⚠️ Has your firm assessed your exposure to sanctions risks and put in place policies and procedures to mitigate these? ⚠️
If not, we strongly encourage you to do so in light of the increased focus on this area for law firms of all shapes and sizes.
It seems likely that we will see an increase in fines imposed by OFSI (the Office of Financial Sanctions Implementation) and possibly OTSI (the Office of Trade Sanctions Implementation) over the coming months and years, which will likely include law firms (both in and out of scope of the Money Laundering Regulations) in light of recent cases and OFSI’s recently published Legal Services Threat Assessment Report (we’ll update you on that shortly!).
The sanctions regime has been a big news item for some time now and the SRA is placing increased focus on law firms having sanctions-specific risk assessments and policies in place, as can be seen in their guidance and their program of sanctions-specific on-site inspections. Now we are seeing OFSI taking enforcement action for breaches of the Russia Sanctions Regime. In October 2024 a concierge company providing services to high-net-worth individuals was fined £15,000 after providing property management services to a sanctioned person (including rent collection), and in March 2025, the first law firm was fined £465,000 by OFSI (as referred to in our April quarterly update) for making payments to sanctioned persons subject to asset freezes.
On the back of that case, OFSI published a blog which highlighted 3 key lessons for businesses to learn from:
- Understand your exposure to sanctions risks: Carry out a firm wide risk assessment, thinking about your client base, the jurisdictions you deal with, and the type of work you carry out (in particular in the field of trade, shipping, aviation) to list a few considerations. It is important to remember that there are plenty of people and entities on the sanctions lists which are based in the UK, so do not assume that your exposure is nil simply because you only deal with clients/ third parties here in the UK.
- Adhere properly to any sanctions policies and processes in place in your organisation: The main thrust of your approach to mitigating risks in this area will likely be to carry out due diligence on your clients, including beneficial owners of entity clients, and screen them and third parties connected to the service you are providing for sanctions. Most electronic ID & verification providers will screen for sanctions as standard. Alternatively, OFSI’s free consolidated list tool can be used to screen for financial sanctions, and FCDO’s free sanctions list tool can be used for trade, transport and immigration sanctions (although beware, these free tools do not provide ongoing monitoring and are simply a snapshot at the time of the search). Whatever tool you use, we recommend you document this in your policies.
- Fully consider ownership and control: Whilst your client entity itself may not be on a sanctions list, the individual with ultimate control of it may be. It is therefore vital to properly understand who your client is and who is ultimately pulling the strings. This may not necessarily be the majority shareholder(s) – there may be someone who has divested themselves of shares to disassociate themselves from the entity, but still has the ability to, for example, fire the board. If that person is themselves sanctioned, the entity will be deemed to be sanctioned too. This is what makes the sanctions regime a particularly slippery beast! As ever, document your thought process and findings.
Please also ensure you have trained your staff on sanctions risks and red flags, and the importance of reporting any concerns about sanctions breaches internally immediately, so that the firm can consider their external reporting obligations. OFSI has made it clear in recent cases and in their enforcement guidance that they value prompt voluntary disclosure of breaches and will generally assess this as a mitigating factor when it comes to enforcement action and the level of monetary penalty (with reductions up to 50%).
The SRA recently updated their sanctions guidance webinar, which is worth a watch and can be viewed here.
We can also assist with training and have a sanctions risk assessment and policy template which you may wish to use as a starting point to get you going if you haven’t already got such processes in place.
Do reach out if we can help you.