Welcome to the July 2024 edition of Dentons Corporate Crime Insights, where our UK Regulatory and Investigations team has pulled together news and updates from each of our respective specialisms likely to be of use and interest to our clients in their decision -making. 

As with all previous editions, our team has used our combined experience and background at each of the key regulators to give our perspective on significant updates to help inform your horizon scanning in respect of financial crime compliance. 

As with many things, the July elections have impacted the publication of some outcomes and materials we were expecting to see this quarter, including the guidance on the new "failure to prevent" offence. Once these materials are published, we will update and recirculate this edition. In the meantime, please see our overarching views on how the change to government is likely to impact on corporate crime compliance and enforcement here.

This update covers:

• Anti-Money Laundering
• Bribery and Corruption
• Sanctions
• Corporate Fraud
• Internal Investigations

Anti-Money Laundering

• An update to the Money Laundering Regulations on treatment of politically exposed persons (PEPs) is now in force. Regulation 35[3A] now applies, which recognises that domestic PEPs carry a lesser inherent level of risk than non-domestic PEPs. As a starting point, this means that, in the absence of other enhanced risk factors, domestic PEPs may be subject to less onerous enhanced due diligence than non-domestic PEPs. However, in practice, applicable rules in Regulation 35, including the requirement for senior management approval in establishing the business relationship, to take adequate steps to establish the source of funds/wealth and enhanced monitoring, all remain applicable.
• The FCA has now published the results of its review into the treatment of PEPs. A deep dive into practices within 15 financial services firms, key points for all firms with PEP relationships to take away are:
  • To ensure that PEP definitions are in line with current requirements (including the changes outlined above recognising the reduced inherent risk of domestic PEPs.
  • Risk assess the person not the PEP status – not all PEPs will carry the same risk, and risk changes over time – so build in sensible review points to ensure that the assigned risk is still appropriate.
  • The review did not find any poor practice around wholesale de-risking or de-platforming of PEPs, although there is a clear indication that this would be unlikely to be considered a reasonable approach. Where PEPs are de-platformed, or services restricted (including on the basis of financial crime concerns) such decisions should be justifiable and the basis for them recorded clearly.  
  • Firms should think about how they are communicating with PEPs in order to get accurate and complete information; and
  • As ever, staff should be trained to properly imbed and understand policies.
• The FCA has published its 2024/2025 Business Plan. The Business Plan covers the final year of FCA's three-year strategy published in 2022 and it is no surprise that the FCA intends to ensure that its first three-year strategy achieves most of the commitments it set out. A key area of focus for the FCA in the next 12 months includes the reduction and prevention of financial crime and, as part of that commitment, we expect that the FCA will continue to increase its scrutiny over the financial crime systems and controls firms have in place. Now is a good time for all of our financial services clients to ensure that they have recently reviewed their control framework to ensure that it is robust and proportionate to the AML-risks relevant to their business.
• HMRC has issued fines to more than 250 estate agencies totalling in excess of £1.6 million for breaching anti-money laundering requirements, with the fines ranging from £1,500 to more than £50,000. Breaches include incomplete or incorrect customer due diligence and lack of recognition of specific risk, including high-risk jurisdictions, politically exposed persons, trusts and sanctions. This is a significant move away from HMRC's previous focus on non-registration and indicates more enforcement action which concentrates on ensuring frameworks meet expectations.
• HM Treasury published its annual report for 2022 to 2023 on anti-money laundering and countering the financing of terrorism (AML/CFT) supervision in May 2024. The annual report highlights interesting enforcement trends, including:
  • Some key sectors where our clients operate, such as retail and wholesale banking, and wealth management and crypto-asset firms were considered by the FCA to be most at risk to financial crime and exploitation for money laundering. This may suggest further focus of FCA's supervisory and enforcement efforts within these sectors. HMRC, on the other hand, identified that money services businesses, art market participants, and the trust and company service providers were subject to the highest risks for money laundering.
  • In 2022-23, the total sum of fines issued by all AML and CFT supervisors was £197 million. The figure is significantly lower compared to £504 million of fines issued in 2021-22. The FCA remains the supervisor imposing the highest fines by far in the UK within the AML supervisory family, showing that the discrepancies between oversight and enforcement between sectors are still clear.
• FATF held its plenary session on 26-28 June. Key takeaways included:
  • Monaco and Venezuela have been added to the grey list;
  • Jamaica and Turkey will be removed from the grey list following their progress in remediating identified weaknesses in AML/CFT; and
  • confirmation that FATF intends to publish the findings of its review of the effectiveness of measures members have in place in respect of "gatekeepers" in July 2024.
• The NCA issued a further SARS reporter booklet, which sets out some emerging typologies, and examples of reporting which enabled disruption of money laundering and criminal activities. Of particular interest is a noted use of a child's account, which had been used for fraudulent purposes, with the child having been persuaded into a "money-making scheme" through social media – a clear example of "online harms", with social media as a recruitment tool. 

