On 13 June 2024, in coordination with other G7 countries, the UK announced a round of new sanctions on Russia, strengthening the economic measures already in place to degrade Vladmir Putin’s war machine in Ukraine. Announced during the G7 Leaders Summit in Italy, these latest sanctions will have far-reaching global effects, which means businesses in the UK and beyond must understand how to achieve compliance, or face costly penalties.
UK Russia Sanctions in 2024
The UK issued a previous round of sanctions against Russia in February 2024, targeting supplies of munitions and military end-use tools, and persons involved in the financing of Putin’s war effort. At the time, the UK also announced that it would be increasing its focus on Russia’s attempts to avoid sanctions, not least by cracking down on corporate compliance, and by addressing the illicit trading of oil via a ‘shadow fleet’ of ships.
The UK’s position on Russia sanctions reflects that of its international partners, and in particular members of the G7 who have also signalled an increased focus on Russia’s attempts to circumvent the economic measures against it.
New Sanctions Targets
The UK has issued 50 new sanctions designations against Russia. Notable amongst the new targets is the ‘shadow fleet’ of ships which the Russian government uses to trade oil in violation of existing sanctions. The oil trade is critical to financing the Ukraine invasion and generated 31% of Russia’s total federal revenues in 2023.
The new UK sanctions also target munitions, machine tools, microelectronics suppliers, and companies providing logistics to the Russian military. That group of targets includes foreign companies based in China, Turkey, Kyrgyzstan, and Israel, and ships supplying military end-use goods to Russia from North Korea.
In conjunction with new US sanctions, the UK sanctions have also increased pressure on Russia’s financial system and, in particular, the Moscow Stock Exchange, with new restrictions for individuals and entities involved in Russian stock trading.
UK Prime Minister Rishi Sunak stressed that the renewed economic pressure would “bear down on Russia’s ability to fund its war machine” and cut off Putin’s ability to prolong the Ukraine conflict. Echoing that sentiment, Foreign Secretary David Cameron said that the UK would continue to work with its International partners to increase that pressure, and would “stand by Ukraine in this fight.”
The UK Government has listed the targets of its new Russia sanctions, which include:
4 ships in Russia’s ‘shadow fleet’
2 ships found to have transported weapons to Russia
1 ship manager
6 entities in the Russian liquefied natural gas (LNG) sector
1 Russian insurance company
2 entities with connections to Russia’s civil nuclear sector
4 entities and 1 individual with connections to the Russian financial system
21 suppliers of goods for Russian military end-use
6 individuals or entities with connections to the Russian state that have benefited from the invasion
2 designation from the UK’s Central African Republic sanctions lists with connections to the Wagner Group
The Future of UK Sanctions on Russia
To date, the UK Government has sanctioned over 2,000 individuals and entities, with restrictions applied to over 90% of the Russian banking sector, and over 130 close associates of Vladmir Putin – with a combined net worth of around £147 billion.
The UK’s latest sanctions, along with those issued by the G7, suggest that the pressure on Russia will continue for the foreseeable future, with a more complex focus on the Russian government’s attempts to circumvent the measures against it, and on efforts to fund its campaign in Ukraine. To that end, the UK recently published the UK Sanctions Strategy, which set out the UK Government’s sanctions position on Russia, and detailed wider diplomatic efforts to address Vladmir Putin’s evasion strategies.
As the UK’s sanctions against Russia evolve and expand, it’s vital that UK firms put adequate sanctions screening measures in place to meet their compliance obligations. Ripjar’s Labyrinth Screening platform is designed to help compliance teams keep pace with new sanctions by providing continuous monitoring and real-time name search capabilities of international sanctions lists, and of thousands of adverse media sources from across the world. Labyrinth Screening includes the cutting-edge AI Risk Profiles and AI Summaries features, which enable compliance teams to identify and extract only the most relevant risk information from vast amounts of unstructured data, and then use advanced generative AI to create a concise summary of that risk, and significantly reduce assessment times.
Name screening is fundamental to anti-money laundering, enabling firms to more accurately capture the level of financial compliance risk that individual customers present, and then deploy appropriate mitigation measures.
Often a regulatory requirement, AML name screening is critical in the fight against financial crime but typically involves the collection and analysis of vast amounts of structured and unstructured data, and the accurate matching of that information to specific individuals. In contexts where firms struggle to meet those obligations or to manage the screening data burden, automation often provides an advantage – if integrated effectively.
Given the critical role it plays in combating money laundering, firms must understand how to implement effective name screening – and how to optimise their screening tools as part of a wider compliance solution.
What is AML Name Screening?
AML name screening is the process of searching customer names for their designation on official sanctions lists, PEP lists and watchlists, or in negative news (adverse media) stories, in order to accurately gauge the level of money laundering risk that they present.
When firms find customer names designated on relevant sanctions or watchlists, or in negative news media, that information should generate an alert, inform the customer’s risk profile, and ultimately help the compliance team take appropriate action. This may include declining their use of services, freezing transactions or forwarding information to the authorities.
Firms may take different approaches to AML name screening:
Manual Screening
A manual name screening process involves manually searching for names in lists and datasets, or using public search engines such as Google or Bing to search customer names with the aim of identifying potential risk. Manual screening may generate usable risk data but is limited in a number of important ways. For example, a search engine’s algorithm may deliver inconsistent or incomplete results, de-prioritise critical information, or block some results under regional data laws. Manual searches may also be time-consuming and vulnerable to human error, especially in cases where large numbers of names must be checked.
Automated Screening
Firms can automate their AML name screening with software tools that are capable of searching through vast amounts of structured and unstructured data with speed and accuracy, reducing the potential for human error. Automated name screening tools allow compliance teams to tailor their searches, review thousands of global data sources in seconds, and then categorise and analyse that data to facilitate stronger decision-making.
AML Risk Data Sources
The AML name screening process typically captures risk data from the following sources:
Economic sanctions lists featuring the names of individuals, organisations and countries subject to economic sanctions imposed by governments.
Politically exposed person (PEP) lists featuring the names of elected and unelected officials such as politicians, government officials, members of the military, and so on.
Government watchlists featuring the names of persons known to pose a financial criminal risk.
Adverse media sources including established news organisations, blogs, websites, forums, and social media posts.
Why is AML Name Screening Important?
Most jurisdictions set out risk-based AML compliance requirements, which makes name screening an essential part of an effective AML solution, and critical to avoiding costly regulatory penalties.
Beyond regulatory obligations, name screening has a significant and meaningful impact in the global fight against money laundering. The value of name screening lies in both the quantity and quality of risk data that it can provide. Vital risk information gained from sanctions lists, PEP lists and watchlists can be enhanced and given additional context from adverse media results. For example, a firm may discover a news story about a customer’s involvement in a foreign money laundering investigation, containing information that may not have been reported by domestic outlets, and which may not be officially confirmed for months. Informed by that screening data, firms can adjust the customer’s AML risk profile and take appropriate action to avoid a compliance violation.
Global Screening Challenges
Although it is an indispensable part of modern compliance, global AML name screening can present administrative and practical challenges. The most common include:
Data Volume
The sheer amount of data involved in AML name screening can be overwhelming. Firms must consider their search parameters carefully, taking into account the regions and languages in which searches should be conducted, and which watchlists or news publications they need to search. Certain searches may generate a huge amount of alerts, including false positives and redundant duplicate stories, all of which need remediation.
Data Quality
Not all risk data is equal. Information from low-credibility sources, such as blogs, forums, and social media posts, is typically less reliable than information from sanctions lists, PEP lists, watchlists, and established publications such as international news organisations. The distinction between low and high quality data may be more challenging for searches carried out in foreign languages.
Language, Spelling, and Naming
Global name searches may struggle to account for the nuances of foreign languages, including naming and spelling conventions. Some cultures reverse the first name-surname order, for example, use prefixes before names, or approximate English spelling translations. Similarly, some data sources may use non-Latinate characters, such as Cyrillic or Arabic.
Aliases, Nicknames and Similar Names
Searches may misidentify customers based on the use of aliases, nicknames, and similar or exact-match names. In searches of Western news stories, for example, the name “John Smith” would, without added contextual input, generate a huge amount of similar or exact-match name alerts, while customers that use nicknames or middle-names when signing up for services may also end up confusing search tools. On the other hand, criminals may actively try to evade searches by using aliases.
AML Name Screening Best Practices
AML name screening is challenging, but firms can streamline their process by applying the following best practices as they develop and use their search solutions.
Optimise CDD
Firms should apply robust customer due diligence (CDD) measures during onboarding to verify their customers’ identities, including collecting official identifying documents such as passports. Effective CDD enriches customer risk profiles with contextual information which can, in turn, help compliance teams clarify name screening data where ambiguities and false positives emerge.
