Risk managers urged to focus on sanction risk as US retargets Iran

As the US reinstates tough sanctions on Iran, experts have stressed the importance of keeping sanction risk management strategies up to date and closely tied to wider corporate goals. Sanctions are a growing area of risk as governments increasingly turn to non-military options to change the behaviour of their political foes, according to a recent webinar hosted by the Institute of Risk Management (IRM). However, sanctions compliance is becoming more challenging, while breaches of sanctions attract higher penalties, it was concluded at the IRM event. According to Zia Ullah, partner and head of corporate crime and investigations at law firm Eversheds Sutherland, many companies fundamentally fail to understand sanction risk and which laws apply to which jurisdictions. They often also fail to maintain and update sanctions screening systems, or disseminate information and raise awareness of sanctions throughout the business, he warned. “Screening systems are great, but they are only as good as the people working with them. They will be less effective if the people are not trained in what they need to do, and this is often where companies fall down,” said Mr Ullah during the webinar. This week, the US has reinstated sanctions against Iran’s energy, shipping and banking sectors. The Trump administration reinstated all sanctions removed under the 2015 nuclear deal, targeting Iran and the states it trades with. Last week, Denmark called for fresh EU-wide sanctions against Iran after a suspected attempted attack by an Iranian intelligence service on Danish soil. Political tensions may lead to other new sanctions. The killing of journalist Jamal Khashoggi in Turkey last month has raised the prospect of sanctions against Saudi Arabia. The EU is considering using sanctions against individuals or groups responsible for cyberattacks. Some in the US Congress want new sanctions against Russia for its interference in American elections. There is a wide range of sanction measures, regimes and authorities that need to be complied with, explained Mark Dunn, head of entity due diligence and monitoring at LexisNexis, a legal and compliance information provider. Sanctions from the UN often set the tone globally, but the EU and US operate their own sanction regimes, while individual countries will have their own rules and requirements, he added. The US Office of Foreign Asset Control (OFAC) is the most proactive body for sanctions enforcement globally, according to Mr Dunn. Typically, a company’s sanctions compliance policy should start with OFAC’s requirements, he said. Sanction rules are very complex and requirements differ by country and regime, explained Eversheds Sutherland’s Mr Ullah. They can target countries, individuals, companies and sectors with trade or arms embargoes, asset freezes, travel or flight bans and suspension from international organisations, he said. The US has numerous separate pieces of sanctions legislation and regimes that companies might need to comply with, while the EU has some 20 in place. These are often extra-territorial and, in the case of US sanctions, can apply to US citizens and companies abroad, as well as US dollar transactions. The US recently imposed sanctions against a Turkish company and two of its directors for doing business with North Korea. According to Mr Ullah, US sanctions are particularly complex and challenging from a compliance perspective, with multiple sources of sanction requirements covering different targets and obligations. Penalties for breaching US sanctions regulations are harsh and have targeted EU institutions in the past. BNP Paribas paid a record $9bn fine in 2014 for sanction breaches, while Commerzbank AG agreed to pay $1.45bn. Standard Chartered is reportedly facing a $1.5bn penalty from the US Department of Justice for violating sanctions on Iran. The complexity of sanction compliance frameworks depends on where a company is based and its footprint, according to Mr Ullah. It is important to align the sanctions policy with business strategy, and ensure that the strategy is sanctions-compliant, he said. Sanction regimes do not typically prescribe processes of compliance. Therefore, how an organisation goes about compliance is largely down to an individual organisation. According to Mr Ullah, the key features of a sanctions compliance framework are risk assessment, procedures, policies and training, with a focus on carrying out due diligence on customers and suppliers. Daily screening and deal-specific due diligence have now become “de rigueur” in some sectors, he added. Sector- or company-specific sanctions are particularly problematic, according to Mr Ullah, who noted that banks increasingly demand that companies demonstrate procedures are in place to mitigate sanctions risk. At the heart of sanctions compliance is the need to “know your customers, and know your customers’ customers”, including ownership and control structures, he said. According to Mr Dunn, board buy-in is crucial to sanctions compliance. Risk managers need to ensure that senior management understand their obligations and endorse the company’s sanctions policies, he said. “Without senior management backing, you will find it hard to secure the resources, training and tools needed to ensure the company is compliant… In your role as a risk or compliance manager, having a seat at the table with the senior leadership team is fundamental in most cases,” he said. Mr Dunn also advised companies to prepare policies and procedures, and then communicate these to employees and contractors. These processes will need to be audited, reviewed and stress tested, he said. In addition, companies should keep a clear record of all training, due diligence and checks carried out to demonstrate that they are being proactive in preventing breaches of sanction rules, Mr Dunn added. He also recommends companies implement screening processes appropriate to the nature and size of the risk. Larger companies operating in several markets will need compliance systems that are fit for purpose and meet regulatory expectations, Mr Dunn said. “Don’t wait for enforcement. Don’t wait for trouble to suddenly take this seriously. By then it is far too late and, worst-case scenario, you will face multimillion-dollar penalties and significant business impact,” he warned.

Risk managers urged to focus on sanction risk as US retargets Iran

Want to read this article?

Read Next

Ferma members told AI will bring risk and reward for corporate insurance buyers

Warmer climate spreading risk of malaria and dengue to new regions

UN launches new net-zero insurance forum to replace NZIA

Pen extends fleet capacity deal with Zurich in Republic of Ireland

Mapfre Global Risks boosts profit by 58% despite reduced premiums

Ferma members told AI will bring risk and reward for corporate insurance buyers

Warmer climate spreading risk of malaria and dengue to new regions

UN launches new net-zero insurance forum to replace NZIA

Pen extends fleet capacity deal with Zurich in Republic of Ireland

Mapfre Global Risks boosts profit by 58% despite reduced premiums

Want to read this article?

Read Next

Ferma members told AI will bring risk and reward for corporate insurance buyers

Warmer climate spreading risk of malaria and dengue to new regions

UN launches new net-zero insurance forum to replace NZIA

Pen extends fleet capacity deal with Zurich in Republic of Ireland

Mapfre Global Risks boosts profit by 58% despite reduced premiums

Related Articles