Sanctions & Extraterritorial Effect – Why multiple restrictive measures may apply to your business dealings

The demands on compliance programmes and procedures have increased considerably in recent months, especially in light of the fast-moving sanctions landscape with respect to Russia’s invasion of Ukraine, but also due to significant new restrictive measures being implemented in respect of China, Iran, and other jurisdictions. The complexity that companies are facing derives not only from the labyrinth of detailed prohibitions and licensing provisions, but also from the fact that most companies will be affected by multiple sanctions regimes at the same time. These regimes differ not only on the detail, but often also on their overall purpose and intent.

In this post, our focus is not on the various detailed sanctions measures that may impact businesses in virtually all economic sectors, but rather on the legal tools used by legislatures and enforcement authorities to extend the reach of those sanctions beyond national borders. We explain why companies are subject to multiple sanctions regimes even where they have only minor (and sometimes no) exposure to a particular jurisdiction.

Extraterritoriality – a novel, yet old concept

Historically, the common-law and civil-law traditions approached extraterritoriality differently. Extraterritoriality refers to domestic laws having effect even where the relevant conduct takes place in another country. [n1] The default position at common law is that criminal offences are only subject to the jurisdiction of the place where the offence occurred: this is the presumption against extraterritorial effect. [n2] The criminal codes of many civil-law countries, on the other hand, have typically granted their courts jurisdiction in respect of some offences that occurred overseas. The German and French civil codes are emblematic of this, and have inspired the criminal codes of many other countries, such as Japan’s Penal Code (刑法). [n3] General extraterritorial effect is given to German and French criminal law where, for example, the offence: 

• was directed against a national of that state (sometimes referred to as ‘passive personality’), or
• was carried out by a national of that state (or by someone who later became a national).

In German law, an additional requirement applies to both cases:

• that the act is also criminal in the place where the conduct occurred (‘dual criminality’) or the place is not subject to criminal jurisdiction at all.

Although the common law does not have similarly broad general extraterritoriality provisions, in recent years legislation has frequently provided for extraterritorial effect for individual offences, such as the US Foreign Corrupt Practices Act of 1977 or the UK Bribery Act 2010. [n4] The extraterritorial reach of such legislation, especially that of the US, has been criticized, including by the EU. The concept of jurisdiction and in particular the extent to which states may exercise prescriptive jurisdiction in respect of conduct in another state has long been a topic of debate in international law. [n5]

The concept of extraterritoriality is thus both old – in that it has long been recognized, especially in the civil-law tradition – and novel, in that the traditional limits on extraterritorial effect of criminal and regulatory legislation have been significantly expanded, and also enthusiastically embraced by leading common-law jurisdictions. Moreover, extraterritoriality is not a doctrine tied to the jurisdiction of criminal courts: it also governs the jurisdiction to bring other types of enforcement action (such as levying civil penalties or issuing formal warnings) of administrative agencies such as the Office of Foreign Assets Control (OFAC) in the US Department of the Treasury, and of the Office of Financial Sanctions Implementation (OFSI) in His Majesty’s Treasury in the UK.

It is against this background that the different sanctions regimes must be considered. In the following sections, we consider the extraterritorial operation of sanctions legislation in the US, EU, UK, Hong Kong, and Japan.

United States

The US sanctions landscape is complex and the rules vary from one sanctions program to another. There are also differences between financial restrictions administered by OFAC and export controls administered by the Bureau of Industry & Security (BIS) of the US Department of Commerce. However, the following principles have general application: US jurisdiction for ‘primary sanctions’ may be established where there is a link/nexus to the US, such as exporting US-origin goods, physical presence or nationality. US sanctions are binding on ‘US Persons’. This term includes:

• US citizens (including persons holding another citizenship) wherever located; [n6] 
• lawful permanent resident aliens (i.e., Green Card holders) wherever located;
• any other person physically in the US;
• any entities incorporated in the US, as well as their foreign branches.
• Some sanctions programs, notably those in respect of Cuba and Iran, in addition require foreign subsidiaries owned or controlled by US companies to comply with US sanctions, but this is not the case for most sanctions programs.

