Fixed penalties for procedural breaches: OFSI and EU compared

A multinational with operations across the UK and the EU receives a regulator inquiry. The business screened its counterparties. It filed no licence application. It sent no breach report. Now two authorities are asking questions simultaneously – and the exposure for those procedural omissions may be calculated very differently depending on which desk picks up the file first. How a business handles the weeks that follow can determine whether a procedural slip becomes an isolated penalty or the opening move in a wider enforcement action.

Fixed penalties for procedural breaches (flat-rate sanctions imposed for specified administrative failures, independently of whether a substantive asset-freeze or trade prohibition was also violated) have become a distinct enforcement tool on both sides of the Channel. As of early 2026, the UK's Office of Financial Sanctions Implementation (OFSI) administers a penalty regime that couples proportional monetary penalties with fixed-rate penalties for defined procedural defaults. The EU's emerging criminal-sanctions directive and member-state implementing rules introduce a parallel but structurally different approach. Comparing the two regimes side by side – criterion by criterion – is the only reliable way to size cross-border exposure and to decide which corrective action to take first.

This analysis sets out the legal basis for each regime, maps the key divergences criterion by criterion, examines the interaction between the two systems for cross-border businesses, and identifies the risk flags that compliance counsel should address before a regulator writes a second time.

Legal basis and governing authority: how each regime is constituted

OFSI's fixed-penalty authority rests on the UK financial-sanctions regime established under the Sanctions and Anti-Money Laundering Act (SAMLA) and the relevant thematic sanctions regulations made under it. The fixed-penalty tier sits alongside the proportional monetary-penalty power and is directed at specified procedural defaults – failures to report, failures to keep records, and similar administrative obligations – rather than substantive asset-freeze breaches. The authority to impose a fixed penalty on a strict-liability basis (meaning no proof of knowledge or intention is required) has been in force, as currently confirmed, since 2022.

OFSI issued revised enforcement and monetary penalty guidance in February 2026. That guidance introduced an early-account scheme, a settlement scheme, and for the first time, fixed penalty amounts for specified procedural breaches. The figures cited in that guidance are subject to legislative confirmation and should be verified before reliance; on the current guidance, one band covers lower-level procedural omissions and a higher band covers more significant procedural defaults. We act for multinationals and financial institutions who have received penalty notices or pre-penalty notices, and the pattern we see is that procedural defaults are increasingly treated as a distinct category rather than a mitigating footnote in a substantive case.

The EU position is constituted differently. EU asset-freeze prohibitions flow directly from Council Regulations, which are directly applicable in member states. For many years, enforcement of procedural obligations attached to those prohibitions was left to member-state law, producing wide divergence in how, and how severely, procedural failures were treated. The EU directive on the criminalisation of sanctions violations changed that architecture. It sets minimum standards, including minimum penalties, for serious offences and requires member states to establish corporate liability rules. Member states were required to transpose by a specified date; transposition has continued through 2026, and infringement proceedings have been opened against those that had not acted in time. The result is a patchwork: some member states now have express fixed-penalty provisions for procedural defaults, others continue to address those failures through general administrative or criminal law.

What counts as a procedural breach in each system?

The distinction between a substantive breach and a procedural breach matters enormously for penalty exposure. A substantive breach is the actual violation of a prohibition – making funds available to a designated person, dealing in a restricted commodity. A procedural breach is a failure to comply with an administrative obligation that surrounds the substantive prohibition – failing to report a knowledge or suspicion to the regulator, failing to maintain required records, failing to respond to a regulator request within the required period.

Under OFSI, the reporting obligation imposed on "relevant firms" is a hard statutory requirement. When a firm knows or has reasonable grounds to suspect that a designated person holds or controls funds, it must report that to OFSI. Failure to report is itself a breach, separate from any question of whether the underlying funds were improperly released. The record-keeping obligation under the UK regime mirrors the five-year retention period applicable across the major regimes. A firm that cannot produce records on request has committed a procedural default whether or not the underlying transaction was lawful.

