FCA’s Review Reveals Mixed Performance in UK Financial Firms’ Sanctions Controls

On September 6, 2023, the UK’s Financial Conduct Authority (FCA) released findings from its extensive assessment of sanctions systems and controls in over 90 UK financial services firms. This review aimed to evaluate the effectiveness of these systems and controls in addressing sanctions risks and their ability to respond swiftly to changes in UK sanctions regimes. The FCA conducted this review due to the significant sanctions imposed by the UK and international partners following Russia’s invasion of Ukraine.

The FCA identified both good practices and areas requiring improvement:

Good Practices:

1. Proactive Risk Management: Several firms proactively assessed their exposure to Russia and engaged in scenario planning ahead of the Russian invasion of Ukraine. This proactive approach allowed them to better respond when UK sanctions against Russia were imposed.
2. Effective Sanctions Screening Systems: Some firms demonstrated that their sanctions screening tools were well-calibrated for the specific sanctions risks they faced. Additionally, some firms employed methods to measure the effectiveness of their systems, including threshold and parameter testing.
3. Appropriate Tool Calibration: Most firms incorporated “fuzzy logic” into their sanctions screening systems to ensure minor variations in names did not result in the failure to detect sanctioned individuals.

Areas for Improvement:

1. Governance and Oversight:
   • Some senior management lacked adequate oversight of sanctions risks.
   • Global sanctions policies were relied upon, which might not align with UK sanctions regimes.
   • Over-reliance on third-party tools without a clear understanding of their calibration.
2. Skills and Resources:
   • Backlogs in assessing, escalating, and reporting sanctions alerts.
   • Resource constraints, lack of governance, and expertise hindered efficient identification and reporting of potential breaches.
3. Screening Capabilities:
   • Inadequate calibration of sanctions screening tools, leading to either overly sensitive or insufficiently sensitive systems.
   • Lack of monitoring of list updates by screening providers.
4. Customer Due Diligence (CDD) and Know Your Customer (KYC) Procedures:
   • Low-quality CDD and KYC assessments, including incomplete ownership structures of entities.
   • Backlogs in these processes, which increase the risk of sanctions breaches.
5. Reporting Breaches to the FCA:
   • Delays in notifying the FCA of sanctions breaches, with some taking months or failing to report breaches altogether.

Potential Next Steps for FCA-Regulated Financial Services Firms:

1. Review and Address Findings: Firms should thoroughly review the FCA’s report, assess its applicability to their own systems and controls, and take proactive steps to address identified gaps and strengthen existing measures.
2. Regular Evaluation: Firms should continuously evaluate their sanctions systems and controls to adapt to evolving sanctions landscapes and align with new requirements.
3. Money Laundering Regime Compliance: Firms should ensure compliance with the UK’s money laundering regime, review the FCA’s Financial Crime Guide, and assess their policies and procedures accordingly.
4. Engagement with the FCA: Be prepared to engage with the FCA regarding its testing of sanctions screening systems and controls.

In summary, the FCA’s review highlights the importance of effective sanctions systems and controls in the financial services sector and provides guidance for firms to enhance their compliance and risk management efforts.