Sanctions specialist Eric Sohn explains how wargaming exercises can be used as a risk management tool to game out threats and enhance strategic planning.
The idea of conducting business wargames is not a new one. A quick Internet search returns an article from Booz & Company dated before the turn of the 21st Century, for example. Much of the existing thought leadership on such business simulations, however, focuses on achieving success in a dynamic competitive environment.
However, a firm could substitute groups of malign actors on the world stage, as well as regulatory and other governmental agencies and offices, for the other companies with whom it is battling for primacy. That would allow the firm to conduct a wargaming exercise to develop contingency plans for regulatory and commercial risks that arise from foreseeable regulatory changes.
The challenge for conducting such an exercise, as it is with any business wargame, lies in creating the proper design. Since the imposition of economic sanctions has been referred to, by both the imposing and targeted parties, as war, it seems an apt regulatory sphere to base such a wargame on.
Know Your Enemies
One’s “adversaries” in an economic sanctions simulation are the regulators under whose purview the business that a firm conducts may fall. It is important to be expansive in considering parties to include, since they may claim jurisdiction not only due to the involvement of the firm, but that of other involved parties, such as clients, suppliers, distributors, agents and other third parties who are involved in the conduct of the business.
That claim of oversight also extends to assets that are used when business transactions are conducted, such as the provenance of goods or services the company procures or supplies (e.g. financial services such as currencies or insurance, or the cargo vessels on which goods are shipped), as well as geographic locations involved in the conduct of the business (e.g. where computer servers or support staff are located, and those through which goods are transported).
In order to properly include regulators in these approximations of real-world interactions, the people setting up the wargame should identify the nature of what each regulator does and why, in a manner not dissimilar to the KYC effort that firms make for the purpose of other regulatory compliance or risk management initiatives. Knowing how to “play” a sanctions regulator requires gathering a broad set of information and related analysis.
At a base level, the company must understand each regulator’s current sanctions regimes with a level of nuance that the common layperson is unfamiliar with. While it is important to know the types of prohibitions imposed under each regime, and the types of actions that have drawn scrutiny, it is similarly vital to understand the motivation behind the programme. Are the parties being singled out for corruption, human rights abuses, actions that could destabilise their country or region of the globe, some other reason, or a combination of factors?
It is useful, in order to get beyond any superficial motivations, to also review any related public statements, such as press releases and speeches on the topic made by that government’s officials, if any. Additionally, the wargame design must also consider whether each individual sanctions programme is actively managed and advanced, because it advances national goals, or does it exist purely because it is required to be so (e.g. due to EU or UN membership)?
The Crystal Ball
The regulators’ likely future actions can be inferred from recent experience and practice. A regulator that issues guidance with some regularity, whether standalone guidance or advisory documents, FAQs, or clarifying information in enforcement action publications – or even in press releases and related documentation – is more likely to take future action.
Here, too, official pronouncements presage whether the promulgation and enforcement of such sanctions represents a priority for the Imposing nation. In a similar fashion, the level of attention to detail given when issuing regulatory documents, and any evidence of a change in such detail, further points to a propensity to take action in those areas (and, to a lesser extent, more generally).
It should also go without saying, that regulators that have been shown to take the lead in updating their programmes (either through regulatory changes or new designations), rather than following others, are more likely to react to changing conditions in the affected countries or to events consistent with those which have been targeted previously (e.g. terror attacks). The likelihood of action under a specific sanctions regime can be inferred from recent past history in that program.
Despite any assumptions one might have about US sanctions imposed on Cuba, for example, the actual volume of sanctions actions taken in recent years (other than those taken in response to its cooperation with the Maduro regime in Venezuela) implies that the likelihood of future changes of consequence is less than that related to dealings with parties associated with other sanctioned countries, such as Iran and Venezuela.
However, in extremis, a regulator can change its behavior in a heartbeat. It is useful to recall the forceful actions taken by multiple regulators who were not known for their enforcement of financial crime violations in the wake of the 1MDB scandal. While those circumstances have not apparently changed those agencies’ general behavior, it remains important to consider that, if the nature of the violations are sufficiently embarrassing or damaging to the prestige or reputation of a nation, regulators have the capability, and can find the will, to take action. It is important to emphasise, therefore, that the purpose of a sanctions wargame is not to determine what the company can “get away with” under current sanctions, but to simulate future changes that may represent risk to the business.