Bribery and Corruption

• On 14 June, the European Council of the EU agreed to proceed with the new Anti-Corruption directive designed to replace and harmonise existing EU legislation in the bribery and corruption space. The directive will mandate that all states criminalise the same acts of corruption and apply the same definitions, in a concerted move to increase effective cross-border enforcement. The Council will now work with the European Parliament to finalise the legislation, which will then have to be implemented at a Member State level.
• On 10 May 2024, former Madagascan presidential aide, Romy Andrianarisoa, and her associate, Philippe Tabuteau, were collectively sentenced to five years and nine months in prison for bribery after an investigation by the National Crime Agency (NCA). Both were convicted after attempting to solicit a bribe from Gemfields Group Ltd, a UK-based mining company, by offering to assist in securing contracts for exclusive mining rights with the Madagascan government. Only 10 months passed between Gemfields reporting its concerns around bribery and corruption to the NCA and Andrianarisoa being convicted in February 2024. The swift investigation by the NCA and subsequent prosecution can be seen as an example of the UK's increased commitment to investigating and prosecuting bribery and corruption offences. Our full article on the case can be found here.
• On 15 May 2024, the Association of Chartered Accountants published its global survey results and report on bribery and corruption. The survey revealed that the majority of small and medium-sized enterprises are aware of the benefits of standing up to corruption, yet more than half believed that doing so comes at the expense of business trade or opportunities. The report is intended to prompt change and encourage all entities to evaluate their practices and ensure compliance with the highest standards of business conduct.       
• In June 2024, the SFO sought authorisation from the attorney general to pursue individual charges against as many as 11 former employees of Glencore. This follows Glencore's guilty plea to paying US$29 million in bribes to gain preferential access to oil in Africa in 2022, which was the first time that the SFO had brought substantive bribery charges (rather than failing to prevent charges) against a company. It is understood that a charging decision should be made by 31 July.
• In June 2024, Adidas launched an internal investigation into alleged large-scale bribery in China as a result of a whistleblower complaint, which included allegations that a senior manager received real estate and millions of euros in cash from suppliers. Two employees appear to have been dismissed as the investigation progresses. It has not been reported that Adidas has self-reported the issue, but what is critical here is that the whistleblower complaint appears to have been made, not through any dedicated reporting system, but via the publication on social media of an anonymous letter, which will significantly reduce, in our view, both the self-reporting options available, as well as any credit for "voluntary" self-reporting. This perhaps underscores the critical importance of providing a space for employees to raise anonymous concerns, and ensuring awareness of and confidence in those reporting methods.

Sanctions

• On 13 June 2024, the UK announced 50 new sanctions designations against Russia, in a co-ordinated action with G7 partners, targeting the Russian "shadow fleet", financial institutions and military suppliers. These included:
  • designations targeting the financial sector such as the National Settlement Depository, National Clearing Centre and the Moscow Exchange Group. This coordinated action with the US, which designated the Moscow Stock Exchange a day prior, reflects a strategic effort to disrupt Russia's financial stability and its access to international capital;
  • designations targeting third country suppliers of munitions, machine tools, micro-electronics and logistics to Russia's military; and
  • the UK's first sanctions on vessels in Putin's "shadow fleet", used by Russia to circumvent existing sanctions and continue trade in Russian oil.
• On 30 April 2024, the UK government updated its guidance on third country processed iron and steel measures, including Norway as a partner country. Following the update, traders importing certain iron and steel products into the UK from Norway will not be required to provide evidence of supply chain history at the point of import to demonstrate compliance with the sanctions. In addition to Norway, the UK government has listed the EU and Switzerland as partner countries in the guidance.
• Further, the UK government has encouraged actors in all parts of the supply chain for third-country-processed iron and steel imports to the UK to undertake the necessary due diligence to ensure that sanctions are not being directly or indirectly circumvented. The imports of iron and steel have been subject to enhanced scrutiny by the UK and we anticipate that OFSI and the ECJU continue to carefully scrutinise steel/iron imports and the level of due diligence conducted by importers.
• On 1 May 2024, OFSI issued a new government webpage for Financial Sanctions FAQs. The FAQs provide guidance on UK financial sanctions regimes in general, as well as specific guidance in relation to Russian sanctions and the Russian oil services ban.
• On 2 May 2024, OFSI also updated its guidance on enforcement and monetary penalties. The updated guidance includes a more detailed explanation on how OFSI uses "case factors" to assess suspected breaches of financial sanctions.
• On 20 June 2024, OFSI issued a new General Licence (INT/2024/4836676) authorising certain payments to the FCA from a UK-designated person, or a person on behalf of, or acting on behalf of, a UK-designated person. This includes: (i) certain payments that a UK-designated person is required to make to the FCA under or by virtue of an enactment; (ii) a payment to the FCA of a levy imposed by the scheme manager of the Financial Services Compensation Scheme by virtue of section 213 of the Financial Services and Markets Act 2000; and (iii) payments to the FCA which are collected by the FCA on behalf of the FRC.
• On 24 June 2024, the EU adopted the 14th package of sanctions against Russia, introducing a significant number of targeted measures and closing loopholes on sanctions currently in place. This included:

