to apply pressure on countries, entities, and individuals. The aim is to encourage a change of behaviour, to cut off the financial resources of certain people or industries, to prevent and suppress terrorist financing, and as an enforcement tool when international peace and security are threatened.

What types of sanctions exist today?

There are four broad types in use today: country-based, list-based, sectoral, and secondary.

Country-based sanctions prohibit almost all transactions, with some exceptions for charities and humanitarian activities, with a specific country or anyone in it. There are only a handful of these in place at present, such as those applied to North Korea.

List-based sanctions prohibit all transactions with specific individuals, entities, and organisations. So, if you’re helping a firm comply with sanctions, you need to check names in records of payment, customers, or clients to see if they are on a relevant sanctions list.

These two types of sanctions have been around for several decades (country-based sanctions generally date from the early 20th century) and were the primary focus when I started working in financial crime almost 15 years ago. But, over the past approximately eight years, we’ve seen the emergence of sectoral and then secondary sanctions regimes.

There does not need to be any intention or knowledge of a breach for an offence to have been committed Sectoral sanctions prohibit transactions connected with specific sectors, usually oil, gas, energy, and financial services within certain geographic locations. An obvious recent example is sanctions relating to the Russian energy sector since Russia’s annexation of Crimea in 2014. The aim there has been to exert pressure to cut off financial resources to certain people or industries tied to Russia.

Secondary sanctions are a recent US-driven measure which target non-US people that do lawful business with a US sanctions target. Generally, we’ve seen these imposed and/or threatened in relation to US sanctions on Iran around its alleged nuclear weapons programme. It’s really the US expanding its extraterritorial reach. They are saying if they know that you are transacting with someone who they, as the US, have designated as sanctioned, then they might sanction you as well.

Which entities impose these sanctions? 

They are imposed by national governments and international and supranational organisations, such as the United Nations and the European Union. Each body maintains a list of the individuals and entities they have sanctioned. In the UK this is published by HM Treasury, via the Office of Financial Sanctions Implementation (OFSI), and in the US by the Office of Foreign Assets Control.

To what extent have sanctions changed in recent years?

They have become more complex, given the rise of global trade. That often means that multiple jurisdiction lists, such as those from the UK, US, and EU, need to be applied by an individual firm, and these lists can sometimes conflict with each other. Since Brexit, the UK list no longer automatically includes all EU entries, so the regimes have diverged, particularly regarding the recent Russian sanctions.

The introduction of sectoral and secondary sanctions has added even more complexity and increased the burden of compliance, particularly from a financial services point of view. With sectoral sanctions, it is not a straightforward case of checking whether the names of clients, transaction counterparties, and security issuers match against a list. You must look at the definitions of the sector, the location that’s involved, the ownership structure, and the chain.

It’s much more looking into complex ownership and underlying locations of operations, including those of clients and customers. It is a lot of digging down and up!

Remember that securities themselves can be listed, as can securities brokers Often, in the legislation, there’s some allowances for transitional arrangements which you need to check. So, if you have credit facilities and loan arrangements with sanctioned banks or you’re in the middle of a deal you can’t get out of quickly, you are given a time limit to exit where possible. The aim is to not unduly negatively impact companies that have business that was previously lawful but now falls under a new prohibition, provided that business ceases as soon as possible. These are not long time limits, so as soon as you are aware of any exposure, you should be seeking legal advice on how to proceed. The same transitional arrangements rarely apply to new additions to sanctions lists where prohibitions are typically effective from day one.

How has Russia’s invasion of Ukraine affected the global framework of sanctions?

We’ve seen a rapid introduction of new sanctions and hundreds of new list entries imposed by the UN, EU, and multiple nations. The wide-ranging nature of these sanctions will mean some firms now have a significant sanctions risk exposure which they need to quantify, mitigate, and manage. That’s made harder by several differences in list entries and other distinct approaches between countries and organisations.

