Designing sanctions and their enforcement for beneficial ownership disclosure
Operationalising effective sanctions
This section highlights some of the key questions and considerations for policy makers and implementers to analyse and answer when operationalising sanctions to ensure that they are effective.
Grace period for operationalising sanctions and enforcement
The first key consideration for policy makers is to determine the grace period (if any) that should be given to legal entities before operationalising sanctions, as well as the duration of the grace period. In many countries, the trend has been to delay the operationalisation of sanctions and their enforcement for a certain period to ensure that legal entities get familiar with the BO disclosure and registration requirements. In Colombia, this initial grace period was eight months,[70] and the US is considering giving a one year period.[71] Kenya extended its initial deadline in order to “enable compliance”.[72] These periods can potentially be misused by legal entities knowing that they will not be penalised severely within this period. Therefore, these periods should be set as short as is reasonably possible, in consultation with the private sector; this could be determined using a risk-based approach.
Levels and types of sanctions
To make sanctions dissuasive, the first consideration for policy makers and implementers is to ensure that the level of financial sanctions imposed on entities or natural persons is not set so low that the entities or natural persons find it affordable to pay the fines instead of disclosing their BO information. This level may vary between countries, and there is only anecdotal evidence of levels being set too low. For example, in Ghana, the fine of USD 350 was found to be too low to promote compliance with BO disclosure requirements, as companies reportedly opted to pay the fine because it was cheaper than compliance.[73] This also underlines the need for more severe sanctions for persistent noncompliance.
Similarly, the 2019 Committee of Experts on the Evaluation of Anti-Money Laundering Measures and the Financing of Terrorism (MONEYVAL) Mutual Evaluation Report (MER) of Malta noted that the fine on companies, partnerships, and associations ranging from EUR 500-EUR 1000 (approximately USD 550-USD 1,100), together with daily penalties ranging from EUR 5-EUR 10 (approximately USD 5.50-USD 11) for failure to submit their BO information on the register, was too low to be considered dissuasive and proportionate, considering the nature and scale of business undertaken in Malta. In order to address these deficiencies, Malta increased fines tenfold and also introduced non-financial sanctions.[74] In this instance, countries may consider imposing higher fines; imposing different fines for different sectors based on the sectoral risk; or setting variable fines – for example, as a percentage of turnover or income. However, the latter two approaches do not appear to be current practice yet, which might be due to the challenges in incorporating and imposing such fines in practice. Germany, however, has implemented sanctions “up to double the amount of the economic advantage caused by the infringement”.[75]
To make sanctions dissuasive, countries should not limit their BO sanctions regime to financial sanctions only. The BO legislative regime should also incorporate non-financial sanctions and criminal sanctions against both natural persons and legal persons or arrangements. It is also important that countries should review – and potentially revise – their sanctions on a regular basis to ensure that they remain effective, dissuasive, and proportionate.
It is difficult to measure the effectiveness of sanctions, as it is challenging to establish direct causal effects between sanctions and compliance rates due to the presence of many other variables, such as a general compliance culture. Whilst high reporting rates cannot be attributable to sanctions alone, they have been associated with effective sanctions by the FATF.[76] Countries with high reporting rates, such as Austria (93% reporting rate, as of July 2019),[77] Denmark (96% reporting rate, as of January 2019),[78] and the UK (99% reporting rate, as of March 2019),[79] have all extended their BO sanctions regime beyond financial sanctions.
Box 6. Non-financial sanctions in Denmark [80]
In Denmark, registration of the BO information is a prerequisite for obtaining a Central Business Register (CVR) number for most types of legal persons. If the existing persons do not provide or provide inadequate information to the register, the law incorporates a provision for compulsory winding up of the entity. It is a criminal offence for a company and its management to not provide the BO information to the register. Partnerships and limited partnerships, which are required to register in Denmark, could also be struck off from the CVR for providing inadequate BO information or not registering the beneficial owners.
By November 2018, the Danish Business Authority (DBA) had compulsorily dissolved around 7,500 companies for failing to register the BO information within the prescribed timescale. It has been noted that, as of January 2019, approximately 96% of all entities covered by the BO legislation had registered their BO information. Further, 99.8% of the entities covered by the company laws under the DBA’s area of responsibility had registered BO information.
Despite high BO reporting rates evident in a few jurisdictions, it is very difficult to determine any exact factors that have contributed to the effectiveness of these BO disclosure regimes. Austria’s 93% reporting rate could be due to various factors, such as low-burden and user-friendly data collection and reporting mechanisms; digital reporting guidance; built-in conditions and error indications; and automated verification procedures.[81] Nonetheless, the level of penalties imposed in Austria for noncompliance with the BO disclosure requirements certainly appears to be one of the factors that drives up compliance in Austria, in addition to automating certain sanctions (see Box 9).
