OFSI updates its Monetary Penalties Guidance on assessing ownership and control

On March 16, 2023, the UK Office of Financial Sanctions Implementation (OFSI) updated its guidance on enforcement and monetary penalties for breaches of financial sanctions (the Monetary Penalties Guidance) to include details on its approach to assessing breaches of financial sanctions where an incorrect assessment of ownership and control of an entity is relevant to the commission of the breach (see paragraphs 3.22 – 3.31).

Key takeaways

In relation to assessing ownership and control in the circumstances where OFSI determines that a breach has occurred, the Monetary Penalties Guidance states the following:

• Where OFSI determines that a breach has occurred, and an incorrect assessment of ownership and control of an entity is relevant to the commission of the breach, OFSI will consider the degree and quality of research and due diligence conducted on the ownership and control of that entity.
• The test for establishing ownership and control of an entity is contained in the relevant sanctions regulations, and guidance on the test can be found in OFSI’s General Guidance. OFSI does not prescribe the level or type of due diligence to be undertaken to ensure compliance with financial sanctions.
• OFSI will consider appropriate due diligence conducted on the ownership and control of an entity to be a mitigating factor where the ownership and control determination reached was made in good faith and was a reasonable conclusion to draw from such due diligence. OFSI may also consider a failure to carry out appropriate due diligence on the ownership and control of an entity, or the carrying out of any such due diligence in bad faith, as an aggravating factor. The weight to be attributed to the mitigating or aggravating factor (as applicable) will be assessed on a case-by-case basis.
• OFSI will consider whether the level of due diligence conducted was appropriate to the degree of sanctions risk and nature of the transaction. The nature of a person’s contractual or commercial relationship with the entity will also be relevant to OFSI’s consideration of the appropriateness of measures undertaken. OFSI would expect to see evidence of a decision making process that took account of the sanctions risk and considered what would be an appropriate level of due diligence in light of that risk. OFSI would usually expect these decisions to be made by reference to an internal framework or policy, but recognises that there is no one-size fits all approach. OFSI expects careful scrutiny of information obtained as part of any ownership and control assessments, particularly where efforts appear to have been made by designated persons to avoid relevant thresholds.

Examples of due diligence

The Monetary Penalties Guidance provides illustrative examples of due diligence which, if undertaken, may be considered by OFSI as potentially mitigating, including:

• An examination of the formal ownership and control mechanisms of an entity to establish whether there is available evidence of ownership and control by a designated person.
• An examination of actual, or the potential for, influence or de facto control over an entity by a designated person.
• Open-source research on an entity and any persons with ownership of, or the ability to exercise control over, the entity, together with an examination of whether such persons are, or have links to, designated persons such that further investigation may be warranted.
• Direct contact with the entity and/or other relevant entities to probe into indirect or de facto control, including, where appropriate, seeking commitments by UK persons as to the role of any designated person or person with links to a designated person.
• Regular checks and/or ongoing monitoring of the above where appropriate.

Assessing ownership and control

The Monetary Penalties Guidance also provides examples of the following areas of enquiry that OFSI may expect to be undertaken by persons seeking to assess whether an entity may be owned or controlled by a designated person (noting that the examples do not provide an exhaustive list; and that a risk-based approach is expected to be taken and so, depending on the facts, not all of the areas of enquiry may be necessary):

Formal ownership and/or control

• The percentage of shares and/or voting power of shareholders.
• The ownership and distribution of other shares in a company.
• Whether ownership / shareholding has recently been altered or divested, including in possible anticipation or response to the imposition of financial sanctions. If so, consideration of whether this warrants further investigation into the possibility of joint arrangements or indirect or de facto control.
• The composition of shares, and whether shares have been split into different classes, or other structural changes made.
• Whether changes to ownership and/or control were part of a pre-planned or wider business/financial strategy.
• Corporate constitutional documents, including articles of association or constitution.
• Any commercial justifications for complex ownership and control structures.
• Agreements between shareholders or between any shareholders and the entity (e.g., shareholders’, joint venture, operating, or guarantee agreements).

Indirect or de facto control

• Indications of continued influence (or the potential for it) by a designated person, including through personal connections and financial relationships.
• The presence or involvement of proxies, including persons holding assets on behalf of a designated person.
• Ownership, holdings of shares, or control by trusts associated with a designated person.
• If shares or other ownership interests of a designated person have been divested, the nature of any relationships and prior involvement of the person benefitting.
• If applicable, how recent transfers of shares were funded and whether this was done at an accurate and true valuation.
• Any operational steps taken to ensure that the designated person cannot exercise control over the entity and/or that the designated person cannot benefit from, or use, corporate assets.
• Information relating to the circumstances of board and/or management appointments, including the backgrounds, relevant experience, and relationships with designated persons.
• The running of board meetings and governance processes, including board or shareholders’ meeting minutes concerning recent changes in the entity’s ownership and control relating to the designated person.
• Ongoing financial liabilities directly related to a designated person, e.g., personal loans, loan guarantees, property holdings, equipment etc.
• Other shareholder agreements, voting agreements, put or call options or other coordination agreements in place between the entity and the designated person or controlled entities.
• Whether there are any benefits conferred to the designated person by the entity or transactions between the entity and the designated person.

In addition, the Monetary Penalties Guidance also makes clear OFSI’s expectations around conducting regulating checks on ongoing monitoring, stating that [w]here relationships or activity is ongoing, OFSI expects that due diligence is, and assessments are, reviewed at appropriate times. Ownership and control is not static and OFSI’s consideration of the due diligence undertaken will consider the regularity of checks, and/or ongoing monitoring where appropriate.

What does this mean for businesses? 

In terms of what this means for businesses, the examples and commentary provided in the updated Monetary Penalties Guidance provide helpful insight into OFSI’s expectations regarding the level and type of due diligence that businesses may be expected to undertake and consider as part of assessing whether an entity may be owned or controlled by a designated person.

This updated guidance should also serve as an opportunity for businesses to review their current risk-based due diligence procedures and ensure they effectively meet the expectations set out in updated Monetary Penalties Guidance.

 Indeed, the guidance states that for due diligence to be considered as a mitigating factor, the onus rests with the person against whom OFSI is considering taking enforcement action to demonstrate that reasonable and appropriate due diligence into ownership and control has been undertaken, and that the ownership and control determination reached was made in good faith and was a reasonable conclusion to draw from such due diligence.

For businesses which are FCA regulated (or otherwise subject to the UK Money Laundering Regulations), this guidance also emphasises the importance of having robust customer due diligence procedures and controls in place. If not, any failures will be a breach of both the sanctions and the money laundering regimes.