Guidance

Complying with the UK Sanctions Regime

Updated 5 August 2024 (Date first published: 28 November 2022)

Summary of changes

This guidance was first published on 28 November 2022. This version provides updates based on legislative changes and our more recent proactive supervision. The major changes from our previous version are as follows:

References to the newness of the sanctions regime have been updated throughout to reflect its more established status.
The document has been restructured to move key information relevant to all firms to the top, followed by specific guidance for firms operating under the sanctions regime.
Additional feedback showcasing good practices from recent sanctions inspections has been incorporated throughout.
Controls for all firms: A new case study has been added to illustrate how firms may inadvertently become involved in the sanctions regime.
Red flags for attempted circumvention of the sanctions regime: Updated red flags now include self-reporting responsibilities and the need to screen staff during onboarding.
Reporting requirements: These have been clarified, and a new section has been added on when you must report to us.
Licensing: Further clarification on staying compliant with licence responsibilities has been provided.
Other resources: We have updated links to external information.

Status

This guidance is to help you understand your obligations and how to comply with them. We will have regard to it when exercising our regulatory functions.

Who is this guidance for?

All SRA-regulated firms, solicitors, registered European lawyers and registered foreign lawyers.

Purpose of this guidance

To help you understand the UK Sanctions Regime, and our expectations for how you comply with it.

Introduction

This guidance explains our expectations and provides practical advice to firms on avoiding breaches of the UK's sanctions regime, and to firms that wish to work within it, for example, those providing services under a licence from the Office of Financial Sanctions Implementation (OFSI) or the Office of Trade Sanctions Implementation (OTSI), which is a part of the Department for Business and Trade. This is distinct from our separate SRA disciplinary sanctions policy.

All firms are subject to the sanctions regime, regardless of the types of services they offer.

We recognise the challenges presented by the sanctions regime and want to help firms to get this right, while acknowledging that the risks are significant.

Working within the sanctions regime is complex and challenging, and firms should not seek to provide these services without first gaining the necessary expertise to do so correctly.

It is also important to note that the sanctions regime spans many separate pieces of legislation. This guidance will speak about the regime in general terms, but it is not a substitute for reviewing the legislation that is specifically relevant to your scenario. We may take enforcement action where firms and individuals breach our Standards and Regulations as a result of failing to comply with the regime.

We use the term 'should' throughout this guidance to express our expectations of firms. Where firms do not follow this guidance, it may be considered as an aggravating factor in any enforcement action taken if the firm breaches the sanctions regime.

Nothing in this guidance should be interpreted as:

legal advice
advice not to grant representation
advice not to facilitate access to justice to any person, whether a designated person or otherwise.

What are sanctions?

Sanctions are restrictive measures imposed by HM Government to achieve a specific foreign policy or national security objective. HM Government has released its strategy for utilising sanctions to tackle global threats, advance international norms, and safeguard the UK's interests.

A breach of UK sanctions is a criminal offence and is punishable by a fine and/or imprisonment.

The UK may impose the following types of sanctions measures:

financial sanctions, including asset freezes, administered by OFSI
trade sanctions, including arms embargoes and other trade restrictions, administered by the Office for Trade Sanctions Implementation (OTSI)
immigration sanctions, barring entry to the country, administered by the Home Office
transport sanctions (divided into aircraft and shipping sanctions), including de-registering or controlling the movement of aircraft and ships, often preventing them from docking in UK ports or landing in UK airports, administered by the Department for Transport (DfT).

Sanctioned individuals, entities, aeroplanes or ships are referred to as 'designated persons.' This guidance is primarily focused on the financial sanctions regime (which aims to prevent money flows to and from designated persons), although it does in places address some of the other kinds of sanctions too.

HM Government's main page on sanctions includes contact details for the relevant departments that administer each of the non-financial regimes (these are explained in more detail below), and signposts where to go to submit a licence application for exceptions to these regimes.

Though unusual, there are some sanctions relating to whole jurisdictions. For example, legislation introduced in July 2022 made it illegal to provide some services to clients in Russia. However, more frequently, sanctions will relate to a list of individuals, entities, ships or aeroplanes. These lists are often titled as being related to a given jurisdiction.

It is important to understand, for example, that just because there is a sanctions regime for Yemen, this does not mean that all Yemeni people and entities are subject to sanctions.

It also does not mean that sanctions regimes cannot relate to individuals who live in or are from the UK. For example, sanctions under the Islamic State/Da'esh regime have resulted in a number of UK nationals becoming designated persons as they were explicitly named on the sanctions list.

The financial sanctions regime is rooted in several pieces of legislation, including the Sanctions and Anti-Money Laundering Act 2018 (SAMLA), which allows HM Government to amend the regime via secondary legislation. HM Government has used these powers multiple times.

Why do I need to know about sanctions?

Generally speaking, you must not undertake paid work for a designated person unless you have been granted a licence to do so by the relevant government body or are doing so under the terms of a general licence. Unpaid work may be allowable where it does not circumvent the sanctions regime or provide financial advantage to the designated person.

Most firms need to know about the sanctions regime to the point of being able to make sure they avoid unwittingly providing services or funds to a designated person, or in any other way breaching the legislation and fulfilling the associated reporting obligations (more detail is provided on these below). This duty is still a very challenging one, in part because the number of designated persons and the prohibitions they are subject to has expanded at a rapid pace and keeping up with the pace of change is demanding.

Sanctions are relevant for all areas of legal service and so firms in and outside of scope of the anti-money laundering (AML) regime should already be undertaking rigorous checks on their clients. However, challenges include the fact that a given entity or individual may be subject to multiple different sanctions simultaneously (for example financial sanctions and immigration sanctions), each of which may need to be considered in their own right.

