Corporate liability and attribution under OFSI: a practical guide

A financial institution receives an OFSI inquiry. The allegation is not directed at a rogue employee acting alone. It is directed at the institution itself – for what a director knew, for what a compliance officer failed to flag, and for what the organisation as a whole permitted. As of early 2026, OFSI's strict-liability civil penalty regime means that corporate fault, in the traditional sense, is not always the question. But attribution – whose knowledge and conduct is imputed to the company – remains critical when the regulator assesses culpability, determines the penalty band, and decides whether to publish its finding.

Under the UK financial-sanctions regime, a company can face a civil monetary penalty on a strict-liability basis for a breach of the relevant thematic sanctions regulations, administered by OFSI under the Sanctions and Anti-Money Laundering Act. The maximum civil penalty is the greater of £1,000,000 or 50 percent of the estimated value of the breach, as currently in force – verify the position before reliance. Attribution determines whose acts and mental states are imputed to the body corporate, and that question shapes every stage of the enforcement response, from the first internal review through to penalty representations.

This guide sets out what you need to establish before OFSI asserts a breach, what the attribution test requires, how the position compares with OFAC and EU enforcement, and the decisions that can materially affect the outcome.

What you need before OFSI asserts a breach

The starting point is understanding what OFSI needs to establish a civil penalty, and what facts your organisation must have ready before the regulator asks. OFSI imposes penalties on a strict-liability basis: knowledge that a breach has occurred is not required for the violation to be established. What knowledge and intent do affect – and affect profoundly – is where the breach falls in OFSI's enforcement bands and whether the matter is referred for criminal prosecution.

Before any inquiry arrives, a business needs to have mapped three things. First, the contractual and operational facts: which transaction is alleged, who executed it, on what authority, and under which internal approval process. Second, the sanctions-screening record: what the screening system returned, when it returned it, and what action was taken. Third, the chain of knowledge: who in the organisation was aware of a potential sanctions issue, at what level, and when.

In our experience, the organisations that handle OFSI inquiries most effectively are those that can reconstruct this chain quickly and consistently. Gaps in the record are not neutral. They tend to be read, by the regulator, as an absence of controls rather than an absence of information. Have you tested whether your documentation would support a coherent account of every decision point in a flagged transaction?

Practically, this means that the readiness checklist for corporate-liability exposure under OFSI has three components: a complete transaction record, a defensible screening log, and documented escalation decisions. Each is examined below.

Completing your transaction record

A complete transaction record means more than the payment instruction and the counterparty name. OFSI's enforcement approach considers the totality of the circumstances surrounding a breach, and the transaction record is the primary vehicle for presenting those circumstances in your favour.

The record should capture: the commercial purpose of the transaction; the counterparty's corporate structure, including any ownership information available at the time; the designated-persons screening conducted and the list versions used; any escalation, legal review, or compliance sign-off; and the final instruction to proceed, including who gave it and under what authority. Sanctions records must be kept for a minimum period, and OFSI can and does require production of contemporaneous documentation. Reconstructed records, prepared after an inquiry begins, carry significantly less weight.

One practical issue we regularly see: a transaction involves multiple legal entities within a corporate group – perhaps a parent approves, a subsidiary contracts, and an affiliate executes. In that configuration, the question of which entity bears liability, and which individuals' knowledge is attributed to each, is not straightforward. The answer depends on the group's internal authority structure and on how OFSI reads the conduct of each entity as a distinct person under the regulations.

Building a defensible screening log

The screening log is often the first document OFSI requests in a civil penalty inquiry. It records whether, and when, the organisation checked its counterparty against the UK Consolidated List and any other applicable lists. The log matters for attribution because it is the most direct evidence of what the organisation knew – or had the means to know – at the point of execution.

A defensible screening log demonstrates: that screening was conducted against a current and complete list version; that the result was reviewed by a person with the authority to act on it; that any potential match was escalated and resolved with a documented rationale; and that a negative result was not treated as the end of the inquiry where other risk indicators were present.

The phrase "we screened the name" is not, by itself, a complete control. OFSI's enforcement guidance makes clear that screening is one component of a sanctions compliance programme, not a substitute for one. Where screening returned a result that was dismissed without adequate analysis – particularly where other transactional red flags were present – the regulator is likely to treat that dismissal as an aggravating factor rather than a mitigating one.

