A UK-based trading company ships precision components to an overseas distributor. The export licence paperwork looks complete. Six months later, a routine review flags that one component required a separate licence under the Export Control Order – and that the end-user was on a restricted list. The company's compliance team now faces a question with criminal consequences: did anyone in the business know, or should they have known? That question is the hinge of criminal exposure in export-control cases under OFSI and its sister enforcement bodies in the United Kingdom.
Criminal exposure in export-control cases under OFSI rules arises where an individual or business commits a financial-sanctions breach with knowledge or reasonable cause to suspect the breach. The governing regime is a combination of OFSI (the Office of Financial Sanctions Implementation), which administers financial sanctions under the Sanctions and Anti-Money Laundering Act (SAMLA), and the Export Control Joint Unit (ECJU), which administers export licensing. The two regimes are distinct but frequently collide: a single shipment can generate civil or criminal liability under both. As of April 2026, OFSI retains the power to impose civil monetary penalties without proof of intent, while criminal prosecution requires proof of knowledge or reasonable cause to suspect.
This briefing sets out the governing authority and legal basis, explains the criminal test and how it operates alongside the civil track, identifies where the UK regime diverges from OFAC and EU positions, flags the highest-risk scenarios, and explains when to involve specialist counsel. It is written for compliance officers, general counsel, and boards at businesses that export goods or provide services touching controlled items.
Who administers criminal exposure in export-control cases in the United Kingdom?
Two authorities share responsibility for criminal exposure in export-control cases in the UK: OFSI and the ECJU, with the Crown Prosecution Service and His Majesty's Revenue and Customs also involved at the prosecution stage.
OFSI sits within HM Treasury. It administers UK financial sanctions – the prohibitions on making funds or economic resources available to designated persons or to entities owned or controlled by them. Where a breach of a financial-sanctions prohibition has a criminal character, OFSI may refer the matter for prosecution. It also retains the power to impose civil monetary penalties on a strict-liability basis: the civil track does not require proof of knowledge. That distinction matters enormously. A business can face a significant civil penalty even if it took reasonable steps; the criminal track adds a higher fault requirement but also the possibility of imprisonment.
The ECJU sits within the Department for Business and Trade. It issues export licences under the Export Control Order and is responsible for licensing decisions and compliance investigations for strategic goods, controlled technology, and dual-use items. Where a shipment proceeds without a required licence, the ECJU investigation can run in parallel with an OFSI financial-sanctions investigation – particularly where the recipient is a designated person, a sanctioned entity, or a restricted end-user under the applicable country regime.
HMRC has primary responsibility for criminal investigation of export-control offences at the border. The CPS decides whether to charge. In serious cases, the National Crime Agency may also be involved. The result is a multi-agency environment: when criminal exposure crystallises, a business may face coordinated action from several authorities at once.
What does that mean in practice? It means that the same factual matrix – a consignment of controlled goods sent to a restricted end-user – can generate OFSI civil and criminal liability for the financial-sanctions breach, ECJU licensing liability for the missing export licence, and HMRC criminal investigation for the physical act of shipping without authorisation. These tracks do not cancel each other out.
What is the legal basis for criminal liability under OFSI?
The legal basis for criminal liability in OFSI-administered financial-sanctions cases is SAMLA, together with the thematic sanctions regulations made under it. Each set of thematic regulations creates offences specific to the relevant sanctions programme; the underlying criminal fault standard is knowledge or reasonable cause to suspect.
Under the relevant thematic regulations, it is a criminal offence to deal with the funds or economic resources of a designated person, to make funds or economic resources available to a designated person or for their benefit, and to circumvent a prohibition – where the person doing so knew or had reasonable cause to suspect that the transaction involved a designated person or a prohibited purpose. This is a lower bar than actual knowledge: it is sufficient for a prosecutor to show that a reasonable person in the defendant's position would have suspected a problem and that the defendant took no adequate steps.
The ECJU regime, by contrast, operates under the Export Control Act 2002 and the Export Control Order. Criminal offences there include exporting without a required licence, breaching licence conditions, and providing false information to obtain a licence. The fault requirement is, broadly, similar: knowledge or recklessness will suffice. Where both regimes apply to the same facts, prosecutors can and do charge under both instruments.