Box 7. Austria’s sanctions regime [82]
Under the Beneficial Owners Register Act (BORA) of Austria, submission of an incorrect or incomplete report or failure to submit a report is sanctioned with a fine up to EUR 200,000 (approximately USD 220,000) for intentional acts or up to EUR 100,000 (approximately USD 110,000) for gross negligence (Art. 15 para. 1 BORA). This includes in particular the following cases:
- inaccurate reporting of beneficial owners;
- unclear information leading to the inability to identify the beneficial owner;
- annual reporting obligation not being fulfilled;
- reporting outside the statutory time period when legal entities are established;
- cases in which certain legal entities are exempt from the reporting obligation but have another natural person as the beneficial owner through control (e.g., through a Treuhand, trusteeship agreement or other control relationship) in which case the exemption does not apply and they have failed to report such natural persons to the BO register, as required by the law; and
- cases of not reporting changes of beneficial owners within four weeks of obtaining knowledge of the changes.
In case of a persistent failure to report, coercive penalties are imposed twice under Art. 16 BORA.
Cases where the information reported about beneficial owners to the BO register is correct but – in the course of the voluntary submission of a Compliance Package [89] – documents transmitted were false or falsified, will be punished with a fine of up to EUR 75,000 (approximately USD 82,000).
Cases in which there is a failure to submit copies of an official photo ID with a report or in which the individual details of beneficial owners who have been disclosed are incorrect or missing are punished with a fine up to EUR 25,000 (approximately USD 27,500).
Cases in which it seems that the legal entity intended to provide a correct report but where individual documents were not transmitted or other obligations were not met in the voluntary submission of a Compliance Package [G], legal entities will be punished with fines up to EUR 10,000 (approximately USD 11,000), if not not already covered by an individual sanction.
Relevant best practice in non-beneficial ownership sanctions regimes
There is a possibility that a country may have an effective sanctions regime in another area similar to BO disclosures, such as the submission of annual returns or financial statements by entities. Policy makers and implementers should consider how sanctions and enforcement has been approached by comparable regimes, and whether any best practices could be drawn for their BOT regime.
In Hong Kong, for instance, the Companies Ordinance provides for sanctions against companies that fail to comply with information filing, including failure to submit information on registration and to file annual returns. The Company Ordinance provides that if a company fails to comply within the specified time, the company and every responsible person within the company commits an offence, and they are liable to a HKD 50,000 (approximately USD 6,400) fine. In the case of a continuing offence, they are liable to a further fine of HKD 1,000 (approximately USD 130) for each day that the offence continues.[83] The Company Registrar also has the power to strike off the company if they fail to file annual returns for consecutive years, as this is a cause to believe that the company is not in operation or carrying on business.[84] Hong Kong has also issued the Companies (Amendment) Ordinance 2018, introducing a requirement on companies to obtain and maintain their own BO registers. This Ordinance also contains sanctions for certain acts, such as providing false information. Such legislation may provide lessons to help policy makers and implementers develop an effective sanctions regime for a centralised BO register.
Roles, mandates, and powers of different authorities
There is no uniform approach among jurisdictions as to which authority or agency would be responsible for holding, maintaining, and monitoring the BO register. In some jurisdictions, it is the tax authority (as in Brazil) or the central banks (as in Costa Rica and Uruguay), but most commonly it is the registrar of companies (as in Austria, Denmark, the UK, and Zambia), due to it, in many cases, being the central authority that is already registering companies and therefore most suitable to hold and maintain a BO register. However, the ability of a registrar to verify the information supplied to it is useful only to the extent that it has the legal power to impose sanctions when it is provided with inaccurate, incomplete, or false information.[85] Although most registrars can impose some form of administrative penalty in the event of noncompliance, such sanctions are typically limited to the suspension or revocation of registration.[86] They do not have any investigative or law enforcement functions, although they can refer any suspected noncompliance to the relevant prosecuting authorities.
If the enforcement function is to be carried out by the registrar rather than another relevant agency, this would move the registrar’s mandate more toward that of a supervisory authority rather than that of a repository. The policy makers and implementers should therefore ensure that necessary legal and policy reforms are introduced so that the registrar of companies or other responsible authorities are able to sanction any breaches of the BO disclosure regime. This includes determining the types of investigatory and enforcement powers that are necessary and appropriate, and likely to be implementable. This is particularly relevant for the BO registrar, which should be entrusted to a non-law enforcement body, such as a registrar of companies. This should include, for instance, the authority to analyse the data for this purpose; the power to request information and documents from and send warnings to legal entities, related natural persons (such as beneficial owners, declaring persons, and officers of the company), and other competent authorities; and the power to sanction natural persons and legal entities for noncompliance (as in Austria).