The regulations tend to be strict liability in nature which means there does not need to be any intention or knowledge of a breach for an offence to have been committed. It is a bit like those driving offences where it doesn’t matter if you meant to or did not mean to speed. You get a ticket either way.

There is a duty and obligation that once a person or a firm becomes aware that a breach has taken place, they must report it to the relevant regulator – the OFSI if they are in the UK. It doesn’t mean you’re going to get handed a potentially huge fine for every breach. That can happen, but what regulators will really look out for is something that might indicate a systemic failure of sanctions management.

How can members determine which sanctions apply to them?

This can be simple or complex. It depends on where the firm you are dealing with is located, where they operate – including where their customers or clients are located and operate – and where group entities are located and operate. This includes parent entities. It can depend on the legal structure of a group, whether they operate as branches or if they have a corporate structure of subsidiaries.

If they have offices in different jurisdictions in Europe, they may need to comply with EU sanctions. If they have sister firms and subsidiaries in parts of Europe and they transact or share customers or clients, then it may be easier for all group entities to comply with a common set of sanctions regimes.

Any US touchpoint, including US natural or corporate persons or transactions in US dollars, means that US sanctions must also be complied with irrespective of a firm’s location, due to their extraterritorial reach.

Where should members get their sanctions information from?

Firms should proactively keep themselves up to date. They can look at relevant regulator websites to find publicly available sanctions lists. They can usually register for update emails that will notify them of any changes to lists and sanctions regulations. The OFSI has a wealth of information on its website, including a recent ‘red alert’ on Russian elites and signs of potential financial sanctions evasion. The FCA also provides guidance on sanctions systems and controls in its Financial Crime Guide (see chapter 7).

Members can also go to sector events, log on to webinars and receive enewsletters. Many law firms provide free briefings and analysis of sanctions regulatory updates. External advice and support is available if members want assistance with their sanctions compliance, such as implementing a sanctions risk framework or understanding their current sanctions exposure.

How can members globally manage their sanctions risks?

Again, know which lists/regimes apply to them and understand their current exposure. Remember that securities themselves can be listed, as can securities brokers. Any entity which is 50% or more owned by a sanctioned person/entity must also be treated as sanctioned. Sectoral sanctions may apply to a class of securities, such as all those issued by a specific government or state-owned/controlled credit institution. I’d also recommend that they design and implement a sanctions compliance framework.

Do you have any operational tips for members?

About the expert

Alison Kopra is director of financial crime at Grant Thornton.

They should look at carrying out a sanctions risk assessment at least once a year, and more frequently than that if something significant happens. In terms of determining what assets to hold, they need to know their current exposure, ensure their framework incorporates sanctions updates as soon as they are published and ensure procedures and controls will flag up any prohibited securities, counterparties, or potential sectoral sanctions, crucially before any transactions take place.

Typically, firms employ screening tools which, on an ongoing basis overnight, every night, are screening clients, customers, and counterparties. This is particularly relevant, what with rapidly changing sanctions regimes. We’ve had hundreds of listings in a very short space of time, plus new sectoral sanctions. Suddenly, overnight you could have potentially quite a big sanctions exposure and not know it.

So, to summarise, the fundamental foundations of managing sanctions risk are your sanctions risk assessment, robust and reliable screening, and thorough client due diligence. If a breach does happen and the regulator suspects there is a systemic failure, there may be a review of your screening information, how the screening is set up or whether an incorrect or incomplete list has been used. It could lead to big fines and reputational damage, so invest a bit in prevention.

What does the future look like, in terms of sanctions?

Sanctions are here to stay. They are inextricably linked to geopolitics and can change drastically, very quickly.

We could see the US impose secondary sanctions more widely, in circumstances other than Iran, and sectoral sanctions also look set to stay. All firms need to keep an eye on evolving geopolitics and the subsequent use of sanctions if they wish to be ahead of the game and avoid costly breaches.