UK Publicizes First Enforcement Case After FinTech Firm Violates Russia Sanctions

Financial technology company Wise Payments Limited violated the U.K.'s sanctions on Russia when it allowed a company owned by a sanctioned person to withdraw funds from a business account, the U.K. said this week. The announcement marked the U.K.’s first use of its new sanctions enforcement disclosure “power,” an authority it acquired last year that allows it to publish details of sanctions violations in cases where the party isn’t hit with a monetary penalty.

The country’s Office of Financial Sanctions Implementation said the violation was “moderately severe” but decided not to impose a penalty, in part because Wise voluntarily disclosed the violation and took steps to “improve the aspects of its sanctions compliance process.” The U.K. also noted the sanctioned company was only able to withdraw about $300.

OFSI said it plans to issue more disclosures in other cases where it also determines the violations are “moderately severe,” including when a warning letter “would be too lenient on the facts of the case, but a civil monetary penalty would be disproportionately punitive.” The agency called the new power an “important step” to “further tailor its enforcement action according to the different severities of breaches it sees.” It also updated its sanctions penalty guidance with a new section on the disclosures, including details on how it plans to use the authority.

“Through publishing details of breaches, this new enforcement tool will act as a form of censure and deterrent while also enabling compliance lessons to be available to other companies and individuals,” OFSI said. The country has been criticized by law firms for the lack of transparency in its sanctions and export control penalty announcements, which typically don’t name the parties involved or include many details about the violations (see 2204190073).

Wise reported the potential violation July 20, 2022, telling OFSI that the withdrawal came from a company debit card in the name of a person who had been sanctioned by the U.K. one month earlier.

Although Wise had a policy in place that mandated sanctions screening against U.K. sanctions lists for all customer details, including ultimate beneficial ownership information, the policy didn’t require the company to freeze the account’s debit card if its automated screening system found a match, the disclosure said. “Instead, customers would retain access to their debit cards until sanctions profile matches were resolved,” the disclosure said.

Wise justified this policy because of the “high false positive rate for sanctions alerts,” adding that it was meant to account for “the interests of its customers and treat them fairly.” But OFSI said the company should have resolved the issue sooner -- a Wise agent “escalated this matter” to Wise’s sanctions specialist team on July 1, a Friday, but the issue wasn’t reviewed until July 4, a Monday, because the sanctions team didn’t work weekends.

The agency said the “lack of staff availability to review sanctions alerts” on weekends “led to a material delay in the proper restrictions being placed on the Designated Person’s account and debit card.”

Despite the low value of the withdrawal, the agency said it “considered that Wise’s systems and controls, specifically its policy surrounding debit card payments, were inappropriate.”

OFSI also pointed to a range of mitigating factors, including the “lack of evidence of deliberate sanctions evasion” by Wise and its decision to terminate the sanctioned person as a customer. The company also hired more staff, introduced weekend hours for its sanctions specialist team and changed its policy so that it immediately blocks debit cards while the team reviews a potential sanctions match.

The agency said the case highlights the importance of companies “carefully” considering the steps they need to manage their sanctions risk exposure. When a company identifies a sanctions risk, it should “fully address that risk by promptly restricting all forms of access to funds or economic resources,” OFSI said. “Firms should also maintain proportionate sanctions screening and alert review functions including, for example, at weekends where they conduct business at such times.”

A Wise spokesperson said the company takes sanctions compliance "very seriously," adding that it "took immediate steps" to suspend its Russia-related services when sanctions were announced following the country's invasion of Ukraine last year. The company has also implemented the "necessary internal system changes to prevent this type of transaction going forward," the spokesperson said in an Aug. 31 email. "We remain committed to ensuring that our day-to-day operations are in compliance with all relevant regulatory requirements, and to working openly and collaboratively with our regulators."