How much diligence is 'due'?: The perils of sanctions checks

The recent allegations involving Santander and Lloyds Bank remind us that sanctions due diligence is a minefield. It also raises important questions about how far financial institutions can reasonably go to insulate themselves from harm.

The Financial Times and other publications recently reported that two of the UK’s largest banks, Lloyds and Santander, provided banking services to a business ultimately owned by a US-sanctioned Iranian entity.

Last week, Santander issued a strongly worded rebuttal to these reports, stating “categorically that, after a thorough internal investigation, it has not found any direct nor indirect sanctions breach in any part of the group.”

Now the details are somewhat complex, but ultimately revolve around a UK based entity called Pisco UK and a man called Abdollah Siavash Fahimi, who has demonstrable links to an entity, Petrochemical Commercial Company, that has been on the US OFAC list since June 2018.

Mr Siavash Fahimi has been a director of Pisco UK Limited since its foundation in January 2008. In 2021, he joined the board of Petrochemical Commercial Company (UK) Limited (“PCC UK”),which is 100% owned by a sanctioned entity and operates from the same London office address as the National Iranian Oil Company. He spent a little under a year in that role. At some point in 2022, Santander ended its relationship with Pisco UK " for reasons unrelated to [the current] allegations.” As the FT points out, shortly after Mr Fahimi’s appointment to the board of PCC UK, in June 2021, a number of emails were exchanged between officers of that company and other entities, including Pisco UK, demonstrating that Fahimi owned Pisco UK in trust on behalf of PCC UK. These emails were subsequently leaked on to the WikiIran website.

Santander has not yet provided a full rationale for this statement, but their press release does say that “standard screening undertaken in relation to this account determined that the account holder was not included on any sanctions lists, and that the business was, according to the relevant public records, owned by persons who were not identified as subject to sanctions.” On this basis, they state that they have “not found any breach by [Santander] of U.S. sanctions against Iran.”

If, as appears to be the case, there was a period of time in 2021 when the links between Pisco, Fahimi and PCC UK were in the public domain, then these statements by Santander raise a couple of questions:

1. How hard did they look? The bank’s statement that “the account holder was not included on any sanctions lists, and that the business was, according to the relevant public records, owned by persons who were not identified as subject to sanctions” may be true in a narrow sense, but it relies on the fact that the trustee relationship was concealed and that there was no other way in which they could have identified the risk that there was a direct corporate relationship between these different entities. Is this accurate?

2. When did they look? Another possibility arising from this statement is that the “standard screening undertaken” on Pisco UK was conducted at a point in the past when it was not linked to sanctioned entities. Depending on when Santander started banking Pisco UK, this could have been some while ago and it is probably safe to assume that no further due diligence was carried out between April 2021 and early February 2024 when this story broke.

All of which boils down to the question of how much diligence is due in cases such as this?

It doesn’t seem credible that, with the right checks at the right time, Santander wouldn’t have been able to identify the Ultimate Beneficial Ownership links revealed in the Financial Times expose; or at least, identified serious concerns worthy of further questioning.

Of course banks with many millions of accounts and must match regulatory and other imperatives with commercial sense. So how much diligence should they carry out before accepting clients and how often should that diligence be refreshed?

With US fines for banks that have breached sanctions on Iran running into over $1 billion and sustained 3.6 percent drop in its share price, Santander will be counting the cost of not having a system that catches such rogue businesses.