In light of the OFSI’s recent fine on Raphaels Bank, Eric Sohn at Dow Jones Risk & Compliance looks at other seemingly outsized penalties, and what they could mean.
On January 21, 2019, the OFSI (Office of Financial Sanctions Implementation), part of Her Majesty’s Treasury, issued its first civil monetary penalty based on specific reported violations since receiving the authority in 2017.
OFSI fined Raphaels Bank GBP 5,000 for making a single GBP 200 transaction dealing with an individual sanctioned under the Egypt sanctions programme. According to the penalty notice, the fine had been cut in half due to the bank’s disclosure of the violation and its cooperation, yet was imposed because it apparently “knew, or had reasonable cause to suspect” that the transaction was in breach of the sanctions regulations.
The penalty imposed seems, on its face, egregiously large for a single violation of such meager size. Yet, not only is there a history of other regulators imposing outsized penalties, but there are solid reasons why OFSI may have chosen to do so in this case.
There are very few publicised cases of civil monetary penalties imposed by the US’ OFAC (Office of Foreign Assets Control) where the penalty amount was larger (or even comparable) to the value of the underlying transactions.
OFAC and the OFSI are unique in that they are empowered to impose fines based on actual violations of sanctions regulations; other regulators mete out fines in response to discovering inadequate systems, control and compliance programs as part of regulatory examinations and reviews.
The two cases where the civil fine collected was in excess of the value of the business transacted were:
- In 2013, Dal-Tech Devices, Inc. agreed to a settlement of USD 10,000 for a single sale of goods (valued at USD 3,226) intended for Iran. However, that penalty pales in comparison to the USD 500,000 base amount, which was applicable because the firm did not voluntarily self-report, and because the violation was considered “egregious” (OFSI’s equivalent term is “most serious”).
- In 2017, ABAN Offshore Limited paid a settlement of USD 17,500 for attempting to order USD 10,127 worth of US-origin oil rig supplies for re-exportation to a drilling rig located in Iranian waters. In this non-self-disclosed, non-egregious case, the base penalty was USD 25,000.
There were two more cases where the fines were very similar to the amount of the transaction. In 2014, Branch Banking & Trust Co agreed to pay USD 19,125 for sending a USD 20,000 funds transfer in violation of the Sudanese Sanctions Regulations. This egregious violation, which was not voluntarily self-disclosed, resulted in a USD 25,000 base penalty.
In a similar fashion, Compass Bank paid the same amount, with the same base penalty, for a non-egregious, non self-reported GBP 8,900 funds transfer in 2013 – despite the bank’s management having actual knowledge that the sanctions regulations may have been violated.
Additionally, there is one case where, although the fine was less than the value of the goods, the settlement amount was appreciably larger than the base penalty. On February 7th of this year, Kollmorgen Corporation settled its violations of Iranian sanctions for USD 13,381, which was almost double the base penalty of USD 7,434, yet less than the USD 14,867 value of the services provided. While the violations were considered non-egregious (“serious” for OFSI violations), and voluntarily self-reported, they were for multiple violations committed over a period of time, with the knowledge of and involvement by management in its Turkish subsidiary in the decision and execution of the violating conduct.
So, there are no truly comparable cases to the fine imposed by UK regulators, especially when one considers the totality of the factors involved.
The Dal-Tech Devices case appears to represent the lowest transaction value which has drawn a regulatory response previously – there have not been any civil monetary penalties which have been publicised by OFAC for violations totaling less than USD 3,000 in over five years. It seems likely that, based on the available information about this case and its Enforcement Guidelines, OFAC may have issued a No Action Letter (as approximately ninety percent of OFAC investigations are concluded) or perhaps a Cautionary Letter, especially for a first offense.
Does the Raphaels Bank penalty fit the guidance?
OFSI’s guidance document claims that penalties are proportionate:
To ensure our response is proportionate, we will assess overall how severe or serious the breach is and the conduct of the individuals involved. Broadly, the more aggravating factors we see, the more likely we are to impose a monetary penalty. The more serious the breach, and the worse the conduct of the individuals, the higher any penalty is likely to be.
The factors which are considered by OFSI include:
- Direct provision of assets to designated persons
- Activities intended to evade sanctions
- Value of the violation
- Harm or risk of harm to sanction program objectives
- Knowledge of sanctions and compliance systems
- Behavior, such as deliberate acts or neglect to take reasonable care
- Failure to apply for, or obey the terms of, licenses
- Facilitation by professionals
- Repeated, persistent or extended series of violations
Of these, the penalty notice only clearly denotes that the first factor, direct dealings with designated person, is applicable. On the issue of the violations’ value, OFSI states:
OFSI will consider the value of the breach (which may be estimated). A high-value breach is generally more likely to result in enforcement action. However, OFSI realises there are circumstances involving lower-value breaches where enforcement action is also justified – for example, if the action was a calculated and deliberate flouting of sanctions.
