The EU and UK sanctions regimes adopted against Russia have introduced several new obligations for EU and UK persons to report specific information to the competent authorities.
This article provides an overview of (i) the types of information that must be reported to the authorities, (ii) those who are subject to the relevant obligation, (iii) timeframes, and (iv) to whom reportable information should be provided.
What needs to be reported?
EU and UK sanctions regimes have introduced various types of reporting obligations. Information falling in scope of the reporting obligations will vary depending on the applicable legal basis.
Information to be reported includes the following:
- “Any information which would facilitate implementation" of the EU Russia Regulations (EU):
Following the EU’s imposition of its 11th Russia sanctions package, it is now mandatory to supply information facilitating the implementation of both the EU Regulation 269/2014 (“EU Regulation 269”), which sets out asset freeze measures, and EU Regulation 833/2014 (“EU Regulation 833”) which imposes trade and financial sanctions (collectively the “EU Russia Regulations”). This is currently the most expansive reporting obligation under the EU Russia Regulations and there is an absence of guidance as to its exact parameters. In addition, information is required to be submitted to Member States, meaning that different Member States may take different approaches.
Given its potential breadth, we recommend those with an EU sanctions nexus adopt a case-by-case approach to any information they hold; particular, it will be important to it in the context of the Member State in which it is held. At the very least, the reporting obligation can be considered to encapsulate information relating to a violation of the EU Russia Regulations, given this would directly assist the implementation of EU sanctions regulations (by way of tackling breaches).
We note that there is no comparably broad reporting obligation under the Russia (Sanctions) (EU Exit) Regulations 2019 (the “UK Russia Regulations”).
- Information on breaches of Russia sanctions (EU and UK)
UK
The UK’s reporting obligations are generally narrower in scope than those of the EU regime, with obligations falling on entities/individuals involved in certain activities.
Under the UK Russia Regulations, where an “involved person”* and a “relevant firm”** comes across information in the course of business which leads them to know or suspect oil-related sanctions breaches have occurred, it is mandatory to file a report.
More broadly, “relevant firms”** should file a report where they know or have reasonable cause to suspect that a person has committed an offence under the UK’s asset freeze regime, or where incorrect information is provided for the purpose of obtaining a Treasury licence.
*a person involved in the supply of delivery of oi/oil products or the provision of financial services/funds/brokering services relating to the supply or delivery of oil/oil products
**these include currency exchanges; businesses that transmit money; businesses that cash cheques that are made payable to customers; statutory or local auditors, accountancy firms; tax advisers; and various others.
EU
As explained above, the obligation under the EU Russia Regulations to supply any information that would facilitate the implementation of the EU Russia Regulations may encompass information about a breach of such regulations. We also note that certain Member States interpret the obligation to “supply any information that would facilitate the implementation” of the EU Russia Regulations as an obligation on companies to self-disclose violations of sanctions (see here for Germany).
- Frozen assets and sanctioned persons (EU and UK)
The EU Russia Regulations establish an obligation to report information held on frozen assets, which includes:
-
- Details about frozen assets;
- Details about assets held or controlled by designated persons not yet treated as frozen; and
- Details about assets belonging to, held or controlled by designated persons which have been subject to any move, transfer, alteration, use of, access to, or dealing in the two weeks prior to the designation of the person.
The UK Russia Regulations establish an obligation to report:
-
- On “relevant firms” (as defined above) knowledge, or a reasonable cause to suspect, that a person is a designated person; and
- On “relevant institutions”*** certain credits a frozen account, or transfers from a frozen account to another account.
It is also worth noting that HM Government – acting through the Treasury – has a broad power to request information regarding frozen funds and economic resources. This power has been used twice since the introduction of expanded sanctions targeting Russia in 2022; the UK government has (broadly) requested information on the funds “held” or “controlled” in the UK on behalf of designated persons; it is now an annual exercise. This year's deadline to report was 10 November 2023.
***a person that has permission under Part 4A of the Financial Services and Markets Act 2000 (permission to carry on regulated activity).
- Information related to specific trade or financial restrictions (EU and UK)
Both the EU and the UK have introduced a significant number of reporting obligations relating to specific trade or financial restrictions over the past months.
As an example, under the EU Russia Regulations, it is mandatory to report information on (i) certain transactions in oil or natural gas originating in or exported from Russia, (ii) exports of exempted goods or technology to Russia, (iii) certain flights between Russia and the EU, and (iv) deposits of Russian persons exceeding EUR 100,000.
In the UK on the other hand, such reporting obligations apply in respect of certain exceptions to trade sanctions; for example, where an entity seeks to rely on (i) contracts concluded prior to the restrictions being imposed, (ii) acts which contravene trade restrictions done in cases of emergency, and (iii) on maritime transportation of certain oil and oil products, exceptions.
Who is subject to reporting obligations?
