+44 (0)20 7353 6000
17 Apr 2024

The New Office for Trade Sanctions Implementation (OTSI) – Why Criminal Risks Lie Ahead for Business

On 11 December 2023, the Government announced the creation of the Office for Trade Sanctions Implementation (OTSI). Its stated focus is the civil enforcement of trade sanctions. However, it also signals an increased risk of criminal investigation and prosecution for those who fall foul of the UK’s framework of trade controls.

This article describes this framework and outlines some points of practice arising from criminal proceedings in the past decade.1 It then explains why OTSI represents an increased criminal risk for business, not just in terms of enforcement but also adverse publicity.

The legal framework

Over the past decade, the UK’s trade sanctions regime has evolved rapidly to keep pace with the Government’s shifting foreign policy and national security objectives, including the UK’s withdrawal from the EU and emerging conflicts such as Russia’s invasion of Ukraine. The result is a sprawling legal framework that can be intimidating for the uninitiated.

Broadly, the controls divide into two types: (a) export controls (where the goods in question move from the UK to an overseas country), and (b) trade controls (where the goods in question move between two overseas countries). These can be sub-divided into a further two types: (a) where the goods themselves are controlled (because, for example, they have a military or dual-use design), and (b) where the goods are being sent to a controlled destination or for a controlled end use (because, for example, they may be used to provide nuclear capability to a particular regime).

There are three main sources of export controls:2

  1. Part 2 of the Export Control Order 2008 (the 2008 Order) contains the UK’s national export controls, defined by reference to extensive (and frequently updated) lists of military and dual-use goods, software and technology. These prohibitions are far-reaching: the fact that they apply to software and technology means, for example, that they criminalise the sending overseas of a WhatsApp message attaching an instruction manual explaining how to operate dual-use goods.
  2. Council Regulation (EC) No 428/2009 (the 2009 Regulation) prohibits the export of certain dual-use goods from Great Britain (including to countries within the EU) and from Northern Ireland to countries outside the EU.3
  3. Part 2 of the 2008 Order also imposes ‘end-use’ controls in respect of dual-use goods not listed in Annex 1 to the 2009 Regulation. These include where an exporter is aware, or has been informed by the Secretary of State, that the goods are or may be intended for military end use by a country subject to an arms embargo imposed by the UK, UN or OSCE.

There are two main sources of trade controls:

  1. The 2008 Order prohibits certain trading activities, including trafficking and brokering, between two overseas countries in respect of defined goods classified into categories A, B or C, as well as in respect of all such goods where the end-user is subject to an arms embargo imposed by the UK. Save in respect of category C goods, these controls have extraterritorial effect, meaning that they apply to any person operating within the UK (including foreign companies and nationals) and to UK persons operating overseas. Thus, for example, the Athens office of a UK company commits a criminal offence if it brokers category B goods from, say, Brazil to China (and even if the office is a Greek company, any British nationals working there and involved in the brokering may still be committing a criminal offence).
  2. The 2009 Regulation prohibits certain brokering services relating to dual-use goods listed in Annex 1 where the broker is aware, or has been informed by the Secretary of State, that the goods may be intended for a restricted end-use. Again, this control has extraterritorial effect.

These are only the main sources of export and trade controls. There are many other pieces of the legal jigsaw. For example, regulations established under the Sanctions and Anti-Money Laundering Act 2018, such as the Russia (Sanctions) (EU Exit) Regulations 2019 (the Russia Regulations). These prohibit the export of restricted goods from the UK to, or for use in, Russia, as well as the supply, delivery and brokering of arrangements to supply or deliver restricted goods from a third country to Russia. Once again, these controls have extraterritorial effect. They will be central to OTSI’s stated goal of curbing the trade in products by UK persons through third countries to Russia.

In order lawfully to engage in activity that would otherwise breach any of these controls, businesses must apply for, receive and comply with an individual licence specific to the goods and/or customer,4 or comply with a general licence,5 both of which are issued and monitored by the Export Control Joint Unit (ECJU). The ECJU undertakes routine compliance inspections at sites where individuals and corporates hold licences. It reports all instances of non-compliance to HMRC, which is the main agency that investigates suspected breaches.