Asset freeze designation

• A further 116 individuals and entities have been designated by the EU and subjected to restrictive measures, including Sovcomflot, Russia's largest shipping company.

Energy

• Prohibits reloading services of Russian LNG in the EU territory for the purpose of trans-shipment operations to third countries.
• Prohibits the provision of goods, technology, services and new investments for the completion of LNG projects under constructions such as Arctic LNG 2 and Murmansk LNG.
• Prohibits the purchase, import or transfer, or provision of certain services of specified LNG projects originated in Russia or exported from Russia through EU terminals not connected to the natural gas system.

Finance

• EU entities operating outside Russia will be prohibited from using: (i) the "System for Transfer of Financial Messages" (SPFS), a specialised financial messaging service developed by the Central Bank of Russia; or (ii) equivalent specialised financial messaging services. Exceptions exist, including for those necessary for the permitted purchase, import and transport into the EU of pharmaceutical or medical products.
• Prohibits engagement, directly or indirectly, in any transaction with an entity established outside Russia and using such services (and listed in Annex XLIV). Exceptions exist, including those necessary for the permitted purchase, export, sale, transfer or supply of pharmaceutical or medical products, and for humanitarian purposes.
• Prohibitions do not apply: (i) until 24 September 2024 of contracts concluded with a body listed in Annex XLIV before 24 March 2024, or of ancillary contracts necessary for the execution of such contracts; and (ii) to the receipt of payments due by an entity listed in Annex XLIV for contracts performed before 24 March 2024.
• EU entities are prohibited from directly or indirectly engaging in any transactions with targeted credit and financial institutions or crypto assets providers established outside the EU, when these entities facilitate transactions that support Russia's defence-industrial base. Exceptions exist, including those necessary for the permitted purchase, export, sale, transfer or supply of pharmaceutical or medical products, and for humanitarian purposes.

Funding of political parties and other organisations

• EU political parties and foundations, non-governmental organisations (including think tanks) or media service providers in the EU are prohibited from accepting funding from the Russian state and its proxies.

Transport

• The EU, against listed vessels (listed in Annex XLII), prohibits the provision of (amongst other items) port access and related services. Vessels can be subject to the prohibition for listed reasons, such as the transport of military equipment for Russia, transporting stolen Ukrainian grain or circumventing the oil price cap. 27 vessels are now targeted by these measures.
• The EU has widened the EU flight ban to apply to non-scheduled flights and where Russian persons are in a position to determine the place or time for take-off or landing (which, subject to certain conditions can include recreation and business trips). Upon request, aircraft operators must also provide information about non-scheduled flights, including ownership and passengers.
• The EU has broadened the prohibition on the transport of goods by road within the EU to include EU companies which are owned 25% or more by a Russian individual or entity.

Import and Export Controls Restriction

• Expands the list of restricted items that could contribute to the technological enhancement of Russia's defence and security sector by adding certain machine tools and certain "all-terrain vehicles".
• The EU also introduced further restrictions on exports of goods which contribute in particular to the enhancement of Russian industrial capabilities (e.g. chemicals, including manganese ores and compounds of rare earths, plastics, excavating machinery, monitors and electrical equipment).
• Restriction on the import of helium from Russia.

