What is the Economic Crime (Transparency and Enforcement) Act?

The Economic Crime (Transparency and Enforcement) Act came into force on 15 March 2022. This act was passed in the wake of the Russian invasion of Ukraine. This law represents a significant shift in disclosure requirements for foreign companies who hold property interests in the UK, along with significant changes to sanctions law, including ‘strict liability’ for sanctions breaches.

These measures include a new register of foreign owners of UK property. Entities who do not declare their beneficial owner will face restrictions in selling their property or face prison. Unexplained Wealth Orders (UWOs) are also being strengthened, with those who hold property in the UK in a trust will be considered an asset’s holder. Law enforcement will have more time to implement UWOs and be protected from litigation costs if the order is successfully challenged. 

Other key changes include:

  • Requirements on foreign legal entities seeking to sell their property during the six-month transition period to identify their true owners to Companies House 
  • Overseas entities must declare if any of their beneficial owners are under UK sanctions
  • New powers to enhance data sharing between HMRC and Companies House
  • Amending the ‘false filing’ offence into a two-tier offence. The first being an offence of providing false or misleading information ‘without reasonable excuse’ which can result in an unlimited fine. The second is an ‘aggravated’ offence of knowingly doing so which can result in a prison sentence
  • New measures will also increase fines for certain offences within the Act and reduce the transition period during which overseas entities must register with Companies House from 18 to 6 months

One vital change to know about is for sanctions compliance. Failure to comply with UK financial sanctions, such as those on Russia, can constitute a criminal offence and result in a fine or imprisonment. Under current sanctions law, the UK’s sanctions watchdog, the OFSI, cannot impose a monetary penalty unless the OFSI is satisfied the person who breached sanctions ‘knew’ or had ‘reasonable cause to suspect’ their conduct breached a sanction.

The Economic Crime Act replaced this knowledge requirement with a strict liability offence, meaning the person’s intent is irrelevant. If a sanction was breached, the OFSI can impose a monetary penalty. The knowledge aspect will remain a defence for a criminal case, meaning an individual or company can plead ignorance in court, but it will not be a defence against the OFSI’s ability to impose a civil fine.

Further, the OFSI can now ‘name and shame’ companies suspected of sanctions breaches, even if a fine has not been imposed.

Additionally, given the increase in scope of Unexplained Wealth Orders (UWO), any business holding assets of someone subject to a UWO could face increased scrutiny from authorities of their own due diligence and financial crime controls.

Finally, the Act allows ministers to ‘fast-track’ the imposition of sanctions. Meaning individuals or companies could face sanctions at short notice, requiring businesses to rapidly adapt to new rounds of sanctions imposed by the UK, which will closely follow or may even supersede those imposed by the US and EU. In short, the Economic Crime Act makes sanctions compliance a top priority. 

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

“In a world older and more complete than ours they move finished and complete, gifted with extensions of the senses we have lost or never attained, living by voices we shall never hear.”

Picture of James

James

VinciWorks CEO, VInciWorks

Spending time looking for your parcel around the neighbourhood is a thing of the past. That’s a promise.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.