Many significant developments took place in 2023 across the
landscape of corporate crime, and we can expect to see more in
2024. In particular, we expect three areas to come under increased
scrutiny: sanctions, deferred prosecution agreements
(“DPA“) and commercial corporate
liability.
As the war in Ukraine enters its third year, we expect that
sanctions will continue to spearhead the international political
and legal agenda with enforcement likely to ramp up, assisted by
expanding resources, new disclosure requirements and improved
international cooperation. An increase in activity can also be
expected in relation to DPAs, with the end of 2023 seeing the Crown
Prosecution Service (“CPS“) concluding
its first DPA. With 2024 also marking the 10th
anniversary of the legislation introducing DPAs, we expect to see
an increase in companies monitoring and updating their financial
crime compliance procedures, in response to the CPS’s newfound
recognition of the agreements.
Finally, the end of 2023 saw the Economic Crime and Corporate
Transparency Act (the “ECCTA“) come into
force, a significant and welcome step in corporate criminal
liability which we expect will drive further constructive change in
compliance behaviour and corporate self-regulation. We expect the
new offence of failure to prevent fraud to result in many companies
augmenting or adjusting their compliance systems, as they look to
avoid potential legal action. And the expansion of corporate
criminal liability to include the acts of “senior
managers” – a term that is sure to be litigated –
will lead to much action in and out of court.
The legal landscape has shifted, and both companies and
individuals need to make sure they’re prepared for what lies
ahead in 2024 and beyond. Here, we lay out what you can expect.
Sanctions
We expect that sanctions, particularly those relating to Russia,
will remain at the forefront of the international political and
legal agenda. In response to Russia’s invasion of Ukraine in
2022, the UK has so far designated 1950 persons (1681 individuals
and 269 entities) for the purpose of an asset freeze.1
These include many of the wealthiest Russian individuals and
largest Russian companies, with business and other ties around the
world, making dealing with Russian sanctions by many measures more
complex than any previous set of sanctions.
Russian sanctions are highly unlikely to become any less
restrictive in the near term, as Western governments have been
unanimous in their view that the sanctions must remain in place at
their current level (if not strengthened) until such time as a
durable peace agreement is reached in Ukraine.
Many significant developments took place in 2023, and more are
expected in 2024.
2023
Enforcement
While it is understood that the pace of investigation into
breaches of sanctions is increasing, which may bear fruit in 2024,
2023 shows only a small increase in enforcement in the UK. In 2023,
the Office of Financial Sanctions Implementation
(“OFSI“) issued nine fines, with three
exceeding £50,000, and seven warning letters in response to
breaches that did not warrant public enforcement
action.2 This is an increase from eight fines, with two
exceeding £45,000, in 2022,3 but remains less than
expected, given the significant broadening of sanctions.
In 2022-2023, OFSI recorded 473 suspected breaches of financial
sanctions (excluding oil price cap and counter-terrorism breaches).
This is a significant increase on the 147 suspected breaches
recorded in 2021-2022. This increase was expected given the scale
of increased Russia sanctions, and OFSI’s increased enforcement
capabilities.4
OFSI has been granted significant new powers over the years, and
in 2023, it used its disclosure powers for the first time to
publish details of a breach on its website. The disclosure powers
are to be used for breaches that are moderately severe: too serious
for a simple administrative warning but not serious enough to
warrant a civil monetary penalty.5 The first target of
the powers was Wise Payments Limited
(“Wise“), which had breached regulation
12 of The Russia (Sanctions) EU Exit Regulations 2019 (the
“Russia Regulations“), as reported by
OFSI on 31 August 2023.6 A cash withdrawal of £250
was made from a business account with Wise held by a company owned
or controlled by a designated person under the Russia Regulations.
In permitting the withdrawal, Wise breached the prohibition on
making funds available to a company owned or controlled by a
designated person. Despite the low breach value, OFSI considered
Wise’s systems and controls, specifically its policy
surrounding debit card payments, to be inappropriate. Mitigating
factors included Wise’s voluntary disclosure, lack of
deliberate sanctions evasions and remedial actions undertaken by
Wise. OFSI is expected to continue to use its disclosure powers in
cases of similar gravity.