Liechtenstein is added as a partner country which applies similar iron and steel restrictions on Russia

• Imposes export restrictions on a further 61 new entities, alleged to support Russia's military and industrial complex. They are subject to tighter export restrictions concerning dual-use goods and technologies, and goods and technologies contributing to Russia's defence and security sector. Some of these entities are located in third countries (China, Kazakhstan, Kyrgyzstan, Türkiye and the United Arab Emirates), including RX Electronics, SuperChip Limited and 48th Central Scientific Research Institute.

Prohibition on services

• The exemption provided for in Paragraph 7, allowing the provision of prohibited services for the exclusive use of legal persons and entities in Russia, owned by, or solely or jointly controlled by, a legal person incorporated or constituted under the laws of an EU member state, EEA, Switzerland or partner country has been extended until 30 September 2024.
• Divestment from Russia or the wind-down of business activities in Russia
• Subject to conditions, the derogation provided in Article 12b, which permits the sale, supply or transfer of items that are the subject of sanctions, where such sale, supply or transfer is strictly necessary for the divestment from Russia or the wind-down of business activities in Russia, has been extended to 31 December 2024. This includes where the services are caught by Article 5n.

Proceedings

• Permits EU operators to claim compensation from damages caused by Russian companies due to sanctions implementation and expropriation.
• Article 11 provides that no claims in connection with any contract or transaction, where its performance has been affected, directly or indirectly, by the sectoral measures imposed under the Regulations, shall be satisfied, if they are made by, for example, those listed in the Annexes, or any other Russian person, entity or body. The package introduces a derogation until 31 December 2024 that competent authorities, on a case-by-case basis, may authorise the satisfaction of a claim for "other Russian person, entity or body" where it has determined that the satisfaction of the claim is strictly necessary for the divestment from Russia or wind-down of business activities in Russia.

Anti-circumvention

• Wording of the circumvention measure has specified that circumvention will occur where one participates in activities without deliberately seeking that the object or effect is to circumvent sanctions provisions, but being aware that the participation may have that object or effect and accepting that possibility.
• EU parent companies will be required to undertake best efforts to ensure that entities they own or control do not participate in activities that undermine the restricted measures.
• As of 26 December 2024, EU operators selling battlefield goods to third countries will need to implement due diligence mechanisms capable of identifying and assessing risks of re-exportation to Russia and mitigating them.
• As of 26 December 2024, EU operators transferring industrial know-how for the production of battlefield goods to third country counterparts will now have to include contractual provisions to ensure that such know-how will not be intended for sale, supply, transfer or exported directly or indirectly for goods intended to Russia, or for use in Russia.

Other measures

• Restrictions on accepting applications for registrations in the EU of certain intellectual property rights by Russian nationals and companies. Prohibit the purchase, import, transfer, sale, supply or export of Ukrainian cultural property goods and other goods of archaeological, historical, cultural, rare scientific or religious importance, where there are reasonable grounds to suspect that the goods have been unlawfully removed from Ukraine. Exception, where the transactions are necessary for the purchase, import or transport of pharmaceutical, medical or agricultural and food products.