Imposing sanctions, as well as penalising parties for violations of those sanctions, however, depends on the regulator’s definition of its jurisdiction for oversight. Additionally, the exercise must identify other elements of the related government that can impose commercial consequences for obstructing the government’s foreign policy priorities, even if those actions are infrequent. Recent foreign policy and sanctions-related actions in the US, for example, have also come from the Commerce and State Departments, in addition to the Treasury Department, of which the Office of Foreign Assets Control (OFAC), the US’ primary economic (as opposed to export/import or travel-related) sanctions regulator, is a part.
Firms must also consider future changes in regulation (e.g. addition of new types of sanctioning authorities), regulatory expectations and enforcement, as an added dimension that can be simulated. New ground broken in recent enforcement actions should be probed to determine whether the enhanced standard of care implied by the actions that were penalised will continue to increase the level of regulatory expectations. If the wargame expects that the standard of care will continue to be raised, one should postulate as to the ways in which those expectations may evolve over time, and how that might affect a firm’s internal operations, as well as its choices of customers, suppliers and partners.
Know Your Enemies’ Enemies
Regulators do not operate independently; they require malign actors to impose sanctions on. While both current adversaries and potential ones need to be identified and fleshed out, the analysis of the future sanctions targets involves an additional step.
Current Risk Exposures
For countries that are already in regulators’ crosshairs, one should analyse three avenues to regulatory difficulties. First, and most obviously, the exercise must gauge the value of any current business with firms sanctioned by regulators, and compare that to the loss of business should one’s firm become sanctioned because of that relationship. Included in this calculation should also be the effect of being shunned by other nations’ companies, out of fear of being sanctioned themselves.
Secondly, the organisation must consider whether the sanctions imposed by the regulator may expand to target the industries within the sanctioned country which the company conducts business with. For example, while there is basically a complete ban on exports and imports between the US and Iran, there are currently only a relative handful of business sectors which can currently become the target of OFAC sanctions designations.
However, the wording of one of the more recent Executive Orders (one of the venues by which the scope of sanctions authority in the US can be changed) allows the Treasury Secretary to designate additional business sectors as subject to future sanctions designations. Therefore, a proper ‘what-if’ analysis requires consideration of the likelihood that the firm’s business with the country will be impacted by such expansion of regulatory authority.
The last element that the wargame should consider is how sanctioned nations have reacted to prior actions, and how that might impact the business. The actions could potentially have been ignored or responded to with heated rhetoric, with retaliatory actions, with adaptation, or with evasion – or a combination of the above. To predict future behaviour, participants should be aware of changes in the tactics chosen, and whether or not different regulatory actions elicit different responses.
The exercise should identify if any prior action represented a temporary change in tactics (rather than strategy) to signal national resolve or capability. The limited number of attacks allegedly made by Iranian forces and those of their proxies on Gulf oil facilities and shipments, for example, appear to fall into this category.
More importantly, there is a need to extrapolate from this historical record the scenarios under which the business may be impacted, due to no nefarious actions of the firm. Business relationships with companies functionally and geographically similar to third-country firms already sanctioned may represent future avenues for adaptations to sanctions, or evasions of them; the impact of losing access to those firms (and the risks inherent in continuing to deal with them) due to future sanctions imposition needs to be gamed out.
Alternatively, a firm’s business assets may become the unwitting targets of asymmetric responses such as the aforementioned attacks on the assets of the Gulf states’ petroleum industry, or government-ordered changes to foreign investment or joint ventures. Additionally, the analysis needs to consider not only the current state of the business, but should also include anticipated and envisioned changes in customers, product and services, and geographic scope of the firm’s activities.
Future Risk Exposures
Identifying future exposures to risk from sanctions imposition is quite similar to the above analysis. It adds one challenging preparatory step: identifying governments that may represent future sanctions targets. It is useful to be expansive in these efforts, then to focus on some considered to be more likely to be sanctioned in the timeframe of the exercise. Some measures that could be used to extrapolate future targets from those currently sanctioned include, but are not limited to:
- Regional geographic ties
- Religious or cultural affinity
- Historical diplomatic relationships, common allies or common adversaries
- Historical trade ties (see https://oec.world)
Additionally, the wargame should attempt to find other sets of actors unrelated to current targeted nations. Identifying such potential sources of risk is largely based on reports in the media. One set of potential flash points can be deduced from evidence of deterioration of diplomatic relations, or conflict over substantive issues that may impact those relations.
Another way to identify potential future sanctions targets is to look for countries who take actions which have drawn reactions (other than rhetorical) from the regulator’s country in the past, under the assumption that similar actions may draw similar responses. Additionally, any country whose general stability may be in question – due to transitions of power that are not peaceful or breakdowns in normal governmental processes (e.g. elections), domestic unrest and related suppression and human rights abuses, or significant corruption – should be considered as a potential target.