Licensing
The distinctive nature of the targets of the Russian sanctions,
many of whom own property and/or reside in the UK, has made the
question of licensing more important than ever before, since
licences may be needed to employ locals and pay UK vendors.
Decisions were taken on 503 cases, up from 170 in the previous
reporting period; 164 licences were granted in relation to the
Russian sanctions regime. OFSI issued 21 general licenses in
connection with the Russian sanctions regime.
In 2023, for the first time, OFSI’s refusal to grant a
licence in the requested terms led to a judicial review hearing,
which was ultimately unsuccessful. On 26 October 2023, the Court
heard a judicial review application made against OFSI by Mikhail
Fridman, a designated person, under section 38(2) of the Sanctions
and Anti-Money Laundering Act 2018
(“SAMLA“).7 After
designation, Mr Fridman, who owns a large property in London was
granted licences to cover many payments, including utility bills,
insurance premiums, legal fees and certain domestic staff payments.
But he was refused licences for some requested household staff
payments, as well as payments for internal phonelines and audio and
TV equipment.8
Fridman challenged the refusal by way of judicial review,
arguing that OFSI should have granted him licences because his
requests met the basic needs derogation, routine holding and
maintenance derogation and prior obligation derogation. But the
High Court upheld every single refusal by OFSI. For the staff,
while OFSI had the statutory power to grant the licence, the High
Court ruled that it had acted rationally in refusing to allow the
payment of drivers, a housekeeper and personal chefs, including
because a purpose of the sanctions regime was to prevent designated
persons from continuing the lifestyle they had enjoyed before being
sanctioned.9 OFSI had also acted reasonably in not
considering the phonelines and equipment to be a basic need.
The case showed that OFSI will grant licences for what are truly
basic needs, but it retains broad powers to refuse licences for
anything that falls outside those boundaries.
Legal and Trust Services Prohibition
In line with the EU, the UK has continued to restrict the
general provision of services where it is considered useful to
support the aim of sanctions.
In December 2022, the UK issued new prohibitions limiting
designated persons and persons connected with Russia from accessing
trust services provided by UK persons. Pre-existing trust services
can still be provided to persons connected with Russia (Russian
citizens based in Russia, Russian companies etc), but no new
services can be provided; designated persons (of whom there are
more than 1,820 so far) cannot be provided with any trust
services.10
On 30 June 2023, the UK banned UK persons from providing legal
advisory services to non-UK persons where the services related to
activities that would be prohibited under the sanctions regime if
those activities were performed by a UK person or took place in the
UK.11 This ban includes: (a) the interpretation of law,
(b) acting on behalf of a client or providing advice on or in
connection with a commercial transaction, negotiation or any other
dealing with a third party and (c) the preparation, execution or
verification of legal documents.12 Contentious matters
were not caught by the ban, and nor was advice as to the effect of
UK sanctions. After an outcry by the legal community, a general
licence was issued allowing the provision of advice relating to any
sanctions regime and any criminal law, in either case imposed by
any jurisdiction.13
Challenges to sanctions designations
2023 saw further challenges to sanctions designations, both in
the UK and EU. Some of the highest-profile involved Roman
Abramovich.
Eugene Shvidler, a UK-US dual citizen, was designated on the
basis of his association with Mr Abramovich, including because he
had a been a director at Evraz plc, a Russian steel company
part-owned by Mr Abramovich. Mr Shvidler claimed the designation
was discriminatory and irrational, including because he no longer
worked at Evraz. The High Court upheld the designation as it
considered that it was reasonable to suspect that Mr Shvidler
obtained a benefit from Mr Abramovich through his remuneration by
companies controlled by Mr Abramovich,14 and that his
designation had a rational connection with the objective of
encouraging the Russian government to cease or limit its actions in
Ukraine.15
Mr Abramovich’s own challenge to his designation by the EU
was rejected by the EU’s General Court on 20 December 2023. The
court ruled that he was designated as a major shareholder of Evraz,
which operates in economic sectors that provide a substantial
source of income for the Government of the Russian Federation, and
the designation was likewise rationally linked to the objective to
exert pressure on the Russian government to end the war in
Ukraine.16
What is Control?
