An OFSI matter: fixed penalties for procedural breaches

A compliance officer at a mid-sized trading company receives a letter from OFSI. No allegation of a substantive breach. No suggestion that funds were transferred to a designated person. The letter concerns something procedural – a report that was not filed on time, a notification that did not reach the right desk. The immediate reaction is relief: surely a paperwork issue carries no real consequence. That reaction is wrong.

As of early 2026, OFSI has published revised enforcement guidance that introduces fixed penalties (monetary penalties of a set amount for defined procedural failings, imposed without a full investigation and without proof of intent) of £5,000 and £10,000 for specified categories of procedural breach. These sit alongside OFSI's existing power to impose monetary penalties of up to the greater of £1,000,000 or 50 percent of the breach value for substantive violations. The fixed-penalty mechanism means that a reporting failure, a notification gap, or a documentation lapse can now produce a swift, certain, and public outcome – without the slower investigation process that once gave compliance teams time to respond.

This case comment examines an illustrative matter in which a regulated business discovered the practical weight of OFSI's procedural obligations, considers the cross-regime context in which that lesson sits, and sets out what businesses should do before a letter arrives.

The lesson: procedural obligations carry real penalty risk

The principal lesson from OFSI fixed-penalty matters is simple. Procedural compliance – the obligation to report, to notify, and to maintain records – is not a secondary concern sitting behind substantive transaction-level controls. Under OFSI's approach, as currently in force and verify before reliance, procedural failings are a distinct and independently enforceable category of breach. The obligation to report knowledge or suspicion of a designated person's assets, and the obligation to respond accurately to information requests, both carry standalone enforcement consequences.

In our practice, the pattern is consistent. A business invests heavily in sanctions screening at the point of transaction approval. Its controls identify a potential match. It escalates internally, takes a decision, and proceeds – or withdraws. What it does not do is file the report to OFSI that the relevant thematic regulations require. The internal process treated the compliance step as complete once the commercial decision was taken. It was not.

The resulting fixed-penalty notice is not, in isolation, ruinous. The financial amounts at the two fixed levels are significant but bounded. What matters is what comes after. A fixed penalty is a matter of public record. It signals to counterparties, correspondent banks, and regulators in other jurisdictions that the business's compliance programme contained a gap. In a credit relationship, that signal is not neutral.

The factual situation: what triggered the OFSI inquiry

In the illustrative matter underlying this comment, a financial institution with operations in the United Kingdom and continental Europe identified a counterparty during a periodic review as a person reasonably suspected of being a designated person for the purposes of the relevant thematic regulations. The institution took the correct commercial step: it declined to proceed with a payment instruction. What it did not do was file the requisite report with OFSI within the applicable window.

The position came to OFSI's attention through a separate information-gathering exercise. The institution's internal records showed that the match had been identified, reviewed, and acted on commercially. The reporting obligation, however, had not been incorporated into the compliance workflow. No one had been assigned responsibility for it. The step had fallen between the screening team and the legal team.

The institution was not alleged to have transacted with a designated person. It was not alleged to have facilitated the movement of blocked funds. The question before OFSI was narrower: did a relevant firm, with knowledge or reasonable suspicion of a designated person, fulfil its obligation to report that knowledge? The answer was no.

Is this an unusual fact pattern? In our experience, it is not. The same gap – strong transaction-level controls, weak or absent post-screening reporting discipline – appears across sectors and across firms of very different sizes.

How the OFSI framework applies to procedural breaches

OFSI can impose monetary penalties on a strict-liability basis, meaning no knowledge or intent is required for the imposition of a penalty; this power has been in force since 2022, as currently in force and verify before reliance. That strict basis was significant in this matter. The institution could not argue that it did not know the obligation existed, and it could not argue that the gap was unintentional. Under the strict-liability model, neither argument provides a complete defence.

The revised enforcement guidance, published in February 2026, introduces an additional mechanism: fixed penalties of £5,000 and £10,000 for specified procedural breaches. These are designed to resolve lower-level procedural failings efficiently, without the full investigation process that attaches to a substantive monetary penalty assessment. The guidance also introduces an early account scheme (a process by which a person under review can provide a full, frank account early in OFSI's investigation in exchange for a reduction in the penalty otherwise applicable) and a settlement scheme carrying a discount of 20 percent on the otherwise-applicable penalty where settlement is reached. Discounts across the voluntary disclosure, early account, and settlement routes can be cumulative.

These mechanisms exist for a reason. OFSI's enforcement posture has moved from a reactive to a proactive model. The availability of swift, bounded penalties for procedural breaches is a signal that OFSI intends to enforce the full range of its statutory obligations, not merely the substantive transaction-level prohibitions.

Record-keeping obligations are a parallel point. Sanctions records must be kept for five years. A firm that cannot produce its screening records, its decision logs, and its escalation correspondence on request is in a weaker position at every stage of an inquiry, regardless of whether its underlying transaction was compliant.

Cross-regime context: how OFAC and the EU treat comparable obligations

OFSI's fixed-penalty approach does not sit in isolation. OFAC, administering the US sanctions regime under IEEPA, requires that blocked-property and rejected-transaction reports reach it within 10 business days of the blocking or rejection. That obligation applies to US persons and to certain non-US persons acting within OFAC's jurisdiction. OFAC's Enforcement Guidelines treat a failure to report as a separate factor in the penalty calculation, and voluntary self-disclosure is a recognised mitigating factor under those guidelines.

