The concept of voluntarily self-disclosing sanctions violations is somewhat counterintuitive because it does not comport with our everyday notions of law enforcement.  When people do things they are not supposed to do, they usually do not volunteer that information to the government agency responsible for punishing such misconduct. The general view in the United States and the United Kingdom is that it is up to police to identify legal violations and prosecutors to prove their cases. For instance, people who speed while driving typically do not alert the police of their transgression, just as employees who arrive late for work generally do not report their tardiness to the boss.

Nevertheless, voluntary self-disclosures sometimes (but not always) make sense when companies violate U.S. or UK economic sanctions. Unlike speeding or arriving late for work—activities that can have immediate repercussions—companies do not know if they have “gotten away” with committing a sanctions violation for an extended period of time. The statute of limitations for sanctions violations is five years in the United States, and sanctions enforcement actions are not time barred at all in the United Kingdom. In addition, if a company does not voluntarily self-disclose a violation, a third party or internal whistleblower very well might report the unlawful conduct to the government.  In fact, in some instances, third parties are required by law to disclose sanctions violations; in other circumstances, parties elect to do so to curry favor with government regulators.

But the single most important factors that leads parties to self-report are the sanctions penalty regimes. The consequences of violating U.S. or UK sanctions can be very severe, and government agencies in the United States and United Kingdom have developed systems that create strong incentives for parties to self-report. Indeed, parties that submit voluntary self-disclosures can mitigate their potential liability—and sometimes avoid paying fines altogether.

Potential Sanctions Penalties

Sanctions violators face civil fines and criminal penalties under both UK and U.S. law. The civil fines in the United Kingdom max out at the greater of £1 million or 50 percent of the value of the funds or resources, while largest penalties that can be imposed in the United States are the greater of $284,582 per violation or twice the value of the impermissible transaction. In the United Kingdom, violators can incur unlimited criminal penalties as well as prison sentences of up to seven years. Persons who commit criminal sanctions violations can incur penalties up to $1 million per violation under U.S. law, and individuals can face prison sentences of up to 20 years.

Sanctions penalties are calculated on a per violation basis, and parties that run afoul of UK and U.S. sanctions rarely commit a single violation. For instance, a company that improperly has sold products to a sanctioned Iranian counterparty often will have engaged in several transactions, each of which could constitute a separate violation (e.g., multiple shipments of products to Iran, multiple financial transactions connected to those shipments, and various post-sale servicing and support for the exported products).  As a result, the potential penalties associated with sanctions violations can add up quickly.

United Kingdom's Voluntary Self-Disclosure Regime

OFSI Voluntary Self-Disclosures

Established in March 2016, OFSI was initially tasked with administration of the UK sanctions regime. OFSI's powers were significantly expanded in April 2017 when it obtained the authority to impose civil monetary penalties. OFSI does not have the power to bring criminal charges against parties, but it can refer criminal violations to other enforcement agencies.

After discovering a sanctions violation and electing to bring a civil enforcement action, OFSI first calculates the statutory maximum penalty. OFSI will then assess a penalty that is “reasonable” and “proportionate” in the circumstances. A penalty is “reasonable” if an “ordinary” person “would regard the proposed penalty as appropriate to the offence,” while a “proportionate” penalty indicates there is “clear relationship between the value of the proposed penalty and both the value of the breach (if known) and how seriously the breach undermined the sanctions regime.” Through these steps, OFSI calculates a baseline penalty.

OFSI can further adjust the baseline penalty through application of a penalty matrix. The matrix mandates that OFSI will reduce the baseline penalty amount for parties that voluntarily self-disclose sanctions violations. Parties that self-report “serious” violations can receive a voluntary disclosure reduction of up to 50 percent. The potential reduction for the “most serious” sanctions violations is more limited, with self-reporting parties receiving a maximum discount of 30 percent off the baseline penalty.

Through published guidance, OFSI has explained that it believes that EU regulations require all natural and legal persons to report if they have a customer or client who is a designated person; become aware of suspected sanctions “offences” (e.g., circumventing sanctions, breaching license conditions, making funds available to a designated person, etc.); frozen funds or economic resources of a designated person; or credited the frozen account of a designated person. UK law does not yet mandate penalties for nonrelevant institutions, businesses, and professions that fail to report such offenses, but the recently published Sanctions and Anti-Money Laundering Bill indicates that the UK government intends to extend the criminal offense of not reporting sanctions violations to all natural and legal persons in the future.

In addition to the general reporting requirement, so-called “relevant institutions” are already subject to affirmative disclosure obligations for reporting designated persons and offenses relating to the breach of asset freeze restrictions. The failure of these regulated entities to disclose suspected breaches is itself a criminal violation of UK law. In August 2017, these mandatory reporting obligations were extended to apply to “relevant businesses or professions,” which include auditors, accountants, independent legal professionals, and tax advisers.

OFSI has not yet imposed civil penalties on any sanctions violators. As a result, the circumstances in which OFSI will award credit to parties for self-disclosing are not well defined. For example, it remains unclear whether a nonrelevant institution will receive credit for disclosing that it committed a sanctions “offence.” OFSI guidance indicates that self-reporting in such circumstances is compulsory, but also has advised that parties will be rewarded for disclosing violations.

UK Criminal Sanctions Violations

The UK has not established a system outside of OFSI through which parties can report criminal sanctions violations.  Instead, parties can simply voluntarily self-disclose such violations to OFSI. Companies that do so expect to receive some credit from the presiding judge, but the UK government has not established a formal system for recommending penalty reductions attributable to self-reporting in the criminal context.

Part Two of this article will examine the sanctions self-reporting regime in the United States.

Matt Bell is the chief compliance officer and legal counsel for ZTE USA. Mike Casey is a partner in the London office of Kirkland & Ellis. Both Bell and Casey advise companies throughout the world on sanctions issues.