And on the issue of harm or risk or harm:
We will make an assessment of the harm, or the risk of harm, done to the sanction regime’s objectives. Those objectives are set out in the relevant regulation, which describes what activities the regime aims to prevent or encourage – for example, to guard against nuclear proliferation. The greater the risk of harm to the regime’s objectives, the more seriously we are likely to regard a case.
To the casual observer, in the absence of evidence to the contrary, it is hard to fathom that a single transaction totaling GBP 200 could produce noticeable harm to the programme objectives of the Egypt sanctions programme, which targets those who misappropriated state funds. Similarly, the penalty notice does not denote or insinuate that the breach at Raphaels Bank represented a “calculated and deliberate flouting of sanctions.”
Perhaps the most pressing issue with the penalty imposed in this case is the lack of clarity as to how the base penalty was derived. While the guidance published by OFSI delineates the factors considered (as listed above), the relationship between the total value of the transactions involved and the base penalty is not specified, except in the most general way.
In the Raphaels Bank case, for example, the GBP 10,000 figure stated in the penalty notice as the base penalty does not appear derived from any public guidance or other regulatory or legislative document; only the GBP 1,000,000 statutory maximum appears in the Policing and Crime Act 2017 (which gave HM Treasury its enhanced enforcement powers) or in OFSI’s enforcement guidance document. That lack of transparency, in contrast to OFAC’s specific transaction value-based formulae and tables for calculating base penalties documented in its Enforcement Guidelines, gives great latitude to regulators, yet incentivises firms to be extra-cautious in the face of uncertainty about the repercussions of sanctions violations.
To provide perspective, a self-reported, non-egregious violation of OFAC sanctions of less than USD 1,000 (as is the case here) would have resulted in a base penalty of only USD 1,000, which reflects the voluntary disclosure by, if not the cooperation of, Raphaels Bank. A first offense would also be reduced to as little as USD 750, absent any other mitigating or aggravating factors. This is in contrast to the GBP 5,000 penalty calculated by OFSI, which is, as of this writing, equivalent to over USD 6,500.
Given the few pieces of information available, it seems challenging to justify a penalty imposed that is 25 times the value of the violating transaction. Perhaps this case can be chalked up to inexperience on OFSI’s part of providing sufficient transparency, either in the guidance or the penalty notice.
Of course, there may have been ulterior motives that made the Raphaels Bank fine as large as it was.
A warning shot?
The head of OFSI stated in a late-2018 interview that they had received over 120 reports of sanctions violations in the reporting year (from April 2017 to March 2018), and that they expected to issue their first penalties in the coming year. Given the timing of the Raphaels Bank penalty notice (it was published on 25 February 2019), it seems plausible that regulators wanted to live up to their prior statements. However, while this might explain the announcement of a penalty, it does fully account for its size.
However, it is quite possible that the purpose of the seemingly outsized penalty was to get the attention of the financial sector and other supervised entities, if not the public at large.
The closest analog, if one considers this action to be overly punitive, would be the reaction of the MAS (Monetary Authority of Singapore) to AML failures at BSI Bank and Falcon Private Bank in the wake of the 1MDB corruption scandal. In both cases, instead of supervised correction and ongoing monitoring of the two firms, authorities closed both firms by withdrawing their merchant banking licenses. In so doing, not only were those directly involved in the illegal conduct punished, but other employees and the firm’s other clients were also forced to bear the impact of the closures.
While not condoning the actions of either firm, one wonders if MAS imposed such draconian penalties because of the message such an action would send to other regulated firms as well as to the rest of the world, who might have begun to doubt Singapore’s status as a trusted financial centre.
Similarly, the Raphaels Bank fine might have been meted out to underscore that OFSI’s enforcement powers will be wielded, rather than being entombed in paper form alone.
Time will tell
Is the action against Raphaels Bank an outlier, driven by both the calendar and by the misfortune of being the first firm to be fined? Or does it denote the growing pains of a new regulatory regime?
Perhaps OFSI needs more of a track record in imposing fines (and following other regulators’ examples too) to find a more appropriate sense of proportionality, and to provide greater transparency to its end-to-end investigative and enforcement processes. Unfortunately, that means that those whose turn is upcoming may continue to feel the disproportionate pain of being test cases.
In the meantime, firms should exercise extra caution to avoid being on regulator’s radar until a more regular order is established.
Addendum: Raphaels Bank closure
Raphaels Bank has recently been reported in the Times of London to be closing down. However, this development is being attributed to factors other than the fine imposed by OFSI.
Eric A. Sohn, CAMS is global market strategist and product director at Dow Jones Risk & Compliance in New York.