It is important that you carry out thorough due diligence checks to identify whether a person (whether natural or legal) is designated. When dealing with a non-natural person, to understand whether they are impacted by the sanctions regime you will also have to consider any counterparties, beneficial owners or individuals with possible control of the entity. When providing services to another firm, where they are seeking your services on behalf of their client, you may also need to consider whether this underlying client is a designated person, and the origin and destination of funds via your firm's client or office accounts.

OFSI will consider whether the level of due diligence conducted was appropriate to the degree of sanctions risk and nature of the transaction. While due diligence is not a defence to a prosecution for breach of sanctions, it minimises the risk of inadvertently committing an offence. Further, we would consider the extent to which due diligence was carried out when considering what disciplinary action (if any) to take.

Below is a non-exhaustive list of less direct ways you might encounter a designated person:

You might be instructed to act on behalf of an entity that is not itself a designated person but is owned or controlled by a designated person.
You might receive payment from a counterparty or third party which is a designated person or owned or controlled by one.
You might be instructed to act on behalf of a trust where a settlor, trustee or beneficiary is a designated person.
You might encounter a request for a renewal of a visa where the client may be subject to a travel ban.
You might be instructed to advise clients on trade licences or export controls.
Firms that specialise in shipping and aviation might be instructed to act where transport sanctions may be in place.

For firms that choose to work in the area of sanctions (for example providing litigation services to designated persons), it is important to recognise that sanctions are a niche, complex and fast-changing area of practice, spanning multiple regimes and many individual pieces of legislation. This is specialised work and requires vigilance as well as expertise. The prohibitions and possible exceptions to each regime are set out in the relevant piece of legislation for that regime and you should consider these carefully before providing legal services to a designated person. They may vary from one regime to another so checking and understanding the relevant legislation in each case is important.

As lawyers, you should act in a way that upholds the integrity of the regime and be vigilant to whether your clients are subject to the sanctions regime, whether directly or indirectly. Firms should seriously consider the risks and how they will address them before offering any services in this area.

Controls for all firms

In order to make sure you are complying with the sanctions regime, you should understand who your clients are, who they are owned/controlled by, and potentially the counterparties and any third parties providing funding. Counter-parties and third parties present a risk because if they are designated persons, or are owned or controlled by designated persons, the funds they introduce into a transaction may need to be frozen and made unavailable to, or for the benefit of, the designated person.

You cannot rely on other parties to assure you they are not designated persons. At the most basic level you should check the identities of clients (and for non-natural persons anyone with control over the entity or at least a 50 per cent stake) and counterparties against the UK consolidated sanctions list. This can be done either:

with digital screening tools that check against the list (see below for more information on these) or
by using HM Government's free screening platform. The official screening platform can apply 'fuzzy logic', i.e. it can find a partial as well as an exact match. This can be important where individuals may have multiple components to their name, alternative spellings, or alternative names/aliases.

Designated persons may seek to hide or misrepresent their identity to circumvent the sanctions regime. This is why it is generally not enough to take a client's identity at their word without further checking. Similarly, it is why you cannot assume that a non-natural person does not have links of ownership or control with a designated person.

So, to have confidence in the conclusions of due diligence, you need to be able to answer the question of 'who' but also the more challenging questions of 'how' and 'why' in relation to the matter. This is because as well as simply checking names against the sanctions list, you will need to consider the possibility that a designated person is exercising control over the individual or entity that is your client or the transaction counterparty.

You should not accept money from a client until you have completed your due diligence. It is up to you to determine your risk level and how best to comply with the financial sanctions regime. The following are features of an effective sanctions compliance regime:

An assessment of the sanctions risks to which the firm may be exposed, for example, which work areas or client groups are most likely to result in a sanctions breach and how can the firm mitigate these risks (with reference to our section on sanctions risk in this guidance) and what is the firms exposure to other jurisdictions.
A written and implemented set of policies, controls, and procedures to identify all clients and counter parties, and to verify their identities using independent materials (for example, passports or other equivalent documentation). Where the client is not a natural person, this applies to ultimate beneficial owners of the client or individuals exerting ultimate control of the entity.
A record of your assessment of sanctions risk for each client and/or matter which identifies any indicators of higher sanctions risk. This should determine how much work will need to be done to assess and verify the background of the client including appropriate checks as to where they have derived their wealth and relevant jurisdictions.
A documented and implemented policy and procedure to monitor clients on an ongoing basis to ensure their sanctions status has not changed after they were originally screened for example after changes to the sanctions list, or after a significant period of time has passed such as a year.
Training on the sanctions regime and related internal compliance procedures for relevant staff including subscribing to the alerts HM Treasury issues on changes to the regime.
Regular reports to senior management on the sanctions risks and performance of the controls in the firm including making sure they take decisions about work involving designated persons.
A form of regular (for example annually) independent (whether internal or external) audit of the firm's compliance regime. This should include reviews of the firm's risk assessment, policies, controls, procedures and training with the results and recommendations reported to senior management and acted upon.
Written controls and protocols on what to do if you identify a designated person or likely designated person to make sure correct reporting to the relevant government authority, freezing of any client assets held and placing a halt on taking any payment from them.
A process, possibly involving named senior staff, for making decisions as to whether to act if sanctions are involved.
Undertaking sanctions screening as part of your staff onboarding procedures. This could be done alongside criminal records checks, background checks, references etc.
Self-reporting breaches of the sanctions regime to us. Our reporting and notification guidance gives further information on solicitors' wider obligations to report serious breaches of regulatory arrangements to us under paragraphs 3.9 of our Code of Conduct for individuals and 7.7 of our Code of Conduct for firms.

Doing due diligence on non-natural persons and counterparties is more difficult than on natural persons that are your client, because it can be more challenging to get behind the legal structures and/or to access the information you need to assure yourself that you understand the beneficial ownership and the background of the matter. Trying to decide the depth of checks for each client and counterparty is one of the key challenges.

There is a duty under Code of Conduct for Solicitors Rule 8.1 and in the AML legislation to establish and verify the identities of clients. Many of the obvious routes to doing this are the same (for example, checking identity against photo identity documents, using digital identification and verification tools, and checking source of funds/wealth).

