New sanctions enforcer on the block: OTSI opens a new chapter for the UK

On 10 October 2024, the UK government implemented major reforms to its sanctions enforcement regime through the Trade, Aircraft and Shipping Sanctions (Civil Enforcement) Regulations 2024 (“TASS”). These regulations grant the Office of Trade Sanctions Implementation (“OTSI”), a division of the Department for Business and Trade, significant new powers to enforce UK trade sanctions. OTSI can now investigate most trade sanctions breaches, demand compliance information, impose fines of up to £1 million or 50% of the breach's value (whichever is greater), and publicly disclose violations.

Within UK law, there are different sanctions regimes, applicable to different countries or activities. Some sanctions regimes, for example the Russia regime, impose asset-freeze measures on named individuals, companies or other entities. Financial transactions and dealings with assets of such “designated persons” are prohibited. Policing these rules is the role of OFSI, the Office of Financial Sanctions Implementation.

Apart from financial sanctions there are also trade sanctions. These typically apply not to identified parties, but to specific trades in products or services, such as weapons, semi-conductors or financial services. The export (and sometimes import) of such products or services to particular territories is prohibited by trade sanctions. With the establishment of OTSI, the UK is gaining a specialised agency which is dedicated to policing this element of the law.

OTSI: A new authority for trade sanctions enforcement

OTSI’s role includes investigating suspected breaches and taking enforcement action in cases involving the provision or procurement of sanctioned services, the movement or acquisition of sanctioned goods outside the UK, and the transfer or availability of sanctioned technology. This also extends to ancillary services that support the movement or acquisition of sanctioned goods and technology outside the UK.

The office also has powers to investigate and enforce breaches related to these activities, including in respect of circumvention of the UK’s trade sanctions through facilitating the contravention of sanctions and failing to comply with exceptions, information requests, reporting, licensing and recordkeeping requirements.

These powers will be applied to individuals and legal entities who are within, or undertake activities within, the UK’s territory or are UK persons, regardless of where in the world the breach occurred. In other words, the new regulations are not limited to activities within the UK’s borders; extraterritorial reach means actions taken overseas could also attract OTSI's scrutiny.

HM Revenue and Customs (HMRC) will continue to handle criminal enforcement and civil enforcement of those sanctions that fall within its remit as the UK’s customs authority and certain trade sanctions that relate to strategic goods and technology, while OFSI will continue to be responsible for undertaking investigations and enforcement of civil breaches of financial sanctions.

Expanding (strict) liability

Central to the new enforcement regime is the adoption of a strict liability framework, changing how trade sanctions breaches are managed. Under the new rules, businesses and individuals can be held accountable for violations regardless of intent or knowledge. This means that a company’s lack of awareness of sanctions breaches is not a valid defence, making proactive compliance essential.

The TASS also simplifies the process for OTSI to determine breaches using a civil standard of proof (the balance of probabilities). Potential outcomes include issuing a warning letter, referral to regulators or other organisations, public disclosure, civil monetary penalties of up to £1 million or 50% of the breach’s value, whichever is greater, or referral to HMRC where OTSI feels that HMRC’s criminal enforcement powers are more appropriate.

Notably, the TASS allows OTSI to impose monetary penalties not just on corporate entities, but also on individuals, such as directors, managers, secretaries, or other officers, if they are found responsible for a breach through consent, connivance, or neglect. As a result, senior management should implement robust sanctions compliance measures to mitigate both personal and corporate liability.

Finally, OTSI can publicly disclose details of sanctions breaches, even when no formal actions are taken. This "name and shame" tactic represents a clear departure from HMRC’s previously confidential enforcement approach. By making non-compliance public, this can be part of the strategy to deter potential violators, as companies and individuals now face the risk of reputational damage that can lead to loss of business, strained relationships, and even difficulties in securing future contracts in addition to significant financial penalties.

Information powers and reporting obligations

OTSI has broad powers to demand information from businesses or individuals if it "believes" that a person may be able to provide it. The new body can request documents, take copies, and ask for explanations regarding certain activities to investigate a suspected breach of a prohibition, or a suspected failure to comply with an obligation imposed under sanctions regulations and to help it monitor sanctions compliance.

Failing to comply with OTSI's information requests or obstructing its investigation is a criminal offence and can lead to fines or imprisonment. A person may commit an offence if OTSI requests information and the person refuses or fails to respond within the required time, or if they knowingly provide false information or submit documents with false information. Additionally, it is an offence to intentionally destroy, hide, or alter documents to avoid investigation, or to obstruct OTSI’s efforts to gather the necessary information. These powers highlight the necessity for businesses and individuals to maintain accurate and accessible records to timely comply with information requests to avoid potential liability.

The TASS also introduces mandatory reporting obligations for “relevant persons”, including financial and legal services providers to inform OTSI as soon as practicable if, through the course of carrying on their businesses, they know or have cause to suspect that a person has committed a breach of trade sanctions (with an exemption for legally privileged material). Failure to comply with this requirement could result in a fine or a criminal prosecution.

Mitigating factors in outcome decisions

While OTSI’s strict liability framework is stringent, the office will consider mitigating factors when determining potential outcomes of a breach. These factors include:

• timely voluntary disclosure of the suspected breach by the person or business responsible, which could lead to a reduction in the civil monetary penalty of up to 50% 
• timely mandatory disclosure of the suspected breach
• compliance with requests for information that OTSI may send out to reporters of suspected breaches during its investigations
• compliance with any relevant recordkeeping obligations under sanctions regulations
• no record of previously having breached sanctions legislation
• good knowledge of trade sanctions and relevant compliance systems proportionate to the size, exposure to sanctions and resources of the business 

Preparing for the new sanctions enforcement regime

The establishment of OTSI and the introduction of a new enforcement framework demonstrates the UK government’s commitment to taking a tougher stance on trade sanctions violations. Businesses and individuals subject to the UK trade sanctions regime must be prepared for this new era of enforcement. This may include:

• Conducting a thorough review and update of compliance programs to ensure they encompass all aspects of relevant UK trade sanctions.
• Providing comprehensive training for staff on the new regulations and reporting obligations to foster a culture of compliance throughout the organization.
• Enhancing due diligence procedures to identify and mitigate potential risks, particularly in third-party transactions and cross-border activities.
• Engaging senior management in compliance oversight to strengthen internal controls and to minimize the risk of personal liability for breaches.

Conclusion

As OTSI begins its operations, the UK’s approach to sanctions enforcement has entered a new chapter. Businesses and individuals should reassess their compliance frameworks, moving beyond box-ticking exercises and fostering a corporate culture that prioritises sanctions compliance. With the potential for significant penalties, public disclosure, and personal liability, staying ahead of the evolving sanctions regime is more important than ever.