What counts as a procedural breach under EU member-state law depends on which member state is administering the matter. The directive requires member states to criminalise failure to comply with reporting obligations, failure to keep required records, and obstruction of monitoring or supervision. But the precise definition of each obligation, the threshold at which it triggers, and whether it is addressed through criminal, administrative, or fixed-penalty provisions varies materially by jurisdiction. A business with subsidiaries in three member states could face three different fixed-penalty regimes for the same procedural default. That divergence is one of the defining practical features of cross-border EU enforcement in 2026.

Criterion-by-criterion comparison: penalty amounts, thresholds, and triggers

The OFSI fixed-penalty amounts published in the February 2026 guidance sit at £5,000 and £10,000 for specified procedural breaches, as currently stated in that guidance. These are flat-rate figures: unlike the proportional monetary penalty (which is calculated as the greater of £1,000,000 or 50 percent of the value of the breach, with a proposed increase to the greater of £2,000,000 or 100 percent subject to legislation), the fixed-penalty amounts do not vary with the size of the underlying position. A firm with a £50,000 blocked account that fails to report faces the same fixed penalty as a firm with a £5 million blocked account that commits the same omission. That is deliberate: the fixed-penalty tier is designed to address the administrative failure, not the financial exposure behind it.

The EU directive's approach to minimum penalties takes a different form. For serious offences it prescribes maximum terms of imprisonment of at least five years for natural persons, and corporate fines expressed either as a percentage of worldwide turnover or as a fixed maximum. The criminal model means that the upper end of exposure is considerably higher than any fixed-penalty figure under OFSI – but the trigger for criminal liability is a higher threshold than the strict-liability standard OFSI applies to monetary penalties. Procedural defaults that would attract a fixed penalty under OFSI may, depending on the member state, fall below the threshold for criminal liability under the transposed directive and instead attract an administrative fine under national law. The interaction between the criminal minimum and the administrative tier is not harmonised across the EU.

The following comparison is illustrative. For a reporting failure by a financial institution:

• UK (OFSI): fixed penalty of £5,000 or £10,000 (guidance, subject to verification) on a strict-liability basis; proportional penalty separately available for a substantive breach. Cumulative discounts are available under the revised guidance for voluntary disclosure, early account, and settlement.
• EU (directive-transposing member state): outcome turns on whether the member state has introduced an express fixed-penalty mechanism or routes procedural failures through administrative or criminal law. Where criminal law applies, the threshold is intent or serious negligence for natural persons; corporate liability runs on a separate track. Where an administrative tier applies, the amount varies by jurisdiction.
• Cross-border position: the stricter prohibition governs where both regimes apply concurrently, but because procedural obligations are jurisdictionally distinct, both penalties may be imposed independently. A firm cannot net one penalty against the other.

In our cross-border practice, we regularly advise businesses that have assumed – incorrectly – that satisfying one regulator's procedural requirements automatically satisfies the other. It does not. The reporting obligation to OFSI and the reporting obligation to a competent authority in a member state are parallel, not substitutable.

Strict liability and the knowledge question: a structural divergence

The most significant structural divergence between the UK and EU approaches concerns the knowledge requirement. OFSI can impose a monetary penalty, including a fixed penalty for procedural defaults, on a strict-liability basis. The firm does not need to have known it was committing a breach. It does not need to have acted dishonestly or negligently. The obligation existed; the firm failed to comply; the penalty follows. That is an unusually sharp instrument for a fixed-penalty regime, and it is what makes OFSI's approach to procedural enforcement genuinely different from most comparative models.

The EU directive, by contrast, requires that criminal offences be committed intentionally, or "at least by serious negligence" for certain offences. This is a materially higher bar. A firm that committed a procedural omission because of a genuine and reasonable misunderstanding of the scope of the reporting obligation has a more defensible position under the criminal-liability model than under OFSI's strict-liability model. The practical corollary is that under OFSI, the question at the first investigation stage is not "did you know?" but "did the failure occur?" Under the EU criminal model, intent and negligence become live issues at the outset.

