FCA tells UK firms to bolster financial crime and sanctions controls

Over the past year, the FCA has undertaken an assessment of sanctions compliance systems and controls in more than 90 firms across various UK sectors, including retail and wholesale banking, wealth management and insurance, using analytics-based and intelligence tools to proactively evaluate each firms’ ability to mitigate sanctions risks.

Hinesh Shah, forensic accounting expert at Pinsent Masons, said: “This comprehensive review by the FCA underscores the critical importance of financial services firms' sanctions systems and controls in preventing financial crime, especially in light of the extensive sanctions imposed following the Ukraine crisis.”

He added: “It is encouraging to see examples of good practice identified, such as proactive risk assessment and appropriate calibration of sanctions screening tools, but it is also clear that there's work to be done. Firms must heed these findings, adapt swiftly, and engage with the FCA to enhance their sanctions readiness.”

Notably, firms that had proactively prepared for potential sanctions prior to the Russian invasion of Ukraine in February 2022 demonstrated a more effective response to UK sanctions implementation. The ability to monitor and evaluate the efficacy of sanctions through management information (MI) was a pivotal factor, the FCA said, along with the alignment of sanctions reporting with UK regulations.

However, the regulator also found that some firms struggle to provide senior management with adequate information regarding their exposure to sanctions, relying on global sanctions policies that do not align with the UK's regime. While some firms demonstrated well-calibrated tools tailored to UK sanctions requirements, others relied excessively on third-party providers without sufficient oversight.

The review also found that resource allocation as a critical issue, with some sanctions teams understaffed and ill-equipped to prevent backlogs in handling sanctions alerts. The FCA said those firms with substantial backlogs face unacceptable risks of non-compliance with sanctions obligations.

Customer due diligence (CDD) and know your customer (KYC) procedures were also highlighted. The FCA reported instances of ineffective CDD and KYC assessments, which increase the risk of firms failing to identify sanctioned individuals or connected parties and corporate structures subject to sanctions. Furthermore, the regulator said the timeliness of reporting potential breaches or relevant sanctions information was inconsistent across firms.

Stacy Keen, financial crime expert at Pinsent Masons, said: “The key themes emerging from the review are not unexpected. Firms that anticipate the imposition of sanctions restrictions in response to ‘global events’ are in a better position to assess exposure to risk.”

“A key aspect to mitigating financial sanctions risk is ensuring that data held by firms on customers, intermediaries, clients and service providers – to name a few – is current and comprehensive so that risk exposure can be assessed as and when sanctions are imposed,” Keen said.

She added: “This data should – on a risk-based basis – include the owners and controllers of corporate entities so that sufficient sanctions screening can be conducted to identify entities caught by financial sanctions restrictions solely because of their ownership or control structure.”

The FCA said it expects all regulated firms to consider the review’s findings seriously and to reassess their approach to identifying and mitigating sanctions risks, taking corrective measures where necessary. It told firms to consult its Financial Crime Guide and SYSC 6.3 of the FCA's Handbook, as well as relevant guidance from the Joint Money Laundering Steering Group (JMLSG).

The FCA review comes after an unprecedented increase in UK sanctions following the Russian invasion of Ukraine in February 2022. Last month, the Office of Financial Sanctions Implementation (OFSI), which is responsible for implementing and enforcing financial sanctions in the UK, issued a ‘disclosure notice’ against Wise Payments Limited, an FCA-regulated firm for breaching Russian sanction regulations. OFSI alleges that Wise authorised a £250 payment to an unnamed designated person on the UK’s sanctions list.