Automate Where Possible
Automation allows firms to build speed and accuracy into their AML screening process, accomplishing in seconds what would have previously taken hours to complete, and without the same potential for human error. Automated screening tools offer an array of peripheral benefits – solutions can be tailored to a firm’s business needs and risk appetite, and scaled to accommodate business growth. Automated solutions can also integrate emerging innovations, and account for multi-language screening challenges.
Risk Categorisation
It is important to implement a screening solution capable of discerning different types of risk from the content it targets, and categorising that information accordingly. Customers involved in potential financial crimes (such as fraud) may pose a different level of money laundering risk than customers involved in narcotics offences, for example, and that nuance can help firms clarify, and deploy a more efficient compliance response.
Ongoing Monitoring
AML risk screening should not become a box-ticking exercise. Customer risk profiles can change quickly as a result of elections, regulatory changes, or geopolitical events such as the conflict in Ukraine, and firms must be ready to adapt to changes in that environment. Screening solutions should continuously monitor for changes, and firms should be proactive in seeking out and capturing new risk data.
Integrate AI
AI has become a powerful weapon in the fight against financial crime. The emergence of generative AI and large language models (LLMs) is particularly valuable for name screening since it enables firms to analyse unstructured data with unprecedented speed and accuracy, across numerous language systems. AI technology is also capable of discerning different levels of risk, identifying duplicate information, and recognising non-Western characters and other translation issues.
Next Generation Name Screening
Build next generation automated name screening into your AML solution with Ripjar’s Labyrinth Screening platform. Powered by AI technology, Labyrinth Screening is capable of searching thousands of global sanctions lists, PEP lists, watchlists and adverse media sources in seconds, to deliver actionable financial intelligence that enables firms to stay ahead of regulatory risk.
Labyrinth Screening is designed to supercharge the name screening process and dramatically reduce assessment times. The platform includes Ripjar’s AI Risk Profiles tool to help teams extract only the most risk-relevant information from large volumes of data, and AI Summaries, a generative AI tool that adds concise prose summaries of that data to each customer profile.
When Russia invaded Ukraine in February 2022, Western countries coordinated to deploy an unprecedented package of economic sanctions against Vladmir Putin’s regime, targeting hundreds of individuals and businesses, and comprising asset freezes and wide-ranging prohibitions on imports and exports.
The Russia sanctions regulations changed the global risk landscape almost overnight and in response, firms moved quickly to review and adjust their sanctions screening solutions to avoid costly compliance penalties. The sanctions challenge became more complex in 2022 and 2023 as global governments issued subsequent rounds of sanctions and enforcement regulations, broadening the scope of existing measures, and increasing penalties for violations.
In 2024, Russia sanctions remain a compliance priority, and firms need to be capable of deploying an effective screening response. To help your organisation navigate the sanctions landscape effectively, let’s take a look at the latest global developments.
Recent Global Sanctions Against Russia
On 22 February 2024, the UK imposed its latest sanctions package against Russia, with 50 new sanctions targeting individuals and entities involved in the manufacture of munitions and tools for Russian military end-use, and in the Russian diamond trade.
On 23 February 2024, the EU and the US also announced new Russia sanctions. Its 13th package against Russia since the invasion began, the EU’s sanctions imposed new restrictions against 106 individuals and 88 entities. The EU measures targeted Russia’s military and defence industries, but extended to companies in China and Turkey which trade in electronic components for Russian end-use. The US imposed 500 new sanctions, targeting some of Russia’s largest financial services, mining, and manufacturing businesses, including the National Payment Card System, the Avangard Joint Stock Bank, and JSC Bank ChelindBank.
On 1 May 2024, the US announced 300 new sanctions against Russia. The sanctions were intended “to limit the Kremlin’s revenue and access to the materiel it needs to prosecute its illegal war against Ukraine”. To that end, the sanctions target the Russian energy, metal, and mining industries, Russia’s ability to develop biological and chemical weapons, and Russian business partners in third countries.
Russia Sanctions Regulations: US, EU and UK Developments
United States
Sanctions Evasion: In September 2023, the US’ Financial Crimes Enforcement Network (FinCEN) published a Financial Trend Analysis (FTA) on Russian sanctions evasion. The FTA was based on suspicious activity report (SAR) data submitted by US financial institutions, amounting to a value of around $1 billion. In the analysis, FinCEN highlighted the following sanctions evasion trends:
The supply of prohibited goods directly from US companies to Russian end-users, or via transhipment through intermediaries in the UK, the Middle East and Asia.
A reliance on businesses in China, Hong Kong, the United Arab Emirates (UAE) and Turkey in sanctions evasion strategies.
The prominence of electronic equipment, including “microelectronic components, imaging technology, electronic filters, and electromechanical instrumentation” in sanctions-violating trading activity.
The emergence of other industries, such as industrial machinery and professional services, in the violation of Russian sanctions.
Secondary Sanctions: In January 2024, President Biden announced that the US would be imposing new secondary sanctions on Russia, targeting non-US banks that provide sanctioned Russian customers with certain services. The secondary sanctions focused primarily on services in support of Russian military end-users.
European Union
Extension of Sanctions: On 12 March 2024, the EU Council voted to extend its existing sanctions against Russia for another six months, to 15 September 2024. The move came 10 days before the EU’s 13th sanctions package (see above). The EU Parliament also announced an increased focus on Russia sanctions compliance with stronger penalties against persons attempting to evade sanctions, including prison terms of up to 5 years for trade with, or provision of, services to Russia.
Targeting Propaganda: Following the extension of existing sanctions and introduction of new sanctions, the EU announced that it would be imposing a 14th round of sanctions on Russia in the coming months. As part of that announcement, the EU indicated it would be targeting Russian propaganda by banning the broadcasting activities of four Russian state media outlets: Voice of Europe, RIA Novosti, Izvestiya, and Rossiyskaya Gazeta.
United Kingdom
Sanctions Strategy: On 22 February 2024, the UK government published the UK Sanctions Strategy in conjunction with the announcement of its latest round of Russia sanctions. The Strategy sets out the UK government’s “approach to using sanctions to address global threats, promote international norms and protect the UK”, including details of measures to “disrupt Russia’s war-machine”.
Sanctions Evasion: Like the EU and the US, the UK Strategy signalled an increased focus on Russia sanctions compliance and attempts by the Russian government to bypass economic sanctions. The Strategy included the following key details:
UK officials are travelling to states in Central Asia, Eastern Europe and the Gulf “to share concerns and build relationships” in the fight against Russia sanctions evasion.
The UK is tackling Russia sanctions evasion in part by targeting illicit finance streams, including complex corporate structures and shell companies that are used “deliberately to obscure the ownership of assets”.
UK efforts include sharing a list of items “critical to Russia’s battlefield capacity” with third parties, and “calling their attention to any spikes in the trade of sanctioned goods – and on how to strengthen enforcement.”
The UK is making a greater effort to identify and designate persons that are involved in “military procurement networks and third country supply and assistance to Russia”.
As part of the Strategy, the UK government announced new restrictions on persons designated on sanctions lists, making it illegal for them to sit on company boards. The Strategy also indicated that the UK would be exploring legal mechanisms to release frozen Russian assets for the specific purpose of rebuilding and reconstruction in Ukraine.
Russia Sanctions Compliance: What’s Next?
With the EU’s 14th package of Russia sanctions on the horizon, sanctions compliance will continue to have a significant impact on financial services for the foreseeable future, and firms must be ready to move quickly as the global risk landscape changes. That challenge means adopting a hyper-vigilant approach to sanctions screening, and emphasising flexibility and accuracy in sanctions screening solutions.
Effective, accurate global sanctions screening involves capturing and analysing vast amounts of data. To that end, firms should find an automated screening solution that meets their business needs and fits the risk environment. Ripjar’s Labyrinth Screening platform is designed to help firms keep pace with the complexity of global sanctions compliance, while streamlining the screening process itself.
Labyrinth Screening offers firms the power to conduct real-time name searches of global sanctions lists and thousands of additional risk data sources from around the world. Powered by cutting-edge AI, Labyrinth includes AI Risk Profiles to help compliance teams extract the most relevant information about customers and build-out comprehensive, useful risk profiles. Labyrinth also includes AI Summaries, a cutting-edge, generative AI feature that adds short, concise prose descriptions of a customer’s AML risk to their profile.
On 24 April 2024, President Biden signed bill H.R. 815 into law, a legislative package that also includes the 21st Century Peace Through Strength Act. Although H.R. 815 is largely recognised as a $95.3 billion foreign aid package, with financial assistance for Ukraine, Israel, and Taiwan, the Peace Through Strength Act contains significant sanctions provisions, including measures for combatting the US’ fentanyl epidemic, and an extension to the legal statute of limitations for sanctions violations, which will significantly affect sanctions compliance.
The new sanctions regulations add to an already-complex risk landscape, and mean that firms in the US and beyond should review their screening approach. Let’s take a closer look at the contents of H.R. 815 and explore its implications for US sanctions compliance.