For a compliance counsel reviewing an apparent procedural failure, this divergence changes the initial triage. Under OFSI the question is: what happened, when, what obligation attached, and was it met? Under the EU criminal model the question also includes: what did the relevant individuals know, and was the failure the result of a systematic gap or a one-off error? That second enquiry can be substantially harder to answer quickly. Does your incident-response protocol capture both tracks?

Discount and mitigation mechanisms: early account, settlement, and voluntary self-disclosure

OFSI's February 2026 guidance introduced a structured mitigation ladder. Voluntary self-disclosure is a recognised mitigating factor under OFSI's enforcement approach and, separately, under OFAC's Enforcement Guidelines for the US regime. Under OFSI's revised approach, a firm that discloses proactively before a regulator enquires benefits from a more favourable categorisation. The early-account scheme rewards cooperation at the investigation stage. The settlement scheme offers a discount – currently stated in the guidance at 20 percent – for firms that agree settlement rather than contest a notice. Those discounts can be cumulative: a firm that self-discloses, cooperates under the early-account scheme, and then settles may benefit from reductions at each stage.

The EU position on mitigation is less structurally defined at the pan-European level. The directive requires member states to treat certain factors – cooperation with authorities, voluntary disclosure, remediation – as mitigating factors in criminal proceedings. But the weight given to those factors and the procedural mechanics for presenting them vary by jurisdiction. There is no EU-wide equivalent of OFSI's settlement scheme with a published percentage discount. In practice, mitigation under the EU criminal model is argued by defence counsel in the same way as in any other criminal proceeding: through evidence of genuine cooperation, systemic remediation, and the absence of financial gain. The absence of a defined percentage makes the outcome less predictable.

For a business trying to calibrate whether to self-disclose to both OFSI and an EU competent authority simultaneously, the asymmetry matters. Disclosing to OFSI is likely to be beneficial under the published guidance. Disclosing to an EU criminal authority is a more complex tactical decision, because the criminal process, once initiated, runs on its own logic. We have acted for businesses facing this precise dilemma, and the answer almost always depends on the specific member state, the seniority of the individuals involved, and whether the firm has already received a formal enquiry. The decision cannot be made mechanically from a comparison table.

Interaction effects: the cross-border multiplier

A business subject to both OFSI and EU financial-sanctions obligations faces not a single penalty regime but a layered one. The same transaction, the same omission, the same failure to file a report can generate parallel proceedings in London and in one or more EU capitals simultaneously. There is no formal mutual-recognition mechanism for sanctions penalties between the UK and the EU post-Brexit. A firm fined by OFSI for a reporting failure does not receive credit for that fine against an EU member-state penalty for the same omission.

That multiplier effect is not merely theoretical. Consider a bank with UK, French, and German operations that fails to report a suspicion across all three jurisdictions in connection with the same counterparty. OFSI can pursue the UK entity. The French competent authority can pursue the French entity. The German competent authority can pursue the German entity. Each penalty is calculated independently under its own regime. The total exposure can be several multiples of any single jurisdiction's fixed-penalty figure. And if the EU member states have transposed the directive in a manner that allows group-level liability, the parent entity may face exposure in its own right in addition to the subsidiary-level proceedings.

A sharp change in the enforcement posture of either OFSI or an EU competent authority in respect of procedural defaults should therefore be monitored not just for its domestic implications but for its signal about the other regime. When one regulator prioritises procedural enforcement, the others have typically followed. The current trajectory – OFSI publishing fixed-penalty guidance, EU member states transposing a criminalisation directive – suggests that procedural compliance is entering a period of materially increased scrutiny across all major regimes.

The question for a cross-border compliance function is not whether to treat procedural obligations as a secondary consideration – they plainly are not – but whether the controls around those obligations are as robust as the controls around the substantive prohibitions themselves. In our experience, they often are not.