Screening obligations attach on a risk basis. A bulk commodities trader moving goods through a high-risk transit jurisdiction faces a different screening obligation than a professional-services firm billing a long-standing domestic client. The calibration of that obligation is itself a question of attribution: what did this organisation, with this risk profile and these resources, know and what should it have known?

Understanding the attribution test under OFSI

Attribution under UK financial-sanctions law determines which individual's acts and states of mind are treated as those of the company. This is not the same question as strict liability. Strict liability means OFSI does not need to prove that the company intended a breach for the civil penalty to be imposed. Attribution means the regulator examines whose conduct constituted the breach, and that question shapes the culpability analysis and the criminal-liability gateway.

UK company law and the relevant thematic sanctions regulations together provide the attribution framework. For criminal liability – which can arise in the most serious cases – the "directing mind and will" doctrine applies: the prosecution must show that a senior officer whose role and authority amount to the directing mind of the company participated in or consented to the relevant conduct. This is a harder standard to meet than civil strict liability, which is why most OFSI enforcement is civil in nature.

At the civil level, the attribution analysis is more practical. OFSI examines the role and seniority of the individual who took the relevant decision; whether the decision was taken within a chain of authority that the company designed and sanctioned; and whether the company's governance arrangements made the breach more or less likely. A failure at senior level – a compliance officer who escalated but was overruled; a director who approved a transaction despite a risk flag – is treated differently from a breach caused by a junior-level processing error that a reasonable control environment would have caught.

UK case law distinguishes existing influence from a hypothetical ability to exert control, and the same logic applies to corporate attribution: control must be actual, not theoretical, as currently in force – verify before reliance. A company cannot escape liability by pointing to an organisational chart that formally separated the decision-maker from the compliance function, if in practice the two operated as one. Conversely, a company that demonstrates genuinely independent compliance oversight may present a different attribution picture from one whose compliance function reports to the same business head who approved the transaction.

How does OFSI attribution compare with OFAC and EU enforcement?

The cross-regime comparison matters because most organisations that face an OFSI inquiry also have US dollar clearing, EU-entity exposure, or dealings in another major jurisdiction. A single transaction can trigger inquiries in multiple regimes simultaneously, and the attribution analysis is not the same in each.

Under OFAC, civil liability is also strict: knowledge is not required. But OFAC's enforcement guidelines explicitly use a culpability analysis that overlaps with attribution – the "egregiousness" assessment looks at the awareness of senior management, whether the breach was willful, and the compliance programme in place. OFAC's statute of limitations for civil violations was extended to ten years in 2024, as currently in force, which means historical conduct that would have been time-barred under the prior regime remains within reach.

In our cross-border practice, we regularly see clients who assume that an OFAC voluntary self-disclosure – a recognised mitigating factor under OFAC's enforcement guidelines – will automatically satisfy OFSI. It will not. The two regimes run independently. An OFSI report, where obligatory or voluntary, must be made to OFSI; an OFAC disclosure is made to OFAC. The underlying facts may overlap, but the regulatory response is separate, and the timing of each disclosure can affect how each regulator reads the company's cooperation.

EU enforcement adds a further dimension. An EU directive on the criminalisation of sanctions violations sets minimum penalties, with maximum imprisonment terms of at least five years for serious offences and corporate fines expressed as a percentage of worldwide turnover. Member states were required to transpose that directive by May 2025, with transposition continuing through 2026 – verify the current position in the relevant member state before reliance. For a multinational with EU subsidiaries, this means that conduct that OFSI would treat as a civil matter may, if it also involves an EU entity, carry criminal-prosecution risk under the domestic laws of one or more member states. That is a material difference in the risk profile of the same set of facts.

Where two regimes both apply, the stricter prohibition governs. A UK entity that is also a US person – or that transacts through a US correspondent – faces the combined effect of both regimes. The attribution analysis for each is conducted under each regime's own rules, and the results do not always align.

What are the risk flags that raise the attribution stakes?

Not every OFSI breach carries equal enforcement risk. The attribution analysis is most consequential where the facts suggest that senior individuals were aware of the risk and proceeded anyway. Several patterns raise the stakes significantly, and each is worth examining as a readiness question before any inquiry arrives.

The first is approval at a level that implies knowledge. Where a transaction required sign-off by a senior officer – a chief compliance officer, a head of trade finance, a director – and that officer was presented with, or had access to, information suggesting sanctions risk, the attribution picture is materially worse than in a case involving purely operational-level execution without escalation.