What Are The New Sanctions Regulations?
A product of a bipartisan legislative effort, H.R. 815 contains new sanctions laws aimed at a range of foreign threats. Its key sanctions measures include:
Strengthened sanctions against China for transactions involving the purchase of Iranian oil.
New sanctions against Iran targeting the country’s petroleum industry, and missile and drone development capabilities.
New sanctions targeting financial support for terror groups Hamas and Hezbollah.
A mandate for the US Treasury to introduce new sanctions against Mexican cartel members involved in the production and trafficking of fentanyl.
An extension of the US’ statute of limitations, doubling potential investigation time from 5 to 10 years.
10 Year Statute of Limitations
While obligated entities should carefully consider each of the new sanctions measures, the extension of the statute of limitations is likely to have the greatest impact on regulatory compliance.
The regulatory change comes at a time when US firms face a high sanctions compliance burden. The US government has expanded its Russia sanctions programme dramatically since the invasion of Ukraine in 2022, along with the introduction of new sanctions against China and Iran. At the same time, the Office of Foreign Assets Control (OFAC) has increased its focus on enforcement, imposing significant penalties for compliance failures as a way to ensure the effectiveness of new sanctions. That shift has delivered results: in 2023 OFAC issued a record $1.5 billion in sanctions fines.
Coming as a surprise to many industry observers, the new 10 year statute of limitations represents a considerable statutory change for US firms and their compliance teams. Under the previous regime, firms that discovered a sanctions violation on their books often conducted a 5 year retrospective review to uncover further violations and identify potential systemic problems. The new law doubles that burden while, at the same time, reducing pressure on regulators and increasing the opportunity to discover additional violations and impose larger fines.
US Sanctions Law Changes: Key Considerations
The change in the statute of limitations means that US firms and obligated entities should review their sanctions compliance programmes, focusing on a number of key considerations:
Risk adjustment: All firms now have an added 5 years of risk to factor into their approach to sanctions compliance. The change may require firms to adjust internal sanctions policy by, for example, maintaining records for at least 10 years.
Retroactive risk: As of June 2024, it was unclear whether OFAC and the US Department of Justice would retroactively apply the 10 years statute of limitations to violations that remain within the previous 5 year limit.
Russia focus: Given that the new statute of limitations was introduced to support the US’ Russia sanctions programme, it is likely that the US government will maintain a strong focus on the application and enforcement of Russia-related sanctions for the foreseeable future. Obviously this focus should not undermine firms’ treatment of other types of global sanctions risk.
Due diligence: Firms that have not been retaining sanctions compliance data for longer than 5 years should adjust their approach to customer due diligence (CDD) to account for the extended risk period. Business data from the past 5 years should be reviewed as a priority.
Global adjustment: The US’ position as a global sanctions leader suggests that other Western governments may now make similar changes to their own statute of limitations regulations.
Overcoming Sanctions Challenges
The US Justice Department recently hired 25 new prosecutors to support its investigations into Russia sanctions violations. The government’s emphasis on enforcement underlines the need for firms to tighten their sanctions compliance performance by putting the right customer due diligence and sanctions screening solutions in place.
Ripjar’s Labyrinth Screening platform helps firms meet the challenges of a constantly evolving risk landscape. Labyrinth gives compliance teams the ability to screen against thousands of risk data sources including global sanctions lists, in real time, across multiple languages. Now featuring the cutting-edge AI Risk Profiles and AI Summaries tools, Labyrinth Screening supercharges the screening process, harnessing the power of AI to extract only the most relevant customer data and build clear, concise summaries of each customer’s risk.
China’s economic and political ambitions often prompt concerns that Western governments will impose sanctions in response to violations of international law. That possibility is particularly worrying for Western businesses because of the significant market disruption they would cause. China is a major trading partner to the West: the UK, US and EU operate at a trade deficit with China, with the UK importing £63.6 billion of Chinese goods in 2021, the US importing $450.4 billion, and the EU €472 billion. With so many Chinese-manufactured goods consumed in the West, the impact of any new sanctions is hard to predict.
Chinese diplomatic relationships also complicate the sanctions landscape. President Xi Jinping’s expression of support for the Russian invasion of Ukraine in 2022, for example, created speculation that China would follow Russia’s lead by attempting to impose its rule on neighbouring Taiwan – an outcome that would force Western governments to take action.
While many Western countries currently implement China sanctions programmes, a China-Taiwan conflict would lead to fresh rounds of penalties, and force companies around the world to adjust their sanctions screening solutions in order to comply. China’s response to new sanctions will also be significant. Xi Jinping’s government recently established its own international sanctions programme, with measures that affect a range of Western individuals.
Many firms were caught off-guard by the swift (and ongoing) implementation of sanctions against Russia. To help your firm be ready to react to any emerging risk, we’ve put together a guide to the current state of play on the China sanctions landscape.
China Sanctions: Global Overview
Western governments have imposed sanctions against China in response to a number of recent international incidents, including espionage activities and human rights violations. Key global China sanctions programmes include:
United States
Most of the US’ current sanctions against China were imposed during the Trump administration in response to Chinese espionage activities and human rights abuses. Those sanctions included a 2018 ban on US agencies using Huawei products, and targeted sanctions against Chinese officials in response to the repression of Uyghur Muslims in 2020. In that year, the US also sanctioned Hong Kong and Chinese officials for undermining democracy in Hong Kong.
In 2022, the Biden administration imposed sanctions against Chinese businesses for supplying technology to Russian military networks in the conflict against Ukraine. The ban applies to advanced computing and semiconductor technology.
United Kingdom
In 2021, the UK imposed sanctions against China for the first time in response to human rights violations against minority Uyghur Muslims. The sanctions targeted the Xinjiang Productions and Construction Corps, and 4 Chinese officials.
Canada
In coordination with other Western allies, Canada imposed sanctions on China in 2021 in response to its treatment of the Uyghurs. Canada’s China sanctions programme includes a ban on the export of sensitive technologies, and imposes investment and travel bans.
The European Union
The EU has responded to China’s crackdown on Uyghur Muslims with the imposition of new economic sanctions in 2021. The sanctions targeted four Chinese officials and introduced export bans on technologies that could be used to conduct surveillance activities on the minority group.
Recent Changes to China Sanctions
The most recent global sanctions against China have broadly focused on addressing espionage and China’s ongoing support for Vladmir Putin’s invasion of Ukraine. The measures have typically been led by the US.
In 2023, the US issued sanctions against Spacety China for providing the Russian military with satellite surveillance imagery of Ukraine, The US also sanctioned Chinese companies for providing technology to Iranian drone manufacturers which, in turn, supplied the Russian military.
Following incursions by Chinese spy balloons into US airspace in February 2023, the US sanctioned several Chinese aviation and technology companies. The sanctions banned the export of parts and technologies, including valuable computer chips, from the US.
In April 2023, the US also imposed sanctions on entities within China for supplying chemicals used in the production of fentanyl by Mexican drug cartels.
In May 2023, the EU proposed a new sanctions package against 7 Chinese entities in response to their support for the Russian invasion of Ukraine.
China’s Sanctions Programme
It’s important to remember that China has also implemented its own sanctions programme to counter Western measures. China sets out its sanctions targets in the Unreliable Entity List (UEL), which was introduced in 2019 and is administered by the Ministry of Commerce (MOFCOM).
China has designated numerous Western targets on the UEL, focusing predominantly on US, UK, EU, and Canadian politicians. Recent designations on the UEL followed Western sanctions imposed in response to the Hong Kong democratic protests and the oppression of Uyghur Muslims, but China has signalled that it may expand its measures to counter new geopolitical pressures.
In 2022, China imposed sanctions against a number of Taiwanese officials following a visit by US House Speaker Nancy Pelosi, and followed up in 2023 with a second round of sanctions, which included Taiwan’s de-facto ambassador to the US. There are also indications that China will retaliate against US tech sanctions by placing sanctions on the export of certain technical components alongside some biotechnology.
The Future of China Sanctions
Xi Jinping’s support for the war on Ukraine will continue to have a significant effect on China sanctions programmes. In addition to the EU’s proposed sanctions, it is likely that the US will broaden its ban on the export of technologies to China, with a continuing focus on the export of microchips and semiconductors. The US may also broaden the scope of sanctions to more Chinese business entities, to capital flows into China, and to other Chinese industries, including biopharmaceuticals and medical software, both of which rely heavily on US intellectual property.
While the US typically has the capacity to act unilaterally against China, it is likely that other countries, including the EU, will adjust their sanctions posture depending on the outcome of geopolitical events – including the war in Ukraine, and the Chinese government’s treatment of Taiwan.
