Over-compliance with sanction-related rules can paralyse a business unnecessarily, but a carefully considered, proportionate response to them can minimise the risk of breaking the rules.

Most sanctions-related legislation tends to be formulated and rolled out at breakneck speed, making it difficult for businesses and individuals to keep up.

To make matters even trickier, guidelines for complying with these rules are often vague, creating ambiguity and anxiety for even the most diligent compliance officers.

Although the amount and reach of sanctions legislation continues to increase, the good news is that guidelines that explain how to comply are improving.

A decade ago, there was very little, if anything, in the way of compliance guidelines. The terminology of the guidance that exists today for different sanctions regimes is relatively consistent, which makes it easier to interpret them and comply with them.

Nevertheless, in today's political climate, sanctions lawyers play an increasingly important part.

The sanctions landscape

When most people think of sanctions, well-publicised American restrictions on doing business with Iran, Cuba and Russia usually spring to mind.

Unhelpfully, the Office of Foreign Asset Control (OFAC), which administers US sanctions, does not maintain a discrete list of countries with which US persons cannot do business.

US primary sanctions programmes vary in scope; some are geographical (applying to entire countries, like Iran), while others are 'targeted' (by measures against terrorism or narcotics, for example) and focus on specific individuals and entities.

For a reasonably comprehensive summary of where and to what or whom US primary sanctions apply, OFAC's Sanctions Programs and Country Information is a good place to start. As of October, OFAC has listed 32 separate sanctions regimes on this list.

OFAC has also introduced the concept of 'secondary' US sanctions, which allow it to target foreign individuals who facilitate transactions with entities sanctioned by 'primary' US sanctions, even if the entity or the transaction in question has no connection with the US.

Individuals caught by secondary sanctions may find themselves sanctioned or 'blocked' from using the US banking system and most major providers of credit cards.

Although the European Union is less prominent than the US as a sanctioning authority, it is no less sprawling, subjecting 34 countries to its sanctions regimes.

The UK imposes its own sanctions on the financial sector, overseen by the Office of Financial Sanctions Implementation (OFSI), as well as EU sanctions.

Most international organisations are more wary of OFAC’s ability to levy multi-billion dollar fines for non-compliance than they are of OFSI's power to impose fines of up to £1 million or 50% of the estimated value of the breach in question.

OFSI has so far barely flexed its muscles. This does not necessarily mean that OFSI is toothless, however, and there is every chance that it will step up the severity of its punishments for breaches of the sanctions rules.

At any event, British and European businesses ought to be prepared for a ratcheting-up of the complexity, reach and heft of internationally important sanction-related policies.

Over-compliance

Far from sticking its head in the sand, the business community is over-complying with both primary and secondary US sanctions.

Although the EU has tried to neutralise the extra-territorial effect of US sanctions by introducing a blocking statute and a trade vehicle called the Instrument in Support of Trade Exchanges (INSTEX), anecdotal evidence suggests that businesses have hesitated to take advantage of these things.

INSTEX is a project run by the UK, France and Germany. These countries embarked on it in June to let EU companies that wanted to trade with Iran to do so without running the risk of breaching US controls. The Americans, of course, are displeased with the scheme's very existence.

Financial firms' reluctance to use INSTEX is unsurprising, given the fear of OFAC and huge dependence of most of the world's businesses on the US banking system.

Since this is unlikely to change in the foreseeable future, the US will continue to wield significant power when it comes to enforcing compliance with sanctions.

This situation need not unduly stifle trade and economic activity among legally trading entities, however. Although a breach of international sanctions might be financially ruinous for a business, over-compliance with sanction-related rules can paralyse it unnecessarily. A carefully considered, proportionate approach can minimise the risk of rule-breaking.

Reasonable steps

Businesses that operate in the EU are not legally obliged to have sanctions compliance programmes (i.e. plans of action) in place. If they do not have compliance policies, however, they leave themselves open to accusations of negligence when something goes wrong. Technical compliance with regulatory rules is no automatic guarantee against a claim of negligence from a plaintiff.

The absence of a proper sanctions policy can also scupper M&A (merger and acquisition) deals and other corporate-level transactions, so any business that wants to grow or be acquired should consider sanction-related compliance as part of its M&A arsenal.

Sanctions compliance need only be proportionate, but every firm ought to think it through carefully.