The sanctions regime, however, applies not only to clients. Firms may breach the regime by transferring assets to third parties or counterparties, for example, in the form of damages, compensation, or payments under a trust or a will.

You should ensure that your staff know how to establish whether a client or third party is a designated person, and what to do if they find this is the case. We recommend that you have an established reporting process so that the relevant people within the firm (for example, the COLP) are aware as early as possible and can react accordingly and swiftly.

Making sure there are not designated persons sitting behind anonymising legal structures is one of the key challenges of sanctions compliance.

For firms with an AML compliance regime, a way of achieving a good standard of sanctions controls might be identifying and verifying all clients (whether in scope of AML or not) to the standard required by the money laundering regulations, and then checking against the sanctions list. Note however that the standard definition of whether an individual exerts 'control' over an entity within the meaning of the sanctions regime, is a subtly different test to whether an individual is a 'beneficial owner' of an entity in the money laundering regulations.

AML beneficial ownership is triggered where an individual owns 25 per cent or more of the shares of a body corporate under the money laundering regulations, whereas the shareholding trigger in UK sanctions regimes is commonly 50 per cent share ownership though there are several other ways that an individual may have or exert control, independent of their shareholding.

Firms that do not work within an AML compliance regime, may find it more difficult to implement this kind of compliance framework, in part, because it can mean challenging prospective clients to provide information to prove their identity and status.

It is more difficult to end a client relationship once you have onboarded them. A prudent step may be to include 'becoming a designated person' as a valid reason in your terms of business or equivalent for ending the business relationship and ceasing to provide services. Firms that receive referrals of work, should run their own client checks before providing services. Relying on others to do your checks for you, exposes you to significant risk and you remain accountable for compliance with the due diligence requirements as well as carrying liability for any breach of the sanctions regime.

One helpful control - used to good effect in AML - is direct sign off by senior management to onboard higher risk clients or matters. This should be accompanied by increased monitoring of these clients and matters throughout the life of the work. Increased scrutiny around movement or release of funds is also important. Appropriate high-risk flags should be added via the case management system used by the firm, so the higher risk is visible to all that work at the firm.

When encountering state-owned entities of a jurisdiction where the premier or other senior politicians are designated persons, you should consider whether these politicians exercise control over these state-owned entities. 'Control' is defined in the OFSI/OTSI guidance as including 'when it is reasonable to expect that the sanctioned person would be able to ensure the affairs of the entity are conducted in accordance with the [sanctioned] person's wishes.' In effect this can mean that any such state-owned entity of such a jurisdiction may effectively be subject to sanctions.

When sanctions change, you should consider doing a recheck of all clients and related parties (beneficial owners and counterparties) and re-examine all money (including money for fees or disbursements) held across accounts where sanctions status might have changed, or risk has increased. Signing up for OFSI/OTSI's alerts will help you keep on top of this.

Below are examples highlighting the importance of regularly reviewing your clients and related counterparties:

An online firm specialising in debt recovery received funds from a counterparty who was later designated as a sanctioned entity shortly after the payment was made.
A large LLP with a policy against representing designated persons found itself in a situation where a trustee of one of their charity clients became designated midway through a case.

These scenarios demonstrate situations where firms, though typically not involved in activities falling under the sanctions regime, must still comply with its requirements due to changes in the status of their clients and counterparties. It underscores the necessity for firms to maintain a comprehensive understanding of both their counterparties and clients, including their ownership structures.

Red flags for attempted circumvention of the sanctions regime

The below is not an exhaustive list. Many of these are also red flags for AML purposes. Where you encounter such a red flag, you should increase your efforts to understand if there is a legitimate reason for the occurrence of the flag. You should also consider whether the presence of a red flag requires your firm to make a report to OFSI/OTSI and/or to exit the client relationship.

Relevant red flags are:

The transaction is unusual, opaque, complicated, or particularly large.
A client is aggressive or in some way resistant to the application of controls.
There is no obvious reason for the matter and in particular for the involvement of a specific jurisdiction – this can be particularly important for trade, aeroplane and shipping sanctions given their often-international scope.
Trade routes that involve high-risk countries known for facilitating illicit activities or having weak regulatory frameworks.
A client or counterparty changes their name by deed poll without a reasonable explanation such as marriage, end of a marriage or change in gender and/or sexual identity.
Use of newly opened accounts, or entities in a transaction that do not make sense in the context of the matter.
Indications of sham litigation (ie manufactured disputes where the transfer of assets is facilitated by settlement) are present for example:
- known jurisdictions where this has happened before (for example Moldova) the dispute not making sense
- the dispute being resolved without apparent conferral between the parties.
Due diligence has not been renewed and/or the client is resistant to refreshing it.
Restructuring without a clear business rationale – (structure, assets, name).
Use of corporate vehicles to obscure ownership, source of funds and jurisdictions involved for example shell companies.
Involvement of third parties (for example providing payments) which could hide designated persons.

While not red flags in their own right, when combined with other red flags, or higher-risk indicators, the following characteristics will likely exacerbate existing risks:

Newly established companies.
Setting up trusts in the names of children and subsequent transfer of property.
Anomalies in the volume, frequency, or timing of gold transactions
Instances where oil transactions involve sanctioned entities or jurisdictions not compliant with international sanctions regimes

What do I do if my client has been sanctioned?

Sanctions can be brought in quickly and without warning. This can lead to situations where a current client may become designated, without the possibility of terminating the retainer beforehand. This can also happen in the middle of a sensitive or time-critical matter. You should firstly check whether there is a general licence in place that covers the ongoing work. Be aware that, even if there is, some considerations below such as reporting to OFSI/OTSI still apply.