Taiwan
China’s position on Taiwan will be a significant factor in any future Western sanctions. While Taiwan has been governed independently since 1949, China has made clear that it intends to eventually bring the island under its full administrative control. To that end, China has engaged in recent actions to emphasise that objective, including military provocations against Taiwan and its Western allies, and issuing sanctions against high profile individuals who undermine China’s claim.
Any escalation of those actions may lead to conflict between China and Taiwan, and would force Western governments to impose new sanctions. In the wake of the coordinated action against Russia, it’s likely that new sanctions against China will be severe, and have a similar impact on Western businesses, affecting much of the industrial landscape and creating a significant new compliance burden.
In the event of a China-Taiwan conflict, firms will have to keep pace with governments in order to avoid penalties. To mitigate risk, it’s a good idea to begin compliance preparations now, rather than waiting until sanctions become a reality. Practically, this means that firms should closely monitor geopolitical developments concerning China and Taiwan, and review current levels of risk exposure, including supply chain and third party risks. Similarly, firms should update their sanctions screening solution to capture emerging risk factors, with particular attention to adverse media searches and multilingual name screening capabilities.
Screening Solutions
Given the obligations that China sanctions impose, it’s vital that firms consider the specific screening challenges of hypothetical targets. While firms should screen regularly for updates to official sanctions lists, there are other specific screening challenges, including:
Multi-Lingual Screening
In order to detect China sanctions risk effectively, firms must be capable of capturing data written in Chinese characters. To that end, solutions should include multi-lingual and multi-script name matching capabilities, and account for the following factors:
Use of non-Latinate characters, for example: 习近平 (Xi Jinping).
Transliteration of names from native to Western characters.
Use of Asian naming conventions, such as the reversal of first names and surnames, or approximations of anglicised spellings.
Misidentification of similar-sounding or similar-spelled names, and variant spellings.
Accounting for multi-lingual challenges means integrating a software solution with sophisticated screening capabilities and, ideally, recruiting compliance teams with the relevant language expertise.
Adverse Media Screening
Emerging sanctions risks are often revealed by news and other media sources before they are officially implemented in government sanctions lists. Investigative journalists, for example, may expose evasion of China sanctions, along with the firms that facilitate that activity.
With that in mind, to stay ahead of the compliance curve, and anticipate emerging sanctions risk, firms should focus on screening adverse media or negative news for stories that involve their customers, with searches taking in traditional screen and print media, along with websites, social media, forums, blogs and so on. Adverse media screening should have a global scope, including searches of domestic, Chinese, and global data sources, and firms should apply the same multi-lingual approach as they apply to other screening processes.
Next Generation Screening
China sanction screening solutions should facilitate fast, efficient searches that minimise noise and false positives, and empower firms to make confident decisions. To achieve that goal, firms must integrate flexible technology that can manage the quickly evolving challenges of both the sanctions and adverse media landscapes.
Ripjar’s Labyrinth Screening platform is capable of searching thousands of global data sources, combining official sanctions list screening with multi-lingual adverse media searches. Labyrinth searches in real time, in over 20 foreign languages, in order to provide meaningful, contemporary data in seconds, and inform strong, speedy decision making. Powered by next generation machine learning technology, Labyrinth also enables firms to extract the most relevant data points, building more accurate customer risk profiles while minimising false positive alerts.
To learn more about China sanctions screening and compliance, contact us today
In 2022, sanctions compliance took on a new level of importance for firms across the world, as geopolitical events, such as Russia’s invasion of Ukraine, complicated the risk landscape. Although Russia’s invasion captured headlines and the attention of compliance officers, there were plenty of additional sanctions concerns throughout the year and, in 2023, it’s important that firms maintain focus on the effectiveness of screening processes in order to avoid penalties.
In a changing risk landscape, your sanctions compliance solution must be versatile enough to adapt to new designations and updates, and robust enough to ensure that customers are screened thoroughly. To help your compliance team stay ahead of its sanctions challenges in 2023, let’s take a look at some of the most notable trends on the horizon.
Sanctions 2023: What You Need to Know
Russia
In February 2022, Western governments announced sanctions against Russia and President Vladimir Putin’s regime as a response to the invasion of Ukraine – and imposed additional restrictions as the conflict progressed. As of February 2023, the UK had imposed sanctions against over 1,200 people associated with Putin’s regime, and over 120 businesses. The US, the EU, Canada, and other Western countries also implemented significant Russia sanctions programmes – a collective response that caused a dramatic contraction in the Russian economy and created a deficit of around $47 billion. The deficit figure is based on official Russian government data and is likely to be much higher than claimed.
The global sanctions pressure on Russia will continue into 2023. While it seems unlikely there will be new measures against Russia’s oil and gas industry, the most recent measures (as of February 2023) have a broad scope:
On February 8, the UK announced a new round of Russia sanctions, predominantly targeting five organisations supplying the Russian military with products and services, and five individuals with financial connections to Putin’s network of luxury homes.
On February 9, the UK and the US jointly announced sanctions against Russian cybercriminals, indicating a new focus on Russian attempts to perpetrate ransomware attacks against the rest of the world.
The EU signalled that it will maintain its own sanctions pressure on Russia with a focus on countering Russian disinformation. In February, the EU announced a new round of export bans worth €10 billion against Russian politicians, military leaders and state propagandists.
Iran
While Russia sanctions are an important global anti-money laundering (AML) and counter-financing of terrorism (CFT) focus, it’s important to remember that there is a wider sanctions landscape with critical compliance considerations. In particular, Iran will likely continue to be a sanctions priority in 2023, with Western nations imposing restrictions in response to the Iranian government’s ongoing repression of human rights protestors and attempts to develop nuclear weapons.
With that in mind, in January 2023, the UK sanctioned Iran’s prosecutor general, Mohammad Jafar Montazeri, in response to the execution of British-Iranian dual national Alireza Akbari. Similarly, the US sanctioned six Iranian petrochemical manufacturers following the sale of fuel to customers in Malaysia and Singapore. The EU also announced a new round of Iran sanctions, against multiple individuals and entities, in response to the Iranian government’s brutal crackdown on human rights protestors.
China
Following revelations about espionage activities in North America, including a spy balloon that entered US airspace in early February, the US quickly announced new sanctions against China. The US’ existing China sanctions include targets responsible for both espionage and human rights violations, but following the spy balloon incident, the Commerce Department set out new measures against several Chinese military tech firms that contributed to the balloon programme, and that pose a threat to US national security.
Matthew Axelrod, Assistant Secretary of Commerce for Export Enforcement, suggested that the US was renewing its sanctions focus on China as a way to counter the Chinese government’s surveillance programmes which have “violated the airspace of the United States and more than forty countries.”
Sanctions Evasion
2022 saw a dramatic increase in the complexity and quantity of global sanctions. Depending on global events, including whether Russia abandons or continues its campaign against Ukraine, the pace of that increase may slow in 2023, but firms must nonetheless be prepared for the emergence of new strategies to evade sanctions restrictions.
Sanctions evasion tactics may include conventional trade diversions, such as recent Russian attempts to move gas shipments through ports in Turkey and the UAE, or the use of shell companies to move money from one financial system to another. Sanctions targets may also seek to exploit technology to conceal their identities, including using untraceable cryptocurrency transactions to move funds across borders.
Russia’s efforts to evade sanctions have prompted a response from Western governments. In February 2023, the US Treasury Department announced that it would be cracking down on third persons that facilitate Russian sanctions evasion “wittingly or unwittingly”. The US’ announcement follows the UK’s introduction of strict liability for sanctions violations in its Second Economic Crime Bill. Under the new rules, the UK government may impose regulatory penalties regardless of whether the offending person knew they were in breach of the rules.
Non-Compliance Risks
Sanctions compliance penalties vary by jurisdiction but entail significant financial and even criminal penalties. Sanctions penalties usually reflect the severity of the offence: in the US, for example, fines can range from thousands, to tens of millions of dollars, and carry lengthy prison terms. The UK’s penalties include a prison sentence of up to 7 years and a fine of £1 million or 50% of the resources involved in the transaction (whichever is greater).
Sanctions violations contributed to a surge in financial penalties in 2022, which saw banks and other financial institutions pay around $5 billion for compliance failures.
Achieving Sanctions Compliance in 2023
The events of 2022 demonstrate just how fast sanctions regulations can change, and how important it is for firms to stay on top of their screening and monitoring obligations. In 2023, the pace of Western sanctions against Russia may slow, especially if the war reaches a stalemate or conclusion, but new measures will continue, including the broadening of existing programmes, and an increased focus on sanctions evasion strategies. In this changing sanctions landscape, the only way for firms to meet their compliance requirements is to integrate technology capable of screening and monitoring customers on a continuous basis – capturing both changes in risk, and attempts to circumvent restrictions.
