In the wake of the global financial crisis, financial institutions are focused on compliance with regulations ranging from macro-prudential requirements to the sale of retail investment products. Against the backdrop of existing anti-money laundering and anti-terrorist financing laws, the legal, regulatory, compliance and risk management functions of financial institutions are hard put to navigate their way through a labyrinth of international legislation and local laws.
Adding to this mix is an often overlooked but growing area of sanctions law. Sanctions law is an instrument used by government bodies to prosecute foreign policy objectives. Where diplomatic efforts have failed and military force remains a last resort, such government bodies may apply pressure on other states and/or entities by means of trade and economic sanctions.
United Nations
The UN Security Council uses mandatory sanctions as a tool to force states or entities to comply with its policy objectives. Some examples of states targeted by the UN are Afghanistan, Cote d’Ivoire, Democratic Republic of Congo, Iran, Iraq, North Korea, Lebanon, Liberia, Sierra Leone, Somalia and Sudan. Typically, UN Members States, including jurisdictions like Singapore and Hong Kong, adopt UN sanctions regulations by incorporating them into local legislation. Businesses, such as financial institutions, operating in or incorporated under the laws of Singapore and Hong Kong, need to strictly comply with such legislation.
European Union
The EU applies sanctions within the framework of the Common Foreign and Security Policy. The sanctions are applied on an autonomous EU basis or by implementing binding Resolutions of the UN Security Council.
Sanctions imposed by the EU may target governments of third countries, or non-state entities or individuals. They may comprise trade restrictions, financial restrictions or restrictions on admission (visas or travel bans). Financial sanctions include prohibitions on investment, payments and capital movements, the withdrawal of tariff preferences or bans on the provision of specific financial services (brokering, financial services, technical assistance). Such sanctions apply to all persons and entities doing business in the EU, including nationals of non-EU countries, and to EU nationals and entities incorporated or constituted under the laws of an EU Member State when doing business outside the EU.
Rules on penalties applicable to infringements of the EU sanctions regimes are laid out in the Member States’ national laws. The UK regime, which is administered by HM Treasury’s Asset Freezing Unit, is made up of a number of different statutory instruments that implement sanctions imposed by both the UN Security Council and the EU. The maximum penalty for a sanctions offence in the UK is imprisonment for seven years and/or an unlimited fine.
United States
In addition, the US Treasury’s Office of Foreign Asset Control (OFAC) administers and enforces economic sanctions programmes based on laws passed by the US Government. Such laws, which are passed to accomplish US foreign policy and national security goals, can be targeted at countries or groups of individuals and can either be comprehensive or selective. OFAC sanctions extend beyond the UN-targeted states to Burma (Myanmar), Cuba, the Western Balkans, Belarus and Zimbabwe and also apply to certain individuals or entities.
OFAC publishes a list of Specially Designated Nationals and Blocked Persons (SDN List), which includes over 6,000 names of companies and individuals located around the world who are connected with the sanctions targets. OFAC requires all US persons to comply with its regulations. ‘US persons’ is broadly defined by OFAC to cover: all US citizens and permanent residents regardless of location; all persons and entities within the US; and all US incorporated entities and their foreign branches. In specific cases, ‘US persons’ also includes foreign subsidiaries owned or controlled by US companies and foreign persons in possession of US-origin goods.
The violation of OFAC sanctions can result in substantial civil and criminal penalties. This can be criminal fines from US$50,000 to US$10 million and/or imprisonment from 10 to 30 years for wilful violations. And civil penalties can range from US$250,000, or twice the amount of each underlying transaction, to US$1.08 million per breach.
Profound impact on financial institutions
While financial institutions may avoid being directly involved in embargoed trade transactions, such as the sale of arms, weapons and ammunition, to overtly sanctioned targets like the Al-Qaida organisation in Afghanistan, potential violations of sanctions law can be more subtle. Under certain sanctions regulations, financial institutions are prohibited from making available any funds, other financial assets or economic resources to sanctioned entities. This could conceivably include the release of money in a bank account to an account-holder or extending a loan or guarantee to a client who is linked to a sanctioned party. Major financial institutions have come under fire for failure to comply with sanctions law. Recent enforcement actions include:
- UBS paid a US$100 million fine in 2004 for breaching US sanctions by sending funds to Cuba, Iran, Libya and Yugoslavia;
- ABN AMRO Bank paid a US$80 million civil penalty in December 2005 for alleged violations of OFAC sanctions in respect of action taken in its New York and Chicago branches to clear cheques and process wire transfers and letters of credit involving Iranian and Libyan parties based on instructions and documents that originated in its Dubai and India branches. ABN also agreed to outside audits and the filing of special reports to US authorities for three years; and
- Lloyds TSB agreed to pay an unprecedented penalty of US$350 million in January 2009 in lieu of US criminal prosecution for processing prohibited payment transactions made by its clients through non-affiliated US correspondent banks. The extraterritorial aspects of this case should be noted. Lloyds was technically not a US person and none of its actions that caused the prohibited transactions took place in the US. However, Lloyds’ actions caused its non-affiliated US correspondent banks to breach OFAC regulations.
