Sanctions systems and controls: firms’ response to increased sanctions due to Russia’s invasion of Ukraine

The Financial Conduct Authority, FCA, has published a press release in relation to UK sanction measures, particularly since the beginning of Russia’s invasion of Ukraine, and firms‘ dealing with those measures in terms of sanction monitoring, due diligence, or reporting.
Specifically, the FCA informs that it has conducted a review of firms‘ systems and controls to ensure compliance with UK sanctions regulations and to prevent financial crime, particularly the risk of financial sanctions evasion. In its statement, the FCA now presents the key findings from the review and highlights several key areas where firms need to improve their sanctions systems and controls. The statement shall serve as a guidance and reminder for financial services firms to ensure they have effective sanctions systems and controls in place to mitigate the risk of breaching UK sanctions and facilitating sanction evasion.
(1) Governance and oversight: Firms need to ensure that senior management is provided with sufficient information about their exposure to sanctions to enable senior management to make informed decisions. This includes monitoring and reviewing the effectiveness of sanctions implementation and ensuring that sanctions reporting is calibrated to the UK regime. In this context, the FCA has observed several instances where senior management lacked sufficient information to effectively fulfill their responsibilities, particularly in cases involving multinational firms relying on systems from other jurisdictions. In this context, the FCA has also noted other deficiencies, such as the absence of basic metrics to deal with sanctions like the implementation of sanctions alerts or the creation of reports which should be submitted to OFSI. Insufficient quantitative and qualitative information thus hindered risk identification and trend analysis, raising concerns about senior management’s ability to comprehend the firm’s risks for informed decision-making.
(2) Skills and resources: Sanctions teams need to be properly resourced to avoid backlogs in dealing with sanctions alerts and enable a quick reaction to sanctions risks. According to the FCA, some firms still lack adequate resources, resulting in significant delays in handling alerts, impacting their ability to promptly identify and report potential exposures. While some firms took actions to mitigate sanctions risk by blocking accounts or transactions when alerts were triggered, operational teams often struggled to prioritize alerts due to resource constraints and increased workloads which increases the risk of non-compliance with sanctions obligations.
(3) Screening capabilities: Sanctions screening tools need to be properly calibrated, up-to-date, and in-line with UK sanction measures. While some firms demonstrated effective calibration of their screening tools, others had poorly calibrated tools, leading to the generation of wrong positive results or the non-identification of sanctioned persons. Also, firms tended to be overly reliant on third-party tool providers without effective oversight of the tools‘ limitations and calibration needs.. Screening tools need to be appropriate for the UK sanctions regime and calibrated to the specific risks faced by a firm, so the FCA.
(4) Customer Due Diligence (CDD) and Know Your Customer (KYC) procedures: Effective CDD and KYC are crucial for compliance with sanctions requirements. The review found instances of low-quality CDD and KYC assessments and backlogs, which increase the risk of firms not identifying sanctioned individuals or entities. Firms need to ensure they gather sufficient information and undertake thorough KYC and CDD to properly screen all relevant parties.
(5) Reporting breaches to the FCA: Firms are required to report any breaches of financial sanctions to OFSI if they know or suspect such breaches have occurred. They must also notify OFSI if they are dealing with a designated person, hold frozen assets, or discover a breach while conducting business. Additionally, firms should assess whether they need to report breaches resulting from significant failures in their systems and controls pursuant to the FCA’s Principle 11, SUP 15.3.8G(2), and Chapter 7 of the Financial Crime Guide. In this context, the FCA has observed that some firms took a long time to report breaches, while others fully investigated and remediated breaches before notifying OFSI. Some firms also failed to report breaches altogether. This delay or lack of reporting hinders OFSI’s ability to address systems and controls issues promptly and collaborate with firms to rectify them.
To conclude, the FCA notes that it expects firms to evaluate their approach to identifying and assessing sanctions risks, strengthen their measures to prevent sanctions breaches and evasion, and adapt to changing risk exposures. Firms are encouraged to engage with the FCA in testing their sanctions systems and controls and to report any significant deficiencies identified.