UK Sanctions Update: enforcement momentum accelerates as OFSI deploys new powers and looks beyond Russia

Signs of a marked acceleration in UK sanctions enforcement continue to emerge. In the months since our last update, the Office of Financial Sanctions Implementation ("OFSI") has now deployed its new settlement scheme across multiple cases, imposed penalties on both UK and non-UK entities (including where proactive approaches to establishing ownership and control linkages to designated persons were not taken), and signalled clearly that its enforcement focus will extend beyond Russia to other sanctions regimes - most notably, Iran.

Meanwhile, HMRC has recently demonstrated that export control enforcement remains equally active. The deepening UK-US relationship on sanctions enforcement, underpinned by a formal Memorandum of Understanding ("MoU") and regular strategic exchanges, point to a more coordinated and ambitious posture from both authorities.

Now Reading

OFSI signals Iran enforcement and awaits increased penalty powers

In an interview published by the Financial Times on 29 June 2026, OFSI Director Giles Thomson confirmed that the body is "increasingly looking" to take enforcement action in relation to Iran sanctions breaches. This follows the UK's 'snapback' of sanctions against Iranian individuals and companies since September 2025.

While Russia remains OFSI's "number one priority", with the office having grown from approximately 30 to 140 staff since the invasion of Ukraine, the Iran signal is significant. It confirms that the enforcement infrastructure and institutional confidence developed through Russia-case investigation and enforcement will now likely be applied across the broader sanctions landscape. It is therefore increasingly important that businesses ensure their systems, screening and due diligence processes can address the full spectrum of UK sanctions that are in force.

Thomson also confirmed that legislation to increase the civil monetary penalty regime from the higher of £1 million or 50% of breach value, to the higher of £2 million or 100% of breach value, is expected "in the next few months".

As set out in our previous update, this change would double the penalty exposure in cases involving cross-border flows of money, where an apparently minor technical procedural breach can have substantial sums attached to it.
Furthermore, OFSI is also prioritising a clampdown on the use of cryptocurrencies to circumvent sanctions – an area that continues to challenge enforcement agencies globally.
The combination of expanded enforcement ambitions beyond Russia and materially increased penalty exposure marks a step-change in the UK sanctions risk landscape.

OFSI-OFAC Enhanced Partnership: deepening transatlantic coordination

On 23 June 2026, OFSI and the US Office of Foreign Assets Control ("OFAC") published a joint blog post following their latest in-person strategic exchange in London in January 2026.

The week-long dialogue focused on the use of respective powers to meet foreign policy and national security demands, "such as tightening or lifting sanctions, adopting new technology, and highlighting enforcement efforts". The exchange produced additional joint guidance, The U.S. and UK Economic Sanctions Authorities: A Comparative Overview, which compares key aspects of the US and UK sanctions regimes, including responsibilities, sanctions lists, licensing, recordkeeping and reporting requirements.

Notably, OFSI and OFAC identified several specific areas for future collaboration, including:

evaluating parallel mechanisms to rapidly increase sanctions pressure;
harnessing lessons from novel restrictions developed in response to Russia's invasion of Ukraine to apply to other scenarios;
identifying typologies and economic impact of sanctions targets to more effectively disrupt behaviour, including in relation to the shadow fleet;
reviewing processes to dismantle sanctions regimes in a structured way, such as in Syria; and
translating lessons from global regimes (counternarcotics, illegal migration) into new tools applicable across shared sanctions programmes.

Both authorities also discussed the use of artificial intelligence to support sanctions functions, with the expectation that emerging technologies will "automate routine tasks or support information analysis to ultimately lead to improved decision-making, provide clearer guidance for industry seeking support, and deliver improved public service".

This builds on the formal Memorandum of Understanding signed between OFAC and OFSI on 9 October 2024, which established the framework for cooperation in the administration and enforcement of sanctions, including sharing of relevant information, conducting coordinated investigations, training of personnel and discussions on regulatory expectations. The MoU facilitates information-sharing across a broad range of categories including investigation records, identifying information relating to suspected violations, transaction-related reporting, and licence application information.

Giles Thomson has confirmed that secondees from OFSI and OFAC have been embedded in each other's operations, with a joint enforcement action anticipated in due course: "It's very much a hope that at one point we'll see a joint enforcement action".

The timing of this statement (days before Thomson's comments to the FT) is unlikely to be coincidental. Iran is a shared priority across both US and UK sanctions regimes, and the infrastructure for joint action (secondees, shared intelligence, coordinated guidance) is being solidified. For firms subject to both US and UK jurisdiction, which includes any entity using UK financial infrastructure or the US dollar clearing system, the prospect of coordinated or joint enforcement underscores the importance of ensuring compliance programmes address both regimes in a holistic manner, rather than treating them as siloed obligations

OFSI Strategy 2026 – 29: the PERC model

The renewed focus on Iran and cooperation with the US comes against the wider backdrop of OFSI's publication of its Strategy for 2026-29, marking the start of the organisation's second decade. The strategy introduces a new operating model structured around four pillars: Promote, Enable, Respond and Change ("PERC").