In the UK, for instance, Companies House is responsible for maintaining the BO register, but lacks the necessary powers to ensure the adequacy and accuracy of the BO data disclosed on the register, and does not have the legal mandate to impose sanctions for breaches of the BO disclosure requirements. This has led to questions over the reliability of the UK’s data. To address this gap, a wider set of reforms has been proposed to enhance the mandate and powers of the registrar.[87]
To ensure effective cooperation and coordination between the designated agency and other law enforcement authorities (for example, prosecution to enforce criminal sanctions), proper procedures and processes should also be put in place to ensure the effective exchange of information between the agencies responsible for enforcement. For instance, it should be clear who can issue which types of sanctions and which government bodies can deal with appeals; these should not rely on an overburdened justice system with backlogged courts, as lengthy procedures can present loopholes.
Effective sanctions for foreign entities
Enforcing sanctions against foreign entities has often been identified as a major challenge by countries, especially if the registered officers of the company are located abroad or if the entity’s directors themselves are other entities.[88]
To ensure the effectiveness of the BOT sanctions regime against foreign entities, sanctions must be applicable to the person supplying the information, which means that the registrar or other enforcement authority must have jurisdiction over that person. An effective mechanism, as discussed earlier, is to require the authorised natural person, or a DNFBP, to be both responsible for making BO disclosures for foreign entities and for the information to be correct, and to require them to be resident within the jurisdiction. Sanctions should cover all the relevant parties, including the legal entity itself, for violating any BO disclosure requirements.
Recording, reporting, and publishing information on sanctions
FATF Recommendation 33 requires countries to “maintain comprehensive statistics on matters relevant to the effectiveness and efficiency of their AML/CFT systems”.[89] In line with this recommendation, another important consideration for policy makers and implementers is to determine how they should record or store the information on any sanctions that are applied against natural and legal persons under the BO disclosure regime, and how regularly this information should be updated. In addition, implementers should determine when and how this information should be made available to the relevant authorities, and whether this information should be available to the public.
The public availability of information on sanctions and noncompliance with BO requirements may drive up compliance and ensure the completeness, accuracy, and currency of the BO data on the register. However, the approach of naming and shaming is unlikely to be effective if it is not complemented by tough sanctions and enforcement. For example, experiences from the labour market,[90] improving business payment practices in the UK,[91] and the assessment management sector in Nigeria [92] have each shown that the approach of naming and shaming companies may not work on its own.
Some of the jurisdictions that have adopted this approach of making sanctions information available to the public include Belgium, Germany, and Poland. To incentivise compliance by entities with the BO disclosure regime, implementers should consider making the sanctions and enforcement information (e.g. fines and blacklisting) available to the public within a defined, short period of time from the date when any sanction has been enforced (e.g. 14 days).
Box 8. Country examples of the public disclosure of sanctions and enforcement information
In Germany, any sanctions imposed on companies for failure to comply with their reporting requirements are required by the law to be published on the Transparenzregister’s website.[93]
In Belgium, the treasury has identified the publication of a blacklist of noncompliant legal entities or legal arrangements as one of the mechanisms that could be implemented on a medium or long-term basis, although it does not appear to be put into practice yet.[94]
In Poland, the law provides that public records maintained by the Commercial Registry Office will indicate any entity that has failed to comply with the obligation of filing the BO information with the centralised BO register.[95]
In the UK, Companies House publishes: information on late filing penalties imposed and appeals received; prosecutions by the department under the Companies Act 2006; and disqualification of directors for persistent breaches of companies’ legislation, as part of their management information statistics.[96] The information is published as statistics, however, and companies are not named.
Foot notes
[G] A Compliance Package is a set of documents required for identification and verification of BO that may be submitted to the register on a voluntary basis by the legal entities as of 10 November 2020 and, therefore, could be inspected and used by obliged parties for the purpose of fulfilling the due diligence obligations. For further details, see: “Compliance Package”, Ministry of Finance, Austria, n.d., https://www.bmf.gv.at/en/topics/financial-sector/beneficial-owners-register-act/Compliance-Package.html.
End notes
[70] EY Global, “Colombia modifies regulations on ultimate beneficial owners”, 4 April 2022, https://www.ey.com/en_gl/tax-alerts/colombia-modifies-regulations-on-ultimate-beneficial-owners
[71] FinCEN, “Beneficial Ownership Information Reporting Requirements”, Proposed rule, 86 FR 69920, 8 December 2021, https://www.federalregister.gov/documents/2021/12/08/2021-26548/beneficial-ownership-information-reporting-requirements.
