Corporate liability and attribution under OFSI: scope and obligations

A compliance officer at a mid-sized UK financial institution receives an OFSI inquiry. The letter references transactions processed two years ago. It asks who authorised the payments, what controls were in place, and whether senior management was aware. The instinct in the room is to say as little as possible. That instinct is wrong – and understanding why requires a clear grasp of how corporate liability and attribution under OFSI actually operates.

Corporate liability and attribution under OFSI rules determines when a company, rather than only its employees, bears responsibility for a financial-sanctions breach. Under the Sanctions and Anti-Money Laundering Act 2017 ("SAMLA") and the relevant thematic sanctions regulations, OFSI can impose civil monetary penalties on a strict-liability basis – no proof of knowledge or intent is required for the breach itself. Attribution rules then decide whether the state of mind of a director or senior manager is attached to the company for the purpose of the more serious, fault-based limb of enforcement.

This briefing covers who administers the regime, the legal basis, the scope of the prohibitions, the attribution test, how corporate liability compares with the OFAC and EU positions, the enforcement process, the voluntary-disclosure question, and the risk flags that should trigger immediate legal advice.

Who administers corporate liability under OFSI, and what is the legal basis?

OFSI – the Office of Financial Sanctions Implementation, a unit of HM Treasury – administers the UK financial-sanctions regime under SAMLA and the relevant thematic regulations. As of early 2026, OFSI operates as the principal civil enforcer of financial-sanctions prohibitions in the United Kingdom; it does not administer export licensing (that sits with ECJU) and does not itself bring criminal prosecutions (those are referred to prosecutors). Its enforcement remit is, however, substantial, and its use of the monetary-penalty power has grown materially since strict liability was introduced.

The legal foundations are layered. SAMLA provides the primary architecture: it grants powers to make financial-sanctions regulations, sets the framework for designations, and provides the statutory basis for monetary penalties. The thematic regulations that sit beneath SAMLA translate each sanctions programme into specific prohibitions. The two interact: OFSI's corporate-liability analysis starts with the prohibition in the thematic regulation and then asks whether the penalty power in SAMLA is engaged.

It is worth asking at the outset: what kind of conduct triggers the regime? The answer is broader than many compliance officers expect. The prohibitions extend not only to dealing with funds belonging to a designated person but to making funds or economic resources available, directly or indirectly, to or for the benefit of a designated person. An indirect payment routed through an intermediary can still be a breach. In our experience, companies are most often surprised by the indirect-benefit limb rather than by a direct transaction with a listed party.

What does the UK ownership-and-control test mean for corporate exposure?

The UK ownership-and-control test extends the reach of a designation beyond the listed individual or entity to companies that a designated person owns or controls. This has a direct bearing on corporate liability: a company that transacts with a non-listed subsidiary of a designated person may still be in breach if that subsidiary is caught by the control test.

Under the UK rules, a non-listed entity can be caught where a designated person owns it – the threshold mirrors the structure of the OFAC 50 percent rule in its ownership limb – or where a designated person otherwise controls it. The control limb is more open-textured. UK case law has held that control must be actual, not merely theoretical: the test looks at existing, exercised influence rather than a hypothetical capacity to exert it.

This diverges from the position under OFAC. OFAC's 50 percent rule (the rule treating entities owned 50 percent or more in the aggregate by blocked persons as themselves blocked) is mechanical: it turns on ownership arithmetic alone, and no assessment of practical control is required. OFSI's control test introduces a factual inquiry that OFAC's rule does not. The consequence for a corporate compliance function is that clearing the ownership threshold is not the end of the analysis; a control assessment must follow where a designated person has any material interest in the counterparty.

The EU position is broadly comparable to the UK in its ownership criterion – entities in which a listed person holds more than 50 percent are caught – and also applies a control test. However, a recent EU General Court ruling has clarified that control must be established by objective and sufficiently weighty evidence, and that the broader character of a state's political or economic environment is not, by itself, sufficient to prove that leadership controls a given company. That principle has implications for the EU analysis and is a useful comparator when advising clients on simultaneous UK and EU exposure.

How does OFSI's strict-liability penalty power work in practice?

