Report non-compliance with sanctions promptly – or pay the price

The regulator recently issued a monetary penalty notice against Colorcon Limited, the UK subsidiary of US-based pharmaceutical group Colorcon Inc, for payments made in breach of UK sanctions on Russia.

Colorcon operated a representative office in Moscow until late 2022. As the company wound down its business, Colorcon made payments to employees and certain service providers that held accounts with several Russian banks that had been designated by the UK in response to Russia’s invasion of Ukraine.

The ultimate recipients of the payments, made between 23 March and 2 December 2022, were employees and service providers that were themselves not sanctioned. However, the banks those employees and service providers held accounts with were designated, meaning any payments contravened UK sanctions restrictions.

Colorcon made a voluntary disclosure to OFSI about the breaches. However, OFSI’s penalty notice states that four months elapsed between Colorcon first becoming aware of the breaches and notifying OFSI of the situation.

A discount of up to 50 per cent may be granted to businesses for “prompt and complete voluntary disclosure” in a case assessed as serious. However, OFSI said it did not consider this time period “prompt” enough and reduced the voluntary disclosure discount to 35 per cent.

Given Colorcon’s “specific and heightened exposure to sanctions risk”, OFSI said the company “failed to sufficiently manage sanctions risk”, instead “focusing on sanctions screening procedures and their reinforcement in relation to direct customers, shareholders and remitting banks rather than their own employees and service providers.”

In total, Colorcon was fined £152,750 in relation to 79 payments made in breach of the Russia (Sanctions) (EU Exit) Regulations 2019.

OFSI said that 44 additional payments, totalling approximately £63,000, were permitted under an OFSI general licence, which granted the company time to complete outstanding transactions with sanctioned entities as it wound down its operations in Russia. However the licence reporting requirements were not complied with, and this was considered an aggravating factor in deciding the value of the penalty – it is also an offence in its own right.

This case serves as a valuable reminder of the need for prompt reporting when an organisation decides to voluntarily disclose a breach of non-compliance and sets a marker that four months is too long in OFSI's view.

OFSI acknowledges that it is reasonable for those grappling with non-compliance to take time to assess the nature and extent of the breach, or seek legal advice, but this should not delay an effective response to the breach.

The penalty notice also reminds businesses that it is an offence not to comply with licence reporting requirements and that breaches should be disclosed to the regulator as soon as possible if a full discount is to be available.

In relation to licences, OFSI says its issuance of a general licence “does not imply that similar transactions made outside the terms of a general licence will be viewed by OFSI as not serious”.

The notice also underlines that it is insufficient for companies to rely on third parties, such as banks – as in this case – to undertake financial sanctions checks or screening. Instead, it emphasises the importance of businesses taking steps to regularly assess their own internal sanctions policies.

Stacy Keen is a Partner, and financial crime and compliance specialist, Pinsent Masons