Ripjar’s Labyrinth Screening platform is designed for purpose, enabling customer name searches against thousands of data sources, including sanctions and watch lists, and adverse media content, in real time, in over 20 languages. Powered by cutting-edge AI, and with intuitive analysis of names, translations, and regional spelling variations, Labyrinth delivers actionable intelligence in seconds, ensuring your firm is able to make crucial compliance decisions quickly, and stay ahead of unexpected challenges in 2023 and beyond.
Learn more about our adverse media screening capabilities: contact us today
On September 30, 2022, the United States Treasury’s Office of Foreign Assets Control (OFAC) published Sanctions Compliance Guidance for Instant Payment Systems. The guidance emphasises the importance of the risk-based approach that firms in the US must take to sanctions risk, in particular where those firms use payment technologies to handle transactions, such as instant payment systems.
OFAC published the payment systems guidance following its court settlement with Tango Card Inc, a stored-value card company that distributes products such as electronic gift vouchers and other online rewards. An OFAC investigation found that Tango Card had violated multiple US sanctions by transmitting its products to sanctioned countries.
With OFAC’s renewed focus on payment systems, it is crucial that service providers understand the new guidance, and how to ensure regulatory compliance.
What Does OFAC’s Instant Payment Systems Guidance Involve?
The 2022 guidance emphasises that there is no “one-size-fits-all approach” to sanctions compliance, pointing out that each instant payment system “has its own unique characteristics” and does not entail “the same sanctions risks”. Accordingly, OFAC’s guidance states that each financial institution’s sanctions compliance solution “should be based on that institutions’ assessment of its own risk”, and take in a variety of factors for mitigating that risk.
OFAC’s guidance sets out the following key risk factors relevant to financial institutions offering instant payment systems:
Domestic vs Cross Border Payments: OFAC’s guidance identifies that domestic payment systems which involve the transfer of funds between US bank accounts are typically a lower sanctions risk than those that facilitate cross-border transactions – which are obviously more likely to involve persons designated by US sanctions programs. OFAC points out that US banks already implement robust screening and monitoring processes (as required by US law), along with risk-based customer due diligence, but that non-US banks “may not be subject to the same regulatory requirements and examinations”.
Nature and Value of Payments: Certain types of payment facilitated by instant payment systems pose a greater sanctions risk than others. To this end, OFAC’s guidance suggests that the “nature and value” of payments should be a relevant risk factor when assessing risk. In particular, banks should examine the consistency of payments with customers’ past behaviour: for example significantly higher value payments than normal, to foreign accounts, may indicate a greater sanctions risk.
Emerging Compliance Technology: New compliance technology, such as artificial intelligence tools and information sharing mechanisms can significantly reduce the sanctions risk associated with instant payment systems. In particular, OFAC notes that such emerging technologies can “enhance sanctions screening functions and reduce false positives”, and encourages financial institutions to integrate technology wherever possible in order to manage instant payment risk.
The Tango Card Settlement
The publication of the instant payment systems guidance on 30 September coincided with OFAC’s settlement with Tango Card Inc, following an investigation that ran from 2016 to September 2021. The investigation found that Tango Card had “deficient geolocation identification processes” that had caused multiple US sanctions violations, including the illegal transmission of 27,720 gift cards and debit cards worth $386,828.65. Those cards had been issued to individuals in a number of high risk sanctioned countries, including Iran, Syria, North Korea, Cuba, and Ukraine’s Crimea region.
While OFAC praised Tango Card’s voluntary disclosure of the violations, it pointed out that the card company should have known that it was delivering cards to customers within sanctioned jurisdictions. The investigation found that Tango Card had failed to implement risk-based measures to identify the non-compliant transactions or establish the location of card recipients, and had failed to implement sufficient “geo-blocking” features to restrict the sale of cards to such customers. While Tango Card did implement contractual provisions that required its direct customers to comply with sanctions provisions, it did not ensure that the cards were not passed to customers in sanctioned jurisdictions.
Following the investigation, OFAC emphasised that contractual provisions should not be used as a means to transfer sanctions liability since they do not mitigate sanctions risk, nor do they absolve persons of their own compliance liability.
As part of the settlement, Tango Card agreed to pay $116,048.60, as opposed to a maximum penalty of $9.2 billion. The relatively low fine reflected mitigating factors in the case, including Tango Card’s voluntary disclosure of its compliance failures and its subsequent cooperation with OFAC during the investigation. OFAC also commended the steps Tango Card subsequently took to address its failures, which included implementing geo-blocking measures to prevent card issuance to sanctioned jurisdictions, conducting compliance training, integrating new screening tools, and hiring a security consultant.
The Importance of Technology in Sanctions Compliance
The Tango Card settlement, and the subsequent OFAC guidance underline the importance of the risk based approach as a sanctions compliance priority for organisations that offer instant payment services, but also demonstrate the importance of technology in achieving that goal. Many of Tango Card’s sanctions violations could have been prevented with the better application of screening technology within its compliance infrastructure: high risk transactions, for example, would have been flagged automatically, while geo-blocking measures would have identified top line domains and prevented products being issued to designated countries.
Ripjar’s Labyrinth Screening platform was designed to help firms meet their sanctions compliance requirements including the challenges presented by instant payments. When a payment is initiated, Labyrinth enables real time searches of sanctions lists, watch lists, and other types of data, including thousands of adverse media sources. Labyrinth helps firms conduct accurate, efficient assessments of the sanctions risks they face, integrating machine learning technology to manage structured and unstructured data, and generate actionable intelligence in seconds.
To learn more about sanctions compliance risk for instant payment systems, contact us today.
Following the Russian invasion of Ukraine on 24 February 2022, Western countries, including the UK, the US, the EU, Canada, and Australia, imposed an unprecedented amount of sanctions against President Vladmir Putin’s regime. Those sanctions have included import and export bans, asset freezes, and travel bans, and focused on both degrading Russia’s ability to fund its military action and on punishing the individuals that fund it. Collectively, the global sanctions response against Russia has targeted hundreds of Russia entities, including banking and media organisations, and thousands of individuals, including military figures, politicians, and members of Putin’s elite inner circle.
On 6 October 2022, the EU issued its 8th package of sanctions against Russia. The new sanctions followed Russia’s declared annexation of four Ukrainian regions, and Putin’s repeated threats to use nuclear weapons against Ukrainian forces. The new sanctions package generally broadens the scope of existing EU Russia sanctions, banning the export of a wider range of goods to Russia, targeting more members of Putin’s elite, and depriving Moscow of billions of euros in revenue. The UK joined the EU in imposing new Russia sanctions.
Key measures from the EU’s latest Russia sanctions update include:
Ban on IT consulting, architectural, engineering, and legal services
While the EU had already sanctioned the provision of financial services to Russian entities, the new sanctions package extended that ban to include IT consultancy, architectural, engineering, and legal advisory services.
Crude oil price cap
While the purchase, import, or transfer of crude oil products originating in Russia was banned under the EU’s 6th sanctions package, under the 8th package the EU has banned the maritime transport of those products – subject to a price cap. Ths means that EU countries may now trade Russian oil with third countries as long as the price of that oil remains below a price cap set by the European Council.
New import and export bans
The EU has expanded its import bans to Russian iron, steel, jet fuel, plastics, machinery and appliances, vehicles, ceramics, textiles, footwear, jewellery, and certain chemical products. The new import restrictions are estimated to be worth around €7 billion.
The 8th sanctions package also expands export bans, with a focus on firearms, military goods and technology, and other products that could be used to develop Russia’s defence sector or fuel Putin’s aggression against Ukraine. The export ban specifically targets:
Goods and technologies with potential military use, including semiconductors, electronic integrated circuits, certain chemical substances and nerve agents.
Small firearms, and goods with no practical use other than torture, punishment, or degrading treatment.
Aviation products including certain oils, tyres, and brake pads.
Products that could enhance Russian industrial capacities, including certain types of coal.
RMRS Ban
The EU has applied a transaction ban to the Russian Maritime Register of Shipping (RMRS), which carries out classification and inspection activities of Russian and certain non-Russian ships. From 8 April 2023, any Russian vessel certified by the RMRS will also be banned from accessing EU ports and locks.
Crypto ban
The EU has tightened its existing restrictions on Russian crypto assets by issuing a complete ban on all crypt-asset accounts, wallets, or custody services to Russian customers. The ban previously only applied to assets worth more than €10,000.
Sanctions expansion to Kherson and Zaporizhzhia oblasts
The EU has expanded its trade and investment ban to the non-government controlled areas of Ukraine’s Kherson and Zaporizhzhia oblasts. The ban previously only applied to the non-government controlled areas of Donetsk and Luhansk oblasts. The expansion follows Putin’s order that Russian armed forces enter those areas.
Russian asset freezes
The EU has expanded the list of individuals subject to asset freezes, with two new designations:
PJSC Kamaz, a Russian military and vehicle manufacturer
The National Settlement Depository, Russia’s central securities depository
The EU has also introduced a mechanism to freeze the assets of persons that facilitate Russia sanctions evasion.
