Sanctions and Insurance

Episode Summary

On this episode of “The Practice Manual,” host Rob Chaplin is joined by colleagues Jonathan Benson, Greg Seidner and Connor Williamson to examine sanctions in the insurance and reinsurance context. The panel analyzes how the sanctions landscape has shifted since Russia’s invasion of Ukraine and amid recent developments involving Iran, Venezuela, Cuba and Syria; how asset freezes, blocking sanctions and sector-specific restrictions differ across the EU, U.K. and U.S.; why a risk-based approach to due diligence is essential in insurance M&A; and how insurers can build compliance programs that address both day-to-day obligations and the steps to take when a breach occurs against a backdrop of increasingly active enforcement.

Key Points

The current sanctions landscape: Russia’s 2022 invasion of Ukraine marked a watershed moment for sanctions policy, with close coordination among the U.K., EU and U.S. and thousands of people and entities now directly targeted. Beyond Russia, the past 12-to-18 months have seen significant activity with regard to other nations, creating both commercial opportunities and compliance pitfalls.

How sanctions apply to insurers: In the U.K., asset freeze restrictions apply broadly, and given the wide definition of economic resources, providing a policy to a sanctioned policyholder is likely prohibited, as are receiving premiums and settling claims. Sectoral restrictions often define financial services to include insurance. The EU takes a broadly similar approach and has also designated certain insurers directly, while U.S. blocking sanctions — supported by OFAC’s 50% rule — are generally viewed as broader in scope.

Sanctions due diligence in insurance M&A: Sanctions red flags can affect valuation, deal structure and the negotiation of warranties. Risk typically arises where a target has exposure to higher-risk jurisdictions or sectors, such as commodities trading, oil and gas, and maritime and shipping. Since ownership and control tests differ across the U.K., EU and U.S., acquirors should assess how a target conducts counterparty due diligence.

Ongoing compliance, reporting and enforcement: Insurers should maintain risk-based compliance programs supported by strong data and systems integrity, appropriate contractual protections and, for global policies subject to U.S. jurisdiction, carve-outs for comprehensively sanctioned jurisdictions. Policies should also address breach response and voluntary disclosures are strongly incentivized.

Rob Chaplin (RC): Welcome back to “The Practice Manual,” the podcast where we unpack the latest trends in insurance and reinsurance. Today, we’re going to be talking about sanctions, which is always a hot topic in the world of insurance. So joining me in this conversation today, I have Connor Williamson (CW), Greg Seidner (GS) and Jonathan Benson (JB).

RC: So, Jonathan and Greg are in our sanctions team and are sanctions experts, and Connor specialises in financial regulation, including the sanctions aspects of financial regulation.

So, let’s kick off the conversation. Jonathan, Greg, could you give us a quick overview of the current sanctions landscape, please?

JB: Thank you, Rob. It’s been a really extraordinary few years since Russia’s full scale invasion of Ukraine in 2022, and that truly did mark a watershed moment for sanctions policy across a great many different jurisdictions, but obviously of particular interest and importance, those in the U.K., the EU and the U.S.

There’s been incredible levels of coordination at the G7 level and amongst smaller groups of nations with those sanctions being coordinated particularly closely amongst the U.K., EU and U.S., with now thousands of people and entities being directly targeted by sanctions. And of course, a raft of, in some cases, very broad-ranging, in other cases, very narrow and tailored sectoral restrictions being imposed by those jurisdictions. So, a few little examples: there have obviously been new prohibitions related to transferable securities. There have been investment bans. There have been a host of new loans and credit-related restrictions introduced and, of course, certain professional services are now also targeted by sanctions in relation to Russia and Belarus.

Particularly of importance to the insurance sector have been the import-export prohibitions and the associated insurance, reinsurance and other financial services restrictions. Some of which, of course, we’re going to be unpacking a little bit more in detail as we go along.

So, it’s been a fascinating now four-and-a-bit years, and as again, we’ll discuss a little more, the action shows no sign of slowing.

RC: Greg.

