The penalty: £15,000 for 2 payments to Syrian Arab Airlines so one of Tracerco’s employees could fly home (flights between May 2017 and August 2018). The flights were actually booked through a UAE travel agency, which it then paid for the tickets.
The firm got a 50% reduction in its penalty because it voluntarily self-disclosed the violations. The penalty was imposed using the old standards of proof – Tracerco either knew or had reason to suspect it was violating the Syria (European Union Financial Sanctions) Regulations 2012, which were the relevant regulations at the time. Tracerco did not request, as was its right, a ministerial review.
Tracerco is a UK-registered subsidiary of Johnson Matthey based in the UAE. The parent company actually reported 4 payments to OFSI in January 2020, but 2 were ruled ineligible for imposing a penalty because they occurred prior to the passage of the underlying legislation (Policing and Crime Act 2017).
There was mitigation due to the low value of the breaches, the violations were not considered deliberate, Tracerco had no prior enforcement history, Johnson Matthey took remedial action to improve group compliance and the firm fully cooperated with the investigation.
OFSI’s notes on compliance include instructions to firms to conduct due diligence on all their transactions, even if it’s not for external parties like customers or suppliers. They also note that sanctions requirements can also extend to UK companies located outside of the UK. Further, they point out that a firm cannot relay on a third party (e.g. the UAE travel checks) to conduct sanctions checks, and it is ultimately liable for any violations that occur.