If there is not a general licence in place, there are several things you will need to do immediately:

Make a report to the relevant authority that you have a client who is a designated person.
Immediately suspend work done for the designated person and communicate clearly to them the reason why. You should then establish whether you are able to continue work under the applicable sanctions regime. Most regimes permit work to continue on an unpaid basis, but some prevent all services regardless of remuneration.
Take steps to ensure that your firm will not make any transfers of their client funds, for example confirm this with your compliance officer for finance and administration (COFA) and communicate to all staff and ensure unauthorised staff cannot unblock access to frozen accounts/assets. These must remain frozen unless and until a licence has been granted.
If the client already has your client account details, communicate clearly to them that they must not send you any funds until further notice.
Engage with your bank and insurers to see whether they will continue to provide services in this instance.
Consider the risk of continuing your relationship with the client, for example reputational and regulatory risk as well as the risk that your firm may ultimately not be paid for work done (without a licence from the relevant government department and willing participation by your bank).

A different scenario is where the kind of work you are carrying out for your client becomes prohibited. Like your client being directly sanctioned, this might happen quickly and without warning. The same considerations apply, although if you hold funds for your client these would not necessarily be frozen if the client is not subject to sanctions. Nonetheless, you should establish the position before remitting funds to the client or third parties.

Once you have taken these steps, you can consider whether you wish to request either guidance from the relevant government authority as to how to proceed or a licence to act for the designated person. You should make sure any relevant interest is being correctly applied to any frozen accounts, and manage client expectations regarding timescales.

Similarly, the treatment of interest on frozen accounts may differ between regimes, so make sure that you are treating it in the correct way.

Any further funds that may come from designated persons must be frozen.

If you do need to stop work on a client's file while you seek a licence to continue, you can be transparent with them about the reason why. In contrast to the Proceeds of Crime Act 2002, there is no 'tipping off' offence.

Where you do not have a licence, whether general or specific, to continue to act for the designated person, you must not:

act for them in any a way that might circumvent the sanctions regime
accept payment for work done
carry out certain types of work, even on an unpaid basis.

Where you are owed payment by a designated person and do not have or do not expect to receive a licence, you should avoid writing-off the money owed, as this may amount to providing a financial advantage to the designated person. Instead, you will need to retain the debt. It is important to note that writing off non-payment as a bad or uncollectable debt would likely require a licence.

Retaining funds which are frozen under the sanctions regime is a proper reason to hold them under Rule 2.5 and therefore would not breach your obligations under the Accounts Rules.

In addition, the requirements of the sanctions regime take precedence over the Accounts Rules. The SRA Principles state that: 'Should the Principles come into conflict, those which safeguard the wider public interest (such as the rule of law, and public confidence in a trustworthy solicitors' profession and a safe and effective market for regulated legal services) take precedence over an individual client's interests.'

In these circumstances you will need to apply for a specific licence from OFSI in order transfer the funds or write-off the debt.

What to do if the counterparty or third party has been sanctioned?

If you are acting in a matter where you become aware that the counterparty or a third party has been sanctioned, similar concerns apply. You cannot simply assume that this is a problem for the other party and their lawyer, or that they have necessary licences in place.

In particular, a court order or award, an undertaking or a contractual obligation do not of themselves overrule the sanctions regime. You would still need to obtain a licence, for example, to pay an award of damages directly to a designated person.

Payment to a designated person's UK-based lawyers would not generally breach the sanctions regime, provided that this did not have the effect of circumventing sanctions. If the lawyer was based in another jurisdiction, you should seek advice.

Differences to the AML regime

Sanctions compliance and AML are often mentioned alongside each other and often the same individuals in a firm may have responsibility for ensuring compliance with both regimes. It is important, though, to understand the differences between the sanctions and AML regimes, though the below is not an exhaustive list:

Sanctions	AML
Applies to all authorised firms.	Applies only to those firms that provide services in scope of the AML regulations.
Applies to payments for legal and other services as well as clients' assets.	Generally, only applies to clients' assets rather than payments for legal services, as long as the payment is 'adequate consideration'.
Legislation does not prescribe how compliance must be achieved, only that it must be.	Legislation sets out a mandatory framework for compliance, including requirements for firm wide risk assessments, customer due diligence, enhanced customer due diligence etc.
Strict liability on behalf of the firm for their duty to comply.	Generally, firms must take a risk-based approach, so as long as all the mandatory steps are taken, and the approach is appropriately informed by risk and their supervisor's guidance – firms may be able to avoid legal liability for breach even if money laundering has occurred.
You must make a report to the relevant authority when you know or suspect that: a breach of the sanctions has occurred that a person is a designated person you hold frozen assets and that knowledge or suspicion came to you in the course of business.	You must make a suspicious activity report (SAR) where you know or suspect that you have encountered the proceeds of crime. This generally does not apply to fees paid for legal services, as long as they are 'adequate consideration', i.e. proportionate to the services provided.
You cannot outsource your liability for complying with the sanctions requirements to anyone else, for example, by relying on a report by an e-verification provider.	In some defined instances you may be able to rely on another regulated firm to check your clients on your behalf, though this comes with conditions.
Control of an entity is ordinarily defined as: The person holds (directly or indirectly) more than 50 per cent of the shares or voting rights in an entity. The person has the right (directly or indirectly) to appoint or remove a majority of the board of directors of the entity. It is reasonable to expect that the person would be able to ensure the affairs of the entity are conducted in accordance with the person's wishes (further examples of this available in 4.1 of OFSI guidance). The breadth of this definition means that the task of establishing control is one of the key issues in completing due diligence in relation to sanctions.	Regulations 5 and 6 of The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 set out the definition of a 'beneficial owner.' This definition includes 25 per cent share ownership of a body corporate (or direct/indirect control of said shares) but also has other interpretations detailed in the legislation (for example for partnerships).

Two key questions are common across AML and sanctions regimes, namely:

Are you sure all parties are who they say they are?
Does the client/matter make sense?

If you cannot say 'yes' to both, you should continue asking questions and digging into the details until you understand what is happening and why.