GS: So Russia has obviously taken top billing for the past several years, as Jonathan mentioned. But in the last 12-to-18 months, there’s been a flurry of activity in other sanctions regimes, primarily in the U.S.

The United States has continued to rely on some of these thematic sanctions programmes, targeting human rights, cybercrime, terrorism. Iran, in the past few months, has obviously jumped to the forefront in a number of ways. And certainly, Iran-related sanctions have followed suit.

Venezuela, on the U.S. side, has also been an area of particular interest, given the somewhat exciting extradition of former President Maduro and the changes both politically on the ground of Venezuela and from a sanctions perspective that have followed with a lot of targeted easing of sanctions in the primarily oil and gas space, as well as associated services with the oil and gas sector, including insurance and reinsurance. There’s a few geographies on the horizon, including Cuba, that are also of interest, and there’s been some targeted changes to the sanctions landscape on the Cuba front.

And further back, Syria was sort of in the headlines midway through 2025 with the U.S., the U.K. and the EU all lifting significantly their sanctions that had been historically targeted towards Syria and the Assad regime. So a lot of movement in the past 12-to-18 months, more so maybe than in several years before that. So it’s certainly an exciting time, if you can call it that, in the sanctions space.

RC: That feels like a sort of tidal wave of sanctions that we’re grappling with.

GS: If not a tidal wave, it’s certainly rough seas, I would say.

RC: Rough seas.

GS: And while that can make for interesting commercial opportunities, it can also make for compliance challenges and pitfalls if folks are not up to snuff and wise to these issues.

RC: So, super helpful background. Connor, tell us about the insurance landscape. Tie that into the insurance landscape for us.

CW: I think a good way to think about this issue is to consider those sanctions that are generally applicable, and by that I mean those sanctions that apply to everyone that is subject to U.K. sanctions, and then those sanctions that are more sector-specific, so particularly applying to those that operate within the financial services sector, and in particular, the insurance sector.

So, within that first bucket, really what we’re talking about here is asset-free sanctions, and those are where an individual or entity has been specifically designated by the U.K. government as being subject to sanctions. And, as a result, there is a prohibition on dealing with funds or economic resources that are owned, held or controlled by that individual. Equally, there is a restriction on making funds or economic resources available to any such person.

And, in an insurance context, given that economic resources is defined very broadly, I think the better view is that the provision of an insurance policy to a sanctioned policyholder is likely to be contrary to this restriction, and in any case, you would not be able to receive premium payments or settle claims in relation to any such policyholder. So, that’s the asset freeze side of things.

On the more sectoral specific side of things, many U.K. sanctions regimes, including the Russia sanctions regimes, has imposed specific prohibitions on the provision of financial services to named entities, governments, public bodies, vessels, etc. Often, the provision of financial services is defined broadly to include the provision of insurance. And so, depending on the specific sector that the insurer is operating within, there can also be an additional overlay that they need to consider when looking to comply with U.K. sanctions.

RC: Jonathan, Greg, how does the position in the EU and the U.S. compare?

JB: So, the position in the EU is broadly similar to the one that you’ve just described, Connor. The EU also imposes asset freezes, which have sort of similar contours to the U.K. measures. And there are certain EU sanctions which specifically prohibit the provision of insurance or reinsurance services. So, for example, in the context of the Russia sanctions in relation to the aviation and space industries.

There’s also, like with the U.K. financial services-related sanctions, a broad set of sanctions imposed by the EU that target financing and financial assistance. Now, it’s only in the context of Russia and Belarus that those terms are specifically defined to cover all forms of reinsurance and insurance, including export credit insurance. But, of course, it would be fair to impute that definition into the EU’s other sanctions regulations. And so, in the EU context, that means that insurance in relation to a great many different activities in relation to Russia and Belarus, amongst others, are prohibited. So insurance, for example, can’t be provided in relation to certain exports, imports, investments, vessels, the purchase or transfer of certain petroleum products and LNG, amongst other things.

Unlike the U.K., the EU, and as Greg will describe in a moment, the U.S., the EU has also specifically designated certain insurers. So, insurers are definitely on the EU’s naughty list in certain respects. Examples are the Russian National Reinsurance Company and the gas industry insurance company, SOGAZ. So, very obviously, if any of those sorts of entities are in the mix, that requires particular focus and attention.

