UK sanctions regime comes under increased SRA scrutiny

With the rapid expansion of the sanctions regime since Russia’s invasion of Ukraine two years ago, sanctions compliance has become a focus of SRA scrutiny.

Why do law firms need to have sanctions controls?

The sanctions regime applies to:

• All law firms and to all types of legal work: even if your area of work falls outside the scope of the Money Laundering Regulations, it is nonetheless subject to the sanctions regime
• Clients, counterparties and third parties (e.g. transferring a payment of damages to a designated person without a licence in place is a breach of the sanctions regime)
• All monies received by a firm, including payment of fees
• Breaching UK sanctions is a criminal offence, punishable by a fine and/or imprisonment.

Outcome of SRA Sanctions Questionnaire

If your firm falls outside the scope of the Money Laundering Regulations, you will have received an SRA questionnaire last May, asking about the firm’s exposure to sanctions risks and its compliance with the UK’s financial sanctions regime.

Of the 3,000 firms that returned the questionnaire:

• Nearly 1,700 were unable to confirm that they identify and verify their clients’ identities, check source of funds, check if a client is subject to sanctions
• More than 1,000 identified a higher risk of acting for a designated person because of the type of services they offered or because they or their clients had links to a sanctioned country

The SRA has this week written to over 1,000 firms they consider to have poor sanctions controls in place, reminding them of the November 2022 Guidance on Complying with the UK Sanctions Regime.

SRA Sanctions Audits

No law firm can afford to be complacent. The SRA has already launched a programme of on-site inspections to test the controls firms have in place to mitigate their sanctions risk and their compliance with the reporting and licensing requirements of the sanctions regime. The regulator has also promised a series of proactive desk-based reviews to test sanctions controls later in 2024.

What do law firms need to do to become compliant?

***Individual and entity checks
As a starting point you need to check clients, counterparties and third parties against the consolidated sanctions list, understanding (where appropriate) who controls them and who owns them. If the level of risk is higher, you will need to go further.

You can carry out basic checks free of charge using the OFSI Consolidated List Search.

Many firms additionally use an electronic verification system which draws on the consolidated list to check identities and carry out sanctions checks on clients and counterparties, and to provide notification of any changes to the list.

If your clients or counterparties are entities, you must also have a robust system for establishing ownership and control.

Where you identify a sanctions risk, check the source of funds/wealth, including for fees.

***Firmwide Sanctions Risk Assessment
The SRA strongly recommends that all firms evaluate their exposure to potential sanctions risks. See our summary of the SRA’s recent guidance below. If your firm is outside the scope of MLR 2017 this will be a new document; if you are within scope you should consider integrating sanctions risks into your AML FWRA.

You can read more about firmwide sanctions risk assessment in our separate article here.

***Sanctions PCPs
Draft and implement policies, controls and procedures to verify the identify clients and counterparties and check them against the OFSI consolidated list, and to ensure correct reporting to OFSI, freezing client assets, or halting client payments.

***Client and Matter Risk Assessment
As with the firmwide risk assessment, this may be a new document for firms outside the scope of MLR2017. If your firm is in scope, you may wish to amend your AML CMRA to record your assessment of sanctions risk for each client and/or matter.

***Ongoing Monitoring
Ensure your PCPs include procedures for ongoing monitoring to ensure sanctions status has not changed.

*** Training
Train all relevant personnel on the firm’s sanctions regime and procedures.

***Reporting Procedures
Establish reporting procedures for increased sanctions risk, with defined decision making. Include sanctions reports as a regular agenda item at Risk Committee and Partners/Board meetings.

***Independent Audit of the firm’s sanctions controls
Consider introducing a regular audit of the firm’s sanctions compliance, with a report and recommendations to senior management.