Controls for firms offering services to designated persons

Intentionally offering services in the area of sanctions is high-risk work. As well as the risks of not fulfilling the strict and frequently changing requirements of each sanctions regime, there are also reputational and financial risks which you should identify and mitigate. You should bear in mind that payment for services to designated persons may not be possible unless facilitated by a licence, and even then, your bank may choose to refuse to facilitate the transaction. The controls in this section are particularly aimed at firms operating either in the area of sanctions (for example litigation services or sanctions advice) or in areas at particularly high risk of encountering a designated person.

For these firms the key control is limiting exposure to sanctions work to only those with the requisite experience and skills.

An extension of this is clear lines of communication between those with sanctions expertise with those that control the firm's finances so that frozen funds (i.e. funds that cannot be used or moved due to being owned by a designated person) are locked down, until licences are granted by the relevant government department, or the client has their designated person status rescinded, i.e. they are no longer sanctioned.

Many aspects of the various sanctions regimes span multiple pieces of legislation which have not been tested in the courts. Where appropriate it may be useful to obtain independent specialist advice on any sanctions work you do.

Another useful control is to create a central inbox for sanctions-based queries within the firm. This creates a single point of contact for sanctions related issues, but also allows the inbox to serve as a repository of answered questions for the future which can also assist when reviewing or auditing the work of the practice.

In our observations of firms operating under the sanctions regime, we have noticed several effective practices. Firms are forming sanctions committees with experts in sanctions, compliance, and finance. These committees oversee all sanction-related matters, ensuring better control over payments, license compliance, applications, and reporting. Additionally, best practices involve exceeding enhanced due diligence, conducting separate risk assessments for sanctions, integrating policies, and training staff on applying the sanctions regime.

We have recognised that keeping the finance team informed and engaged is a critical control. The main concern revolves around changes in general license conditions, with the most frequent breach being failure to adhere to updated reporting deadlines.

Ceasing to act

Even if a client is not on the sanctions list, firms should keep their client lists under review and be considering who they feel comfortable acting for on an ongoing basis. Firms deciding who they act for is unlikely to be a regulatory matter. Firms can choose who they act for and can choose not to act for any lawful reason.

Whether a retainer has been properly terminated is addressed by the common law, and usually turns on whether there is a 'good reason' for the termination (Buxton v Mills-Owens [2010] EWCA Civ 122).

Whether there is a 'good reason' for terminating a client retainer will be determined by the individual facts of the scenario. Either way, from a regulatory point of view, our concern is to make sure that the firm has both carefully considered the legal position and also understood and mitigated any risks to the client so far as they are able to do so.

The situation may be more difficult if a person is designated part-way through ongoing litigation. If this occurs, you should be open with the court and opposing party as soon as possible and keep them informed promptly of any developments that may influence the progression of the matter as you become aware of them. Any subsequent billing will need to be facilitated by an appropriate licence.

If your firm has decided what you would and would not do in various circumstances, you should consider adding this to your terms of business, allowing you to point to these should you need to cease acting for a client in relation to their sanctions risk or because they are a designated person.

Reporting requirements

The sanctions and AML regimes include different and separate reporting requirements. Just because you have made a suspicious activity report (SAR) to the National Crime Agency (NCA), does not absolve you of the duty to report a sanctions breach (or designated person or frozen asset) to OFSI/OTSI and vice versa.

If you find out that your client is a designated person, either because their status has changed or they are a new client, there is a clear duty to report this to OFSI/OTSI.

Licences also often come with reporting requirements, which may set out necessary timelines for reporting. These must be fulfilled in their entirety. Complying with license conditions are also applicable for trade sanctions and are issued and monitored by the Export Control Joint Unit, under the Department for Business and Trade.

OFSI conducts an annual exercise to gather information on all frozen funds. Any firm holding frozen funds must report this to by the annual deadline. This changes each year but advance notice if given via email alerts.

It is also important to note that there is no concept of 'deemed consent' in this area. If you submit a report and do not hear back, this does not mean that a licence has been granted or that you are otherwise permitted to act in a way which would breach a sanctions regime.

When you must make a report to us

There are separate duties for reporting issues to us. We expect firms under investigation by OFSI to self-report to the SRA. We would also expect firms that are self-reporting a sanctions breach to the relevant government body to also report this to us.

Please not that this only applies to breaches – in the following scenarios, for example, we would not expect you to submit a report to us where:

A former or dormant client who is not actively instructing the firm has been sanctioned.
You are undertaking work under a general or a specific licence.

Instances where firms should self-report to us include not meeting reporting deadlines while using a general license or accepting and forwarding payments from designated persons beyond the terms permitted by a general license. While not comprehensive, these examples offer guidance on when a self-report is necessary.

Using Screening Tools

Many firms use screening tools (usually technological) to help make sure they are not exposed to designated persons. Such platforms often offer a suite of similar services (including identification and verification of the kind that is compliant with AML requirements).

These tools can be helpful, but there are some principles to follow to make sure they are providing the protection they purport to. Questions you should seek to ask of any prospective service provider include:

How frequently do they update their sanctions data? A low frequency (anything less than daily) creates a risk the information used to screen is out of date.
Which sanctions databases do they search, and do they cover the geographical areas you deal with? It is also important to note that some regimes have extraterritorial reach.
Do they cover all jurisdictions to which you have exposure and how frequently do they update from these lists? Again, infrequent updating heightens the risk that the records will be out of date.
How do they deal with names that have multiple spellings or may have been translated from a non-Roman script (for example Chinese, Arabic or Cyrillic scripts)?
Where the tool facilitates a partial or 'fuzzy' match capability you should seek to understand the confidence level the tool uses when seeking a match and if adjustable, you should consider what the right level is for your clients based on your identified sanctions risk.
How do these systems assess beneficial ownership and ownership & control?