In 2023, the English courts addressed the question of
“control” under the Russia sanctions – but left
nobody much the wiser.
Under the Russia Regulations, a non-designated person is subject
to many of the same restrictions as a designated person if it is
owned or controlled by a designated person. In Mints v NBT
[2023] EWCA Civ 1132, the Court of Appeal in obiter
considered the parameters of control. Regulation 7 provides that
control exists if it “is reasonable, having regard to all
the circumstances, to expect that P [the designated person] would
(if P chose to) be able, in most cases or in significant respects,
by whatever means and whether directly or indirectly, to achieve
the result that affairs of C [the company] are conducted in
accordance with P’s wishes.“17 The Court
of Appeal observed that this condition was described in wide terms
and did not contain any limit as to the means and mechanism by
which a designated person could achieve the result of control.
Therefore, it considered the provisions covered all entities in
respect of which a designated person “calls the
shots“. As a result, the Court of Appeal acknowledged,
this meant that Vladimir Putin could be deemed to control all
companies in Russia. If that result was absurd, the Court of Appeal
stated, it was for Parliament to clarify the legislation.
OFSI and the Foreign, Commonwealth and Development Office leapt
into action and issued guidance notes on control. They stated an
intention not to read the provision as widely as all that, and
provided some examples of what they thought control might amount
to, but did not provide much further assistance beyond the language
of the statute.18
Shortly afterwards, the High Court in Litasco SA v Der Mond
Oil and Gas Africa SA, Locafrique Holding Sa [2023] EWHC 2866
(Comm) considered that there was an important substantive
difference between “would” and
“could“, and that the prohibition applied where
a designated person had an existing influence, and not merely to a
state of affairs which a designated person was in a position to
bring about.19 Even so, Foxton J still allowed:
“I would be prepared to assume that it is strongly
arguable that President Putin has the means of placing all of
Litasco and/or its assets under his de facto control, should he
decide to do so.“
The true meaning of control therefore remains uncertain, and we
expect most companies will read it as broadly as they can to ensure
they avoid enforcement action, until such time as Parliament takes
up the Court of Appeal’s invitation to fix the problem.
2024
We expect that there will be plenty more sanctions-related
activity in 2024.
Enforcement, which was relatively light in 2023, should ramp up,
assisted by:
- Expanding resources: OFSI has recruited around 100 new
full-time staff this year in order to deliver more effective
implementation and enforcement of sanctions. It has increased
resourcing in its enforcement team by 175%, its licensing team by
160% and its engagement team by 120%.20 It is hoped this
will also reduce the backlog in licence applications, many of which
wait many months before being determined. - New disclosure requirements: A reporting obligation will
be introduced requiring the disclosure of foreign reserves of the
Central Bank of Russia, National Wealth Fund of Russia and Ministry
of Finance of Russia.21 - Improved international cooperation: Personnel of OFSI
and the US Office of Foreign Assets Control
(“OFAC“) met regularly in 2023 to
discuss cross-jurisdictional issues. OFSI and OFAC issued their
first joint fact sheet to provide further clarity on the UK and
US’s Russia-related humanitarian authorisations.22
OFSI also engages closely with the EU, the G7, Crown Dependencies
and Overseas Territories.23 - Office of Trade Sanctions Implementation: On 11 December
2023, the government announced the establishment of a new unit, the
Office of Trade Sanctions Implementation
(“OTSI“), within the Department for
Business and Trade. OTSI’s aim is to monitor compliance with
trade sanctions and to assess suspected breaches. It also has the
power to impose monetary penalties for breaches of trade sanctions
and to refer cases to law enforcement agencies for investigation
and potential prosecution.
Deferred Prosecution Agreements
DPAs in the UK will have their 10th anniversary in
February 2024.24 These agreements allow a prosecutor to
suspend prosecution of an organisation that has committed a
specified crime, provided the organisation meets certain specified
conditions and the Court determines that the DPA is in the
interests of justice.25
Until late in 2023, the only prosecuting agency to enter into a
DPA was the Serious Fraud Office
(“SFO“). But in December 2023, the CPS
agreed its first ever DPA – which turned out to be the
second-largest DPA ever agreed in the UK.
