OFSI fine highlights need for timely voluntary disclosure

Stacy Keen of Pinsent Masons was commenting following the regulator issuing a notice for a monetary penalty notice against Colorcon Limited, the UK subsidiary of US-based pharmaceutical group Colorcon Inc, for payments made in breach of UK sanctions on Russia.

Colorcon operated a representative office in Moscow until late 2022. As the company wound down its business, Colorcon made payments to employees and certain service providers that held accounts with several Russian banks that had been designated by the UK in response to Russia’s invasion of Ukraine.

The ultimate recipients of the payments, made between 23 March and 2 December 2022, were employees and service providers that were themselves not sanctioned. However, the banks those employees and service providers held accounts with were designated, meaning any payments contravened UK sanctions restrictions.

Colorcon made a voluntary disclosure to OFSI about the breaches. However, OFSI’s penalty notice states that four months elapsed between Colorcon first becoming aware of the breaches and notifying OFSI of the situation. A discount of up to 50% may be granted to businesses for ‘prompt and complete voluntary disclosure’ in a case assessed as serious. However, OFSI said it did not consider this time period ‘prompt’ enough and reduced the voluntary disclosure discount to 35%.

Given Colorcon’s “specific and heightened exposure to sanctions risk”, OFSI said the company “failed to sufficiently manage sanctions risk”, instead “focusing on sanctions screening procedures and their reinforcement in relation to direct customers, shareholders and remitting banks rather than their own employees and service providers.”

In total, Colorcon was fined £152,750 in relation to 79 payments made in breach of the Russia (Sanctions) (EU Exit) Regulations 2019.

OFSI said that 44 additional payments, totalling £63,012.85, were permitted under an OFSI general licence, which granted the company time to complete outstanding transactions with sanctioned entities as it wound down its operations in Russia.

Commenting on the penalty notice, Keen, a sanctions expert, said the case served as a valuable reminder of the need for prompt reporting when an organisation decides to voluntarily disclose a breach. “The case emphasises the need for prompt reporting on the identification of non-compliance and sets a marker that four months is too long in OFSI's view,” she said. “OFSI acknowledges that it is reasonable for those grappling with non-compliance to take time to assess the nature and extent of the breach, or seek legal advice, but this should not delay an effective response to the breach.”

The penalty notice also reminds businesses that it is an offence not to comply with licence reporting requirements and that breaches should be disclosed to the regulator as soon as possible if a full discount is to be available. In relation to licences, OFSI says its issuance of a general licence “does not imply that similar transactions made outside the terms of a general licence will be viewed by OFSI as not serious”.

The notice also underlines that it is insufficient for companies to rely on third parties, such as banks – as in this case – to undertake financial sanctions checks or screening. Instead, it emphasises the importance of businesses taking steps to regularly assess their own internal sanctions policies, Keen said.