Corporate Fraud

• Between April 2023 and February 2024, the Financial Conduct Authority (FCA) charged or secured convictions against more than 20 individuals for fraud-related offences, signalling a robust enforcement stance. The regulatory body is expected to bring additional charges as part of its ongoing efforts in the coming months. This period has also witnessed a notable increase in the prosecution of insider trading cases, with Mr Stuart Bayes convicted by the FCA for accumulating a profit of just over £132,000 from purchasing shares ahead of a market announcement.
• The Payment Systems Regulator has taken a firm stance against requests from the Payment Association to delay the start date of the mandatory reimbursement model for APP fraud, due to be in force from 7 October 2024. The interim head of the Payment Services Regulator has confirmed his view that there is a need to "act quickly" on authorised push payment fraud. New regulations are set to compel banks and payment companies to reimburse victims for claims up to £415,000, starting in October 2024. According to UK Finance, £459.7 million was lost on APP fraud in 2023, with 76% of APP cases originating from online sources, signalling a dire need to help affected consumers.
• UK engineering firm, Arup, fell victim to a sophisticated "deepfake" scam, after sending approximately £20 million to fraudsters using "deepfake" AI to impersonate a senior manager during a video call to authorise financial transfers. This incident, one of the largest known deepfake scams, underscores the growing cyber threats that companies and governments face from advanced AI technologies. This development serves as a call for organisations to evaluate and fortify their cybersecurity protocols and fraud detection capabilities. It further stresses the imperative for businesses to proactively adapt to technological innovations to protect their corporate assets and maintain the integrity of their operations.
• The Serious Fraud Office (SFO) has successfully convicted former investment manager David Kennedy for his involvement in a massive £100 million investment fraud scheme, leading to significant losses for numerous investors. Kennedy, alongside Timothy Schools, operated the Cayman Islands-based Axiom Legal Finance Fund, falsely assuring investors of safe returns through loans to UK law firms engaged in seemingly promising no-win-no-fee litigation. Investigations found that Kennedy had funnelled investor funds into a plethora of high-risk legal cases that were neither independently assessed nor successful, leaving many without any financial return. The SFO found that Mr Kennedy had diverted more than £5.8 million for personal luxuries, including properties in Switzerland and Tenerife, and home renovations in Hull, all concealed through offshore accounts and intricate trust structures. Mr Kennedy has been sentenced to eight years' imprisonment, following Mr Schools' 14-year sentence, and confiscation proceedings are expected in respect of both defendants.
• Annual fraud reports have been issued this quarter by both UK Finance and Interpol. Key global trends include:
  • An overall 2% decrease in reported fraud across the UK this year (in our view, this is likely a result of the huge amount of work and resources applied by both government and regulatory agencies tasked with addressing financial crime and the working level implementation of tighter fraud controls and customer verification through work being done within industry).
  • Identification of a clear change in criminals tactics, moving away from the targeting of weaknesses in systems and controls (generally in order to compromise personal data) and a move towards the increasingly sophisticated targeting of individuals, including through the use of AI "deepfakes" in interactions with victims, and organised financial crime including the selling of "leads" (sometimes referred to as "suckers lists") to identify susceptible individuals.
  • One particularly nasty emerging global typology, which we have heard referenced increasingly regularly recently is still on the rise, namely "pig butchering". This refers to a hybrid type of targeted scam which combines romance and investment fraud, making it less likely that victims will report.
  • Finally, a crossover between financial crime and forced labour/modern slavery, with Interpol highlighting evidence that organised crime gangs are using forced labour globally to operate "scam centres" which appear broadly equivalent to the "boiler room scams" we have long been familiar with in the UK.

Internal Investigations

• As anticipated, the FCA's proposed overhaul of its enforcement investigation disclosure policy has sparked significant debate, with parties arguing that the need for transparency must be balanced with concerns over potential reputational impacts. The policy, which would see the FCA publicly announcing the identity of firms facing enforcement investigations and providing updates, reflects a shift towards greater openness in regulatory proceedings. However, even the former Chancellor, Jeremy Hunt, reportedly warned that "naming and shaming" a financial services firm is different from doing so to other commercial bodies. Our team discusses the proposed changes in our article and sets out the need for a nuanced approach and the complex balance between the regulatory priority of transparency with the economic policy objective of stable, reputable firms.
• On 11 June 2024, the FCA released its whistleblowing data for Q1 2024, revealing a moderate increase in reports received between January and March as compared to the previous quarter, with a total of 298 new cases. Most new reports were submitted through the FCA's online reporting form and many whistleblowers opted to share their identity with the FCA, allowing greater engagement on the issues as part of any subsequent investigation. The most frequently reported concerns related to compliance, organisational culture, fitness and propriety, and consumer detriment.
• There continues to be a trend of investigations into the conduct of high-profile individuals – from television presenters to sportspeople and CEOs – making the news. The publication of investigations before they are concluded carries additional reputational risk to the individual under investigation and a careful balance has to be drawn by firms in determining the benefit of acknowledging such an investigation (and being "seen" to address the issue) and the collateral damage to the individual. We have also seen an increased scrutiny of the integrity of internal corporate investigations in general and plenty of allegations of "whitewashing" based on perceived inadequacies in independence and transparency. Amidst this, the Solicitors Regulation Authority (SRA) is set to revise its guidance to address the quality and independence of investigations by lawyers. This underscores the need for lawyers conducting internal investigations to be both thorough and unbiased, as well as the need for organisations to strengthen their internal investigation protocols to ensure that they are conducted with impartiality, thereby upholding public trust.
• Finally, the introduction of the FCA's anti-greenwashing rules on 31 May 2024 signifies a step in the UK's commitment to promoting genuine and transparent sustainability practices within the financial sector. Embedded within the broader Sustainability Disclosure Requirements (SDR), these rules are designed to reinforce the UK's pledge to achieve a net-zero economy and to harmonise with international environmental efforts. Whilst we do not expect the FCA to undertake immediate enforcement related to these new rules, firms are advised to proactively align with the SDR, which may involve conducting investigations to ensure compliance.