The counterparty was Entain Plc
(“Entain“), a global online sports and
gaming business headquartered in London, which is the owner of
Ladbrokes and Coral bookmakers.
The DPA arose out of an HM Revenue & Customs
(“HMRC“) investigation into
Entain.26 In 2019, HMRC commenced investigations into
Entain’s former Turkish subsidiary (sold two years earlier as
part of Entain’s takeover of Ladbrokes) and its third-party
suppliers relating to the processing of payments for online betting
and gaming in Turkey. In July 2020, HMRC informed Entain that it
was widening the scope of investigation to examine other potential
offences.
In May 2023, Entain announced that it was in DPA negotiations
with the CPS and was working towards achieving a resolution for the
ongoing HMRC investigation.27
On 24 November 2023, Entain announced that it had reached an
in-principle DPA with the CPS relating to the failure of the
Company to have adequate procedures in place to prevent bribery. On
5 December 2023, the Court approved the DPA,28 which
required Entain to pay £615 million, consisting of: (i) a
fine of £465 million; (ii) a disgorgement of profits of
£120 million; (iii) costs of £10 million; and (iv) a
charitable donation of £20 million.
Entain and the CPA also agreed that Entain would (i) conduct its
gambling operations only in regulated markets (and subject to the
scrutiny of those authorities); (ii) review and, where necessary,
enhance its compliance procedures; and (iii) engage PwC to conduct
an external compliance review, the terms of reference for which
would be agreed with the CPS and the product of which would be
shared with the CPS.29
The Court judgment approving the DPA noted that Entain had
provided significant co-operation to the investigation even though
there was no self-reporting, there had been a wholesale change of
senior management and approach, and Entain had acknowledged that it
was necessary to overhaul its culture and practices. Conversely,
conviction would have disproportionate consequences: Entain would
lose its licences to operate in other jurisdictions, putting at
risk jobs and revenue, which would have a major effect on
shareholders, pension fund holders and suppliers.
Apart from the significance of the first DPA entered into by the
CPS – in a year when the SFO entered into none – it is
also noteworthy that the DPA originated in a joint investigation by
HMRC and CPS, showing the UK’s willingness to rely on its
combined investigatory powers. This is also the second largest
corporate criminal settlement in the UK, behind Airbus’s
£880 million DPA in 2020. It remains to be seen whether the
CPS will continue to be involved in large corruption cases, but it
certainly shows that the CPS has real teeth as an enforcer of
corporate crimes. This should serve as a reminder to companies to
monitor and update their financial crime compliance procedures.
Corporate Criminal Liability
On 26 December 2023, the expansion of the ambit of economic
crimes committed by senior managers came into force pursuant to the
ECCTA. A second provision under the ECCTA creating a new failure to
prevent fraud offence is also due to come into force in 2024, as
soon as the Secretary of State has issued relevant guidance.
While this legislation is apparently, according to the
government, not expected to lead to a material rise in
prosecutions, it is a significant and welcome step which we
anticipate will drive further positive change in compliance
behaviour and corporate self-regulation.
Expansion of Corporate Criminal Liability
Under the ECCTA, if a senior manager of a body corporate or
partnership acting within the actual or apparent scope of their
authority commits an offence from a list of economic crimes, as
defined by the legislation, the organisation is also guilty of the
offence.30 Breaking this down:
- Senior manager: A “senior manager” is
an individual who plays a “significant role” in
(a) the making of decisions about how the “whole or a
substantial part” of the activities of the body corporate
or partnership are to be managed or organised; or (b) the
“actual managing or organising” of the whole or
a substantial part of those activities.31 - Jurisdiction: A “body corporate” is
defined to include a body incorporated outside the United
Kingdom.32 Where no act or omission forming part of the
relevant offence took place in the United Kingdom, the organisation
may still be guilty of an offence if it would be guilty of the
relevant offence had it carried out the relevant acts in the
location where they actually took place.33 In other
words, if the relevant acts were committed abroad, and would have
been a crime there as well as in the UK, the body corporate may be
found guilty in the UK. - Economic crimes: The list of economic crimes is set out
in Schedule 12. This includes many crimes of fraud, tax evasion,
money laundering, theft, terrorist financing, bribery and
misleading the market. The Secretary of State has the power to add
or remove offences.34
As we launch into 2024, we can expect that the definition of
“senior manager“, and when a senior
manager’s acts should be imputed to their companies, will be
subject to debate, since what constitutes a “significant
role“, what is “the whole or a substantial
part” of a company’s activities, and when a person is
acting within “the actual or apparent scope of their
authority“, are inherently subject to interpretation.
