Don’t fall foul of sanctions

The danger for many businesses when it comes to sanctions and sanctions controls, is that there are multiple ‘grey’ areas for organisations working across different jurisdictions.

Organisations need to consider not only their own customer base but the entirety of their supply chain at a granular level, against a backdrop of an ever-evolving regulatory landscape. 

There can be a high price to pay for getting it wrong. In 2009, the international shipping company DHL was fined $9.4 million for breaking the embargo to ship goods to Sudan and Iran.

And in 2019, e.l.f. Cosmetics Inc agreed to pay nearly $1m to settle liabilities stemming from violations of the North Korea Sanctions Regulations, due to importing 156 shipments of false eyelash kits worth $4.43m from two Chinese suppliers that sourced materials from North Korea.

As well as having supply chain visibility, a significant challenge for compliance professionals is that jurisdictions often have different, and sometimes conflicting, regulations and laws.

As an example, following Brexit, the UK has now developed its own autonomous framework under the Sanctions and Anti Money Laundering Act 2018, which will differ from its European counterparts and offers the opportunity for the UK to pursue its own foreign policy objectives outside of the EU’s regulatory framework.

As a best practice approach, organisations always need to follow the ‘strictest set of rules’ from the jurisdictions their business is involved in. All staff need to have an awareness of sanctions and their individual responsibilities.

Compliance professionals and second line staff need to be fully aware of relevant legislation and also become keen students of geopolitics and worldwide events as they transpire, to best assess how new incidents and measures will impact on their business and sanctions controls in affected regions.

With sanctions moving higher up the agenda and increasingly being reported in the mainstream media, it is clear that a greater focus on sanctions risk compliance is now required.

Reputation a chief concern

The International Compliance Association recently conducted a global survey of sanctions and compliance professionals to highlight the main areas of sanctions compliance concern.

We sampled 401 respondents in July 2021 from a range of industries including banking, accounting, asset management, insurance, payment services, and betting and gaming. 

Interestingly, respondents identified the impact of digital currencies and emerging financial technologies as an area of concern, with almost half (46%) suggesting greater training and education is needed around crypto/digital currencies and emerging financial technologies in relation to sanctions compliance.

Cryptocurrency is still a largely unregulated space. However, with the rapid rise in digital currencies and emerging financial technologies, naturally, regulations continue to evolve.

This is adding to the complexity of sanctions compliance for organisations operating across multiple jurisdictions who constantly need to review and assess the impact of new legislation and regulation. 

Firms cited potential reputational damage (42%) as their biggest concern in terms of sanctions risk.

This was followed by concern about substantial fines (27%), followed by inability to conduct business (13%) in specific geographical regions.

Sanctions are a crucial instrument in the international battle against financial crime, proliferation, terrorism, corruption and human rights abuses. Those who manage the risk need the right combination of knowledge, capabilities and behaviours to manage it effectively.

Our survey perhaps points to the need for a greater awareness of the impact and real-world consequences of the activities that lead to the implementation of sanctions measures, and the tactics employed to subsequently evade the restrictions

Wider challenges related to training were also identified. For example, 70% of respondents have undertaken less than ten hours of training on managing sanctions risk over the past 12 months. Ten percent had undertaken no training, while the majority (39.4%) have undertaken less than five hours. 13% said no sanctions-specific training has been delivered to staff.

It was positive news that 68% of respondents confirmed their business had undertaken a sanctions risk assessment in the past 12 months (18% had not). However, a third (32.9%) of firms have not assessed sanctions risk across their supply chain in the past 12 months, and a quarter of respondents were ‘unsure’.

This does highlight the need for business leaders and staff to understand the nature of the entirety of their supply chain to remain compliant.

Staying ahead of the curve 

We know staying ahead of the curve through horizon scanning and keeping up to date of live events as they occur is critical for compliance professionals.

Sanctions risk also now needs to be part of the debate at senior management level. Discussion allows suitable strategies to be developed to assist in protecting the supply chain, while meeting minutes ensure there is an audit trail for regulators.

Many firms use screening software which can be helpful. Advances in artificial intelligence and machine learning will progress further in the future. However, situations can currently evolve faster than the software can be updated and there are many instances where it is necessary to intervene sooner.

Our survey found that although a significant number (85.5%) of respondents use screening software to help manage sanctions risk, more than two thirds (64%) had problems with false positives – 23.9% saying a definite yes, while 39.85% suggesting that false positives are ‘somewhat’ of an issue, so it is important to acknowledge limitations of use at this time.

Overall, it was no surprise that complexity was cited as the biggest challenge to managing sanctions risk according to 39% of respondents, followed by lack of staff awareness/education on the related risks (26%), again pointing to the need for more training relating to sanctions.

However, with 55% of respondents expecting to make changes to their sanctions risk programme in the next 12 months (20% major changes, 34% minor changes), this offers an opportunity to broaden training programmes to ensure staff are fully equipped to understand the changing nature of sanctions risk and control and the full consequences of non-compliance.

Putting sanctions compliance risk into perspective, firms should look to the guidance provided by international bodies such as the UN or EU and also from jurisdictions with their own autonomous regimes, such as the US and the UK via the Office of Foreign Assets Control (OFAC) and the Office of Financial Sanctions Implementation (OFSI) respectively. 

While clear policy controls are essential, education of staff in the key skills is also necessary to protect businesses, particularly in relation to the use of emerging digital currencies. This can be achieved through investment in continued professional development for staff to ensure a greater focus on sanctions risk compliance to protect the firm across increasingly diverse supply chains, against the situation of constantly changing legislation.

The ICA International Diploma in Managing Sanctions Risk is aimed at mid-senior level managers who are responsible for managing risk.

Ross Savage is a course director and global lead of Sanctions Compliance at the International Compliance Association.