The second is a compliance alert that was dismissed. If the screening system returned a potential match, a compliance analyst flagged a concern, or an internal policy was applied inconsistently, and the organisation proceeded without documenting a reasoned resolution, the regulator is likely to treat the undocumented dismissal as the relevant decision point. Who made that decision, and at what level, is the attribution question.

The third is a pattern of similar conduct. OFSI's enforcement posture – and that of OFAC and the EU – treats a one-time operational failure differently from a recurring failure across multiple transactions, products, or business lines. A pattern implies that the failure was not incidental but was embedded in the organisation's conduct. Attribution in that context reaches further up the governance structure.

The fourth is group structure. Where a breach is committed by a subsidiary, OFSI may examine whether the parent had control or influence over the conduct, and whether the group's governance arrangements effectively attributed the subsidiary's decisions to the parent. This is a distinct attribution question, and it requires specific advice.

The voluntary self-disclosure decision and the myth of silence

A persistent and dangerous misunderstanding in corporate compliance is that staying silent following a potential breach is safer than self-disclosing. It is not. This section addresses that myth directly.

OFSI operates a licensing regime and a reporting obligation. There is a legal duty on certain categories of firm – "relevant firms" under the applicable regulations – to report knowledge or suspicion of designated persons to OFSI, as currently in force. Failing to report where that obligation applies is itself a breach. Silence in that context is not a choice; it is a separate violation.

Where the reporting obligation does not apply but the organisation has identified a potential breach, the self-disclosure analysis is a strategic one. Voluntary self-disclosure is a recognised mitigating factor under OFSI's enforcement approach, as it is under OFAC's enforcement guidelines. OFSI's guidance introduces a settlement scheme and an early account mechanism that can, in appropriate cases, reduce the penalty. Discounts under the scheme can be cumulative – early account, voluntary disclosure, and settlement may each carry their own reduction, as currently in force – verify the current position before reliance.

The question of whether to disclose, when to disclose, and what to say is a legal decision that requires advice. The disclosure package must be accurate and complete. A partial disclosure – one that presents the facts favourably while omitting adverse information – is unlikely to achieve the mitigation it is designed to secure, and may be treated as an aggravating factor if the full picture emerges later. In our experience, organisations that treat self-disclosure as a legal process, rather than a public-relations exercise, are better positioned to benefit from the mitigation it can provide.

Is the decision to stay silent really protecting the organisation, or is it compounding the exposure? The attribution analysis above explains why silence at the corporate level may not shield the individuals whose conduct is already on the record.

When to involve counsel and what to prepare

The moment at which external counsel is instructed in an OFSI matter can affect the entire subsequent handling. Counsel should be involved before any response is made to OFSI – whether that response is a formal penalty submission, a voluntary disclosure, or an informal communication. This is not procedural conservatism. It is because the first communication with a regulator sets the frame for everything that follows.

What to prepare before instructing counsel: the complete transaction documentation, as described above; the screening log; a chronological narrative of events, including who knew what and when; any internal communications that bear on the compliance decision; and the organisation's current sanctions compliance programme documentation. The programme documentation matters because OFSI's enforcement posture gives weight to whether a genuine compliance programme was in place and functioning at the time of the breach. A programme documented after the inquiry begins does not demonstrate what was in place before it.

For groups with US or EU exposure alongside the UK position, counsel needs to understand the multi-regime picture from the outset. Disclosures to OFSI and OFAC must be coordinated. The attribution analysis under each regime may produce different results for the same set of facts. And the criminal-liability gateway under the EU directive may require separate advice in the relevant member states.

We act for multinationals, financial institutions, and exporters on sanctions and export-control matters across the major regimes. Our practice covers both the civil and criminal dimensions of an OFSI enforcement response, including voluntary self-disclosure, penalty representations, and, where necessary, challenging a designation or enforcement finding.

For a confidential review of a potential breach or a live OFSI inquiry, contact Calder & Vance at info@caldervance.com.

Related practices

• Corporate liability and attribution under OFSI – full enforcement and penalty-defence service for OFSI inquiries
• Criminal liability under EU sanctions – EU directive criminalisation analysis and cross-border exposure
• Criminal liability under OFAC – US criminal enforcement, voluntary self-disclosure, and OFAC penalty defence

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.