Personal liability is a particular feature of the UK criminal regime. Directors, managers, and compliance officers can be prosecuted individually where an offence by a company is attributable to their consent, connivance, or neglect. This is not a theoretical risk. In our experience advising on OFSI enforcement matters, the personal-liability question is often the one that concentrates a board's attention most sharply.
How does the criminal test differ from the civil-penalty track?
The civil and criminal tracks under OFSI run on different fault standards, and that divergence determines the strategy when a potential breach is identified.
The civil-monetary-penalty track under OFSI is strict-liability with a due-diligence defence. OFSI does not need to prove that the respondent knew or suspected the breach. It needs to show that a prohibition was contravened. The respondent can argue that it took all reasonable steps and exercised all due diligence, but the burden is on the respondent to make that case. The maximum civil penalty is the higher of a set monetary ceiling or a percentage of the transaction value, as currently in force under SAMLA – verify the precise figure before relying on it.
The criminal track requires the prosecution to prove knowledge or reasonable cause to suspect beyond a reasonable doubt. That is a materially higher bar. However, the consequences are also materially higher: an unlimited fine in some categories of offence, and imprisonment of up to a term specified in the relevant thematic regulations. Verify the current maximum custodial term in the applicable instrument.
The gap between the two tracks creates a practical problem. A business that receives an OFSI civil-penalty notice cannot simply treat it as a regulatory fine and move on. The same facts that produce the civil notice may be referred for criminal investigation. Early engagement with specialist counsel is therefore not optional once a notice arrives: it is the step that determines whether the matter stays civil or escalates.
Is there a reporting obligation? Yes. Under SAMLA and the relevant thematic regulations, certain regulated-sector firms must report suspicions and actual breaches to OFSI within a short statutory window. The obligation applies to banks, financial institutions, and other obligated entities. Missing that window can itself be an offence, and it removes the possibility of credit for early and voluntary disclosure.
In our practice, we regularly advise businesses on whether a potential breach sits in civil or criminal territory. The assessment turns on what the relevant individual knew, what systems were in place to alert them, and what steps were taken once a concern arose. Those three questions should be answered before any external communication with OFSI.
How does OFSI criminal exposure compare to OFAC and the EU?
Comparing the UK, US, and EU criminal-exposure positions reveals meaningful divergences that matter for any business operating across more than one jurisdiction.
Under OFAC – the Office of Foreign Assets Control in the United States – civil-penalty liability is also strict. OFAC does not need to show intent for a civil penalty; the question is simply whether a prohibited transaction occurred. Criminal prosecution under IEEPA and related statutes requires wilful violation: the defendant must have acted knowingly and intentionally in breach of the rules. The criminal threshold in the US is therefore higher (wilful) than in the UK (knowledge or reasonable cause to suspect).
Extraterritoriality is also more pronounced in the US regime. OFAC secondary sanctions reach non-US persons who facilitate significant transactions with certain designated persons or programmes, creating exposure for UK businesses that have no direct connection to the United States but whose clients or banks do. A UK exporter transacting in US dollars, routing through a US correspondent bank, or dealing with a party on the SDN List (OFAC's list of Specially Designated Nationals and blocked persons) faces potential OFAC civil liability even where the UK OFSI position would not produce a penalty.
Under the EU regime, criminal liability for sanctions breaches is now harmonised to a degree by the EU directive on criminal penalties for sanctions violations. EU member states are required to treat wilful violations of Council regulations as criminal offences. The definition of criminal fault is broadly consistent with the UK knowledge-or-recklessness standard, though precise transposition varies by member state. For a UK business with EU subsidiaries or EU-routed transactions, the EU criminal exposure runs independently of the OFSI position.
The practical consequence is overlap, not mutual exclusivity. A single transaction that breaches OFSI prohibitions, OFAC secondary-sanctions rules, and an EU Council regulation produces three independent liability streams. The position that matters is the strictest of the three – and that is rarely the same regime in every case.
