The Bermuda Monetary Authority has warned that firms viewed as “low risk” cannot rely on that status to shield them from sanctions breaches.

Speaking at a recent webinar hosted by the BMA’s Financial Sanctions Implementation Unit, supervisors outlined several case studies that revealed gaps in firms’ internal controls — including missing procedures, weak screening and confusion among staff over reporting obligations.

The stakes will soon be higher than ever. Last month, the Financial Action Task Force warned that most countries are still failing to recover the profits of crime, even as Bermuda prepares for its next mutual evaluation by the Caribbean Financial Action Task Force, expected in 2026. The last review was completed in 2018.

In one example from the BMA, Company A, a corporate service provider, had no documented sanctions procedures despite meeting other anti-money laundering and anti-terrorist-financing requirements. Staff “did not know how to escalate or report to the FSIU” and there was “an absence of documented procedures which resulted in confusion among staff, which had the potential of delayed escalation and reporting obligations,” said Cherie Allen, senior governance, risk and compliance professional at the BMA.

Supervisors noted that sanctions controls cannot simply be added as an extension of AML frameworks. Firms are expected to maintain clear, written processes that are tested in practice, alongside practical training on routes to escalate.

A second case involving Company B, a trust company, highlighted wider compliance failures discovered during an ownership change request.

According to Ms Allen, “the AML and ATF compliance and sanctions programme had significant gaps. The documentation was found to be incomplete and there was evidence of altered information.

“Ultimately, due to the serious findings, Company B was issued a civil penalty,” she explained.

The final example involved Company C, a small long-term insurer that considered itself low risk due to its simple business model.

Ms Allen said the firm “did not understand why it was the subject of an AML ATF sanctions on-site inspection”.

She went on to explain that the firm “did not have adequate AML ATF sanctions programme in place and did not address sanctions at all.”

In Paris last month, the FATF announced its new Asset Recovery Guidance and Best Practices, calling for countries to “act faster, search further and think bigger” in confiscating illicit wealth.

According to the FATF, more than 80 per cent of jurisdictions operate at only “low or moderate levels of effectiveness” in asset recovery.

In fact, Interpol and the United Nations Office on Drugs and Crime have estimated that less than 1 per cent of criminal proceeds are ever confiscated.

The UK sanctions list spans a wide spectrum of high-risk actors — from state operatives to politicians.

Recent designations have included Russia’s military intelligence agency and its officers, cited for involvement in hostile cyber-operations and the 2018 nerve-agent attack in the United Kingdom; people and entities linked to the Russian Government’s actions in Ukraine; and figures from past regimes such as Barzan Ibrahim al-Tikriti, the late half-brother of Saddam Hussein and a former senior intelligence official in Iraq. The list also captures companies and ships tied to sanctioned activity.

The BMA’s message to industry was clear: size and simplicity offer no exemption.

All regulated entities, they said, must maintain sanctions programmes, with documented policies, regular screening, thorough risk assessments and staff who understand what to do when a potential match arises.