Testing systems and using them effectively

In order to explore the above questions, you should consider testing any new systems before implementation and on a relatively regular basis, for example running known and newly added designated persons through the system.

In using these kinds of tools, it is important to recognise the importance of using supporting information as well as the name of the individual, such as their date of birth. Date of birth can be key in reducing false positives and providing a way to judge the risk posed by a fuzzy/partial name match.

This kind of technology may struggle to correctly identify subsidiary entities of non-natural persons that are designated persons or to establish control that is not based on share ownership or role appointments. This is why this kind of technology works best when accompanied by detailed due diligence done by the firm itself.

You should also make sure that staff using and relying upon these systems know of their capabilities and limitations. Ownership and control, in particular, may be difficult for an e-verification system to determine with the information available to it. Data from these systems is a useful starting point, but human judgement is needed to determine whether any further investigation is needed.

Licensing

For most firms, it is enough to implement controls to successfully identify designated persons in order to avoid unwittingly providing them with prohibited services.

Despite their status, designated persons might still have legitimate need of legal services. In most circumstances, in order to be paid to provide services to a designated person under the financial sanctions regime, you have to make use of a general licence or apply for and be granted a licence to do so. A licence will only be granted where there are grounds to do so. These grounds can be found in the legislative instrument for the relevant sanctions and you should check these before making an application.

The exception to this is where an entire area of legal services, for example trusts, is prohibited to a class of client. In these circumstances, you are not able to work for an affected client at all, even on an unpaid basis, unless a licence is in place.

Licensable activities might include payment of reasonable fees for legal advice (and expenses), payment of bank charges and other reasonable fees for maintaining frozen funds, and the satisfaction of court judgments or contractual obligations arising prior to designation. Monies may also be made available for living expenses or medical expenses under licence.

Two different types of licence may be granted: specific and general. The table below summarises the differences between them.

General Licences	Specific Licences
Cannot be applied for.	Can be applied for.
May be retrospective.	Cannot be retrospective.
Publicly viewable.	Not publicly viewable.
Can be granted on any basis as determined by the government department.	Can only be granted on the basis of the grounds set out in the implementing legislation.

Both specific and general licences are normally issued with accompanying requirements, for example around record keeping or reporting. Specific licences and general licences will often have requirements around notifying the relevant government department of their use. You will also need to consider any time limits that may apply to licences, as generally they are not issued indefinitely.

Responsibility for overseeing your firms adherence to the sanctions regime falls with senior staff. It is therefore crucial that adequate controls are in place. Some firms have found it helpful to create an alarm or diary notification to remind them of when they need to carry out a time-sensitive action in order to comply with the conditions of a licence, for example reporting or applying for renewal.

It is very important to understand the terms of the licence correctly, as providing services outside of those terms will likely lead to a breach of the sanctions legislation. The amount of fees you are allowed to be paid may also be limited by licence, and if so, you will need to monitor this to ensure you remain within the bounds of the licence. You might need to seek clarification on the terms of the licence, alternatively you might wish to seek independent legal advice.

Signing up for email alerts from the relevant government department will help you to keep up to date with any changes to general licences.

Non-financial sanction licences

Non-financial sanctions licences are handled by several government departments and teams. Where the intended actions contravene more than one sanctions regime, you may need to make applications to more than one department.

Trade sanction licences are sent to the Department for International Trade (DIT) which has separate teams for import and export licensing. For licences for most materials, you need to email tradesanctions@trade.gov.uk but military and dual use export licensing applications have a separate licensing system. It can be helpful to attach a cover letter explaining the circumstances in order to ensure your application is processed promptly.

Immigration sanction licences are administered by the Home Office as a part of the visa application process. Exceptions may be considered under the grounds of 'exceptional circumstances.'

Transport sanctions (i.e. sanctions on ships and aeroplanes) licences are normally done through DfT.

Licences for non-financial sanctions might need an accompanying financial sanctions licence where a matter overlaps sanctions regimes.

Supplementary guidance on financial sanctions in the context of trade sanctions has been published.

Legal Professional Privilege

The duty to make reports does not override or supersede Legal Professional Privilege (LPP).

OFSI has said in section 5.4 of the sanctions general guidance, that any attempt to take a blanket approach to LPP preventing any sharing of information about designated persons will likely be challenged. While LPP is unlikely to mean you cannot make a report at all, it may need to be considered in relation to what information you can include in your report.

If you require more detailed guidance on this point, you can either request it from the relevant government authority or seek independent legal advice.

Whenever you invoke LPP to not report or to limit the information reported, you should make a detailed record as to the reasons for the decision taken including:

who took the decision
when the decision was taken
the reasoning as to why LPP applied
who in the firm signed off on this approach
any other relevant information for example relevant legal advice received on this point.

Where the licensing body asks for information (for example in relation to a licence application) that would rightly be subject to LPP and that privilege has not been waived, you cannot volunteer it. However, in such an instance is the licensing body is under no obligation to grant a licence without this information. This is a risk you should consider when deciding to work in the sanctions area.

Lastly, if a client has asked you to help them circumvent the sanctions regime or to help them to commit another offence, we would expect firms to consider whether they need to make any further reports to help prevent offences from occurring.

Sanctions risk assessment

The sanctions regime is one of strict liability and taking a risk-based approach will not necessarily protect you if you breach the sanctions regime (even unintentionally.) That said, there are scenarios that are, in our view, more likely to lead to a breach of the sanctions regime or encountering a designated person or frozen asset. Risk is heightened when more than one of these are present in a matter.

We have produced some guidance and a template on completing a sanctions risk assessment for your firm. This will help you consider where your firm is at risk of becoming involved with designated persons. While it is not compulsory to have a sanctions risk assessment in place, we recommend it as good practice for all firms.

Enforcement

Relevant authorities may make take the following actions where the sanctions regime has been breached:

issue a warning
refer regulated professionals or bodies to their relevant professional body or regulator in order to improve their compliance with financial sanctions
publish information about a breach, even where no monetary penalty is imposed, if this is in the public interest
impose a monetary penalty
refer the case to law enforcement agencies for criminal investigation and potential prosecution.

