The UK authorities are taking further steps to bring crypto businesses within the regulatory perimeter. As of 30 August 2022, cryptoasset exchange and custodian wallet providers are required to comply with the reporting obligations implemented by the Office of Financial Sanctions Implementation (“OFSI”). Crypto firms are now required to inform OFSI as soon as practicable if they know or reasonably suspect a person is subject to sanctions or has committed an offence under financial sanctions regulations. Breach of a financial sanction is a criminal offence in the UK, punishable by up to seven years in prison and/or a monetary penalty.

This development is highly significant as there have been concerns that Russia may be using cryptoassets and exchanges to evade the financial sanctions imposed following its invasion of Ukraine by the UK, the United States, the European Union, Canada and Japan. UK action mirrors recent steps taken by the Biden administration. In August, the US Office of Foreign Assets Control imposed sanctions on a cryptoasset ‘mixing service’ that allegedly has laundered over US$ 7 billion over the past three years and follows an executive order signed earlier this year that enhanced the US government’s ability to restrict the use of cryptoassets in illicit finance.

Given the tragic human cost of the ongoing conflict in the Ukraine and the intensity of governmental, media and regulatory focus on financial sanctions, it seems highly likely that the crypto sector will be targeted for further investigation and enforcement by authorities on both sides of the Atlantic. Crypto businesses with a connection to the UK (including branches) should ensure that they have the appropriate systems and controls to comply with these new requirements.  

The Regulations

On 19 July 2022, the UK Government laid before Parliament both The Sanctions (EU Exit) (Miscellaneous Amendments) Regulations 2022 and The Sanctions (EU Exit) (Miscellaneous Amendments) (No. 2) Regulations 2022 (together, the “Amending Regulations”) which amended the reporting obligations set out in legislation enacting various sanctions regimes, including Russia, Iran and Syria.

These Amending Regulations came fully into force on 30 August 2022. Should cryptoasset exchange or custodian wallet providers fail to adhere to adhere to the requirements, they will likely be committing a criminal offence. Under the rules, relevant firms must immediately act if they suspect that one of their customers is subject to sanctions or if they suspect a breach of sanctions.

A relevant firm is under an obligation to inform OFSI as soon as practicable if it knows, or has reasonable cause to suspect, that a person (i) is a designated person, or (ii) has committed an offence under financial sanctions regulations, where that information is received in the course of carrying out their business.

The Amending Regulations have defined a cryptoasset exchange as  “a firm or sole practitioner that by way of business provides one or more of the following services, including where the firm or sole practitioner does so as creator or issuer of any of the cryptoassets involved—

• exchanging, or arranging or making arrangements with a view to the exchange of, cryptoassets for money or money for cryptoassets,

• exchanging, or arranging or making arrangements with a view to the exchange of, one cryptoasset for another, or

• operating a machine which utilises automated processes to exchange cryptoassets for money or money for cryptoassets”.

A custodian wallet provider has been defined by the Amending Regulations as “a firm or sole practitioner that by way of business provides services to safeguard, or to safeguard and administer—

• cryptoassets on behalf of its customers, or

• private cryptographic keys on behalf of its customers in order to hold, store and transfer cryptoassets”.

Penalties

Breaches of financial sanctions are a serious criminal offence in the UK. OFSI can respond to a potential breach of financial sanctions in several ways, depending on the facts of the case. OFSI has a range of responses at its disposal, including: (i) issuing a warning, (ii) referring regulated professionals or bodies to their relevant professional body or regulator in order to improve their compliance with financial sanctions, (iii) publishing information pertaining to a breach even where no monetary penalty is imposed, if this is in the public interest, (iv) imposing a monetary penalty, and (v) referring the case to law enforcement agencies for criminal investigation and potential prosecution.

The most serious offences relating to the principal prohibitions under UK financial sanctions carry a maximum sentence of seven years’ imprisonment. Financial penalties may also apply ranging from 50% of the total breach up to £1 million – whichever is the greater value. OFSI guidance (linked below) explicitly states voluntarily disclosure of the breach will likely result in a reduction in the penalty given.

Since June 2022, OFSI has also been able to issue monetary penalties for breaches of financial sanctions on a strict liability basis. The Economic Crime (Transparency and Enforcement) Act 2022 lowered the threshold for the imposition of a civil monetary penalty. For further detail on this development, please see our memo titled Sanctions Watch UK Authority Outlines Powers to Impose Strict Liability Civil Penalties.

In addition to financial penalties, is always important to consider the significant reputational damage that may be caused by the negative publicity resulting from sanctions breaches. Any enforcement action will likely be published by OFSI and the business media.

Details of recent enforcement actions taken by OFSI are published on the UK government website. 

On 6 September 2022, the Director of OFSI announced plans to double the agency’s headcount by April 2023 with particular focus on enforcement and intelligence. This development is likely to herald increased enforcement activity as the agency expands its resources to better investigate potential sanctions breaches.

Guidance

The recently updated general guidance for financial sanctions states that both cryptoasset exchange and custodian wallet providers fall under the remit of the Sanctions and Anti-Money Laundering Act 2018 as “relevant firms”. Cryptoassets are also explicitly included in the non-exhaustive list of examples of “funds and economic resources”.

All individuals and legal entities who are within or undertake activities within the UK’s territory must comply with UK financial sanctions. Furthermore, All UK nationals and legal entities established under UK law, including their branches, must also comply with the UK financial sanctions, irrespective of where their activities take place.

In order to assist with compliance, OFSI maintains two lists of those subject to financial sanctions. The first is the consolidated list of asset freeze targets, which sets out individuals, entities and ships subject to sanctions known as “designated persons”. The second list is of persons named in relation to financial and investment restrictions. Persons contained in the second list may also appear in the consolidated list.

Increased UK regulation of the crypto sector – a clear trend

Since January 2020, the Financial Conduct Authority (“FCA”) has been the anti-money laundering and counter-terrorist financing supervisor of UK cryptoasset businesses under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (as amended, the “MLRs”). All cryptoasset businesses carrying out cryptoasset activities within the scope of the MLRs in the UK must be registered and compliant with the FCA. Businesses that are already registered or authorised with the FCA for other activities are further required to register with the FCA if they are carrying on relevant cryptoasset activities.

In August 2022, the FCA published new rules relating to marketing of high-risk investment to consumers. This follows a consultation earlier in the year on how best to strengthen the UK’s financial promotion rules for high-risk investments, including cryptoassets. These rules do not however, currently apply to cryptoasset promotions as crypto marketing is not currently within the FCA’s remit. In January 2022, the Treasury confirmed its intention to legislate to bring certain cryptoassets into the scope of the financial promotion regime. Once this has been resolved, the FCA expect to regulate crypto marketing and “follow the same approach as those for other high-risk investments”.

These developments are consistent with the trend of increasing regulatory oversight into the cryptoasset sector. It is highly likely that the UK will see further restrictions and obligations put in place to bring cryptoasset regulation more into line with other regulated markets such as the financial services sector.