Sanctions Impact
The EU’s 8th package of Russia sanctions demonstrates the bloc’s commitment to maintaining pressure on Vladmir Putin’s regime while the conflict in Ukraine is ongoing, and requires firms within the EU to adjust their customer screening and monitoring solutions to account for new designations.
In practice, this involves collecting and analysing a diverse range of customer data, including sanctions list and watchlist data, and information from media sources from around the world. The Russia sanctions landscape evolves rapidly and, as revealed by European Commission Chief Ursula von der Leyen, the EU is already discussing a 9th package of sanctions “to hit Russia where it hurts to blunt even further its capacity to wage war on Ukraine”.
Given the scope of the Russia sanctions challenge, it is important to implement an automated screening solution with the power to manage vast amounts of customer data, and with the flexibility to adapt to evolving compliance requirements. Ripjar’s Labyrinth Screening platform is designed for exactly that purpose: integrating cutting edge machine learning technology, Labyrinth is capable of searching customer names against thousands of data sources, including sanctions lists, watch lists, and adverse media in over 20 languages. Labyrinth delivers real time results, and screens on an ongoing basis, enabling you to generate more accurate customer risk profiles, and know as soon as possible when that risk changes.
To learn more about Russia sanctions compliance screening, contact us today.
Ripjar was born out of the UK Intelligence Community; this heritage gives us a unique perspective on understanding how frequently national security risks cross-over into the risk management concerns of enterprise organisations, especially when it comes to addressing the compliance risks associated with economic sanctions. Today, Ripjar exploits powerful machine learning algorithms to discover threats, helping our customers around the world develop a better understanding of their risk exposure, in particular in this cross-over space of national security and enterprise risk.
Deployed by governments around the world, sanctions regulations are not just a question of checking names against a watchlist when doing business with high-risk clients but require companies to consider a spectrum of risks. Ransomware attacks, for example, may force a business to pay money to free up internal systems and, by doing so, unwittingly violate sanctions restriction, and incur significant financial or even criminal penalties.
Sanctions present an evolving regulatory risk for all businesses, but some organisations, such as telecommunications companies, with complex internal networks often spread across different jurisdictions, must be especially vigilant for emerging vulnerabilities, work harder to understand who is using their services, and be ready to adapt their compliance solutions as the global landscape changes.
Sanctions Threat
Sanctions are often seen as a big-ticket foreign policy and national security tool, used to target hostile regimes or their leaders to achieve diplomatic goals or punish crimes such as treaty violations or human rights abuses. Most recently, for example, Western countries acted collectively to impose an unprecedented number of sanctions against Russian oligarchs and politicians following Vladimir Putin’s unprovoked invasion of Ukraine in February 2022.
But sanctions are not just about punishing high profile leaders or personalities. In the 21st century, Western governments have trended towards ‘smarter’ sanctions that expose and curtail specific crimes and activities, including individuals funding and facilitating terrorist networks. Sanctions have become a multi-faceted tool to combat adversaries in a variety of ways, cutting off trade links, freezing assets, preventing travel, and addressing malicious activities such as cyber-attacks or ransomware attacks.
Sanctions Challenge
The complexity of modern sanctions is a significant compliance challenge – one that is increased by the potential scale and volume of the sanction’s requirements, which can change rapidly along with geopolitical events. The Russian invasion of Ukraine saw the US, the UK, the EU, and Canada, along with other countries impose over 18,000 sanctions against Vladmir Putin’s regime and its supporters, with a crippling effect on the Russia’s commercial landscape. Since then, as the conflict progressed, Western countries have expanded sanctions, adding 23% since the conflict began, including measures against Russia’s ally, Belarus.
For large telecommunications companies, the administrative burden of sanctions compliance, and in particular compliance with Russia-Ukraine sanctions programs, should be a priority. As Russia sanctions have expanded, so too have their compliance challenges. The National Crime Agency notes that the Russian oligarchs that have enabled their country’s aggression against Ukraine employ numerous strategies to evade sanctions, including using shell companies or proxies to transfer assets, making investments in foreign businesses, or selling assets (often at a loss) before sanctions measures kick in.
Adding to the challenge for larger companies, and especially telecommunications, is the volume of customers that must be monitored, and data that must be analysed. Some of these organisations have tens of millions of customers, meaning the scope of their compliance solution must cover multiple jurisdictions, and potentially account for multiple languages and naming conventions.
Importance of sanctions
While sanctions compliance is a challenge, it is important to remain focused on their impact and the positive benefits of their effective implementation. Telecommunications companies have the power to significantly aid national security objectives through effective sanctions compliance, not only cutting off support for international criminals, and identifying the proceeds of their crimes, but ensuring they are not able to use networking and digital services to move assets which may cause harm and damage in areas all over the world.
With that in mind, it is important that telecommunications companies keep an eye on the global horizon and be ready to adapt quickly and efficiently when new sanctions measures are introduced – not only to ensure their effectiveness, but to minimise risk and service disruption. Looking beyond the Ukraine invasion, the United States recently issued new restrictions on the export of microchips to China with the objective of preventing its development of advanced supercomputers for military applications. The Biden administration has signalled that it will be working on other ways to “strengthen America’s position against China” and will be urging its allies to follow suit in imposing new export restrictions.
The evolution of China sanctions demonstrates the speed with which the global landscape can change, and the constant state of readiness that firms must develop to deal with new compliance risks. With that challenge in mind, Ripjar works to help companies develop their own advanced sanctions and risk management solutions.
Jeremy Annis CEO, Ripjar Ltd
To learn more about how Ripjar can help you address sanctions risks, contact us today.
Ransomware is a type of malicious software that encrypts a target computer or network so that its owners cannot access their stored data. The criminals in control of the ransomware then demand money – a ransom – from their victims in order to enable access. Since ransomware attacks take place online, victims rarely know who they are paying ransoms to, or understand the regulatory compliance risks associated with such payments. In 2021, it is estimated that ransomware cost global businesses around $20 billion, with that figure expected to rise to over $256 billion by 2031. However it is notoriously difficult to gauge the real costs as many organisations will not admit to paying a ransom.
In response to the significant criminal threat, global regulators and law enforcement authorities are increasing their focus on detecting and preventing ransomware attacks by imposing a range of penalties against those that launch them. In the case of state sponsored attacks, that also includes imposing sanctions. However, whatever actions regulators take, it is crucial that organisations remain vigilant by understanding ransomware risks and how to avoid falling victim to an attack.
Ransomware and Global Sanctions
Ransomware attacks are a popular criminal methodology amongst international criminals – and are often used to work around the restrictions imposed by international economic sanctions.
The crippling effect of ransomware attacks mean that their victims may be inclined to make ransom payments to unknown criminals in order to free their data, despite the potential sanctions risk associated with doing so. Ransomware is such an effective way of thwarting sanctions measures and raising illegal funds that many ransomware attacks are sponsored by the governments of sanctioned countries, and deployed as part of extensive criminal campaigns targeting organisations in the media, energy, communications, and financial industries.
Recent examples of state-sponsored ransomware attacks include North Korea’s ‘Maui’ ransomware attack on US healthcare organisations in 2021, and Russia’s ‘NotPetya’ ransomware attack on Ukraine in 2017, which originally targeted financial, energy, and government networks but subsequently spread indiscriminately into Europe and back into Russia.
OFAC Ransomware Sanctions 2022
In September 2022, the US Treasury’s Office of Foreign Assets Control (OFAC) announced that it was imposing sanctions against several individuals and entities affiliated with Iran’s Islamic Revolutionary Guard Corps (IRGC).
The sanctions followed an OFAC investigation that revealed the individuals and entities were behind a series of ransomware attacks against networks owned by US and global organisations. OFAC was also able to link the attacks to a number of Iranian state-sponsored hacking groups, known to cybersecurity entities as Nemesis Kitten, DEV-0270, APT35, Charming Kitten, Phosphorus APT, and Tunnel Vision. The ransomware attacks perpetrated by those groups included:
An attack on a New Jersey municipality in February 2021 that exploited a Fortinet vulnerability.
An attack on Microsoft Bitlocker in March and April 2021, in which decryption keys were held for ransom. Numerous small businesses were impacted by the attack.
An attack on a US children’s hospital in June 2021 in which a group gained supervisory control of the network and of data acquisitions systems.
A series of attacks from June to September 2021 targeting transportation, healthcare, emergency services, education, and energy providers.
The IRGC-linked group sanctioned by OFAC is made up of employees and associates of Najee Technology Hooshmand Fater LLC and Afkar System Yazd Company. The list includes:
Managing directors Mansour Ahmadi (Najee Technology) and Ahmad Khatibi Aghda (Afkar System).
Employees of Najee Technology and Afkar System: Mojtaba Haji Hosseini, Mohammad Shakeri-Ashtijeh, Mo’in Mahdavi, Aliakbar Rashidi-Barjini, Amir Hossein Nikaeen Ravari, Mostafa Haji Hosseini, Ali Agha-Ahmadi, and Mohammad Agha Ahmadi.