There is very little case law in the area and the Courts may
continue to consider that the requirement of certainty in the
criminal law requires a narrow interpretation. Either way, the
offence will not capture crime committed on behalf of companies by
middle managers or lower-ranking employees.
Failure to Prevent Fraud
The new offence of failure to prevent fraud provides that a
“large organisation” is guilty of an offence if
a person who is associated with the organisation commits a fraud
offence intending to benefit (whether directly or indirectly) the
organisation or any person to whom the associate provides services
on behalf of the organisation (or to a subsidiary of that person),
unless the organisation can show it had
“reasonable” procedures to prevent
fraud.35
Subsidiaries of large organisations can also be guilty of this
offence (although the size test is slightly different, where a
subsidiary is involved).36
Taking the key limbs in turn:
- Large organisation: Significantly, and unlike its
predecessor failure to prevent offences, this offence was limited,
over the objections of the House of Lords, to large organisations
only. Those are defined as businesses meeting at least two of the
following three criteria:
- Turnover of more than £36 million;
- Balance sheet total of more than £18 million; and/or
- More than 250 employees.37
- Associated persons: Employees, agents and subsidiaries
are associated persons, as is any other person who performs
services for or on behalf of the relevant body. A company can
therefore be criminally liable for the acts not only of its
employees but also of third parties, including consultants,
lawyers, accountants and so forth. - Fraud offence: means one of the set of offences listed
in Schedule 13, which includes false accounting, cheating the
public revenue and fraud, as well as aiding, abetting, counselling
or procuring the commission of such an offence. The list is smaller
than the corresponding list for economic crimes, described
above. - Defences: There are two defences available to
companies.
- Uniquely to this offence, it is a defence if the organisation
itself was, or was intended to be, a victim of the fraud
offence.38 - In line with the predecessor failure to prevent offences under
the Bribery Act 2010 and Criminal Finances Act 2017, it is a
defence for the organisation to prove that it had in place such
prevention procedures as were reasonable in the circumstances, or
it was not reasonable in the circumstances to expect the
organisation to have prevention procedures at
all.39
- Uniquely to this offence, it is a defence if the organisation
- Guidance: The Secretary of State is required to publish
guidance about reasonable procedures (the
“Guidance“).40 This may be
instructive as to how much companies are supposed to do. The
previous guidance on adequate procedures to prevent bribery, issued
by the Ministry of Justice in 2011, is recognised to be a
well-written document that is of some use to companies. It is more
difficult to assess its effect on prosecutions, since there remains
no clarity from either prosecutors or the courts as to what
constitutes adequate procedures. - DPAs: The offence is susceptible to deferred prosecution
agreements.41
There has been some criticism regarding the exclusion for
smaller companies, since fraud can be conducted in and through
those companies as well (and they were not carved out from the
failure to prevent bribery offence under the Bribery Act). The
carve-out is not really complete, though. First, the Act cleverly
ensured that small companies that are subsidiaries of large
companies will be caught, so there is no incentive for large
companies to artificially restructure themselves. Second, small
companies will often be the “associated persons” of large
companies, for which the large companies will be criminally liable.
So the large companies may be expected to demand that the smaller
companies that do work for them take measures to enhance their own
compliance.
The major question now for 2024 will be how much companies will
need to augment or adjust the compliance systems they have built up
to prevent bribery and sanctions over the past 15 years, in order
to meet the requirements of the failure to prevent fraud
offence.
Looking ahead
2024 looks set to be a busy year in the corporate crime world,
with both companies and individuals expected to come under
increased scrutiny. With further developments on the horizon,
companies and individuals need to be prepared and ensure they meet
the everchanging legal requirements.