The five Ws

When drawing up sanctions compliance policies, companies ought to think about five Ws: What? Who? Where? Why? And when?

What?

There are two main forms of sanctions: trade and economic. Trade sanctions cover products with dual civilian and military use and need not concern us here. Economic sanctions strive to prevent any economic 'benefit' being conferred, directly or indirectly, on any sanctioned persons or entities and are very broadly defined.

Who?

Knowing who you are dealing with seems an obvious point to consider when it comes to sanctions compliance. Different countries maintain extensive (and highly changeable) lists of sanctioned countries, organisations and individuals which the compliance officer can access online when checking the status of an applicant for business.

Open-source data only provides a starting point, however. The compliance officer can find it very hard to pinpoint the ultimate beneficial owner of a company or asset, especially if complicated corporate structures are involved.

The way in which a bank or other financial firm deals with this requires a cost-benefit analysis that asks whether the commercial opportunity is worth the time and expense involved.

The 'who' also requires the firm to consider whether the nationality of staff involved in relevant transactions exposes the business to sanctions.

A company may have done everything right in terms of background checks on its partners or applicants for business, the structuring its business and its currency arrangements, but it can still be caught out if a staff member's nationality conflicts with the rules that apply to sanctions.

Where?

The firm must take stock not only of the places in which it does business but also at the places where it (and its business partners) are based, the geographical reach of its supply chains and (if this is relevant) the locations of the headquarters of the banks that it uses.

This can be complicated if any one of these operates through subsidiaries and has a foot in a sanctioned jurisdiction. The firm must be 'forensic' in its background checking and must structure its commercial ecosystems carefully, the better to keep its whole network on the right side of sanctions.

Why?

Every firm must understand, and be ready to explain, every transaction. This will prove extremely helpful if the transacting entity ever has to apply for a licence or, in the worst case, finds itself being investigated by the authorities, or falls into a contractual dispute with a counterparty.

Most sanction regimes offer licences for legitimate activities but if such a legitimate activity ultimately ends up involving a sanctioned entity, a licence and proof of legal intent are unlikely to save it from being penalised by a sanctioning authority – although if it has these things ready the regulator might lower the fine.

Another issue to bear in mind is litigation over frustrated contracts.

If a company wants to claim that a contract cannot be fulfilled due to sanctions, it is important for the firm to be able to show that it has done everything possible to try to fulfil the contract. This includes applications for licences.

When?

Sanction-related legislation and the lists of sanctioned ('designated') entities change constantly and we are travelling towards greater complexity and more restrictions. Financial firms, trusts and family offices therefore have to keep up with changes and amend their internal policies and structures accordingly.
 
They have to check contracts that are automatically renewed, such as insurance policies and supplier agreements, to ensure that they are still valid in the light of updated sanctions. There will be cases in which the financial firm has to suspend commercial contracts because a particular part or person in a transaction has been sanctioned. However, even in cases where contracts are paused for long periods, courts have tended to take the view that they have not been frustrated.

Risk management

Sanctions compliance is ultimately a risk management exercise. Although risks can only be minimised rather than eradicated, this should not prevent a legal business from functioning properly.

The development of a workable approach to sanctions compliance involves:

• a knowledge of the regulatory landscape and an understanding of one's exposure to sanctions;
• policies and procedures that help the compliance department spot 'red flags';
• a training programme that familiarises all staff with compliance policies;
• clear leadership from the top and channels for directing difficult commercial decisions to compliance officers;
• active screening processes for all customers and service providers throughout the supply chain; and
• the monitoring of changes to sanction-related rules and the procurement of advice about how to respond.

More and more litigation has occurred in respect of "contract frustration" due to sanctions and the introduction of more stringent sanctions policies and clauses as a result.

Financial firms should think about refreshing commercial relationships with these in mind and protect themselves adequately with the right clauses in their contracts.

It is important, however, that these protective clauses do not stifle deal-making, especially for M&A purposes. Both sides must strike a balance, usually through patient negotiation and expert advice.

* Vivien Davies can be reached on +44 (0) 207 861 4719 or at vivien.davies@fieldfisher.com; Andrew Hood can be reached on +44 (0) 207 861 4794 or at andrew.hood@fieldfisher.com; Vanessa Wilkinson can be reached on +44 (0) 207 861 4286 or at vanessa.wilkinson@fieldfisher.com