OFSI's civil monetary-penalty power operates on a strict-liability basis, as currently in force: OFSI does not need to prove that the company knew it was committing a breach, or that it intended to breach sanctions. The breach itself – the dealing with, or the making available of funds to, a designated person – is sufficient.

The maximum civil penalty is the greater of £1,000,000 or 50 percent of the estimated value of the breach, as currently in force and subject to verification before reliance. OFSI weighs a range of aggravating and mitigating factors, including the severity and duration of the conduct, the level of senior management involvement, the quality of the compliance programme at the time of the breach, cooperation with the investigation, and whether the breach was voluntarily disclosed.

The attribution question arises most acutely where OFSI is considering the fault-based dimension of its analysis: whether a corporate officer's knowledge or deliberate conduct should be attributed to the company. In our experience, this is the aspect of an OFSI investigation that escalates fastest, because a finding of deliberate breach or recklessness carries significantly greater consequences than a finding that a strict-liability breach occurred without culpable fault. The practical dividing line is between a compliance failure (systems broke down) and a conduct failure (someone in the business knew and proceeded anyway).

The attribution rules derive from established principles of English company law. The acts and state of mind of a person who is the directing mind and will of the company – typically a director or senior officer exercising real authority over the relevant area of the business – can be attributed to the company. The principle is not simply hierarchical: it asks who in reality was responsible for the decision. A compliance officer several layers below the board who unilaterally approved a transaction may or may not fall within the directing-mind analysis; a board member who signed off on a commercial relationship with a designated counterparty almost certainly does.

What are the reporting obligations that may already be running?

Corporate liability under OFSI is not only about exposure to penalties. There are positive reporting obligations that bite on "relevant firms" – a category that broadly captures the regulated financial sector and related sectors – who know or have reasonable cause to suspect that a person is a designated person, or has committed an offence under the financial-sanctions regime.

That reporting obligation arises as a matter of the thematic sanctions regulations, not as a consequence of an OFSI investigation: it runs from the moment the firm acquires the relevant knowledge or suspicion. A firm that discovers a potential breach and does not report risks compounding its position. The obligation to report is separate from, and earlier than, the voluntary self-disclosure decision discussed below.

The cross-border dimension matters here. A financial institution operating across UK, EU, and US jurisdictions may face overlapping reporting and blocking obligations on the same facts. Under OFAC rules, blocked-property and rejected-transaction reports are due within 10 business days of the blocking or rejection, as currently in force. Under OFSI, the reporting obligation is not defined by a single number of days in the way OFAC's is, but it attaches promptly on knowledge or suspicion. Managing three sets of obligations simultaneously – OFAC's deadline-driven blocking and rejection report, OFSI's knowledge-or-suspicion obligation, and any EU member-state reporting requirement – is precisely where early legal advice is most valuable.

How does voluntary self-disclosure affect the corporate position?

The myth that silence is safer than disclosure is a recurring feature of OFSI enforcement. It is wrong. OFSI treats cooperation with its investigation, and voluntary disclosure of a breach before OFSI has identified it independently, as meaningful mitigating factors. A company that discloses promptly, provides a full account, and cooperates with the follow-up investigation will almost always be in a materially better position than one that withholds information and forces OFSI to build its own case.

Voluntary self-disclosure (a proactive report to OFSI before the regulator has independently identified the breach) is recognised in OFSI's enforcement guidance as a factor that can reduce the penalty level and influence how the case is characterised. The same principle applies under OFAC: OFAC's Enforcement Guidelines recognise voluntary self-disclosure as a mitigating factor, and the difference in treatment between a disclosed and an undisclosed violation is significant in both regimes.

The disclosure decision, however, requires careful preparation. A poorly scoped or inaccurate self-disclosure can make the position worse. Before making any report to OFSI, a company needs to understand the full scope of the conduct at issue, whether it has identified all relevant transactions, and how its account fits with any documentary record OFSI may be able to obtain independently. We regularly advise clients through this preparation phase, and in our experience the quality of the disclosure package – not simply the fact of disclosure – is what shapes the regulator's response.