Promote: making sanctions rules and expectations clearer, so that compliance is the best option - and non-compliance has visible consequences.
Enable: reducing friction for legitimate activity through practical guidance (we note that current guidance is somewhat lacking, which is often a disproportionate blocker to productive economic activities from UK perspective, and so the regulator's focus on this in particular is welcome), strong licensing service standards and digital-first services.
Respond: acting quickly and proportionately on breaches, using the full enforcement toolkit to deter and disrupt non-compliance and circumvention.
Change: embedding lasting improvements by learning from cases and engagement, strengthening sanctions design and driving a sustained compliance culture.

Since 2021, OFSI has progressed over 1,400 enforcement cases, issued 18 public enforcement decisions and over £22 million in monetary penalties, and "moved to a more proactive approach, supported by investment in [OFSI's] intelligence capabilities". The new strategy formalises this shift from a reactive to proactive posture through published KPIs, including a commitment that 90% of new enforcement investigations will be submitted for decision within 18 months of commencement, and that OFSI will "increasingly pursue intelligence originated case outcomes" in 2027/28 and 2028/29. Other notable features of the strategy include:

Licensing case commitment: a commitment to complete 50% of licensing cases within 6 months.
Counter-terrorism designations: OFSI has used UK counter-terrorism designation powers for the first time since 2023, designating 7 individuals and 5 entities in support of domestic security objectives. The strategy commits to an "expert counter-terrorism function" that works "proactively with partners across the sanctions lifecycle to designate individuals or entities, supervise financial activity, share intelligence and enforce breaches of counter-terrorism sanctions".
Circumvention cell: OFSI confirms it co-chairs the Financial Sanctions Circumvention Cell with the private sector, through which it will "flag activity to be vigilant for, and to increase rates of compliance and self-reporting". Businesses engaged in sectors with higher circumvention risk should ensure they are connected to this channel.
International alignment: OFSI commits to delivering "joint or co-branded public output with international partners every quarter (e.g. joint guidance, public statements, case studies or advisories) aimed at tackling sanctions circumvention routes and typologies".

The strategy also acknowledges the evolving threat landscape, noting that "new technologies will reshape sanctions evasion while the rapid evolution of crypto assets and a more fragmented financial services industry will present new challenges to compliance systems".

Read alongside the new enforcement framework discussed in our last update, including the four-level seriousness model, the Early Account Scheme, and fixed penalties, this strategy confirms that OFSI is operating with an ambition to deliver more enforcement, faster, and with greater transparency. The explicit commitment to intelligence-originated cases means that firms cannot assume enforcement will be confined to matters surfaced solely via voluntary disclosure or routine reporting.

Recent OFSI enforcement cases

Recently, OFSI has imposed financial penalties in three notable cases, all resolved through its new settlement scheme, which allows subjects to receive discounts to penalties, in exchange for waiver of the right to appeal. For more information on the settlement scheme, please see our previous update.

Apple Distribution International Limited ("ADI") - £390,000 penalty (19 March 2026)

This was the first OFSI case resolved by the settlement scheme and, notably, the first financial penalty imposed by the OFSI on a non-UK entity.

ADI, an Irish-incorporated subsidiary of Apple Inc., instructed a UK-based bank to make two payments (June and July 2022) totalling £635,618.75 to Okko LLC ("Okko"), a Russian app developer wholly owned by a designated person, JSC New Opportunities. ADI operated an online marketplace (the App Store) and used UK-held funds to pay software developers for revenues earned on that platform. OFSI determined that ADI's failure to cancel these payment instructions constituted conduct that was committed in the UK and was a breach of regulation 12 (making funds available to a person owned or controlled by a designated person) of the Russia (Sanctions) (EU Exit) Regulations 2019 (the "Russia Regulations").

Some of the key aggravating factors in this case included the high collective breach value, the direct provision of funds to an entity owned by a designated person, and the fact that ADI's sanctions framework was not sufficiently calibrated to the increased Russia-related risk following the February 2022 full-scale invasion of Ukraine. OFSI noted that ADI's failure to request ownership information from Russian app developers "very likely contributed to the breach payments occurring".

While the first payment ("Payment A") was processed on the day of the designation of JSC New Opportunities, OFSI assessed that there was a narrow window in which the payment could potentially have been cancelled before completion. It also considered it significant that another breach payment ("Payment B") occurred approximately a month after Payment A. In terms of mitigation, OFSI considered ADI's lack of intent and knowledge, the narrow window for cancellation of the first payment, and ADI's voluntary disclosure to OFSI in October 2022. In light of the above, OFSI set a baseline penalty of £600,000 before applying a 35% reduction to account for ADI's voluntary disclosure and settlement of the case under transitional arrangements. No penalty was imposed directly on Apple Inc.