Criminal offences, evidential burdens and penalties

In relation to breaches of export controls, the main criminal offences are found in section 68 of the Customs and Excise Management Act 1979 (CEMA):

  1. Section 68(1) makes it an offence to export goods from the UK contrary to any prohibition or restriction (i.e. whether imposed by the 2008 Order, 2009 Regulation or any other source of law). This offence attracts strict liability, meaning that ignorance of the export control breached does not provide a defence. A prosecutor need only establish that the goods were subject to an export control and attribute their export to the defendant.
  2. Section 68(2) creates a more serious offence where a defendant is “knowingly concerned” in the export of goods from the UK with “intent to evade” the relevant prohibition or restriction. It is sufficient for a prosecutor to establish that the defendant knew in general terms that the movement of goods was prohibited or restricted. It is not necessary to prove a specific knowledge of the particular control breached, nor an intent to mislead the UK authorities.6 If made out, the “intent to evade” offence carries significant financial penalties and up to 10 years’ imprisonment.7

The main criminal offences for breaching trade controls are bifurcated along identical lines in the 2008 Order:

  1. Article 34(1) creates a strict liability offence for breach of the trade controls contained in Part 4 of the 2008 Order.
  2. There are two “intent to evade” offences: Article 35(4) for breach of the trade controls in the 2009 Regulation and Article 34(5) for breach of the trade controls in Part 4 of the 2008 Order. Both carry an unlimited fine and/or 10 years’ imprisonment.

Historically, in this firm’s experience, HMRC has focused most of its investigations (and the CPS most of its prosecutions) on the strict liability offences, especially where the target of the enforcement action is a corporate. This is unsurprising: where a corporate’s systems and controls have failed to detect the cross-border movement of licensable goods or failed to apply the correct licensing procedure, it becomes an easy target for HMRC/the CPS given the low evidential burden. Hardly any businesses are immune from this exposure. Indeed, we are aware of two large City law firms investigated by HMRC for unlawful exports of dual-use cryptographic software from their London to Beijing offices. If prosecuted for the strict liability offence, the fine may be modest but the reputational damage will not: the Department of Business and Trade routinely publishes such details.

In this firm’s experience, enforcement action for the ‘intent to evade’ offences has been rare in the case of corporates, although we have seen cases where HMRC has conducted exhaustive corporate investigations in search of evidence that might suggest a deliberate breach. In these cases, HMRC will typically scrutinise all prior communications with the ECJU as well as internal communications within the corporate. The type of evidence on which prosecutions for the ‘intent to evade’ offence are founded would include:

  1. Where the defendant has tried and failed to obtain an individual licence from the ECJU (but then exported or traded the goods regardless).
  2. Where the defendant made efforts, when applying for an individual licence, or when purporting to rely on a general licence, to obscure the true design, end-use or end-user of the goods.
  3. Where the defendant knew that any attempt to obtain an individual licence would inevitably be refused (but then exported or traded the goods regardless).
  4. Where the defendant sought to keep an existing customer happy by supplying a new line of goods that fell outside what was permitted by the general licence it previously (and lawfully) relied upon.

To uncover this type of evidence, it is not unknown for HMRC (often acting with the UK Border Agency) to arrest and interview employees under caution, to seize goods at the border, and to obtain warrants to enter and search businesses’ premises to seize documents and electronic material (or, less coercively, to require production of documents).

An increased risk of criminal prosecution…

Historically, there has been a dearth of reported prosecutions of trade sanction violations from which to draw meaningful guidance. The statistics that are published suggest that the CPS has secured only four convictions since 2016 (when the ECJU was established) and all of these were for the strict liability offence under section 68(1) CEMA. The only prosecution finalised in 2022 followed a corporate’s guilty plea, which resulted in a fine of just £600 plus the statutory surcharge and court costs.

The historic lack of prosecutions masks a more active investigative picture. In 2022 HMRC took ‘no further action’ in 61 trade sanction investigations, issued 123 warning letters and made 22 offers of compound penalties, including the largest ever at c. £2.7 million, following the voluntary disclosure of breaches of both export and trade controls.8 In this firm’s experience, ‘compounding’ under section 152 CEMA, which involves paying a penalty, often accompanied by a range of remedial measures to prevent reoccurrence, is a very common disposal of a criminal investigation into breaches of trade sanctions and, for the business, an attractive means of avoiding prosecution – not least since its name is never published.

So what difference will the creation of OTSI – which has only civil enforcement powers – make to a criminal regime often accused of lacking teeth? To be clear, it is unlikely to turn this gentle backwater of the criminal law into a foaming torrent of prosecutions. However, it does increase the criminal risk.

First, the creation of a specialist body empowered to levy monetary penalties for non-compliance with trade sanctions invites, and creates the capacity for, more investigations and prosecutions by HMRC/the CPS. OTSI will be able to detect a greater number of violations and refer cases to HMRC that it considers too serious to merit a civil disposal – a referral that will make HMRC reluctant to justify its previous practice of mainly disposing of cases through warning letters and compound penalties. Indeed, the somewhat archaic ‘compounding’ route under section 152 CEMA will likely become obsolete in practical terms, replaced by OTSI’s monetary penalty powers. This should embolden HMRC’s export control division to define itself as a body likely to commence criminal investigations and to refer them to the CPS for prosecution.