These are applied using the civil standard of proof.

OFSI has made clear in section 3.3 of the financial sanctions enforcement guidance, that although sanctions remain a strict liability regime, they will enforce it using a risk-based approach. This means that, when determining whether to impose a penalty, and if so of what kind, they will take into account the circumstances in which the breach occurred. For example, they will take into account whether the breach:

was reported to OFSI/OTSI voluntarily
was inadvertent or deliberate
was intended to circumvent sanctions
itself involved a breach of relevant professional standards
occurred despite appropriate due diligence being conducted.

Read the complete OFSI guidance on enforcement.

We expect firms we regulate to take a proportionate effort to prevent unintentional or accidental breaches of the sanctions. In order to determine where greater effort may be needed, we have set out our assessment of where the risk is greatest below. You should take proportionately greater effort to ensure they are not breaching sanctions in the scenarios below:

Sanctions risk factors

Jurisdiction – some jurisdictions carry higher risk than others. In judging which jurisdictions are higher risk, we would include:

Any jurisdiction with a dedicated regime in the UK Consolidated list.
Any jurisdiction with significant exposure to the other UK sanctions regimes, for example the regimes addressing human rights or ISIL & Al-Qaida.
Jurisdictions that while not the subject of a dedicated regime, have significant footprint of designated persons. One way to check this is using the Ctrl+F 'find' command to check the number of mentions for each country on the consolidated sanctions list. For example, Syria has almost one thousand mentions, while Norway has three.
Jurisdictions where there are well established financial links with a jurisdiction with a named regime, for example Moldova and Cyprus have had strong economic links with Russia.
Jurisdictions listed by other regimes (for example EU and US) but not by the UK. The implication is there is a risk that the UK would move to harmonise its regime with other international regimes and so a person designated by a non-UK regime is at risk of being designated by the UK regime in future.
Jurisdictions noted as being able to provide services or entities that help to hide ownership – in many cases these may also be high-risk for money laundering, for example the UK's high-risk third country list and offshore services centres.

Some individuals/entities are more likely than others to be sanctioned. This can be difficult to predict, but the following may help you to consider what the risk may be:

Do they meet the definition of a Politically Exposed Person under the AML legislation?
Are they established in or have significant links to a jurisdiction with a UK sanctions regime addressing it?
Do they have a personal or professional relationship with a designated person including family members?

When alongside one of the previous risks (for example jurisdictional), designation as an ultra-high net worth individual should be seen as an aggravating risk factor (ie investable assets of $30 million or more)

Transactions aimed at purchasing expensive luxury goods, for example works of art, private aeroplanes, boats, or high-end cars

Transactions for the funding of education, for example via private schools or universities, with higher amounts indicating higher risk

Offering transportation/freight work, for example aviation or maritime work.

Offering immigration and transactional work (these areas have consistently been reported as the most at-risk areas of legal service in terms of unwittingly encountering a designated person)

Offering reputation management services, particularly where linked to litigation

Charities and other entities that may be able to offer a range of services across borders and particularly where linked to higher risk jurisdictions

Payments directly to or received from, a counterparty or third party.

An entity has been controlled or majority owned by a designated person in the past. Even if divestment or sale has occurred, this can be a smokescreen where control or ownership may appear to have changed but the designated person is still exercising control

Jurisdictions that do not have an obvious relevance to the client or matter

As well as the above, any structure or legal arrangement which may make it more difficult to identify the individuals behind it creates a raised sanctions risk. Trusts, international connections/exposure, any opaque structure or even just uncertainty around the ultimate source of funds used for transactions or fees all increase the sanctions risk. Crypto assets, including crypto currencies and non-fungible tokens, can also raise the sanctions risk of a matter. You can mitigate this risk by doing thorough and effective research on the transaction history of the crypto assets in question.

In assessing the risk of sanctions non-compliance in your firm, we expect you to assess your firm against the above criteria, including having controls in place to correctly identify each of the scenarios and, wherever possible, mitigatory measures in place.

Where risks are identified, mitigations to consider using include:

Monitoring the source bank account of the client (different to the source of funds) which may be used to pay as this may create other issues, for example is the bank itself sanctioned.
Regular coordination and exchange of expertise within the firm, for example regular roundtables of fee earners and staff to discuss risk.
Reviewing the sanctions risk assessment, policies, controls, and procedures to ensure they are sufficient to address the risks identified
Subscribing to relevant updates, for example OFSI/OTSI or sanctions/compliance blogs.
Seeking independent legal advice or tailored external training on an issue.

Authority and Enforcement

We take compliance with the sanctions regime very seriously and may take enforcement action where appropriate.

While sanctions compliance is mainly focused on achieving ongoing compliance with the legislation of the sanction regime, authorised firms and solicitors need to bear in mind that they are also required to comply with our standards and regulations. The following standards and regulations may be particularly relevant:

Principles 1, 2 and 5 requiring you to act:
- in a way that upholds the constitutional principle of the rule of law, and the proper administration of justice
- in a way that upholds public trust and confidence in the solicitors' profession and in legal services provided by authorised persons
- with integrity.
Code of Conduct for Firms
- 1.1, preventing discrimination against clients
- 2.1 ensuring proper governance and related systems are in place
- 3.1 and 3.2 requiring you to keep up to date with your duties and cooperate with us and other relevant bodies
- 3.9 requiring you to report serious breaches of regulatory arrangements.
Code of Conduct for Solicitors, RELs and RFLs.
- 1.1, preventing discrimination against clients
- 7.1, 7.3 requiring you to keep up to date with your duties and cooperate with us and other relevant bodies
- 7.7 requiring you to report serious breaches of regulatory arrangements
- and 8.1 requiring you to identify who you are acting for in any matter.
Rule 3.3 of the Solicitors' Accounts Rules setting out the prohibition of using a client account to provide banking services.

