OFSI publishes new guidance on ownership and control

On 16 March, the Office of Financial Sanctions Implementation (OFSI) updated its enforcement and monetary penalties for breaches of financial sanctions guidance (the Guidance) to include detail on its expectations in relation to determining ownership and control.

The Guidance states that where there has been a breach of a prohibition or failure to comply with an obligation under sanctions regulations and an incorrect assessment as to ownership and control of an entity is relevant to this breach, OFSI will assess the degree and quality of the due diligence which was conducted on the ownership and control of that entity.

OFSI does not set out a prescriptive level of due diligence which will ensure compliance. However, it will consider due diligence carried out in good faith and reaching reasonable conclusions to be a mitigating factor when assessing a breach. Equally, a failure to carry out appropriate due diligence in bad faith will be an aggravating factor in their assessment.

When considering the appropriateness of measures taken, OFSI will take into account the sanctions risk, the nature of the transaction and also the nature of a person’s contractual or commercial relationship with the relevant entity. Whilst acknowledging there is no prescribed approach, OFSI would expect to see clear evidence of the decision making process assessing the sanctions risk, ideally with reference to some internal framework or policy.

OFSI provides some examples of actions taken which will be considered mitigating factors, including:

• an examination of the formal ownership and control mechanisms of an entity;
• an examination of actual, or the potential for, influence or de facto control over an entity by a designated person;
• conducting open-source research; and
• direct contact with the entity, including where appropriate seeking commitments from UK persons involved as to the role of any designated persons.

OFSI also helpfully list examples of areas of enquiry they would expect to be made to establish whether an entity is owned or controlled by a designated person. These range from looking into the presence or involvement of proxies to ownership of shares through trusts to assessing the circumstances in which board members are appointed and assessing the running of board meetings and governance processes, particularly where there are recent changes in ownership and control relating to the designated person.

Ultimately, the onus of demonstrating that a reasonable level of due diligence has been carried out in the circumstances lie with those against whom enforcement action may be taken. Detailed decision making assessments and clear evidence of how conclusions are drawn are key, not forgetting that ownership and control can change over time so risk must remain constantly under review.