Unchartered territory: Preparing for Russian sanctions compliance scrutiny from regulators

‘There is a different world view today’, says David Chenkin, managing partner and chair of the government investigations, white collar defence and anti-money laundering group at Zeichner Ellman & Krause in New York, ‘so firms may want to look at the types of customers to see if any of them could be severely criticised in the future’.

An increase in sanctions enforcement activity should be expected as historically stronger enforcement patterns by regulators in the US compared to the UK are replaced with global coordination. In the US, the Office of Foreign Assets Control (OFAC) has fined financial institutions nearly $12 million in the year to date through May, while the penalties it issued in 2021 and 2020 reached $20 million and $23.5 million, respectively. Since 2019, the Office for Financial Sanctions Implementation (OFSI) in the UK has issued fines just short of £21 million.

The UK seems to be “tightening the net”, according to Jeremy Willcocks, a partner in Arnold & Porter’s corporate practice in London. ‘There is a desire from the British government and the British people to make sure rogue companies are fined’, he says.

Breach response and remediation

It is therefore important that institutions implement policies and procedures to manage breaches. They can look beyond sanctions and review anti-money laundering (AML) programmes, according to Christine Reisman, managing director at Protiviti in St. Louis. ‘Most firms know that many controls mitigate risk for both AML and sanctions compliance’, she says.

If a breach occurs, the first line of defence should collect all the relevant information required by the second line of defence and stop processing related transactions. The second line of defence can then inform senior management. In conjunction, the first and second lines of defence should liaise to investigate whether similar breaches have occurred in the past.

A lookback process may reveal weak controls or processes, including name screening and transaction filtering, that require tuning or strengthening. It is important to apprise regulators of the breach and the adjustments that have been made to prevent similar breaches from reoccurring, while documenting the controls and screens.

Due to the scope of the recent sanctions, institutions should anticipate receiving more customer information requests and closer scrutiny of their high-risk customers. 

But Chenkin highlights the risk of providing customer information absent a subpoena from a requesting entity. ‘If a firm provides customer information without process, they are creating a bigger issue’, he says.

For more information on sanctions compliance, please contact Bernadine Reese, managing director at Protiviti UK at [email protected].