The main points of the case and the issues it involved are outlined by Rahman Ravelli’s Syed Rahman and Ulrich Schmidt.
The Bank of Scotland (BoS) has been fined £160,000 for breaching the Russia sanctions regime.
The Office of Financial Sanctions Implementation (OFSI) imposed the penalty on BoS (which is part of Lloyds Banking Group), in accordance with section 146 of the Policing and Crime Act 2017. It was imposed for breaches of the Russia (Sanctions) (EU Exit) Regulations 2019 (the Russia Regulations), namely regulation 11 and regulation 12; which relate to dealing with, and making funds available to, a designated person.
Between 8 February and 24 February 2023, BoS processed 24 payments, totalling £77,383.39, to or from a personal current account held by an individual designated under the Russia Regulations.
In that period, the bank processed four payments which were credited to the account totalling £76,000.00. It also processed 20 payments which were debited from the account between 13 February and 23 February 2023, totalling £1,383.39. OFSI concluded that the processing of these 24 payments breached regulation 11 of the Russia Regulations. The four payments that BoS processed to the account were transferred from a separate account held at BoS. OFSI found this to be a breach of regulation 12 of the Russia Regulations.
Lloyds Banking Group formally disclosed these breaches on behalf of BoS on 16 March 2023. This led OFSI to view BoS as being eligible for a voluntary disclosure discount. The maximum 50% voluntary disclosure discount was applied to the penalty, reducing it to £160,000.
Variation
The account in question had been opened on 6 February 2023 at the Halifax bank (a trading division of BoS) by a British person who had been designated by the UK in 2020. When opening the account, the person used a UK passport for identification that contained a spelling variation of their name. No automatic sanctions alert was triggered against the account when it was opened or when the transactions were carried out; due to the inability of the bank’s automatic sanctions screening system to identify the designated person.
A politically exposed persons (PEP) alert was raised on 20 February 2023 as part of Lloyds Banking Group’s automatic PEP screening. The variation of the designated person’s name that was used to open the account was a match against an entry contained in the commercial list Lloyds Banking Group had downloaded to enhance its PEP screening.
At the time, Lloyds Banking Group did not use a commercial sanctions list to enhance its sanctions screening. OFSI does not order firms to obtain and use such commercial lists, but it expects firms with greater sanctions risk exposure to take such an enhanced approach to screening.
Lesson
In its findings, OFSI emphasised the failure to generate an automatic sanctions alert when the account was opened. It also highlighted a four-day delay in acting once the designated person’s identity had been established during the PEP review - during which, £75,000 was paid into the account.
The case is a concise lesson on the need for firms to make sure their sanctions screening tools are fit for purpose. Firms with greater sanctions risk exposure may need to use commercial packages, such as commercial sanctions lists, to ensure they meet their obligations. Firms also have to have robust procedures in place so a situation can be acted on promptly as soon as it arises. Such measures can only be effective if staff training is appropriate, subject to regular review and revised when necessary to meet any challenges that may arise.