Not only must US Persons meticulously avoid performing any act that would contravene US sanctions; they are also prohibited from facilitating a sanctions breach by another person. This imposes considerable restrictions on delegating or ‘outsourcing’ decision-making power to a non-US person. It is also prohibited to cause a US person to breach sanctions, even if this is done innocently. For example, a foreign bank that processes a US dollar payment (virtually all such payments are made through a correspondent account in the US) is likely to cause its correspondent bank in the US to contravene a sanctions prohibition and thereby break the law where the money for that payment belonged to a person on the US SDN list of blocked persons and property (‘designated person’). This causation basis of liability has been used on numerous occasions to bring enforcement actions against non-US financial institutions. The financial sector and import/export businesses are particularly exposed to the extraterritorial application of primary sanctions measures.

The tool of ‘secondary sanctions’, which is included in several US sanctions programs (notably Iran, North Korea, Russia, and Venezuela), empowers the Treasury to designate non-US persons for certain ‘breaches’ of US primary sanctions even where the non-US person was not subject to the already broad US jurisdiction described above. Non-US persons have been subjected to secondary sanctions for conduct including materially assisting or acting for or on behalf of a designated person; operating in a sanctioned industry in a country which is subject to sectoral sanctions (Russia, Venezuela); being controlled by a designated person (owned entities, meanwhile, are already deemed designated under OFAC’s 50% rule); or being involved in a ‘significant’ transaction with a designated person.

The aim of such secondary sanctions is to cut non-US persons that engage in business with sanctioned parties off from the US financial system, with banks and financial institutions being frequent targets. The precise consequences depend on the relevant sanctions regime, but they include prohibitions on maintaining US correspondent accounts; debarment from US contracting; loss of US export licences; travel bans; and even an individual or entity being themselves designated and added to the SDN list.

Secondary sanctions are a controversial geopolitical instrument as they push the boundaries of extraterritoriality. The EU Blocking Regulation (Council Regulation (EC) No 2271/96) received a ‘face lift’ in 2018, specifically in response to the US withdrawal from the Joint Comprehensive Plan of Action regarding the Iran nuclear program. The Blocking Regulation effectively prohibits compliance with certain Cuba- and Iran-related US sanctions by persons in the EU. The Recitals to Commission Delegated Regulation (EU) 2018/1100 (which effected the 2018 updates) specifically refer to the extra-territorial application of laws adopted by third countries (i.e., the US), and describe these as violating international law.

European Union

Although each EU regulation sets out its scope of application individually, EU sanctions typically apply to nationals of an EU member state wherever in the world they are physically located; and to any legal person, entity or body incorporated or constituted under the law of a member state, again irrespective of where physically located. In addition, EU sanctions apply of course within EU territory and also to any legal person, entity or body incorporated or constituted outside of the EU in respect of any business done in whole or in part in the EU. What sets EU sanctions (as well as those of the UK and Hong Kong, considered below) apart from US sanctions is that EU jurisdiction is established only where there is an EU nexus. The EU does not have jurisdiction to impose ‘secondary sanctions’ of the type that OFAC frequently uses. That said, EU sanctions also have considerable extraterritorial reach.

At the time of writing, EU sanctions violations do not amount to an EU ‘crime’, although there have been calls for the law to be changed in this respect. [n7] While EU regulations set out the prohibitions and licensing grounds, as well as the scope ratione personae of the sanctions, it is implementing legislation taken at member state level that sets out the applicable penalties (which can be criminal and/or administrative in nature), subject to national criminal and/or administrative substantive and procedural law. This adds a further layer of complexity to the extraterritorial effect of EU sanctions. 