GS: In the U.S., I would say most U.S. sanctions programmes are sector agnostic, meaning they’re meant to be broad-based, they’re meant to target broadly commercial activities involving sanctioned jurisdictions, sanctioned persons. So, for instance, blocking sanctions, which target individuals and entities, as well as vessels and certain other forms of property that are identified on the SDN list in the U.S. but also by operation of law. The 50% rule in the U.S., which means sanctions generally apply to entities in which one or more sanctioned persons hold a 50% or greater interest.

Those blocking sanctions prohibit virtually all commercial activity, so certainly those could impact the insurance space, either directly when you’re talking about an insured or a beneficiary under a policy that is themselves sanctioned, subject to blocking sanctions or operations offering of insurance products in regions that are either themselves maybe comprehensively sanctioned or that are geographically or commercially close to those jurisdictions. But a lot of these issues also come indirectly. The activities of an insured, which may involve a comprehensively sanctioned jurisdiction or a sanctioned party.

I’ll say that certain U.S. sanctions programmes — Russia, Iran, most notably — include sectoral sanctions as well. It’s not all broad-based, comprehensive sanctions. OFAC — the Treasury agency that administers U.S. sanctions — it also imposes targeted sanctions designed to prohibit or restrict certain activities, dealing in certain debt or equity of targeted persons.

I mentioned sectoral sanctions, which may generally apply to certain sectors of a country’s economy — financial services, defence, energy tend to be some of the more common ones. And certainly, those can be areas where insurers and reinsurers are involved, either directly insuring the activities of persons operating in those sectors, or the insureds are engaged in activities with counterparties in those sectors, or insuring the movement of goods or other activities that are involved.

So, U.S. sanctions generally, when compared against U.K. and EU, tend to be viewed — certainly the blocking and comprehensive sanctions — as broader in scope, though there are the more targeted sanctions programmes and authorities that can specifically pinpoint activities that may impact the insurance space.

RC: Thank you. Thank you, team. That’s really helpful background and certainly provides a lot for those operating or who intend to invest in the insurance industry. So, let’s turn now to a practical topic, how to think about sanctions in the context of insurance M&A. Jonathan, we commonly work together on transactions and we come across these issues from time to time. What should those on the buy-side be thinking about from a sanctions perspective?

JB: For sure, Rob. These issues do crop up with some degree of regularity now, and clearly undertaking an appropriate risk-based due diligence exercise on M&A transactions in respect of sanctions compliance issues is now very important. Sanctions red flags can affect valuation, deal structure, negotiation of the warranties and the like.

Now, in our experience, I would say that sanctions risks will typically crop up where a target is engaged in activities concerning a higher-risk set of jurisdictions. I’m thinking of the comprehensively sanctioned countries and territories that Greg has described, but also, of course, the likes of Russia and Belarus.

And then another area where risk can often crystallize is where the target has exposure from a sectoral perspective. And common issues that we see coming up on deals time and time again are where a target is providing insurance in the commodities trading, particularly oil and gas-related space. And that’s because that’s been a particular focus over the course of the last few years for sanctions authorities in the U.K., EU and the U.S. There have been some interesting developments in that regard, with OFAC relaxing certain Russia- and Iran-related prohibitions over the course of this year for time-limited periods. It’ll be interesting to see how that plays out in the M&A context over the course of the next few months and years as those unilateral relaxations of sanctions can cause compliance problems for multinational insurers.

Another focus, of course, would be in respect of insurance companies which are active in the maritime and shipping space for much the same reasons that I’ve described.

One other area that’s worth mentioning is issues around ownership and control. Obviously, the tests to determine whether or not an entity is owned or controlled by a sanctioned person vary as between the U.K., the EU and the U.S., with the U.S. not having a control test at all. And, so, examining how a target deals with counterparty due diligence and assessing whether or not that’s appropriately dealt with is obviously a key point as well.

RC: So, thanks Jonathan. Has there been any guidance on due diligence?

