The role of KYC when it comes to sanctions
In late July this year, five months after the Russian invasion of Ukraine began, fresh sanctions continue to be introduced. Investments in Russia have been banned, penalties have been imposed on critical major state-owned enterprises and dozens of individuals have had their assets frozen. The EU has also enforced a partial embargo of Russian oil, banning sea shipments.
Various international sports organisations and governing bodies have either suspended Russian teams from competitions or stripped the country of its right to host events. The nation has been banned from taking part in both the Eurovision song contest as well as the 44th Chess Olympiad.
Sporting events and Eurovision aside, what roles do banks have when it comes to these sanctions, and where does Know Your Customer (KYC) come in?
“In most western jurisdictions there is an absolute, legal responsibility to report suspicious activities,” says Dr Robert Dover, Associate Professor of Intelligence and International Security at the University of Leicester. “They have a duty to know who their customer is and to know the parties involved in a transaction. They also have an obligation to make sure they’re in legal compliance around sanctions.”
“Banks and financial institutions are at the front line of financial sanctions because they are the facilitators of payments for targeted states and individuals,” says Professor Kern Alexander, Faculty of Law, University of Zurich and Fellow, Queens College University of Cambridge. “And when banks are involved with sanctions -which they have to be - they need to know their customers extremely well. They have to understand the transaction they’re financing.”
According to Barclays, KYC is the process of verifying the identity of customers or clients. The objective of KYC guidelines is to prevent banks from being used by criminal elements for money laundering activities. It also enables them to understand their customers and their financial dealings to serve them better and manage their risks prudently.
In practice, KYC means identifying and verifying the identity of the customer through independent documents, data or information. It involves strict customer due diligence, which could involve:
- Researching company data and investigating senior executives and directors
- Verifying that the individual or company doesn't appear on any sanctions lists or watchlists
- Checking the individual isn't listed as a politically exposed person (PEP), potentially opening them up to corruption or bribery
“Banks run the risk of having third party liability for sanctions and if they don’t carry out careful examinations and inspections, they can be held liable for negligence or recklessness and failing to follow certain protocols on the transactions or the counterparties to the transactions,” says Alexander.
“They have internal risk management and software programmes that are written to flag unusual transactions and carry out background checks on customers who might have suspicious sources of income or wealth. They also identify the currency and the jurisdiction of banks that are party to cross-border transactions.
“Financial institutions have a structure of sanctions compliance that’s part of AML,” he continues. “Critical to AML is knowing your customer and suspicious transaction reporting. Banks can’t identify every transaction that might be targeting a state or person, but there is a risk-based approach where software programmes flag up suspicious or unusual transactions to risk management specialists at the bank.”
In order to achieve KYC compliance, banks and other financial services companies need to have in place stringent policies that incorporate:
- A customer acceptance policy
- Risk management
- A Customer Identification Program
- And ongoing monitoring
KYC clearly plays an enormous part in supporting sanctions. Adhering to the practices is no small ask, but it’s an imperative step in playing your part.