Once these sets of future impediments to the free conduct of the business are identified, the analysis can continue similarly to the one conducted for a firm’s current risk exposures. The fact that these parties are not currently targeted, however, makes anticipating how they would react to regulatory actions with confidence a challenge.
Identifying Countervailing Forces
Lastly, as much as this exercise has focused on identifying areas where risks may increase, it is also useful to envision forces which could reduce the likelihood of future sanctions imposition. When evaluating intergovernmental relations, the views of interested third parties colour the prospects for sanctions imposition. While “the enemy of my enemy” may indeed be my friend, it does not necessarily follow that the friend of my enemy is also my enemy.
The limited scope of US sanctions on Russian energy firms represents an apt example. In a vacuum, it would seem logical to attempt to choke off such a significant part of the Russian economy. But, seen more broadly, the US has been dissuaded, to a certain extent, by European nations that are still dependent on Russian energy production. Being able to identify the impact of potential action (or inaction) on other parties may (or may not) affect how those regulators behave in the wargame, and helps provide a more realistic scenario.
No Plan Survives…
If not for the scope of US’ sanctions programmes, the analysis could be limited to consider only the actions which are proscribed by one’s primary regulator, and the regulators in every geography in which one conducts business. However, there is another calculus to consider: the potential for secondary sanctions, which are currently only imposed by the US. While they can take multiple forms, secondary sanctions impose restrictions or prohibitions on a party’s access to the imposing nation or its economy. This is due, in part, to the differences in the consequences involved, both in the nature of the penalties imposed, and the impact of those penalties.
If a firm has operations in the US, and the company violates US sanctions, they can be fined (although generally not enough to go out of business), required to make changes to their business operations (including staffing levels, and policies and procedures, for example), and/or required to have their compliance programme overseen by an external monitor, among other potential repercussions. In the wake of the 1MDB bribery and corruption scandal, Singaporean authorities essentially seized two financial services firms’ local operations. Individuals, too, can be penalised, as evidenced by New York state regulators’ enforcement cases resulting in staff dismissals.
On the other hand, the US has imposed the following penalties on parties not under its legal jurisdiction, for activities counter to its foreign policy priorities:
- Restriction or revocation of the right to travel to the US
- Restrictions on free movement, and activity, within the US
- Imposition of restrictions or prohibitions on exports to a violating firm
- Prohibiting correspondent banking privileges
- Imposing primary sanctions, including freezing of all assets
- Seizure and civil forfeiture of cargo
So, a sanctions wargame should consider scenarios that envision a change in international relations that threaten the imposition of any of these potential penalties – not only on the firm, but also on the parties with which it conducts business.
Imagine, for example, that a major client of the firm is headquartered in a country whose relations with the US were in decline, and that the client has close ties with its government. A sanctions wargame could consider two potential risks to the business. First, the scenario would need to quantify the commercial impact, in the event that the client’s business with the firm is significantly impacted by US sanctions actions.
Secondarily, and just as importantly, the wargame would need to consider the regulatory risk exposure of being a supplier to that client, especially if the client decides to continue its actions that the US has singled it out for taking. From there, the firm can both test out responses to these theoretical threats to its business, and can plan ways to identify these risks early, and to minimise such risks (e.g. by minimising client or geographic concentration).
“Would you like to play a game of chess?”
As in the 1983 US movie “WarGames”, a sanctions wargame can’t be all-encompassing and comprehensive. Instead, one identifies a number of discrete flashpoints that pose the potential for commercial risk to one’s business, then executes the simulation for each selected scenario. In general, only scenarios that one determines represent either a higher likelihood of coming to fruition, or a more significant commercial impact if it were to come to pass, are worth the effort of simulating – at that given point in time.
As a risk management tool, gaming out threats to the business as weak signals develop in international relations is a prudent step. After all, one can neither claim ignorance when speaking with regulators – nor when explaining resulting regulatory consequences to one’s shareholders, business partners or other key stakeholders.
It’s also an important strategic planning exercise; regulatory entanglements can be just as disruptive to a company’s bottom line – and its future as a going concern – as other foreseeable changes to the business, such as competitive challenges or technological changes that complicate maintaining a firm’s position in the marketplace. Identifying potential threats to the business in a wargame, and using its results in developing contingency plans, is the smart way to protect the bottom line.
As the famed chemist Louis Pasteur is known to have said, “chance favors the prepared mind.” Running sanctions wargames is a structured way to be prepared rather than leaving things to chance.
Eric A. Sohn, CAMS is global market strategist and product director at Dow Jones Risk & Compliance in New York.
