Sanctions Compliance: ‘Never Take Shortcuts, Keep Checking’

And more is yet to come; therefore, companies must build robust sanctions compliance systems under extreme time pressure. The European Council agreed the 6th package of EU sanctions against Russian and Belarus companies and individuals on May 31. 

Though some sanctions against Russia have been in place since 2014, they stepped into the spotlight after the escalation of the Russo-Ukrainian conflict this February. The scope of products and services affected and the companies subject to various sanctions have broadened significantly. János Rinfel, a senior associate at KPMG Legal Tóásó Law Firm, highlights the risks EU companies face and explains how to tackle the challenges posed.

BBJ: What is the background to these sanctions?

János Rinfel: Sanctions are not something new in international politics. Diplomatic sanctions have been around for a long time when it comes to bilateral relations and have been a clear indication of a deteriorating situation and relationship between two states. 2014 was a significant milestone for sanctions, as the package against Russia then went far beyond any previous measures. As an EU member state, Hungary must apply the EU regulations directly, without any further legislative action necessary. The events of February 2022 have caused the importance of sanctions to reach new heights. Therefore, companies must develop new internal policies and mechanisms to counteract their complexity.

BBJ: What issues should European companies consider?

JR: Companies must conduct very detailed third-party due diligence procedures that go all the way up to the ultimate beneficial owner (UBO) of their contractual partners. Also, even if a potential partner is included on a sanctions list, it does not necessarily mean that one cannot deal with such an entity/private individual. Sanctions should not be looked at as a binary switch, that not being included on the lists means “OK,” while being included means “Not OK.”

Sanctions can rather be characterized as a broad scale of restrictive measures introduced against a private person or a company. The far end of the scale is that a company’s assets are frozen, which practically means that you must not deal with any such entity or private individual. In this case, sanctions stipulate that no economic resources can be made accessible to such an entity. A very recent case was former Chelsea Football Club owner Roman Abramovich. Mr. Abramovich [through a complex corporate web] has a fancy yacht harbored in Turkey. The problem was that a British company operated the harbor. As sanctions usually have extraterritorial effects [applicable to U.K. companies even outside of British territory], the harbor operator allegedly breached U.K. sanctions with its activities in Turkey in providing harboring services.

For EU companies willing to fully comply with applicable sanctions regimes, we would suggest the following four-step protocol:

First, check any business partner, including its UBO and majority owners.

Second, if the business partner is subject to EU sanctions, conduct a detailed analysis.

Third, verify the exact scope of products and services and compare them to any sectorial sanctions.

Fourth, if the scope of products and services are not covered, go ahead. If those may be affected by sectoral sanctions, conduct a detailed analysis.

You should know that in any case, if a sanction applies to your envisaged dealings, you can seek a license to get clearance.

BBJ: Billionaires rarely expose themselves as owners of expensive assets; they instead prefer to hide behind complex offshore company schemes. How can authorities establish who the actual owner(s) are?

JR: Beneficial owners must always be identified in the EU. However, it is true that, in most cases, revealing the ownership structure can be very difficult if a company seeks to do business with Russian or Belarus partners; therefore, new procedures will need to be implemented to identify your business partner’s UBO. Furthermore, preliminary identification is just the start; ongoing monitoring is required to ensure compliance in the long run. I usually suggest bi-weekly checking and using practical tools that offer automatic monitoring services and warnings if any changes affect the status of monitored business partners. Any such changes may require you to reassess the relationship and take measures based on a cost-benefit analysis. How much time and monetary resources would need to be invested in screening the partner and effectuating changes? Is it still profitable to do business with this partner, and what happens if the risks are out of your comfort zone? This is where we, as lawyers, can best help.

BBJ: What is your experience regarding Hungarian companies and their attitude to sanctions?

JR: It is a widely spread misbelief that they think they have nothing to do with sanctions. For instance, they believe that the computer parts they export can hardly be related to any military operation. This is not true. To stick with this example, computers or IT devices could be considered dual-use, capable of being utilized for both civilian and military applications. Trade in these types of goods is heavily regulated, as they can be classified for civilian use and then transformed for military purposes.

Another issue is that Hungarian companies may believe that, if there is a problem, some authority or their bank will warn them before they make the “wrong move.” This is not true either. For example, if the company makes a wire transfer to a Russian partner, the bank will not automatically stop the transfer if the partner is subject to sanctions. This is a common mistake.

To wrap up, not just the business partner but also the goods and services must be equally checked. Furthermore, before you effectuate any transactions with possibly affected business partners, make sure you conduct a thorough internal verification process. Do not skip this, not even a single time. Everything must always be checked and, most importantly, constantly monitored after the fact. Never take shortcuts and keep checking.

This article was first published in the Budapest Business Journal print issue of June 3, 2022.