The myth of silence: why staying quiet worsens the position under both regimes

A persistent misconception among businesses facing a potential procedural breach is that silence is safer than self-disclosure. The reasoning is intuitive but wrong. Under OFSI, the strict-liability standard means that a failure to report is already a completed offence by the time the business discovers the underlying exposure. Silence from that point forward does not undo the offence; it simply delays the regulator's knowledge of it while the mitigation window narrows. Under OFSI's revised guidance, voluntary self-disclosure before OFSI opens an inquiry is a distinct category: it triggers the mitigation ladder at its most advantageous point. Waiting until OFSI writes first forfeits that advantage.

Under the EU criminal model, the position is more nuanced but reaches the same practical conclusion. Cooperation with a criminal investigation after the fact can be a mitigating factor. But the moment the competent authority opens a file, the business is no longer in the self-disclosure category; it is in the cooperation category. The distinction matters for the prosecutor's charging decision and, in some member states, for whether the public prosecutor has discretion to close the matter. That discretion typically favours earlier disclosure.

The objection we encounter most often from clients is that self-disclosure will "flag the issue" to a regulator that might otherwise not have noticed. That is a real risk for an isolated, minor procedural omission in a regime with limited enforcement capacity. It is not a realistic concern for a systemic reporting failure at a regulated financial institution operating in a jurisdiction with active sanctions enforcement. Regulators at both OFSI and EU level receive information from multiple sources: transaction monitoring by correspondent banks, suspicious-activity reports, whistle-blowers, and intelligence sharing between authorities. The likelihood that a systemic failure remains unknown to the regulator indefinitely is low. The cost of the regulator discovering it independently is materially higher – in penalty terms, in settlement-discount terms, and in reputational terms – than the cost of managing a proactive disclosure.

Risk flags and when to involve counsel

Several patterns consistently signal elevated procedural risk in cross-border enforcement matters. Recognising them early – ideally before a regulator writes – is the point at which legal advice has the most value.

• Delayed or missed reporting: If a firm has identified a potential match to a designated person – in a screening alert, a transaction-monitoring hit, or a due-diligence finding – and has not filed a report to OFSI or to the relevant EU competent authority within the applicable window, the procedural breach may already be complete. The question is not whether to report but how to manage the late disclosure.
• Record-keeping gaps: The five-year retention obligation applies to sanctions-related records under the UK regime. If a regulator requests records and a gap exists, the gap itself becomes a second procedural issue layered on top of whatever prompted the request.
• Inconsistent group-level compliance: Where a UK parent and EU subsidiaries operate different sanctions policies, a procedural omission in one jurisdiction may be replicated across others without anyone in the group being aware. A group compliance audit that treats UK and EU procedural obligations as distinct tracks – not a single unified system – is more likely to surface these gaps.
• Post-merger integration: Newly acquired entities often carry unresolved procedural exposures. In our experience, those exposures surface during the integration period when legacy records are reviewed, and they arrive at precisely the moment when the business is least able to absorb a parallel regulatory enquiry.
• Concurrent regulator contact: If OFSI and an EU authority have both made contact in connection with the same counterparty or transaction, the business is already in a multi-jurisdictional enforcement position. The sequence in which disclosures are made and the content of each submission need to be coordinated. Inconsistent statements to two regulators in the same matter create a category of risk that is entirely avoidable.

The decision about when to involve external counsel is often made too late. An initial regulator enquiry – a letter, a call, a request for information – is not simply administrative paperwork. It is the start of a formal process that may or may not escalate. The steps taken in the first two weeks after that contact, including decisions about what records to preserve, what to say and what not to say, and whether and how to make a proactive disclosure, can determine the trajectory of the matter. Treating the initial contact as a compliance-team matter rather than a legal matter is the most common error we see in the early stages of enforcement investigations.

Related practices

• Corporate liability and attribution under OFSI – analysis of how OFSI attributes liability within corporate groups for sanctions enforcement purposes.
• Penalty calculation methodology: OFAC and EU compared – criterion-by-criterion analysis of how OFAC and EU authorities calculate penalty amounts for substantive sanctions breaches.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.