We advise multinationals to map the applicable regimes before a transaction closes, not after a problem surfaces. Cross-border exposure analysis is more efficient than post-breach damage limitation.
What are the highest-risk scenarios for criminal exposure under OFSI?
Criminal exposure under OFSI in export-control cases tends to crystallise in a recurring set of scenarios. Identifying them is the first step in a compliance programme that is genuinely protective.
The first scenario is the layered intermediary. A UK business sells to a distributor, which re-exports to a restricted end-user. The UK business did not deal directly with the end-user. But if it had reasonable cause to suspect the re-export destination and took no steps to verify the route, the knowledge-or-reasonable-cause-to-suspect test may be satisfied. Red flags for this scenario include distributors in high-risk transit jurisdictions, unusual payment routes, and end-use certificates that are vague or inconsistent with the goods.
The second scenario is the owned-or-controlled entity. The ownership and control test (the UK and EU test for whether a non-listed entity is caught through a listed person) means that transacting with a company majority-owned by a designated person is prohibited even if the company itself is not on any list. A business that screens only listed names and not ownership chains will miss exactly this exposure. The OFSI ownership test asks both whether a designated person holds more than 50 percent and whether they exercise control – the control limb captures structures that defeat the numerical threshold.
The third scenario is the dual-use classification failure. A component that the exporter believes is commercial may carry an ECCN (Export Control Classification Number under the US Commerce Control List) or a UK/EU control-list entry that requires a licence for certain destinations. Where the exporter failed to classify correctly and the item reached a restricted end-user, the combination of the classification failure and the end-user's status may produce both ECJU licensing liability and OFSI financial-sanctions exposure.
The fourth scenario is the voluntary self-disclosure that goes wrong. A business identifies a potential breach, prepares a VSD (voluntary self-disclosure to a regulator), and submits it – but the disclosure is incomplete or the underlying analysis understates the scope of the violation. An inadequate VSD can be used by OFSI in a subsequent civil or criminal proceeding. The submission should be prepared with legal advice and should reflect a complete internal investigation.
A fifth scenario that we encounter regularly in our cross-border export-control practice involves businesses that have been acquired. Post-acquisition due diligence may reveal historic breaches by the target. Those historic breaches are now the acquirer's problem. Pre-completion sanctions and export-control due diligence is the only reliable mitigation.
Common misunderstandings about OFSI criminal exposure
Several persistent misunderstandings about OFSI criminal exposure in export-control cases lead businesses to underestimate or mismeasure their risk.
The most common misunderstanding is that OFSI deals only with financial sanctions and that export-control criminal exposure is entirely an ECJU matter. That is incorrect. A single shipment to a designated person generates both an OFSI financial-sanctions liability (for making economic resources available) and an ECJU licensing liability (for shipping without the required licence). Both authorities can act; both tracks can produce criminal referrals. Treating them as separate silos is the compliance error most likely to produce a gap.
A second misunderstanding is that criminal prosecution for sanctions offences is rare and therefore not a practical concern for compliant businesses. The UK Government has made clear through public enforcement guidance that criminal prosecution is available and that it will be used for serious or deliberate violations. The availability of the civil track does not guarantee that a matter will remain there. In our experience, the factor that most frequently determines whether a matter escalates to the criminal track is the quality of the business's compliance documentation at the time the breach occurred.
A third misunderstanding is that the de-risking approach (a financial institution exiting a relationship to avoid sanctions exposure) provides complete protection. Exiting a customer relationship after a suspected breach does not eliminate historical liability. If the breach occurred before the exit, the exposure survives the termination. The exit may prevent future breaches; it does not erase past ones.
Finally, some businesses assume that acting on legal advice provides an absolute defence. UK law provides that acting in good faith on legal advice that later proves incorrect is a mitigating factor, but it is not a complete defence in all circumstances. The quality and timing of the advice, and whether the business followed it consistently, all matter to the analysis.