JB: Unfortunately, most jurisdictions don’t provide tremendously detailed guidance as to their expectations as regards due diligence. From an EU perspective, there’s been a bit of guidance since 2022, and key recommendations include that EU companies should, of course, do all the sorts of things that we would expect them to be doing, like identifying and evaluating circumvention risks, identifying where enhanced due diligence might be appropriate, and, of course, looking at the inclusion of appropriate commercial terms to manage compliance risks as a consequence of the results of the due diligence.

U.K., not a huge amount of guidance in this context, but it’s clear that regulatory expectations are high, with OFSI in particular saying that when it’s considering whether an enforcement action is appropriate, it will be looking at the degree and quality of the due diligence that was undertaken on the ownership and control of the counterparty.

Greg, what about from a U.S. perspective?

GS: So, OFAC generally hasn’t issued guidance specific to the type or form of due diligence that they expect to see in a given M&A transaction, or broadly speaking, in the commercial context. OFAC has issued guidance in the form of frequently asked questions to the insurance industry. Those FAQs, frequently asked questions, tend to deal with how to address a situation where an insured becomes a sanctioned person, what blocking or other compliance measures need to be taken, what type of screening may be appropriate in the ordinary course for insurers and reinsurers.

But in the M&A context, OFAC’s touchstone guidance is always that it should be risk-based, and that’s both generally and specific. Generally speaking, a compliance programme, maybe the target in an insurance M&A transaction, should have a compliance programme that is risk-based, meaning its scope and size and robustness is commensurate with the risk presented by that target’s business activities.

But with respect to a given transaction, the due diligence should also be risk-based, meaning the level of diligence that an acquirer may want to perform in one transaction may not be appropriate in another transaction because the targets may have just different risk profiles. They may operate in different spaces. They may offer different insurance products. They may have different touchpoints with different counterparties. So it’s important, and I think what OFAC would expect to see in any given transaction, is giving thought to what is risk-based, what is commercially feasible and appropriate, and certainly targeting on the areas of a target’s business where risk is most likely to emerge. That’s where the most effort and resource should be expended, in targeting the most risky aspects of a target’s business.

RC: Thanks, Greg. That makes complete sense. Now let’s bring this to life with some practical examples we’ve seen in transactions that we’ve worked on. Jonathan?

JB: So, just to pick out two very quickly. We’ve seen issues come up in the context of reinsurance coverage, where there has been reinsurance provided in respect of vessels, which it turns out have either been carrying sanctioned goods or have trespassed into a sanctioned territory in a problematic way. And in that sort of context, really, you want to be understanding the exact role of the target in the provision of that reinsurance, what diligence was done, what steps might have been taken as a result. Have there been any payments? Have there been any reports to regulators and the like?

And then another area which we often see come up on transactions is in relation to oil price cap exposure. Now, I’m sure our listeners and viewers will be very familiar with the oil price cap, but in essence, it’s a mechanism to ensure that Russian energy can continue to flow globally, but without overly enriching Russia’s government. And there are various different compliance obligations placed on different parties involved in the movement of Russian energy, Russian oil principally, with insurers, generally speaking, having the least onerous obligations. But that doesn’t mean that they’re free of obligations altogether. And one point that repeatedly comes up is where people haven’t quite discharged their obligations under the various different bits of guidance issued by the EU, U.K. and the U.S. in that context, which can obviously cause regulatory problems for the target.

RC: Connor, what about sanctioned policyholders?

CW: Absolutely. Sanctioned policyholders can be a key issue, which is sometimes uncovered as part of diligence. So, in particular, what you’re focusing on is does the target have sanctioned policyholders? If so, how are they managing that to date? And equally, how are they looking to identify that as part of their ongoing screening processes?

This is an area where market practice can really differ. So some target groups will take a belt and braces approach, which is effectively a zero-tolerance approach, whereby they will not deal with any individual or entity that is sanctioned, irrespective of the jurisdiction in which they’re sanctioned. So, for example, a U.K. insurer may, in theory, refuse to deal with an entity that is sanctioned in Canada, notwithstanding the fact that they are not necessarily strictly subject to Canadian sanctions. Separately, you have groups which take a more case-by-case approach, so they will look at the particular individual or entity that they’re looking to provide a policy to. They will consider their sanction status, and they will consider the extent to which their sanction status is ultimately relevant to the sanctions to which they’re subject.