United Kingdom

Since the end of the Brexit implementation period on 31 December 2020, the UK has not participated in EU sanctions programmes. Instead, the UK now implements its own autonomous sanctions under the Sanctions and Anti-Money Laundering Act 2018, as amended (most recently in 2022 [n8]). Section 21 of that Act – conveniently titled ‘Extra-territorial application’ – defines the term ‘United Kingdom Person’ as including a UK national or a body incorporated or constituted under the law of any part of the UK, and this provision may be extended to bodies incorporated or constituted in the Channel Islands, the Isle of Man, and the UK overseas territories (such as the Cayman Islands or the British Virgin Islands). [n9] UK sanctions apply to UK Persons wherever they are in the world, as well as to conduct in the UK. 

UK nationality law is complex and recognizes no fewer than six different types of nationality status. [n10] Alongside full British citizenship, which automatically comes with the right of abode in the UK, British overseas territories citizens, British overseas citizens, British nationals (overseas), British subjects and British protected persons also qualify as UK nationals and hence as UK Persons. Note that permanent residents (holders of indefinite leave to enter or remain) are not subject to UK sanctions, except of course in relation to conduct carried out in the UK. The fact that UK sanctions apply with full force to non-citizen nationals has important repercussions, especially in respect of Hong Kong (see below). 

Hong Kong

Hong Kong does not implement autonomous sanctions, and PRC mainland legislation does not directly apply to it. However, Hong Kong – like the other jurisdictions considered in this post – does implement sanctions measures adopted by the UN Security Council under Chapter VII of the UN Charter. This is done by virtue of the United Nations Sanctions Ordinance (Cap. 537). The Ordinance itself does not define its territorial scope; however, implementing regulations typically extend sanctions to ‘Hong Kong persons’. [n11] For individuals, these are persons who are both a permanent resident of Hong Kong and a Chinese national. For bodies corporate, any body incorporated or constituted under the law of Hong Kong falls within the definition of Hong Kong person. Individual prohibitions typically provide that the prohibited conduct applies to any person acting within Hong Kong, as well as to Hong Kong persons in respect of conduct carried out anywhere in the world. 

Many Hong Kong residents have dual citizenship, and indeed the likelihood of a Hong Kong person being also a UK Person is high, especially because British nationals (overseas) or ‘BNOs’ – a status created by the UK government prior to handover in 1997 – are included in the definition of UK Persons. The UK Home Office estimates that there are around 2.9 million BNOs, [n12] or just under 40% of the region’s population. A person may be a BNO even if they do not currently hold a valid passport describing them as such. This is important because the UK’s civil penalties regime applies on a strict liability basis. This means that it is no defence to a charge of sanctions violation to maintain that the person did not know/suspect, and had no reason to know/suspect, that they were breaching sanctions (e.g. because they were unaware of their BNO status). This strict liability applies only to the UK’s civil penalties regime, not to criminal proceedings.

Japan

Broadly speaking, the provisions of the Foreign Exchange and Foreign Trade Act (FEFTA) apply to transactions between residents and non-residents of Japan. FEFTA covers acts committed in Japan as well as acts committed in a foreign state by a representative, agent, employee of other worker of a legal entity with its principal office in Japan, but only in respect of the legal entity’s property or business. Similarly, acts committed abroad by a person having their domicile in Japan (or an agent, employee or other worker of such person) are subject to FEFTA in relation to the property or business of that person.

FEFTA’s extraterritorial reach in respect of individuals is thus not coupled to nationality, and both individual and corporate extraterritorial liability is limited to acts in relation to the property or business of the individual or corporate. However, for an act to be covered by FEFTA, a relevant transaction between a resident and a non-resident must occur. FEFTA and implementing regulations define individuals who are domiciled or resident in Japan, as well as companies having their principal office in Japan, as "residents", including both Japanese nationals and foreigners. Japanese nationals are presumed to have domicile in Japan and therefore prima facie qualify as residents, except in one of the following cases:

• persons who leave Japan and stay in a foreign country for the purpose of working at an office in a foreign country (including an overseas branch, local corporation, or international organization);
• persons who leave Japan and stay in a foreign country for the purpose of remaining in a foreign country for two years or more;
• persons who have in fact stayed in a foreign country for two years or more after leaving Japan; and
• persons falling within any of the above categories who have temporarily returned to Japan for office work or vacation and have been in Japan for less than 6 months.