In its enforcement case summary, OFSI noted that UK financial sanctions may apply to non-UK firms if they use UK financial institutions to conduct their payments, even where a non-UK firm manages an account outside of the UK. For any non-UK business that holds or controls funds through UK banking infrastructure, this serves as a powerful reminder that there is no geographic shield in those circumstances, and underlines that the regulator may still choose to enforce where much of the substantive conduct was outside of the UK. Businesses should be conscious that if there is a UK nexus to their activity (whether through banking relationships, payment routing or conduct occurring within the UK), then they must consider UK sanctions compliance.

Deutsche Bank AG London Branch ("DBLB") - £165,000 penalty (30 April 2026)

This case arises from the same underlying transactions as the ADI case - DBLB was the UK-based bank that processed the two payments to Okko on behalf of ADI. OFSI's basis for penalising DBLB separately rests on the fact that DBLB, as the entity that actually processed the payments and released funds to Okko, independently breached regulation 12 by making funds available to a person owned or controlled by a designated person. DBLB "remained ultimately responsible for ensuring it acts in compliance with financial sanctions when processing payments on behalf of its customers", regardless of the fact that Okko was not itself a DBLB customer and that the payment instructions came from ADI. While DBLB's third-party screening vendor had incorporated updates to the UK Sanctions List, including JSC New Opportunities (the designated person), the vendor list did not include any data in relation to Okko's ownership by JSC.

OFSI identified the following aggravating factors when assessing the breach: the high collective value of the payments, the direct provision of funds to an entity owned by a designated person, and concerns with DBLB's risk management - in particular, DBLB's failure to understand that ADI did not request ownership information from downstream customers. Mitigating factors included the absence of intent or knowledge, and (as aforementioned in the ADI case), the very limited window for cancellation of one of the payments. Notably, while DBLB also voluntarily disclosed the breaches in September 2022, the OFSI considered the initial disclosure to have "lacked detail and provided limited insight into the underlying reasons for the breaches". OFSI imposed a baseline penalty of £300,000, ultimately applying a 45% discount in return for DBLB's voluntary disclosure and settlement of the case under transitional arrangements.

OFSI's message in relation to this case is unambiguous – outsourcing screening does not outsource responsibility. The onus was on DBLB to understand the limitations of the vendor screening tools, which it should have supplemented with additional measures once it became apparent that there were blind spots in higher risk areas. OFSI's criticisms of DBLB's original notification is a reminder of, under the new settlement framework, the importance of supplying as much detail as possible when working with OFSI in relation to a suspected breach (albeit DBLB was still able to access a significant discount).

Sabre Global Technologies Limited ("SGTL") - £1,000,920.59 penalty (26 May 2026)

SGTL, a UK-registered company, supplied a Global Distribution System ("GDS") to JSC Ural Airlines ("Ural") under a contract in place since 2007. Ural was designated on 19 May 2022 and SGTL was informed the same day. Despite this, SGTL continued to provide access to the GDS until 6 December 2022 - over six months after Ural's designation.

The case involved three breaches of the Russia Regulations: (i) regulation 13 (making funds available for benefit of a designated person, through invoicing and instructing payment); (ii) regulation 14 (making economic resources available, through continued GDS access); and (iii) regulation 19 (circumvention).

The finding of circumvention is particularly notable. In July and August 2022, SGTL explored alternative routes to receive payment from Ural Airlines, including requesting a test payment to a US bank account after experiencing sanctions-related payment blocks at its UK bank. SGTL's UK bank had repeatedly notified it of sanctions concerns with payments from Ural Airlines - in June, July and September 2022. Despite these repeated red flags, SGTL did not apply to OFSI for a licence to permit receipt of payments or the continued provision of services to a designated person. OFSI identified a substantial list of aggravating factors, many of which related to the circumvention conduct.

In addition to this, OFSI noted the seven-month duration of the economic resource breach, and the fact that at the time of the breaches SGTL "lacked competent senior oversight of sanctions", amongst other factors. Mitigating factors were limited – while SGTL cooperated fully following its initial disclosure, OFSI determined that it "contained limited information as to the circumstances, fact pattern, or cause of the breaches". Importantly, SGTL continued to provide services to a designated person after the submission of the initial report.

OFSI assessed this case as "most serious", while the previous two cases were designated as "serious". OFSI set a baseline of £1,251,150.73 and applied a 20% discount for voluntary disclosure and settlement, imposing a final penalty of £1,000,920.59.