And there’s not necessarily a right approach on this, but rather, as part of diligence, you want to understand what approach have they been taking, where are they taking a risk-based approach, and how does that impact on your overall assessment of the business as part of the diligence process.

RC: Thanks, Connor. Jonathan, one of the things that we found when advising is people often get quite muddled between sanctions and anti-money laundering or AML requirements. Help us with that.

JB: So, unfortunately, it’s a quite complex area which many clients do struggle with. But the broad position is that if there is activity going on which would violate the U.K. sanctions if that activity took place in the U.K., that can result in there being the proceeds of crime, which can trigger reporting obligations. It can also trigger a requirement for there to be a defence against the money laundering offenses put in place through making a so-called DAML SAR to the National Crime Agency here.

And, of course, there may also be independent sanctions-related reporting requirements if there are regulated entities involved, for example. Plus, again, if there are regulated entities, there may be requirements to report to the FCA in certain circumstances as well. So, reporting has become a bit of a minefield.

RC: Clearly, if we are selling a business where we find or believe there may be sanctions problems, it’s obviously crucial to get on top of that before you launch the sale process. So, let’s move on. Jonathan, talk to us about ongoing sanctions compliance.

JB: Thank you, Rob. So, we talked about sanctions issues in M&A, but clearly, ongoing compliance is absolutely crucial for insurers and anyone involved in the insurance sector to ensure that ordinary course activities don’t result in violation of law and that when those blockbuster transactions come along, they run as smoothly as possible.

RC: Greg?

GS: As I mentioned before with the M&A context, with the expectations of a target’s compliance programme being risk-based, the same sort of dynamic applies with respect to an insurer that’s looking to develop or enhance its own compliance programme. It should be appropriately risk-based for the insurer, the reinsurers’ business activity. So they need to consider their customers and counterparties, who they’re dealing with on an ongoing basis, the geographies in which they operate and in which their customers, their policyholders operate, their controls and their overall programme should be sophisticated and mature, which is what regulators will expect of a sophisticated insurance company.

And they should also ensure that they have strong data and systems integrity, both on an ongoing basis and if issues emerge, the ability to recall that data, ensure that they have clear records of payments and other activities they’ve engaged in on their customers’ behalves.

And then on a contractual basis, they’ll want to ensure that their policies, their other agreements with counterparties include reps and warranties, other provisions that may be appropriate. One key point that often comes up is where they’re offering sort of global insurance protection. OFAC consistently advises that where they’re engaged in activities that are subject to U.S. jurisdiction, they should ensure that those global policies have appropriate carve-outs for activities involving comprehensively sanctioned jurisdictions. So, global coverage, but we will not provide coverage or other services in connection with activities involving Iran or Cuba or other comprehensively sanctioned jurisdictions.

RC: That’s really helpful. So Connor, thought should also be given to the policies and procedures which are in place when a sanctions breach has occurred. Help us with that.

CW: I absolutely agree. Things go wrong occasionally. That’s just something that happens, and it’s really important that policies and procedures don’t only focus on ongoing compliance, but they also focus on what will we do in the event that we identify non-compliance. So, for example, making sure that there are proper processes internally for both identifying breaches, but also for making sure that the appropriate reports are made to the authorities.

So, in a U.K. context, for example, most U.K. sanctions regimes will attach reporting obligations on relevant firms. The definition of relevant firms commonly captures any entity which maintains a Part 4A permission from FSMA, so any PRA or FCA-authorised entity. And so, where a breach occurs, and we’re looking at an insurer or an insurance broker, there is an obligation to report, for example, to OFSI, and not doing that report can result in a breach in and of itself. So, it’s both identifying breaches and making sure that those are addressed appropriately.

RC: And Jonathan, the EU?