The increasingly global operations of financial institutions expose them to the application of various overlapping, and at times inconsistent, sanctions regimes. The regulators they need to liaise with may range from the OFAC in the US to the UK Bank of England, the Monetary Authority of Singapore (MAS) and the Hong Kong Monetary Authority (HKMA). The challenge of compliance is exacerbated by a lack of clear guidelines on the implementation of such regulations and the constantly changing list of sanctioned entities and transactions. Growth in the use of sanctions and the vigour demonstrated in the level of enforcement activity means that financial institutions cannot underestimate the importance of having a robust sanctions compliance programme.
A recent study conducted by Deloitte, and based on a survey by the Economist Intelligence Unit entitled: Facing the sanctions challenge in financial services, indicates that the increasing complexity, regulatory rigour and inconsistent nature of global regimes are raising the bar for sanctions compliance. It also concluded that there is a lack of awareness of sanctions compliance among financial services companies that needs to be addressed.
Hong Kong
In Hong Kong, UN sanctions are given legislative effect locally via regulations made under the United Nations Sanctions Ordinance (Cap 537). These regulations vary in nature and scope depending on the identity of the sanctioned targets. Most regulations impose prohibitions against making “available any funds or other financial assets or economic resources to, or for the benefit of, a relevant person or a relevant entity”. However, there can be subtle differences between the provisions. For example, while the regulation in respect of Liberia prohibits the provision of “any technical training or assistance related to the supply, delivery, manufacture, maintenance or use of any prohibited goods”, other regulations specifically define “other assistance” to include “investment, brokering or other financial services”.
A breach of the Hong Kong regulations may be punishable on conviction by indictment by an unlimited fine and imprisonment for a term not exceeding seven years. Some of the regulations prescribe that if the person convicted of an offence is a body corporate or firm and it is proved that an officer or partner thereof consented to, connived in, or was guilty of neglect in the commission of the offence, such officer or partner shall be guilty of the same offence.
While it is evident that financial institutions operating in Hong Kong, or operating elsewhere but incorporated under the laws of Hong Kong, have to comply with UN sanctions gazetted by the Hong Kong SAR Government, the applicability of the US Treasury’s OFAC sanctions is less clear-cut if the financial institution in question is not an OFAC-defined ‘US person’. In practice, however, the HKMA requires all financial institutions under its supervision to screen their transactions against both UN and OFAC sanction lists.
Singapore
The Monetary Authority of Singapore Act (Cap 186) provides that the MAS may issue directions to or make regulations concerning financial institutions in accordance with decisions of the UN Security Council. ‘Financial institution’ is specifically defined to include banks, finance companies, insurers, insurance intermediaries and licensed financial advisers registered under various Singapore statutes. A financial institution that fails to comply with any directions or regulations shall be guilty of an offence and be liable on conviction to a fine not exceeding S$1 million (US$706,000).
An example of such regulations is the Monetary Authority of Singapore (Sanctions – Democratic People’s Republic of Korea) Regulations 2009. Made in August 2009 shortly after North Korea’s missile tests under its rogue nuclear weapons programme, the Regulations prohibit financial institutions from entering into any financial transaction or providing any financial assistance or services to any person that relates to certain import/export items from or to North Korea, persons in North Korea or nationals thereof. Financial institutions are also prohibited from providing “any financial services or any other related services” or “transferring financial assets or resources, or other assets or resources” that could contribute to the North Korean weapons programme.
There is significant convergence between the UN and US Treasury as regards Pyongyang’s nuclear and ballistic missile activities in that both bodies sanctioned the state as well as certain companies and individuals for their links to such activities. Front companies like Hong Kong Electronics (based in Iran) and four other North Korean companies had their assets frozen and certain named individuals were banned from travelling.
Matters are, however, not as straightforward with Burma (renamed Myanmar by its military regime). While Burma figures prominently on OFAC’s SDN List, there are as yet no formal sanctions imposed by the UN. US diplomatic officials have alleged that Singapore is being used as a shelter for the assets of Burma’s military leadership. Singapore officials have publicly insisted that its financial system is clean and that without UN-imposed sanctions, there is no legal basis to compel financial institutions to cut ties with Myanmar entities. It is, however, understood that some Singapore banks are taking measures to distance themselves from companies with Myanmar links.
Challenge and response by financial institutions
Given the challenges in complying with overlapping sanctions regimes, and the potentially significant penalties and personal liability for breaches of regulations, financial institutions need to be conscious of the complexities and nuances of sanctions law. The starting point to an effective compliance programme would be the adoption of a globally integrated sanctions policy and the deployment of technological tools and competent staff to implement such policy. Regular risk assessment reviews would also ensure that the systems and controls remain operationally robust.
By Guy Spooner, Sam Eastwood, Ruth Cowley and Wilson Ang
Norton Rose (Asia) LLP