Foreign nationals working in an office in Japan or who have been in Japan for more than 6 months are presumed to have domicile or residence in Japan; and a Japanese branch of a foreign company would qualify as a resident.

The government has considerable discretion in terms of enforcement and interpreting the subtleties of the sanctions legislation. Companies would be well-advised to check each specific case if the interpretation is not obvious.

Conclusion

There are many ways in which an individual or corporate entity may be subject to several sanctions regimes at the same time, even regimes implemented by jurisdictions without a physical presence. The important links are nationality and incorporation; origin of goods; but also currency flows/use of clearing services, purchasing insurance or using overseas servers may be sufficient to ground jurisdiction. We do not seek to cover every single possible way to establish a nexus to a particular country, and much will depend on the individual sanctions programme. However, in broad terms, corporates would be well-advised to establish:

• with which countries they have a ‘constitutional’ nexus, notably through incorporation;
• in which countries they engage in business which could create a business nexus;
• with which countries their directors and senior leadership have a ‘management’ nexus which might then ground corporate criminal and/or enforcement liability; and
• where their employees are based or operating from, even temporarily, and what their nationality status is, both to safeguard the employee and to avoid the possibility of vicarious civil, regulatory or even criminal liability.

If you have any specific questions, please get in touch with your usual Freshfields contact for more detailed advice.

_________________

Footnotes:

[1] Most criminal legal systems recognize that ‘mixed’ offences, where part of the criminal conduct occurred overseas, are properly within their jurisdiction. This post does not consider such general theories of criminal law. 

[2] See e.g., Seymour v The Queen [2007] UKPC 59, [2008] 1 AC 713.

[3] H. Oda, Japanese Law, 4th edn. (Oxford: Oxford University Press, 2021) Ch 18.

[4] The criminal extra-territorial jurisdiction of UK courts in relation to many offences against the person has also recently increased considerably under the Domestic Abuse Act 2021. Various fraud and dishonesty offences are also subject to UK extraterritorial jurisdiction.

[5] See e.g., M. Shaw, International Law, 9th edn. (Cambridge: Cambridge University Press, 2021) Ch 11. The key tension is between state sovereignty and the concomitant principle of non-interference in the affairs of another state on the one hand, and the extension of legislative and/or judicial jurisdiction to conduct carried out in such other state on the other hand. 

[6] Holders of US nationality who are not US citizens do not seem to fall within the definition of ‘US person’: 31 CFR § 560.314. 

[7] The power to create EU crimes, which allows the EU institutions to set down minimum penalties to be implemented by member states, derives from Art 83(1) TFEU. https://www.consilium.europa.eu/en/press/press-releases/2022/06/30/sanctions-council-requests-european-parliament-consent-to-add-the-violation-of-sanctions-to-the-list-of-eu-crimes/ (accessed 17 October 2022).

[8] The Economic Crime (Transparency and Enforcement) Act 2022 removed the requirement for OFSI to prove knowledge, suspicion or belief when imposing a penalty for a sanctions violation, thereby introducing strict liability for ‘civil’ sanctions breaches. 

[9] The UK Government’s policy is to extend UK sanctions to the Crown dependencies and overseas territories, except Bermuda and Gibraltar, which have their own autonomous regimes. See e.g., The Russia (Sanctions) (Overseas Territories) Order 2020, S.I. 2020/1571.  

[10] https://www.gov.uk/types-of-british-nationality (accessed 17 October 2022).

[11] See for example, United Nations Sanctions (Libya) Regulation 2019, s 1, s2(1).

[12] https://homeofficemedia.blog.gov.uk/2022/02/24/media-factsheet-hong-kong-bnos/ (accessed 17 October 2022).