OFSI penalty highlights sanctions compliance gaps at global companies

The Office of Financial Sanctions Implementation (OFSI) has issued a monetary penalty of £152,750 on Colorcon Limited, a UK pharmaceutical company, for breaches of the Russia sanctions regime.

The fine relates to 79 payments totalling £128,277.72, made by Colorcon's Moscow office to its Russian employees and service providers. While the employees were not designated as sanctions targets, their banks were designated, meaning Colorcon breached financial sanctions by paying into accounts at the sanctioned banks.

Having self-reported the breach to OFSI, Colorcon chose not to dispute its decision to impose a monetary penalty. The company received a 35% discount on the fine in recognition of its voluntary disclosures and full cooperation with OFSI's investigation – without this reduction, the penalty would have been £235,000 (the permitted statutory maximum penalty in this case being £1,000,000).  However, it did not qualify for the full discount because OFSI considered that it had unreasonably delayed in reporting the breaches.

OFSI assessed the breach as "serious". It considered that aggravating factors included Colorcon's status as a global company with an established presence in Russia that had "significant awareness" of sanctions risk but failed to take reasonable care. It also noted the repeated and persistent nature of the errors made by Colorcon in failing to identify multiple payments to accounts held at designated banks over an extended period (payments were made between March and December 2022).

Compliance guidance

OFSI highlighted the following compliance lessons for industry:

• Third-party reliance is insufficient: Colorcon asserted that its understanding was that its bank would apply UK sanctions screening, but OFSI noted this was never tested through making appropriate enquiries with the bank. The decision makes it clear that that companies cannot rely on third parties to undertake financial sanctions checks on their behalf and they will be liable for any breaches that occur.
• Regular review of policies and processes: Sanctions policies and processes should be regularly reassessed to maximise effectiveness in response to the changing geopolitical landscape. OFSI will not necessarily consider the existence of sanctions policies as a mitigating factor if they are not fit for purpose. In Colorcon's case, relevant documentation had not been materially updated since 2018.
• Review general licences: Although 44 of the payments were covered under a general licence before its expiry, Colorcon failed to comply with its reporting obligations and continued transactions even after the licence had expired. OFSI noted that failure to comply with specific licence requirements such as reporting obligations under general licences will be considered an aggravating factor if a monetary penalty is imposed.
• Timely disclosure of breaches: Breaches should be disclosed to OFSI as soon as reasonably practical after discovery. Although OFSI gave a discount of 35%, the four-month delay between discovery of the breach and making an initial notification was too long, so Colorcon did not qualify for the maximum discount of 50%.

Osborne Clarke comment

The Colorcon penalty is a further helpful indicator of how OFSI is approaching the enforcement of UK sanctions (in the generally limited body of penalties issued to date under the Russia Sanctions regime).

It underscores the heightened sanctions compliance risks facing UK companies with global operations, particularly those with established presences in sanctioned jurisdictions, and the need for organisations to take a risk-based approach to their compliance systems and procedures.

The 27-month delay between Colorcon's breach report and publication of the penalty notice also indicates that companies could face lengthy and potentially costly investigations if their compliance procedures fail to adapt to rapidly evolving sanctions regimes.

Michelle Tong, Senior Paralegal at Osborne Clarke, assisted in writing this Insight.