When considering what, if any action to take, we will have regard to our Enforcement Strategy. We are likely to take particularly seriously the acceptance of any instructions which are apparently aimed at circumventing the sanctions regime.

Access to insurance and financial services

All authorised firms must maintain adequate and appropriate insurance, which must include the SRA's minimum terms. Firms should note that 6.11 of the SRA Minimum Terms and Conditions of Professional Indemnity Insurance allow an exclusion for 'any sanction, prohibition or restriction under United Nations resolutions or the trade or economic sanctions, laws or regulations of the European Union, United Kingdom, Australia or United States of America.' This means an insurer cannot be forced to pay a claimant where doing so would be illegal via the regimes of these jurisdictions.

You should check your insurance policy for any relevant exclusions. Bear in mind that insurers who are based outside of the UK are likely to apply exclusions based on their own jurisdictions. US-based insurers, for example, may exclude work for clients in jurisdictions such as Cuba which fall under their local sanctions regime but not the OFSI/OTSI regime.

For an insurer to legally pay an award to a designated person, under the UK sanctions regime, they would require a licence by OFSI/OTSI. In our view, it is ultimately the duty of the insurer to apply for the licence and the decision of OFSI/OTSI whether to grant one. For this reason, when providing legal services to a designated person, you should be upfront with them about the risk that your insurance may not be able to legally pay out in the instance of a successful claim.

If you are seeking assurance about whether your insurance will cover work for your client, it is advisable to engage with your insurer before taking on a designated person as a client in order to understand whether they would in fact intend to seek a licence from OFSI/OTSI in the event of a successful claim.

If your insurer is interpreting clause 6.11 SRA Minimum Terms and Conditions of Professional Indemnity Insurance to mean that it will not provide cover to any client who is subject to sanctions, then your firm may want to exclude liability to the client to the extent that the insurance policy will not cover any successful claim brought by the client.

Read the guidance on applying for a waiver and the application form.

Please include with your application correspondence from your insurer setting out their position. An independent decision maker will decide the waiver application.

The situation for banks and other financial service providers is different, as we do not prescribe any minimum terms of engagement. If you are concerned that your bank may be unwilling or unable to facilitate transactions involving designated persons under licence you should engage with them as soon as possible and be upfront with your client about any restrictions you might face and why.

While you may seek to challenge a bank that is refusing to process a licensed transaction relating to a designated person, we have encountered numerous scenarios where the refusal of the bank was an insurmountable obstacle. You should consider the risk of this happening before providing services to a designated person. If you have been assigned a relationship manager or lead contact with your bank, you should consult them as early as possible to understand your bank's approach to these scenarios. You should closely monitor such situations as they may undermine the financial viability of your firm.

It is important to note that the existence of an OFSI/OTSI licence permits certain actions but does not compel third parties to take or facilitate those actions.

If timelines are tight, you should factor in delays in transactions times across jurisdictions and banks.

Immigration sanctions

Immigration sanctions are often applied in conjunction with accompanying financial sanctions. Seeking licences under the financial sanctions regimes or seeking the right for a designated person to travel to the UK are separate processes and you will need to satisfy each separately.

Immigration sanctions work can also be extremely time sensitive. Once someone lawfully in the country becomes a designated person under this regime, it starts a 20-working-day period by the end of which the individual either needs to have left the country or an immigration claim is made. If the designated person is outside the country when they are designated, their entry into the country might be allowed on the basis of human rights grounds, depending on the circumstances.

Shipping sanctions

Due diligence on ships can be complex and may take several months to complete. It is important to remember not to accept money until you have completed your due diligence controls.

The main areas we have observed as being relevant in this area are disputes around access to ports and insurance arrangements.

Aircraft sanctions

Matters relevant to aircraft sanctions are rare, but most frequently involve the manufacture or trade of aircraft parts.

Trade sanctions

The Office of Trade Sanctions Implementation (OTSI) is responsible for monitoring and ensuring compliance with trade rules. OTSI will have powers to issue penalties to those in breach of the regime, including investigating suspected trade sanctions breaches.

The greatest challenges in this space are:

understanding the ownership of counterparties, often the purchaser of the good in question
trying to decide whether something amounts to a 'dual-use good'.

Sanctions regimes in other jurisdictions

The UK is not unique in having a sanctions regime. Depending on your exposure to other jurisdictions you might need to consider how you will comply with the local requirements. You can find useful links to the sanctions regimes in other jurisdictions below:

As the G7 has agreed to co-ordinate their sanctions regime in relation to Russia, you might also need to consider these regimes where a Russian designated person is or may be involved:

Canada
Japan

If you have exposure to more than one regime (for example by offering services in multiple jurisdictions or to international clients or counterparties), you will need to consider how you will satisfy each regimes in its own right. This might include seeking licences or their equivalent instruments from other national relevant authorities. This is not just an issue of some individuals being designated persons under one regime but not the other. For example, there are differences between the US and UK regimes in terms of ownership and control.

Some regimes, in particular the US, may have extra-territorial implications. So even if there is no obvious US nexus to a transaction, US sanctions may still be relevant. This is also sometimes the case where sanctions apply to all US nationals, even those outside of the US, for example, living and working in a UK law firm. In particular, the US sanctions regime claims worldwide jurisdiction over all transactions using US dollars.

It is also worth considering that in limited examples, where a non-US entity has facilitated transactions that were banned by the US regime, but which were not illegal for a foreign firm to facilitate, that the US does have the option of extending their sanction to include the foreign firm. This is a risk you should consider if providing sanctioned services legally permitted by the UK but that would be illegal in the US.

It is important to note that SAMLA, or equivalent legislation, also applies to overseas British Overseas Territories and Crown Dependencies.

Other resources

Further help

If you require further assistance, please contact the Professional Ethics helpline.