Individuals linked to NET Peygard Samavat Company – as a result of links to the IRGC and the Iranian Ministry of Intelligence and Security.
OFAC’s sanctions mean that the assets of the Iranian persons designated have been frozen in the US, and US persons are prohibited from doing business with them. US firms that violate OFAC sanctions risk significant criminal penalties, while non-US firms risk being sanctioned themselves.
OFAC emphasised the damage that ransomware causes in the US, revealing that the cost of attacks reached “over $590 million in 2021” (up from $416 million in 2020). The US government suggests that figure does not reflect the true cost of the attacks which also covers the disruption of critical systems and ordinary businesses.
Ransomware Risks
The global ransomware threat is a significant anti-financial crime (AFC) priority – especially given the risk of violating sanctions by paying the criminals behind attacks. In March 2022, the Association of Certified Anti-Money Laundering Specialists (ACAMS) released a report on its Global Ransomware Risks Survey, which took in respondents from public and private sector organisations. The report set out a number of key findings, including:
Only 40% of respondents believed their organisation was shielded from ransomware attacks.
Only 41% of respondents considered ransomware attacks as part of their sanctions compliance programs.
Only 24% of respondents were familiar with the potential sanctions compliance risk of paying ransoms to criminals.
Only 20% of respondents felt that their government authorities were doing a good job of protecting companies against ransomware attacks.
Almost 50% of respondents believed that they would be targeted by a ransomware attack in the next 12 months.
The ACAMS report reveals a need for firms around the world to strengthen their sanctions compliance programmes to account for the ransomware threat. In practice, this means implementing suitable cyber-security measures to detect and prevent ransomware attacks, and – should an attack happen – ensuring that they do not violate sanctions compliance regulations by making ransom payments. Firms may address the ransomware sanctions compliance risk in a variety of ways, including:
Reviewing their networks regularly for vulnerabilities to ransomware and other cyber-attacks.
Either directly or working with a Managed Security Service Provider (MSSP), implementing appropriate cyber-security measures across their network, including software solutions and employee training.
Implementing a ransomware sanctions compliance response should an attack take place.
Involving sanctions compliance teams and anti-money laundering (AML) teams in ransomware compliance policies and procedures.
Investing in ransomware insurance.
The ACAMS study revealed that only 24% of respondents were aware of the point at which they should elevate a ransomware attack to a financial crime compliance priority, while only 53% of respondents were aware of the terms of their ransomware insurance – and what they needed to do to comply with the terms of their coverage.
Ransomware Compliance
Addressing the sanctions compliance risk associated with ransomware requires firms to make decisions about customers and risk factors quickly. To meet that challenge, firms must collect and analyse a vast amount of data, and use that data to inform compliance processes before and during a potential ransomware attack. In practice, this means implementing an automated software platform as part of a sanctions compliance solution.
In September 2022, following OFAC’s sanctions announcement, cyber-security firm Secureworks confirmed the link between the designees and the IRGC. The confirmation followed a similar Secureworks Counter Threat Unit (CTU) investigation in May 2022 that revealed a link between ransomware attacks from the Cobalt Mirage group and the Iran-linked Phosphorus APT group.
As part of a next-generation risk management approach, Labyrinth Intelligence and Labyrinth Screening are two powerful tools used in the fight against ransomware and other types of financial crime. Integrating cutting-edge knowledge graph and machine learning technology, Labyrinth enables firms to make sense of complex, diverse, structured and unstructured data. It also enables real-time searches against thousands of global data sources including sanctions lists, watchlists, and adverse media sources, in 22 languages, seamlessly blending data to deliver actionable compliance intelligence.
In a constantly shifting sanctions and regulatory landscape, Labyrinth offers a way for firms to stay on top of customer activities and adapt quickly to emerging risks such as ransomware.
To learn more about how Ripjar can help your firm address ransomware risks, contact us today.
As an influential global power, the UK imposes economic sanctions in order to punish wrongdoing, maintain peace, and achieve foreign policy goals. UK sanctions are developed, implemented, and enforced by a number of governmental organisations, and the names of their relevant designated targets are featured on sanctions lists. UK entities are typically forbidden from doing business with sanctions targets and must check the UK sanctions list to ensure that they are not violating the law. UK economic sanctions typically consist of prohibitions on trade and transactions in general, investment, and business relations, and may target entire countries, organisations, or individuals.
The UK’s sanctions landscape changes constantly, with new designations added and withdrawn regularly. In February 2022, for example, along with other Western countries, the UK moved quickly to impose what Prime Minister Boris Johnson called “the most severe package” of economic sanctions against Russia, with businesses expected to comply with new restrictions as they were introduced. Similarly, the UK recently introduced a new global human rights sanctions regime (GHSR), intended to target individuals around the world (rather than entire countries) that commit serious breaches of human rights.
UK sanctions are implemented under the authority of the Sanctions and Anti-Money Laundering Act 2018. Given the complexity of the regulatory regime, it is important that businesses understand how these sanctions work, and how to remain compliant in a changing regulatory environment.
Who Imposes Sanctions in the UK?
The following government departments and bodies are responsible for the management and implementation of the UK’s sanctions regime:
The Foreign, Commonwealth and Development Office (FCDO): The FCDO, formerly known as the Foreign and Commonwealth Office (FCO), is responsible for developing and implementing the UK’s sanctions policy. That work includes setting out all international sanctions regimes and their designations. The FCDO is also responsible for negotiating the UK’s international sanctions, which means working with legal officials and economists to devise the substance and duration of restrictive measures against foreign targets, while considering their impact on UK interests.
The Office of Financial Sanctions Implementation:OFSI is the department of HM Treasury tasked with ensuring that sanctions are implemented correctly and that they “make the fullest possible contribution to the UK’s foreign policy and national security goals”. In practice, OFSI is responsible for enforcing the country’s sanctions, including assessing breaches of regulations, and imposing monetary penalties for violations. OFSI maintains and publishes sanctions guidance and resources for UK firms in order to promote regulatory compliance.
Department for International Trade: The DIT maintains a special unit known as the Export Control Joint Unit that is responsible for implementing the trade sanctions and embargoes set out in the UK sanctions regime.
Department for Transport: The DfT is responsible for the implementation of transport sanctions. In practice this relates to the movement of ships and aircraft in jurisdictions controlled by the UK.
Home Office: The Home Office is responsible for implementing travel bans against countries and individuals designated by UK sanctions.
HM Revenue and Customs: HMRC is responsible for enforcing breaches of trade sanctions, including imposing monetary penalties against those responsible.
National Crime Agency: The NCA works with other UK authorities and government departments to investigate and enforce breaches of the country’s sanctions.
Types of UK Sanctions
UK sanctions vary by their targets and by the severity of the issue they are intended to address. The most common types of UK sanction measures include:
Asset freezes: Targeted asset freezes may be deployed against individuals and entities, blocking access to funds and other economic resources such as property.
Market restrictions: The UK may restrict access to financial markets and financial services for sanctions targets. This type of restriction may be applied as embargoes, investment bans, capital access restrictions, restrictions on the provision of advisory services, and directions to cease business relationships or activities.
Directions to cease business: UK authorities may direct specific types of business or person to cease all business with sanctions targets.
Travel bans: The UK may impose travel bans on foreign sanctions targets or restrict travel to and from a target country.
Sanctions Risks in the UK
Most individuals and companies seek to adhere strictly to UK sanctions in order to avoid aiding criminals and exacerbating international conflicts and human right abuses. However, persons that fail to comply risk criminal prosecution, financial penalties, and significant reputational damage.
HM Treasury may impose sanctions penalties following an investigation of a violation in which wrongdoing is found. Criminal punishments for sanctions violations include a maximum of 7 years imprisonment. Exact financial penalty amounts vary by the severity of the offence and are imposed under the following criteria:
Monetary penalties for sanctions violations may be imposed up to a value of 50% of the breach, or up to £1 million (if that amount is greater than the value of the breach).
OFSI takes the facts of individual cases into account when deciding on penalty amounts and may apply reductions where cases have been voluntarily disclosed.
How to Comply with UK Sanctions
UK firms must be ready to screen new customers against the relevant sanctions lists both at onboarding and throughout the business relationship. In practice, this means matching new and existing customer names against the UK sanctions list, which is updated regularly with new designations.
It is important that the sanctions screening process is conducted thoroughly, efficiently, and accurately, and captures the level of compliance risk that each customer presents. With this in mind, UK firms must ensure their sanctions screening solution is supported by the following measures and controls:
Transaction screening: Firms must screen customer transactions for signs of suspicious activity, including transactions with counterparties that feature on the UK sanctions list.