Footnotes
1. https://www.gov.uk/government/publications/ofsi-annual-reviews/ofsi-annual-review-2022-to-2023-strengthening-our-sanctions
2. https://www.gov.uk/government/collections/enforcement-of-financial-sanctions#full-publication-update-history
3. https://www.gov.uk/government/collections/enforcement-of-financial-sanctions#full-publication-update-history
4.
https://www.gov.uk/government/publications/ofsi-annual-reviews/ofsi-annual-review-2022-to-2023-strengthening-our-sanctions
5. https://ofsi.blog.gov.uk/2023/08/31/ofsi-uses-disclosure-power-for-first-time/
6. https://www.gov.uk/government/publications/disclosure-notice-31-august-2023
7. https://ofsi.blog.gov.uk/2023/11/28/ofsi-successfully-defends-first-court-review/
8. He was also refused a licence to
pay his property’s management company, as it was considered to
be owned by a designated person.
9. https://caselaw.nationalarchives.gov.uk/ewhc/admin/2023/2657
10. https://ofsi.blog.gov.uk/2023/05/30/trust-services-sanctions-5-months-on/;
https://www.legislation.gov.uk/uksi/2022/1331/contents/made
11. https://www.legislation.gov.uk/uksi/2023/713/contents/made
12. https://www.sra.org.uk/sra/news/sra-update-117-russian-services/
13. https://assets.publishing.service.gov.uk/media/64d39dd59865ab0013c8fb09/russia-sanctions-legal-advisory-services-general-trade-licence__1_.pdf
14. Eugene Shvidler (the Claimant) v
Secretary of State for Foreign, Commonwealth and Development
Affairs [2023] EWHC 2121 (Admin), at [100]-[103]
15. Eugene Shvidler (the Claimant) v
Secretary of State for Foreign, Commonwealth and Development
Affairs [2023] EWHC 2121 (Admin), at [106] –[128]
16. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A62022TJ0313&qid=1704830443443,
at [92]-[104]
17. https://www.legislation.gov.uk/uksi/2019/855/regulation/7
18. https://www.gov.uk/government/publications/ownership-and-control-public-officials-and-control-guidance/ownership-and-control-public-officials-and-control-guidance
19. Litasco SA v Der Mond Oil and Gas
Africa SA, Locafrique Holding Sa [2023] EWHC 2866 (Comm), at
[65]-[70]
20. https://www.gov.uk/government/publications/ofsi-annual-reviews/ofsi-annual-review-2022-to-2023-strengthening-our-sanctions
21. https://www.gov.uk/government/publications/ofsi-annual-reviews/ofsi-annual-review-2022-to-2023-strengthening-our-sanctions
22. https://ofsi.blog.gov.uk/2023/11/15/one-year-on-the-ofac-ofsi-enhanced-partnership/
23. https://www.gov.uk/government/publications/ofsi-annual-reviews/ofsi-annual-review-2022-to-2023-strengthening-our-sanctions
24. They were introduced on 24
February 2014, under the provisions of Schedule 17 of the Crime and
Courts Act 2013.
25. https://www.sfo.gov.uk/publications/guidance-policy-and-protocols/guidance-for-corporates/deferred-prosecution-agreements/
26. https://www.cps.gov.uk/cps/news/first-ever-cps-deferred-prosecution-agreement-ps615-million
27. https://www.londonstockexchange.com/news-article/ENT/update-on-hmrc-investigation/15978038
28. https://www.cps.gov.uk/publication/rex-v-entain-plc-deferred-prosecution-agreement
29. https://www.cps.gov.uk/publication/rex-v-entain-plc-deferred-prosecution-agreement
30. ECCTA, s.196.
31. Id., s.196(4).
32. Id.
33. Id., s.196(3).
34. Id., s.197(1).
35. Id., s.199(1)..
36. Id., s.199(2).
37. Id., s.201(1). As noted, the test
is slightly different where the alleged offender is the subsidiary
of a large undertaking.
38. Id., s.199(3).
39. Id., s.199(4).
40. Id., s.204(1).
41. Id., s.206(3).
Originally published 31 January 2024
The content of this article is intended to provide a general
guide to the subject matter. Specialist advice should be sought
about your specific circumstances.
#Corporate #Crime #Year #Ahead #Corporate #Crime