JB: Similar, yes. In some respects, even broader in the sense that there are reporting obligations imposed on EU-incorporated entities in circumstances where they identify information that would facilitate the implementation of EU sanctions. How that actually plays out in reality does very much depend on the facts.

RC: Greg, the U.S.?

GS: So, OFAC does not have regulations that require reporting of violations. There’s no mandatory obligation for a party to report potential violations of U.S. sanctions. There are strong incentives, however, to voluntarily disclose violations, and those incentives include the overall view that OFAC may take of an activity that potentially violates sanctions. If a monetary penalty is going to be imposed, it can certainly impact the value of a monetary penalty.

On the disclosure subject, and Jonathan did mention AML though earlier, U.S. insurance companies are treated as financial institutions for purposes of the so-called Bank Secrecy Act, and that entails not only the obligation to have AML compliance programmes but also report suspicious activity. So there is an overlay of AML considerations that could necessitate disclosure if we’re talking about a U.S. insurance company.

RC: Jonathan, voluntary disclosure?

JB: Obviously, this is something that always comes up when a breach is identified and there isn’t a mandatory reporting obligation. In the U.K., there’s real incentive to make voluntary disclosures. Following changes to OFSI’s guidance in this area, you can now get up to a 70% reduction in the penalty, and it’s a not dissimilar position on the other side of the Atlantic with OFAC strongly incentivising parties to make disclosures.

And that’s, of course, all against a backdrop of increasing sanctions enforcement actions right the way across Europe. The U.K. is now regularly enforcing sanctions. There’s a proposal that the monetary penalties that can be imposed could be doubled in respect of financial sanctions breaches. And we’re now getting to the sort of rump end of the EU member states transposition of the EU sanctions enforcement directive, with most member states now having implemented that into national law. And importantly, that now means that from a corporate perspective, fines will be either a maximum of €40 million or up to 5% of global turnover. So, we’re talking about potentially very large figures indeed.

RC: Greg.

GS: So the U.S. has also been active in the enforcement space, both historically having imposed very significant penalties, as well as recently as this year and last year. They continue to be active with very large penalties, including a $275 million penalty for activities involving the shipment of liquefied petroleum gas that was ostensibly from non-sanctioned jurisdictions, Iraq and Oman, but actually was Iranian in origin. And there were various telltale signs that would have, at least in OFAC’s view, should have put the importer on notice of the origin of the product.

And the only thing I’ll add, Jonathan, I did mention earlier that there’s no mandatory reporting obligation for violations of U.S. sanctions, though there are strong incentives, as you noted, to voluntarily disclose. There are mandatory reporting obligations in the context of blocking and rejection decisions for transactions. So, if an insurance company and an insurer/reinsurer blocks a payment or an insurance policy, and they’re subject to U.S. jurisdiction, they do have an obligation to report that within a 10-day timeframe. So, those are just sort of ordinary course compliance functions that should be reflected, where appropriate, in an insurer or reinsurer’s compliance programme and policies and procedures.

RC: Thanks, Greg. Well, that brings us to the end of today’s episode. Sanctions is certainly a very interesting area intellectually, but it’s also a very dangerous area as well, and it’s important to know exactly what you’re doing if there are these types of risks in an area which you are exploring. So, my thanks today to Jonathan, to Greg and to Connor, and to you, our listeners and viewers. I hope you join us next time.

“The Practice Manual” is a podcast by Skadden, Arps, Slate, Meagher, and Flom LLP and affiliates. Skadden is recognized for its deep experience in representing insurance and reinsurance companies and their advisors on a wide variety of transactional and regulatory matters. This podcast is provided for educational and informational purposes only and is not intended to be and should not be construed as legal advice. This podcast is considered advertising under applicable state laws.” .

“The Practice Manual” is a podcast by Skadden, Arps, Slate, Meagher & Flom LLP and affiliates. Skadden is recognized for its deep experience in representing insurance and reinsurance companies and their advisors on a wide variety of transactional and regulatory matters. This podcast is provided for educational and informational purposes only and is not intended to be and should not be construed as legal advice. This podcast is considered advertising under applicable state laws.

This podcast is considered advertising under applicable state laws.