There is also a criminal-exposure dimension to the disclosure decision. Where the facts suggest deliberate conduct by a director or senior officer, a voluntary disclosure to OFSI does not immunise individuals from criminal prosecution. The disclosure itself may inform a referral. This is one of the reasons early legal advice is essential: the disclosure strategy must account for both the corporate regulatory position and the individual criminal-exposure risk simultaneously.

How does corporate liability under OFSI compare with OFAC and EU enforcement?

Three features distinguish the UK position from the two comparator regimes most relevant to cross-border businesses.

First, strict liability. All three regimes – OFSI, OFAC, and the EU under national implementing legislation – can impose civil liability without requiring proof of knowledge. But the rate at which they exercise that power, and the penalty bases they apply, differ. OFAC's civil-penalty base is set per-transaction and can reach substantial figures. OFSI's is capped at the greater of £1 million or 50 percent of the breach value. EU member-state penalties vary widely by transposing legislation, though the EU directive on criminalisation of sanctions violations has driven minimum standards across the bloc, including maximum imprisonment terms of at least five years for serious offences and corporate fines expressed as a percentage of worldwide turnover, as currently in force.

Second, the attribution analysis. OFAC's enforcement is primarily corporate and entity-focused; individual attribution is handled through separate criminal referral to DOJ rather than through a structural attribution test applied within the civil-penalty proceeding itself. OFSI's attribution framework operates within the civil proceeding, which means the question of whether a director's knowledge is imputed to the company arises at the penalty-calculation stage, not only at the point of criminal referral.

Third, disclosure incentives. Both OFAC and OFSI treat voluntary self-disclosure as a mitigating factor, and both have structured guidance on how disclosure affects the outcome. The EU position varies by member state because the directive leaves transposition to national law. For a business with simultaneous OFAC and OFSI exposure – which is the common position for any UK-incorporated group with US-dollar payment flows – the disclosure strategy must be coordinated across both regulators. A disclosure to OFSI that precedes an OFAC disclosure by several weeks can create an evidential asymmetry that is difficult to manage. We act for clients in exactly this position and we have found that parallel-track coordination between the UK and US submissions materially reduces the downside risk.

What are the key risk flags that should prompt immediate legal advice?

Several indicators, taken individually or together, are sufficient to trigger an immediate legal review rather than an internal investigation managed within the compliance function alone.

An OFSI formal inquiry or questionnaire is the clearest. OFSI's written inquiries are not preliminary: they are investigative steps, and the answers provided become part of the evidentiary record. Handling them without specialist advice is a significant risk.

A transaction-screening hit on a counterparty that has already been processed – particularly where the hit reveals that the counterparty may be owned or controlled by a designated person – requires rapid scoping. The 10-business-day OFAC reporting window, and the promptness of OFSI's knowledge-or-suspicion obligation, leave little time for internal deliberation before the reporting question must be resolved.

Evidence that a director or senior officer was aware of the designated status of a counterparty at the time of the transaction shifts the analysis from a compliance failure to a potential directing-mind question. That shift changes the nature of the advice required.

A pattern of transactions rather than a single event multiplies the exposure. OFSI's penalty is calculated per breach: multiple transactions with a single counterparty, or transactions across multiple designated counterparties, can produce a penalty figure that exceeds what a single-transaction analysis would suggest.

For companies operating across UK, EU, and US jurisdictions, any OFSI exposure should be reviewed simultaneously for OFAC and EU implications. The three regimes can bite on the same facts from different directions, and a response strategy that resolves the OFSI position without accounting for OFAC's separate jurisdiction may inadvertently prejudice the US case.

What does effective corporate governance look like in this context? At a minimum: a board-level escalation path for sanctions hits, documented senior management sign-off on counterparty due diligence, a testing cycle for the screening programme, and standing instructions on what to preserve and what not to do in the first hours after a potential breach is identified. In our practice, the companies that manage OFSI inquiries most effectively are those that have rehearsed the escalation path before they need it.

Related practices

• Enforcement & Investigations – OFSI corporate liability – advisory and representation on OFSI enforcement proceedings and penalty defence.
• Criminal liability for sanctions violations under EU law – how the EU criminalisation directive affects corporate and individual exposure.

For a confidential review of your company's exposure under the OFSI regime, contact Calder & Vance at info@caldervance.com.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.