Emma RadmoreOSFI has imposed a penalty of £390,000 on an Irish-incorporated subsidiary of Apple, Apple Distribution International Limited, for breach of the sanctions in relation to Russia. ADI had instructed a UK based bank to make 2 payments in 2022 to a company that was wholly owned by a person designated under the Russian sanctions. While ADI relied on various affiliates to implement relevant processes, OFSI determined that the responsibility of ensuring sanctions compliance sat with it and that the conduct of its affiliates would be assessed as its own conduct.
The Russian entity in question, an app developer named Okko, had formerly been owned by PJSC Sberbank, but when that was designated in April 2022, it told the company to JSC New Opportunities, which was not at that time designated. However, on 29 June 2022 it did become designated and therefore the assets of the app developer became subject to an asset freeze. ADI instructed one payment before the designation, but the funds were released the day after it. It instructed a further payment the day after the designation. The two payments totally over £600,000.
In imposing the penalty, OFSI noted that there was a window, albeit a small one, in which the first payment could have been stopped, and it considered it significant that another breach payment was instructed for the following month. In fact, 2 payments had also earlier been instructed to the developer and another entity owned by Sberbank, but OFSI did not take action in relation to these as they happened before the Policing and Crime Act strict liability regime took effect.
OFSI found that although ADI did have a sanctions screening process in place, it had not calibrated it significantly to the increased financial sanctions risk associated with Russia. It relied primarily on self-certification and third party providers for its information, but OFSI felt it should have affirmatively requested ownership information. In mitigation, OFSI saw no evidence that ADI was aware that the developer was wholly owned by a designated person, although there had been press articles about it, and that it lacked intent, knowledge or cause to actually suspect the payments would breach sanctions. The first payment would not have been included in the breach were it not for the second.
ADI made voluntary disclosure to OFSI having commissioned a due diligence report on Okko after it was made aware of unrelated concerns about it. Once this report showed the ownership link, ADI proactively notified its due diligence providers of the link and has since committed to improving its process to require more, and frequent, information from Russian app developers.
OFSI assessed a reasonable penalty for this breach as being £600,000, which was reduced by 35% to take account of the voluntary disclosure and settlement.
This action is the first OFSI case resolved by means of settlement – which it wants to use to get quicker and more efficient enforcement outcomes.