Related practices
- Apparent violation assessment – EU enforcement – cross-border apparent-violation review under EU Council regulations and related enforcement instruments
- Criminal export exposure under SECO – Swiss sanctions and export-control criminal-liability regime compared
- Criminal export exposure under Singapore's regime – how Singapore administers criminal sanctions and export-control liability
When should a business involve specialist counsel?
The answer to this question is almost always: earlier than instinct suggests.
Criminal exposure in export-control cases under OFSI rules develops quickly once a potential breach is identified. The reporting obligation in the relevant thematic regulations runs from the point at which a person in the regulated sector knows or suspects a breach – not from the point at which they are certain. That means the clock is running during the internal investigation. If the internal investigation takes longer than the reporting window, the failure to report is itself an offence.
The three situations that most urgently require specialist involvement are: (1) identification of a possible breach, whether in a transaction review, a screening hit, or an acquisition due-diligence process; (2) receipt of any communication from OFSI, the ECJU, HMRC, or any other enforcement authority, including informal enquiries; and (3) any scenario where an individual within the business may face personal liability – where a director or compliance officer's conduct is in scope of the events under review.
The position above covers the standard case. Your facts – the goods, the counterparty, the route, the applicable country regime, and the knowledge present within your organisation – determine the analysis. For a confidential early assessment of your exposure under the OFSI rules and the parallel ECJU regime, contact Calder & Vance at info@caldervance.com.
If a transaction has already been flagged, or a filing has been refused, an early review can preserve options that narrow with time. Voluntary self-disclosure, prepared correctly, can reduce a penalty and reduce the probability of criminal referral. Delay removes that option. Contact us at info@caldervance.com.
Frequently asked questions: criminal exposure in export-control cases under OFSI
Who administers criminal exposure in export-control cases under OFSI?
OFSI (the Office of Financial Sanctions Implementation, within HM Treasury) administers UK financial-sanctions compliance and can refer cases for criminal prosecution. The ECJU administers export licensing. HMRC investigates criminal export-control offences at the border. The CPS decides whether to charge. In serious cases, the National Crime Agency may also be involved. These authorities can and do act simultaneously on the same facts, meaning a single incident may produce parallel enforcement proceedings.
What does OFSI prohibit in relation to criminal exposure in export-control cases?
OFSI prohibits dealing with, or making funds or economic resources available to, designated persons or entities that they own or control. These prohibitions are set out in the thematic sanctions regulations made under SAMLA. Criminal liability arises where a person commits such a breach with knowledge or reasonable cause to suspect that a designated person is involved. The ECJU separately prohibits exporting controlled goods without a required licence. Both prohibitions can apply to the same export transaction.
How is criminal exposure in export-control cases enforced under OFSI?
OFSI may impose civil monetary penalties on a strict-liability basis or refer matters to prosecutors for criminal charges. Criminal prosecution requires proof of knowledge or reasonable cause to suspect, and can result in an unlimited fine and imprisonment for individuals. OFSI's enforcement guidance sets out the factors it considers when deciding between civil and criminal routes, including the seriousness of the breach, whether it was deliberate, and the quality of the respondent's compliance systems. Voluntary self-disclosure before enforcement begins is treated as a mitigating factor.
About the author
Henry Ashworth advises on UK financial sanctions and export controls, including OFSI licensing and enforcement, and judicial-review challenges to designations. Calder & Vance – International Sanctions & Export Control Counsel.
About Calder & Vance
Calder & Vance is an independent international sanctions and export-control boutique. We advise multinationals, financial institutions, exporters, and individuals on the major regimes – OFAC and BIS in the United States, OFSI and ECJU in the United Kingdom, the EU Council regulations and the EU General Court, the United Nations Consolidated List, and the regimes of Switzerland, Canada, Australia, the UAE, Singapore, and Japan. Our work is limited to lawful compliance, licensing, delisting, enforcement defence, and due diligence. To discuss a matter, contact info@caldervance.com.
Disclaimer: This material is general information, not legal advice, and is not a substitute for advice on your specific facts. Sanctions and export-control rules change frequently and differ by regime; verify the current position before relying on anything stated here. Calder & Vance does not advise on circumventing or evading sanctions. For advice on your situation, contact info@caldervance.com.