The past 12 months have seen an increase in the volume and pace of enforcement actions published by the Office of Financial Sanctions Implementation ("OFSI"). OFSI has demonstrated a willingness to take a more proactive approach in response to breaches and in doing so has set out increasing expectations of UK businesses in relation to the components of an effective sanctions compliance framework.

Overview of Recent Cases

OFSI has so far published six enforcement actions this year, involving three charities, a law firm, a shipping company, a trust and company services company, a bank and a pharmaceutical company.

This brings OFSI's total tally of published enforcement actions to 16 since it first acquired the power to impose civil monetary penalties in 2017.  Details of all of OFSI's published cases to date are online at: https://www.gov.uk/government/collections/enforcement-of-financial-sanctions.

The recent enforcement cases have primarily involved the UK's Russia sanctions regime, with two cases involving the counter-terrorism regime. In those two cases, no monetary penalty was imposed. In the other four, OFSI categorised the conduct as "serious" as opposed to "most serious".

The two cases where no monetary penalty was imposed involved a failure to provide information requested by OFSI, and a breach involving making funds available to a designated person.

The four cases where a penalty was imposed involved a variety of breaches, including one case for a failure to respond to a request for information. The other three cases involved making funds available to designated persons and one case involved "dealing" with funds owned by a designated person. In all three of those cases, the relevant conduct predated the imposition of the strict liability regime in June 2022.

OFSI currently has the ability to impose a civil monetary penalty of up to the greater of 50% of the value of the breach (which OFSI calculates by aggregating all the breaches in the case together) or £1 million.  As set out in the table below, in the three recent cases where a penalty was imposed, OFSI has not issued a penalty higher than half of the statutory maximum, before considering discounts for voluntary disclosure:

The case published on 31 July 2025 involved a reduction of £100,000 from the original penalty following submissions to OFSI. In two cases, the companies exercised their rights to ministerial review but OFSI's originally imposed penalty sum was upheld.

Voluntary disclosure discounts were only granted in two of the above cases, in the respective amounts of 50% (the maximum available for cases assessed "serious") and 35%. Where a discount of only 35% was applied, this was because disclosure was not deemed prompt enough, following a 4-month delay between the firm becoming aware of the breaches and it making the initial notification to OFSI.

Enforcement Lessons

The recent cases illustrate several trends in relation to OFSI's enforcement priorities and expectations:

• Scope of enforcement: A broadening scope of enforcement, with OFSI targeting not only financial institutions but also legal and professional service providers and corporates.
• Direct payments to DPs: Direct payments to designated persons, including to designated banks are considered by OFSI to be more serious and treated as an aggravating factor because they can cause greater harm to the objectives of the sanctions regime. Seemingly, this is even the case for inadvertent breaches that occur as a result of technical or human error, such as insufficient due diligence (including beneficial ownership checks) or misunderstandings of sanctions regulations.
• Sanctions policies and controls: Inadequate or outdated sanctions policies and controls, and a failure to follow existing procedures, are frequently cited as key compliance failures. OFSI will treat as aggravating where a company has policies in place but these are outdated (e.g. a policy dating back to 2018 was deemed to not be adequate) or where the company has adequate procedures but these are not properly followed by staff.
• Seniority: OFSI treats seniority as an aggravating factor when it comes to breaches. Where payments were authorised by senior staff, this was viewed as more problematic.
• High-risk sector or geographic location: Companies with a Russian presence or exposure to higher risk sectors are expected to have had a closer understanding of their heightened risk profile.
• Other regulatory obligations: When a firm is FCA-regulated, it is expected to have more robust controls in place to cater for sanctions risk.
• Reporting: Delays in reporting or responding to OFSI, whether due to internal review processes or lack of awareness, were treated as aggravating factors. Taking time to assess the nature and extent of the breach and seek legal advice is reasonable but should not delay an effective response to the breach.
• Licences: Failing to report under a general or specific licence is a breach in itself, and the issuance of a general licence does not imply that similar transactions made outside the term of the general licence will not be viewed as serious.
• Responding to RFIs: Firms must ensure they have appropriate communication and monitoring systems in place to properly and promptly address requests for information from OFSI, including by appointing responsible personnel and maintaining up-to-date contact details.

These matters all underscore the critical need for firms—especially those with cross-border operations or exposure to high-risk sectors—to maintain robust, up-to-date compliance systems. OFSI's recent cases make clear that both substantive breaches (such as making funds available to designated persons) and procedural failures (like non-responses to RFIs) continue to be subject to strict scrutiny. Ultimately, the enforcement trends highlight OFSI’s expectation that all organisations subject to UK financial sanctions operate with a high standard of diligence, transparency, and responsiveness.

Looking Ahead

With OFSI signalling an increasingly assertive enforcement posture, UK businesses should expect further scrutiny in the year ahead. The trend towards greater transparency, including the publication of penalty notices will continue. Businesses should ensure that their compliance programmes are up to date, that staff are adequately trained, and that potential breaches are identified and addressed promptly. As recent cases show, the cost of non-compliance can be significant—not only in financial terms, but also reputationally.