Assessing Firms’ Sanctions Controls: Successes and Challenges Unveiled

Firms have undergone assessments of their sanctions controls by the FCA, and here is a summary of what they are doing well and where improvements are needed:

What Firms Are Doing Well:

1. Horizon Scanning and Scenario Planning: Some firms demonstrated strong capabilities in anticipating and planning for sanctions-related issues.
2. Sample Testing: Firms effectively employed sample testing methods to assess the accuracy and effectiveness of their sanctions controls.
3. Tuning of Screening Tools: Certain firms excelled in fine-tuning their screening tools to minimize false positives and false negatives, optimizing their performance.
4. Screening Tools with Fuzzy Logic: The FCA praised firms that utilized screening tools equipped with fuzzy logic, enhancing their ability to handle nuanced and complex data.

Areas Requiring Improvement:

1. Management Information: Some firms fell short in providing senior managers with adequate information regarding their sanctions processes, impacting decision-making.
2. Resources: Insufficient internal resources and expertise within sanctions teams led to unacceptable screening backlogs and delays in compliance.
3. Screening Calibration: Issues were identified with screening tools that were either overly sensitive or not sensitive enough, potentially resulting in compliance gaps.
4. Timely List Updates: Delays were observed in some firms updating their screening lists following sanctions designations, compromising the effectiveness of the controls.
5. Third-party Screening Reliance: Over-reliance on third-party screening tools without sufficient verification was noted, posing potential compliance risks.
6. Customer Due Diligence (CDD) and Know Your Customer (KYC): Some firms faced challenges due to low-quality CDD and KYC processes, which hindered their ability to screen all relevant parties thoroughly.
7. Breach Reporting: Some firms took weeks or even months to report sanctions breaches to the FCA, while others neglected this obligation entirely.

What Firms Need to Do:

1. Complete KYC and CDD: Ensure that appropriate KYC and CDD procedures are conducted for all potential parties, including controllers, shareholders, and Ultimate Beneficial Owners.
2. Review Reporting Procedures: Review and improve reporting procedures for potential sanctions breaches, ensuring that all relevant staff are adequately trained to meet their obligations under relevant sanctions regimes.
3. Enhance Screening Tools: Continuously enhance screening tools and regularly test their effectiveness to minimize false positives and negatives.
4. Detailed Information for Senior Managers: Provide senior managers with detailed information on sanctions processes to enable informed decision-making.
5. Third-party Screening Oversight: Establish adequate oversight to assess the effectiveness and reliability of third-party screening tools in use.
6. Recognize Growing Risks: Understand that financial and reputational risks from sanctions breaches are increasing, especially as regulatory enforcement activity intensifies. Complying with sanctions regimes is crucial to mitigating these risks.