On 5 August 2021, the UK’s Office of Financial Sanctions Implementation (“OFSI”) published details of a £50,000 penalty imposed on TransferGo Limited (“TransferGo”), a UK-based fin-tech company specialising in international money transfers, for breach of EU sanctions against Russia. This penalty highlights that the UK remains serious about enforcing financial sanctions breaches and that the consequences of misinterpreting or adopting an overly narrow interpretation of UK sanctions can lead to negative consequences.

BACKGROUND

Between 20 March 2018 and 18 December 2019, TransferGo made 16 transfers worth a total of £7,764.77 to individuals with bank accounts at the Russian National Commercial Bank (“RNCB”), an entity subject to an asset freeze under the EU sanctions against Russia. TransferGo had taken the position that, because the beneficiaries of the payments were not subject to an asset freeze, transfers to RNCB would not breach EU sanctions. OFSI refuted that position in its decision, ruling that TransferGo’s actions resulted in funds being made available to RNCB. OFSI reasoned that funds held by a bank on behalf of its customers belong to the bank.

In April 2018, OFSI received a suspected breach report, which identified some of the transfers made to RNCB. OFSI’s public statement does not specify who made the report, though it appears almost certain that it was not made by TransferGo itself, given OFSI’s statement that TransferGo did not voluntarily self disclose the transactions. The breach report led OFSI to investigate TransferGo, identifying additional transfers to RNCB.

COMMENTARY

TransferGo’s penalty is OFSI’s fifth enforcement action since it gained the power to apply civil penalties in 2017. Although relatively low in value (especially compared to the £20.47 million fine imposed on Standard Chartered Bank in February 2020), it raises a number of important considerations for any entity doing business in the UK:

• OFSI can impose civil penalties of up to the greater of (i) £1 million, or (ii) half the value of the breach. In this case, because 16 transfers in breach of UK sanctions were identified, the maximum possible penalty was £16 million. The fact that TransferGo’s was fined only £50,000 (which did not include any discount for self-reporting) suggests that OFSI continues to make significant adjustments to “maximum” penalty amounts to ensure that they are reasonable and proportionate to the breaches in question. That makes it less likely that OFSI’s penalties will reach the fine amounts often imposed by the U.S. authorities, except when the value of the breach is very significant.
• This case appears to have come to OFSI’s attention through a suspected breach report filed by a third party. The risk of sanctions issues surfacing in this way is significant in the UK in particular because the UK imposes a positive duty on financial institutions and professional services firms to report known or suspected sanctions breaches. Businesses operating in the UK should be mindful that, if they decide not to self report, their professional advisers may be required to do so.
• TransferGo appealed OFSI’s penalty through the statutory appeal process, which involves review by a government minister. In other cases, such reviews have resulted in reductions of civil penalties. In this case, however, the review process does not appear to have changed the outcome.
• TransferGo’s attempts to remain anonymous in connection with the announcement of the penalty were rejected by OFSI and the government minister reviewing the case. The government minister concluded that it was in the public interest and contrary to OFSI’s objectives for this enforcement action to remain anonymous. That outcome is in line with OFSI’s guidance, and confirms that it will be difficult for a company subject to OFSI’s enforcement action to justify anonymity, except in the most exceptional circumstances.
• TransferGo is regulated by the UK’s Financial Conduct Authority (“FCA”), the main UK financial regulatory body. As a regulated firm, TransferGo is obliged to maintain systems and controls to prevent financial crime, including sanctions violations. It remains to be seen whether the FCA will launch a separate investigation or enforcement action against TransferGo, particularly given OFSI’s criticism of TransferGo’s apparent misunderstanding of its sanctions obligations.

Although this is the first penalty imposed since the UK implemented its post-Brexit autonomous sanctions regime, it related to conduct occurring prior to 1 January 2021. As a result, it was technically imposed for breaches of EU, rather than UK, sanctions. OFSI’s penalty report emphasised that OFSI would continue to enforce breaches of EU sanctions committed at the time when those sanctions applied in the UK, despite the new era of UK autonomous sanctions.