This case highlights several failings in SGTL's response that corporates should bear in mind. Fundamentally, when a bank blocks a payment on the grounds of sanction concerns, the appropriate response will typically be to stop, seek advice, and (if then considered necessary, for example if the bank's concerns turn out to be well-founded) potentially to engage with OFSI if the payment and/or service is to continue. Attempting to reroute payments around a block (even if the quantum of the payment is negligible) is precisely the kind of conduct that will be seen by OFSI as "most serious" and attract penalties near the statutory maximum.

HMRC Export control enforcement: £1.1million compound settlement

Enforcement activity is not solely confined to OFSI in the UK. In May 2025, HMRC concluded a compound settlement of £1,160,725.67 in relation to a UK exporter that made goods available contrary to the Russia Regulations.

The notice contained guidance relating to Russian companies operating in third countries. Restrictions on making goods available to persons connected to Russia can be breached by exporting sanctioned goods to Russian companies, regardless of the jurisdiction they operate in - including in Central Asia and other regions where Russian companies maintain branches and operations.

For the purposes of the Russia Regulations, being "connected with Russia" includes any person incorporated or constituted under Russian law, regardless of where they operate. The "making available" prohibition applies across multiple categories of goods and technology including restricted goods (regulation 25), energy-related goods (regulation 42), luxury goods (regulation 46B), G7 dependency and further goods (regulation 46Y), and Russia's vulnerable goods (regulation 46Z30), among others.

HMRC has stated the following key compliance lessons from the incident:

UK companies exporting to third countries should check whether the consignee, end-user or any other party is a Russian-owned company;
Ignorance of sanctions is not an excuse - companies should sign up for UK sanctions email alerts; and
Businesses should review trading relationships in light of new sanctions and seek professional legal advice where uncertain.

This case is a reminder that sanctions enforcement extends well beyond financial services. Exporters, manufacturers, logistics providers and trading companies with any touchpoints to sanctioned jurisdictions or persons face equivalent exposure. The role of HMRC in enforcing export controls under the Russia Regulations demonstrates the breadth of the enforcement landscape firms must now navigate.

Conclusion and practical implications

The developments since our last update suggest a clear trend: UK sanctions enforcement is intensifying in pace, scope and ambition.

OFSI has now deployed its settlement scheme across three cases in quick succession, imposed its first penalty on a non-UK entity, issued a "most serious" penalty near the statutory maximum for circumvention, and publicly signalled that Iran enforcement is in its sights. The OFAC-OFSI partnership continues to deepen, with embedded secondees, joint guidance, and a stated ambition for joint enforcement action. In addition to this, HMRC has demonstrated that export control enforcement carries equivalent teeth. The key points for businesses in light of these developments are as follows:

· Shift of enforcement beyond Russia. OFSI has signalled Iran enforcement clearly, and the renewed emphasis of the OFSI-OFAC partnership indicates a broader application of enforcement capacity across shared sanctions regimes leveraging the infrastructure built over four years of Russian sanctions enforcement.

· OFSI building greater breach-finding capabilities. OFSI's new strategic commitments to intelligence-originated cases and its OFAC-based partnerships means that operating a robust internal compliance structure for dealing with sanctions risk and breach disclosure is growing in importance.

· Increase in penalty exposure. The forthcoming legislative increase to £2 million / 100% of breach value, combined with the reduced voluntary disclosure discounts significantly changes the landscape of financial consequences for non-compliance with UK sanctions legislation.

· Ownership and control remain a major risk. The ADI and DBLB cases both turned on failures to identify ownership by designated persons - a theme echoed in OFSI's ongoing call for evidence on ownership and control. OFSI expects businesses to be proactive in identifying ownership information, particularly in higher-risk environments.

· Circumvention will be treated seriously. The SGTL case demonstrates that attempts to engineer alternative payment routes are more likely to be classified as more serious and are likely to result in penalties approaching the statutory maximum.

· Export controls are being actively enforced. The HMRC compound settlement demonstrates that the "making available" prohibition has real teeth, particularly in relation to third-country exports to Russian-incorporated entities. Businesses should be wary that sanctions enforcement is not restricted solely to OFSI.

· Attention to detail when voluntarily disclosing. OFSI has criticised the lack of detail in voluntary disclosures in some recent cases and can reduce the disclosure discount in these circumstances. Businesses choosing to make a voluntary self-disclosure should ensure that any written submissions are appropriately detailed and address causation, in a way which is mindful of this new enforcement environment and expectations.

Businesses should continue to review and, where necessary, strengthen their sanctions compliance frameworks, including screening systems, onboarding procedures, ongoing monitoring, escalation processes, and staff training, to reflect the current enforcement reality. Crisis response and readiness where an issue is identified is critical. OFSI's renewed surveillance and penalty processes are ultimately intended to allow it to move faster, and it is critical that businesses move faster on compliance too.

Read John Buttanshaw Profile