[72] Business Registration Service, “PUBLIC NOTICE - BENEFICIAL OWNERSHIP E-REGISTER PROGRESS UPDATE - 30TH JULY
2021 ”, 30 July 2021, https://brs.go.ke/assets/downloads/BENEFICIAL_OWNERSHIP_ E_REGISTER_PROGRESS_UPDATE%20_30TH_JULY_2021_V3_FINAL.pdf.
[73] Kiepe, “Verification of Beneficial Ownership Data”, 10.
[74] Anti-Money Laundering and Counter-Terrorist Financing Measures: Malta – Fifth Round Mutual Evaluation Report, (Strasbourg: MONEYVAL Secratariat, July 2019), 185, https://www.fatf-gafi.org/media/fatf/documents/reports/mer-fsrb/Moneyval-Mutual-Evaluation-Report-Malta-2019.pdf; Anti- Money Laundering and Counter-Terrorist Financing Measures: Malta – 1st Enhanced Follow-Up Report (Strasbourg: MONEYVAL Secratariat, April 2021), 9, https://rm.coe.int/moneyval-2021-7-fur-malta/1680a29c70.
[75] Abschnitt 7, §56.3.1, Geldwäschegesetz, https://www.gesetze-im-internet. de/gwg_2017/.
[76] Best Practices on Beneficial Ownership for Legal Persons, FATF, 66.
[77] Ibid.
[78] Ibid, 67.
[79] Joint Committee on the Draft Registration of Overseas Entities Bill: Collated Written Evidence Volume, House of Lords and House of Commons, 22 March 2019, https://www.parliament.uk/globalassets/documents/joint-committees/draft-registration-overseas-entities/ROEB-written-evidence-volume.pdf.
[80] Best Practices on Beneficial Ownership for Legal Persons, FATF, 67.
[81] Ibid, 65.
[82] Ibid, 65-66.
[83] Ibid, 68.
[84] Ibid.
[85] Emile van der Does de Willebois, Emily M. Halter, Robert A. Harrison, Ji Won Park, and J.C. Sharman, The Puppet Masters: How the Corrupt Use Legal Structures to Hide Stolen Assets and What to Do About It (Washington DC: The World Bank, 2011), 75, https://star.worldbank.org/sites/star/files/puppetmastersv1.pdf.
[86] Ibid, 73.
[87] See: “Corporate Transparency and Register Reform: Powers of the Registrar”, Department for Business, Energy and Industrial Strategy, December 2020, https://assets.publishing.service.gov.uk/government/uploads/system/uploads/ attachment_data/file/942167/Registrar_s_Powers_Consultation.pdf.
[88] Knobel, Beneficial ownership verification: ensuring the truthfulness and accuracy of registered ownership information, 17.
[89] International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation: The FATF Recommendations, FATF, 25.
[90] See: “Government publicly ‘naming and shaming’ firms breaking labour marker rules has some effect, but must be higher profile and complemented by tougher enforcement and larger fines”, Resolution Foundation, 9 November 2021, https://www.resolutionfoundation.org/press-releases/government-publicly- naming-and-shaming-firms-breaking-labour-market-rules-has-some-effect-but-must-be-higher-profile-and-complemented-by-tougher-enforcement-and-larger-fines/.
[91] See: “Does Naming and Shaming Customers who pay late actually work?”, Hilton-Baird Collection Services, 28 January 2020, https://www.hiltonbairdcollections.co.uk/does-naming-and-shaming-customers-who-pay-late-actually-work/.
[92] See: “AMCON: As Media War against Delinquent Debtors Gathers Steam”, THISDAY, 12 December 2021, https://www.thisdaylive.com/index.php/2021/12/12/amcon-as-media-war-against-delinquent-debtors-gathers-steam/; “Another Attempt at Naming and Shaming”, InvestAdvocate, 5 January 2022, https://investadvocate.com.ng/2022/01/05/another-attempt-at-naming-and-shaming/.
[93] Abschnitt 7, §56, Geldwäschegesetz, https://www.gesetze-im-internet.de/gwg_2017/; UBO disclosure requirements within the EU, KPMG International, 7.
[94] Best Practices on Beneficial Ownership for Legal Persons, FATF, 66.
[95] UBO disclosure requirements within the EU, KPMG International, 34.
[96] “Statistics at Companies House”, Companies House, n.d., https://www.gov.uk/government/organisations/companies-house/about/statistics.