Increasingly aggressive US sanctions policies highlight the need for financial institutions to adopt and implement a sophisticated risk-based approach to compliance.
In recent years, policymakers in the US, the EU, and elsewhere have expanded the use of targeted economic sanctions to achieve foreign policy and economic objectives. Such measures often impact entities that are highly integrated in the global economy, while also introducing uncertainty and potential reputational and economic harm for non-sanctioned entities – particularly financial institutions.
Without proper controls in place, a financial institution risks breaching its sanctions obligations when any new individual or entity is “designated” and placed on a sanctions list. With the threat of heavy penalties for non-compliance, and new sanctions often being imposed with little forewarning, it is incumbent upon financial institutions to ensure their clients are not engaged in or facilitating business with sanctioned entities.
On 10 January, the White House issued an executive order imposing sanctions on Iran’s construction, mining, manufacturing, and textiles sectors. A 90-day wind-down period was announced, but not until the following week.
The order also authorised the use of secondary sanctions against foreign financial institutions that engage in certain transactions connected to the four newly-covered sectors, whereby the Treasury Department may:
“prohibit the opening, and prohibit or impose strict conditions on the maintaining, in the United States of a correspondent account or a payable-through account by such foreign financial institution.”
On the same day, the Treasury’s Office of Foreign Assets Control (OFAC), designated 17 Iranian metals producers and mining companies, and specifically named a network of three China- and Seychelles-based entities for their involvement in Iran’s metals sectors.
Then on 23 January, secondary sanctions were imposed on six more companies based in Hong Kong, China and Dubai for transactions involving Iran’s petrochemical and petroleum sectors.
Designed to frighten
“These sanctions are designed to frighten any bank,” a senior banker told Regulation Asia on the condition of anonymity. “One possible consequence of breaching sanctions is that a bank can lose its ability to conduct business in US dollars, which can make life very difficult. A cost-benefit analysis would always be in favour of doing US dollar business.”
Even if you conduct business in other currencies like the euro, Swiss franc or Chinese yuan, from a bank’s point of view, US authorities can still say you are facilitating the breaking of sanctions, he said.
“It’s just not worthwhile for a bank to touch this type of business due to the amount of money they can lose if US authorities turn their gaze on you. Besides the potential for secondary sanctions or other forms of penalties, there is always the risk that the US will pressure the bank or its US dollar or US branch network in other ways.”
In addition, the senior banker highlighted difficulties for banks that are engaged to conduct bond business in non-US dollar currencies, for example, if an Iranian company that has outstanding Eurobonds.
“Paying agents, trustees, legal advisers and custodians will all run for cover if there is any sanctions sensitivity. Even settlement systems – such as Euroclear and Clearstream – will first ask OFAC what they can and cannot do,” the senior banker said.
While there may still be ongoing business between Iran and places like Dubai or Abu Dhabi, banks across Europe and Asia – even banks in Russia and China – don’t want to take the risk, he added.
Not as easy as it used to be
The fact that Russian and Chinese banks today will not break US sanctions is another sign of their far-reaching impacts. In both countries, specialised institutions have been set up to handle transactions that could potentially violate sanctions, shielding other banks from possible penalties.
Take for example, Bank of Kunlun, China’s main bank for processing billions of dollars in oil payments to Iran. The US Treasury sanctioned Kunlun in 2012, barring it from directly accessing the US financial system, but the bank continued its Iran business using the yuan and euro for its transactions.
However, when the US reinstated oil sanctions in May 2018, it prompted Kunlun to suspend both euro- and yuan-denominated payments from Iran later in the year. Chinese state refiners that had been using Kunlun to channel nearly all of their payments for Iranian oil also scaled back their purchases to comply with US sanctions.
Kunlun worked to resume oil imports to China, and in July 2019 launched operations in Iran, saying it would use only the yuan to conduct its banking transactions, only cooperate with non-sanctioned Iranian banks for transactions, and only deal in payments related to non-sanctioned goods.
Then in September, the US imposed penalties on a handful of Chinese shipping companies for continuing to carry Iranian oil after sanctions waivers had lapsed. In addition, a blacklisted Chinese oil tanker owned by Kunlun’s sister shipping company was seized by Singapore port authorities while carrying petroleum products from Iran to China.
Following these incidents, a member of the Iran-China Chamber of Commerce, Mohammad Reza Hariri, said Bank of Kunlun had officially informed Iran that it would never involve itself in deals against US sanctions, adding:
“Many ways used by Iran to skip the sanctions have been revealed, even by ourselves. Therefore, bypassing the sanctions is not as easy as it used to be.”
High cost, long-term impacts
Almost seven years after Bank of Kunlun was sanctioned, US financial institutions are still prohibited from opening or maintaining a correspondent account or a payable-through account with the bank, illustrating the long-term impacts and costs of breaching US sanctions.
It is worth noting that the restrictions against Kunlun were imposed despite the lack of any transactions involving US parties or the US dollar. Over the years, a number of Asian firms have had similar restrictions imposed by the US Treasury – including Macau-based Banco Delta Asia (since 2007) and China-based Bank of Dandong (since 2017).
Meanwhile, global banking giant HSBC is still dealing with fallout from its 2012 deferred prosecution agreement with the US Department of Justice – which included penalties for Iran-linked transactions. Though it was released from the threat of further penalties in December 2017, the bank has reportedly spent more than USD 1 billion a year upgrading its compliance systems.
More recently, Standard Chartered Bank was ordered in April 2019 to pay over USD 1 billion to US and UK authorities. But the bank is still facing a lawsuit from whistleblowers, who allege the bank concealed the full extent of its Iran dealings. The lawsuit was filed in the Southern District Court of New York on 23 December 2019.
Risk-based approach
The long-term impacts of sanctions breaches highlight the need for financial institutions to adopt and implement a sophisticated “risk-based” approach to sanctions screening to ensure compliance, says Phillip Malcolm, Regional Performance Director for APAC at Refinitiv.
“This means they should carry out an assessment in order to be able to understand which parts of their business carry greater exposure to sanctions risk and focus enhanced counterparty diligence and screening exercises on those areas,” he explains.
Not only do financial institutions have to ensure they are not doing business with designated persons, or entities they own or control, additional due diligence measures need to be taken to address third-party risk, i.e. the risk that a third party with which it does business is diverting its products or services to such persons and entities.
But, according to Malcolm, screening is only as good as the inputted data, and financial institutions with data gaps or inconsistencies need to focus their short-term efforts on ensuring a complete and coherent data.
He says:
“This will reduce the risk of missing a potential match during the screening process and identifying large numbers of ‘false positives’, but it is also important to consider ‘fuzzy matching’ to identify non-exact matches, because sanctioned individuals will often alter the spelling of their name or other details to obscure their identities.”
When implementing a comprehensive sanctions screening policy, financial institutions also need to consider who reviews potential screening matches, what training they have, and how sanctions hits are escalated within the organisation, Malcolm says.
This is especially the case given the strict legal liability nature of sanctions offences and zero tolerance approach taken by authorities and enforcement agencies, he adds.
“Implementation short cuts are not worth the risk.”
For more information on navigating the shifting sanctions landscape in 2020, register here for this webinar.
This article was jointly produced by Regulation Asia and Refinitiv.