Adverse media screening: News stories may indicate that a customer has been sanctioned or is likely to be sanctioned before that information is confirmed by official sources. Accordingly, firms should screen foreign media sources for stories that indicate a customer’s sanctions status has changed.
Next Generation Sanctions Screening
The Russian invasion of Ukraine, and the subsequent package of sanctions imposed against Vladimir Putin’s regime demonstrate just how quickly the UK sanctions landscape can change. While the first round of Russia sanctions was announced in February 2022, new measures quickly followed throughout March, April, June, and July. Adding to the challenge, the UK government introduced new sanctions enforcement regulations, further increasing the compliance burden on UK firms.
To achieve UK sanctions compliance, firms should implement a screening solution that meets the unique challenges of their environment. Ripjar’s Labyrinth Screening solution has been designed with that challenge in mind, integrating next-generation name matching software capable of analysing real time data from global sanctions and watch lists, and from adverse media sources across 21 languages. Our solution utilises artificial intelligence to make balanced risk management decisions about client profiles – and to ensure that you are informed whenever new risks emerge.
To learn more about how Labyrinth Screening can support your UK sanctions compliance and global sanctions risk management, get in touch with Ripjar today.
The sanctions enforcement measures included in the Economic Crime Bill will bring the UK sanction regime into closer alignment with US sanctions programmes and will, according to OSFI Director Giles Thomson, ‘strengthen OFSI’s ability to take appropriate enforcement action against persons…that fail to ensure they are not dealing with sanctioned entities’.
With the new rules now in effect, it is crucial that UK financial institutions understand their sanctions compliance obligations.
OFSI Sanctions Enforcement Powers
The rules set out in the Economic Crime Act concern sanctions enforcement and monetary penalties for persons that breach sanctions regulations. As of 15 June, 2022, the following measures are in effect:
Strict liability: Breaches of UK sanctions regulations will be evaluated on a strict liability basis regardless of an individual’s intent or knowledge that they were in violation.
Proportionate penalties: OFSI has the power to impose monetary penalties for sanctions breaches ‘proportionately and effectively’ and where it is ‘in the public interest to do so’. The rules emphasise the importance of self-disclosure and attempts to prevent sanctions breaches as mitigating factors in any subsequent punishment.
Publication of breaches: OFSI has the power to make the details of sanctions breaches public where a monetary penalty has not been imposed.
Penalty reviews: Senior UK officials may now conduct reviews of monetary penalties for sanctions breaches, in addition to UK ministers.
The Changing Sanctions Landscape
The OFSI sanctions enforcement changes are designed to make the UK’s sanctions regime more impactful and responsive to global threats.
Prior to 15 June, OFSI was not able to prosecute sanctions breaches unless there was ‘reasonable cause to suspect’ that the person breaching the rules knew that they were doing so. This meant that many sanctions violations went unpunished as a result of a lack of supporting evidence – and allowed sanctions targets to continue to perpetrate illegal activity.
Similarly, where a sanctions breach previously did not result in a monetary penalty, OFSI was unable to release details of the persons responsible to the public. Under the new rules however, firms will still risk reputational damage for sanctions violations even if they are not punished financially.
Finally, by extending the power to review sanctions penalties to senior officials, OFSI intends to speed up the UK’s sanctions enforcement process and ensure that the measures remain a useful diplomatic deterrent.
The fast-tracking of the Economic Crime Act, and its relevant sanctions enforcement measures, reflects the UK’s attitude to ongoing Russian aggression in Ukraine, and the threat that poses to regional and global stability. The UK’s reputation as a financial destination for Russian oligarchs, including members of President Vladimir Putin’s elite inner circle, meant that a huge amount of Russian assets were held in UK banks and financial institutions when the invasion began. With that in mind, UK sanctions against Russia represent a significant part of the collective global response to the invasion, and the 2022 enforcement measures a way for OFSI to act more decisively against organisations and individuals that take action to prolong the hostilities.
UK Business Challenges
OFSI’s new sanctions rules, and in particular the introduction of strict liability, require UK businesses to review their sanctions screening solutions carefully. In the context of Russia’s war with Ukraine, and the global sanctions landscape, new designations are added and withdrawn from watchlists regularly, which means UK firms must ensure that their solutions are updated continuously to ensure they are not doing business with the UK’s Russian sanctions targets, or any targets on the UK government’s autonomous sanctions watchlist.
Given the urgent need for sanctions compliance, UK firms must implement a screening solution capable of collecting and analysing vast amounts of customer and transaction data, and of reacting to a constantly changing regulatory environment. In practice this means:
Conducting suitable due diligence to establish customer identities and build accurate customer risk profiles.
Screening customer transactions for suspicious activity.
Following Russia’s invasion of Ukraine, the UK joined the international community in condemning Vladimir Putin’s regime and in issuing an unprecedented package of severe economic sanctions. While its international actions have been swift and significant, the UK government has also announced that it will be taking major steps with domestic legislation to detect and prevent members of Russia’s elite – so-called ‘oligarchs’ – from misusing the economic system.
To that end, Prime Minister Boris Johnson has brought forward plans for the UK’s new Economic Crime Bill, in order to enable financial institutions and authorities to target Russian oligarch finances held in UK banks. Prime Minister Johnson said that the bill would ensure that President Putin and his supporters would have “nowhere to hide” their illegal money.
What is the Economic Crime Bill?
The Economic Crime (Transparency and Enforcement) Bill is a long-awaited legislative measure intended to target the anonymity of money launderers that exploit the UK’s financial system. Britain’s legal and financial community has urged the government to implement the Economic Crime Bill for years. First drafted in 2018, the bill was delayed as new priorities emerged: the invasion of Ukraine changed those priorities, prompting the UK government to fast-track the legislation, along with additional financial measures to follow in coming months.
The Economic Crime Bill was introduced into the UK’s Parliament on 1 March 2022. The new version of the bill contains the following legislative measures:
Overseas Entities Register
The Economic Crime Bill introduces a UK register of overseas entities that own property in the UK. The register will include information on the beneficial owners of those entities. UK companies are already required to provide beneficial ownership information to a register of People with Significant Control (PSC) and the new rules are intended to create parity for foreign entities.
The register will be retroactively applicable, extending to properties bought by foreign persons up to 20 years ago in England and Wales, and to properties bought since December 2014 in Scotland. Noncompliance with the regulations may result in fines of up to £500 per day, and prison sentences of up to 5 years.
Unexplained Wealth Orders
Unexplained Wealth Orders (UWO) require their targets to explain the source of their assets, including their properties, to the authorities. Where that explanation is unsatisfactory or inadequate, the authorities may assume the asset was obtained unlawfully, and confiscate it from its owner.
UWOs were introduced in the UK in January 2018 with the goal of addressing foreign criminals laundering money through property ownership. However, UWOs have proved difficult to enforce: only 9 UWOs have been issued since their introduction, with the most recent case ending in defeat for the UK’s National Crime Agency (NCA) at a cost of £1.5 million to the taxpayer. No UWOs have been issued since 2020.
The Economic Crime Bill has been designed to make UWOs easier to issue and enforce. Under the new rules, law enforcement authorities:
Will have a longer period of time in which to review materials presented in response to a UWO.
Will incur lower legal costs if an UWO prosecution is ultimately unsuccessful.
Will be able to issue UWOs to the directors, officers, and trustees of a target asset, making it easier to address property ownership hidden behind foreign corporate structures.
Sanctions Enforcement
The Economic Crime Bill also reforms the UK’s sanctions enforcement rules by introducing strict liability for noncompliance. Under the current system, the Office for Financial Sanctions Implementation (OFSI) can only prosecute sanctions breaches if it has ‘reasonable cause to suspect’ that the person involved knew they were breaking the rules. New measures in the Economic Crime Bill will introduce a ‘strict civil liability test’, enabling OFSI to impose financial penalties for sanctions breaches regardless of any awareness of wrongdoing.
The introduction of strict liability will make it easier for OFSI to impose fines, and punish sanctions noncompliance. The new rules will also allow OFSI to publicly release the names of organisations that breach sanctions but that do not receive a fine.
Economic Crime Bill: Compliance
Given the current escalation in sanctions activity against Russia and against Russian oligarchs and politicians, it is vital that firms stay ahead of their regulatory responsibilities. In practice, this means implementing an effective risk management process that enables fast, efficient client name matching.
Ripjar’s risk screening solution integrates next generation name-matching software to ensure you maximise true positive hits on global sanctions and watchlists, and minimise false positives, across a range of language systems and character sets. Powered by machine learning technology, our solution includes advanced adverse media monitoring tools capable of analysing a spectrum of news sources across 21 languages in order to ensure you are informed as soon as your client’s risk profile changes.
Give yourself the best opportunity to understand and mitigate risks early: speak to Ripjar about how our screening technology can deliver significant commercial advantages.
Get in touch to learn how Ripjar can help your compliance with the Economic Crime Bill.