Under the EU Russia Regulations, most of the reporting obligations apply broadly to “natural and legal persons, entities and bodies”. In addition, certain specific obligations apply more narrowly. To take two of the examples discussed above, the deposit reporting obligation mentioned above applies to credit institutions, while the flight reporting obligation applies to aircraft operators.
In the UK regime – and as noted above – the obligations to report fall on specific categories of persons. From the obligation to report frozen funds annually to OFSI, which applies to all UK persons, to the narrower obligations which fall on “relevant firms” or to “relevant institutions”, it is crucial that companies review and understand the specific reporting obligations that fall on them. In addition, policies and procedures should be adopted to systematise this reporting, given applicable timeframes.
When should information be reported?
Under both the EU and the UK Russia Regulations, the statutory deadlines for reporting information can be short. This is particularly the case with the EU sanctions regime, where most of the reporting obligations come with a two-week deadline, while some are even more stringent and require the information to be reported within five working days or even “immediately”. Additionally, certain information, such as details of EU deposits, should be reported on a rolling basis.
In the UK, the reporting obligations generally provide for a greater degree of flexibility; for example, requiring specific information to be provided “as soon as practicable”. However, the annual reporting process does impose named-day deadlines.
Where should information be reported to?
Determining the relevant authority to report to is not always simple – particularly in the EU – and there is usually no single regulator in any country. In certain situations there may be multiple competent authorities. In general:
- In the EU, the EU Russia Regulations will in some instances state which is the competent authority. Please note that certain information may have to be reported to several authorities, or to a national authority and to the European Commission. Businesses will also need to determine which Member State to report to, or if several Member States should be reported to. Where several authorities need to be reported to, this will usually have to be done to each of them individually.
- In the UK, the relevant authorities include the Office of Financial Sanctions Implementation (“OFSI”), the Department for Business and Trade (“DBT”), and HM Revenue & Customs (“HMRC”). Additionally, in some instances businesses will have separate reporting obligations to sector specific regulators, for example the Financial Conduct Authority or Solicitors Regulatory Authority, and other enforcement authorities for example the National Crime Agency.
Consequences of breaching reporting obligations
Under both EU and UK Russia Regulations, failure to comply with reporting obligations amounts to a breach of the Russia Regulations.
In the EU, penalties vary from Member States to Member State, since enforcement of the EU Russia Regulations is primarily a Member State responsibility. As an example, in France a breach of reporting obligations carries a penalty of up to five years imprisonment, the confiscation of the proceeds of the crime (if any), and a fine equal up to a maximum of twice the amount to which the offence relates. It is worth noting that the European Commission recently introduced a proposal for a directive which, if adopted, will set minimum rules concerning the definition of criminal offences and penalties for the violation of EU sanctions regulations.
In the UK, failure to report in breach of the UK Russia Regulations is an offence which carries a maximum penalty of 6 months imprisonment and/or a (in England, unlimited) fine. Additionally, enforcement bodies have powers to levy penalties. For example, OFSI can impose monetary penalties (the greater of £1,000,000 or 50% of the estimated value of the breach) for breaches of reporting obligations.
Reporting obligations and Voluntary self-disclosure of breaches of Russia sanctions
By definition, voluntary self-disclosures do not fall under the category of “reporting obligations”. We however note that the UK and certain EU regulators encourage voluntary self-disclosures in instances of sanctions breaches.
Consequently, where an entity identifies information that indicates an internal breach of UK or EU sanctions laws, they should consider whether making voluntary self-disclosures would be appropriate. Some regulators and courts may view voluntary self-disclosures as a mitigating factor in terms of enforcement, which can for example reduce the quantum of any fines.
The decision, timing, scope and opportunity of such a voluntary self-disclosure need to be carefully considered, in particular to take into account the approach of the specific regulators or courts (for example, as to the possibility of the public naming of relevant entities).
Next steps for EU and UK entities, or for international entities with EU or UK exposure
- As a first step, it is important to assess (i) whether your activities are exposed to reporting obligations and (ii) if you have previously reported all the required information to the relevant authorities within the applicable timeframes.
- Adopt sanctions reporting policies (which can be done by amending already existing sanctions policies) and implement reporting processes; these will help to ensure that breaches do not occur.
- The EU and the UK Russia Regulations are constantly evolving. It is key to keep monitoring for updates continuously to be best placed to respond to any changes and ensure continued compliance.
How we can help
Please get in touch with us to discuss whether reporting obligations apply to your activities, and how you should engage with sanctions authorities. Hogan Lovells has a deep understanding of the regulatory landscape, has already assisted several clients with sanctions reporting compliance, and is particularly well placed to help, having a global team spanning across close to 30 countries.
Authored by Aline Doussin, Pierre Estrabaud, Daniel Shapland, Simi Malhi, Helka Kittila, and Thomas Allinson.