Second, calls for the publication of investigations, prosecutions and penalties for breaches of trade sanctions, to ensure consistency with the transparent approach adopted by the Office of Financial Sanctions Implementation (OFSI) since its creation in 2016, were loud and clear following the Government’s announcement of OTSI. The anonymity afforded by ‘compounding’ will become a thing of the past and full details of civil penalties, naming the corporate offender and giving details of their misconduct, will become the norm. Just as the NCA has ramped up (and been very vocal about) its criminal enforcement of financial sanctions, HMRC will be expected to follow suit in the criminal enforcement of trade sanctions.  The publicity and deterrent effect generated by criminal prosecution will achieve the so-called “maximum impact” the Government has promised. Indeed, we may well see the introduction of mandatory reporting obligations, which for now remain limited to financial institutions in relation to financial sanctions.

Third, the Government has itself promised “tougher penalties” for those who “dodge” trade sanctions, doubtless because it faces global pressure to keep pace with its G7 partners in starving the Russian military effort. Amongst other measures, in March 2023 the Government pledged a further £50 million to support its Economic Deterrence Initiative, which includes the effective enforcement of trade sanctions. In June 2023, the UK agreed to collaborate with the Five Eyes countries (Australia, Canada, New Zealand, the UK and the US) to facilitate the exchange of information related to export control violations and maximise the effectiveness of each country’s enforcement regimes. This global interest generates accountability and, for multinational corporates, local expertise in each country will be critical to manage the increased risk of cross-border compliance and enforcement activity.

… for corporates in particular

The increased risk of criminal enforcement for breaches of trade sanctions applies to individuals but even more so to corporates.

On 26 December 2023, section 196 of the Economic Crime and Corporate Transparency Act 2023 (ECCTA) came into force to expand the scope of corporate criminal liability. Now a corporate is criminally liable for certain offences committed by “senior managers” acting within the actual or apparent scope of their authority. Under Schedule 12 to ECCTA, these include the offences for breaches of export controls under section 68 CEMA and the offences for breaches of export and trade controls under the Russia Regulations. (It does not currently include the offences for breaches of trade controls in the 2008 Order, but there is little room for complacency as the Criminal Justice Bill currently before Parliament may expand the scope of corporate criminal liability further to include any UK criminal offence.)

Historically, in this firm’s experience, it was common practice for HMRC’s export control division to investigate a corporate for a strict liability offence and one or more of its employees for the ‘intent to evade’ offence. Section 196 ECCTA is likely to change this dynamic: depending on the seniority of the employee, the corporate may itself now be investigated for the ‘intent to evade’ offence. In those circumstances, corporates should no longer consider a warning letter or compound settlement to be the default response to a breach of trade sanctions, even if they disclose it promptly and voluntarily.


OTSI promises to be a well-resourced and ambitious agency with political support. A more active and aggressive civil agency focusing on breaches of trade sanctions will inevitably mean that more cases reach the thresholds for criminal investigation and prosecution. Coupled with the wider reforms to corporate criminal liability, HMRC’s export control division is ideally placed to shake off its historic lethargy and flex its criminal muscle – a fully-fledged criminal enforcement agency that is as essential to the fight against illicit trade as its new civil cousin.

This article was originally published in WorldECR on the 5th April 2024.

  1. This article does not cover the UK’s import controls and associated criminal liability for non-compliance.
  2. A myriad of further legislation controls the export of goods that can be used for WMD purposes, torture, nuclear exports, chemical weapons and radioactive sources.
  3. The 2009 Regulation is retained by the European Union (Withdrawal) Act 2018. A licence is not required to export controlled dual-use items from Northern Ireland to the EU as a result of the Windsor Framework.
  4. Called a SIEL (Standard Individual Export Licence) or OIEL (Open Individual Export Licence).
  5. Called an OGEL (Open General Export Licence).
  6. See, by analogy to import control offences, R v Hussain [1969] 2 QB 567 and R v Forbes [2001] UKHL 40; and by analogy with trade control offences, R v Knight (John) [2008] EWCA Crim 478.
  7. Export Control Order 2008, Art. 42. The Russia (Sanctions) (EU Exit) Regulations 2019, Art. 86(3); (4) increases the maximum penalty from 7 years to 10 years where the breach of export controls also contravenes the Russia Regulations.
  8. United Kingdom Strategic Export Controls Annual Report 2022 (19 July 2023), p.57.
Latest Insights


May 10 2024


April 26 2024


April 22 2024