The EU position adds a further dimension. Under the EU asset-freeze regulations, directly applicable prohibitions extend to making funds or economic resources available, directly or indirectly, to or for the benefit of a listed person. National competent authorities across the member states enforce those prohibitions, and reporting obligations vary by jurisdiction. An institution operating in multiple EU member states carries reporting obligations in each relevant jurisdiction, not simply under one national framework.

The practical consequence is well known to cross-border compliance teams. A single underlying fact – a screening match, a declined payment, a suspicious ownership structure – can give rise to concurrent reporting obligations under OFSI, under OFAC, and under one or more EU competent authorities. Fulfilling one obligation does not discharge the others. Where two regimes both apply, the stricter obligation governs the relevant conduct. Treating a report filed with one regulator as sufficient for all is one of the most reliably recurring errors we see in practice.

For businesses operating between the United Kingdom and the European Union, this point is structural, not exceptional. A UK-authorised payment institution processing euro-denominated transactions through a Frankfurt correspondent will, in certain scenarios, hold obligations under both OFSI and the relevant EU authority. The workflows governing each must be distinct and must be owned by an identified individual.

Risk flags: the compliance gaps that produce fixed-penalty exposure

The fixed-penalty mechanism targets the lower end of OFSI's enforcement spectrum. That does not mean the exposure is trivial. It means the exposure is predictable. The patterns that produce it are consistent.

The first and most common is workflow fragmentation. Screening tools flag a potential match. The front-line team escalates to compliance. Compliance takes a view on the commercial decision. No one owns the step of considering whether a regulatory report is required. The screening event and the reporting obligation occupy different systems and different inboxes.

The second is role ambiguity on reporting obligations. The obligation to report knowledge or suspicion of a designated person to OFSI falls on relevant firms as a category. Within a firm, the role responsible for making that report is frequently unassigned, or is shared between teams without a clear decision-maker. When the question arises, time passes while the teams confer. The reporting window runs.

The third is conflation of internal approval and external reporting. A firm may have strong internal governance: an MLRO sign-off, a credit committee decision, a legal opinion. These are controls of real value. They do not, however, constitute a report to OFSI. The internal process and the external obligation are separate steps, and completing one does not complete the other.

The fourth, less obvious but increasingly significant, is failure to re-screen on designation updates. A counterparty is onboarded and cleared. A designation is added to the UK list some months later. The firm does not detect the change in time to file a timely report. Systems that screen at onboarding only, without ongoing monitoring, will produce this outcome regularly. The question is not whether this happens, but when.

The resolution: how the matter was addressed

In the matter underlying this comment, the institution made an early, voluntary approach to OFSI once the gap was identified. That approach is consistent with OFSI's guidance, and it is consistent with the position we advise clients to consider when a procedural gap comes to light before a formal inquiry has opened.

Voluntary disclosure, in OFSI's framework as in OFAC's, is a recognised mitigating factor. It is not an immunity. It is a factor that OFSI weighs in the penalty calculation and, under the revised guidance, it can interact cumulatively with the early account and settlement discounts. The institution in this matter engaged with OFSI's information-gathering process promptly, provided full and accurate records, and was transparent about the gap in its workflow.

The outcome was a penalty at the lower of the two fixed-penalty levels, together with a remediation undertaking that included a redesign of the reporting workflow and the appointment of a named responsible individual. The financial cost was bounded. The reputational consequence – a published notice – was not avoided. The institution had correctly concluded, however, that early transparency produced a materially better position than a prolonged inquiry would have done.

The myth that staying silent is safer than self-disclosing deserves direct correction. Silence does not prevent OFSI from conducting an inquiry; it removes the mitigating credit that early, voluntary engagement would otherwise generate. It also carries the risk that the inquiry, when it comes, proceeds on incomplete information that the firm could have supplied and chose not to. In OFSI's enforcement model, the posture of the subject firm is itself a relevant factor. A firm that comes forward promptly and co-operates fully is treated differently from one that is located by the regulator.

When to involve counsel: the decision points that matter

Three decision points in a fixed-penalty or procedural-breach matter are the ones where specialist counsel changes the outcome most reliably.

The first is the moment a potential reporting gap is identified. Before anything is said to OFSI, counsel can assess whether a reportable event occurred, when the window opened, and whether it has expired. That assessment determines the disclosure strategy. A miscalibrated early disclosure can create a problem that careful timing and scope management could have avoided.

The second is the decision about whether and how to engage with an OFSI information request. OFSI's information-gathering powers are broad. A response that is technically accurate but incomplete, or that is accurate as to one part of the fact pattern but silent on another, can extend and complicate an inquiry. We regularly advise on the scope and framing of responses at this stage.

The third is the penalty calculation itself. OFSI's revised guidance introduces structured mechanisms – early account, settlement – that carry defined discounts. Engaging these mechanisms requires a decision about timing and about what is volunteered. A firm acting without counsel at this stage frequently forgoes discounts it was entitled to claim, or engages a mechanism at a point in the process where it is no longer available.

The position above covers the standard procedural case. Your facts – the specific obligation, the applicable reporting window, the number of jurisdictions in play, and whether a concurrent OFAC or EU obligation runs in parallel – change the analysis. An early review, before any engagement with OFSI, preserves the options that close once correspondence has begun.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.