A UK-based financial institution receives an alert: a payment processed three weeks ago may have passed through an account with links to a designated entity. The question is not only whether a breach occurred. The question is what the institution must do next – and how quickly. Under the rules administered by OFSI (the Office of Financial Sanctions Implementation, His Majesty's Treasury's financial sanctions authority), the obligation to investigate, to assess, and in certain circumstances to report does not wait for the institution to feel ready.
Internal sanctions investigations under OFSI rules are structured inquiries a firm must conduct when it identifies a potential breach of UK financial sanctions law. The governing instrument is the Sanctions and Anti-Money Laundering Act 2018 ("SAMLA") and the relevant thematic sanctions regulations made under it. OFSI's enforcement guidance sets out what it expects from a regulated person who discovers a possible violation – and reporting obligations can be triggered within a short statutory window.
This briefing covers who must investigate, what the investigation must address, how OFSI's approach compares with OFAC's and the EU's, where firms most often go wrong, and when to involve sanctions counsel.
Who administers UK financial sanctions and why does it matter for internal investigations?
OFSI administers UK financial sanctions under powers derived from SAMLA and the thematic regulations that implement each regime. It sits within His Majesty's Treasury and holds civil enforcement authority, including the power to impose monetary penalties and to publish details of enforcement action. It works alongside His Majesty's Revenue and Customs and the National Crime Agency on criminal referrals.
This structure matters for internal investigations because OFSI is both the regulator to whom a report may be owed and the authority that will assess whether a penalty is warranted. An investigation that is poorly scoped, inadequately documented, or that fails to identify all affected transactions will be evident to OFSI if the matter enters enforcement. Conversely, a well-conducted internal investigation – one that surfaces the full picture and produces a credible voluntary self-disclosure – is a factor that OFSI considers in its penalty assessment.
In our experience, firms that begin their internal investigation as if it were already being reviewed by OFSI produce the most defensible record. That means preserving communications, locking down relevant data, and making deliberate decisions about legal privilege from the first hour.
What triggers the obligation to investigate?
The trigger for an internal sanctions investigation under OFSI is not a formal notice from the authority. It is the moment a firm knows – or has reasonable grounds to suspect – that it holds, controls, or has dealt with funds or economic resources belonging to a designated person, or has otherwise been involved in a transaction that may breach the applicable sanctions regulations.
Practically, triggers include: a positive screening hit against the UK Consolidated List or the UN Consolidated List; an alert from a correspondent bank; a customer disclosure; a media report connecting a counterparty to a designee; or an internal audit finding. They also include negative indicators that fall short of a confirmed hit – an unusual payment pattern, a counterparty whose beneficial owner is obscured, or a jurisdiction flag that warrants further inquiry.
What triggers the investigation also defines its scope. A firm that treats a potential breach as a narrow transactional matter – checking only the single payment that generated the alert – may satisfy itself on too narrow a basis. OFSI's enforcement guidance makes clear that it expects a regulated person to understand the full extent of any contravention. That means examining whether the same counterparty or related parties are present elsewhere in the book, whether the ownership chain was assessed correctly at onboarding, and whether the issue is systemic or isolated.
Have you defined the scope of your investigation by reference to the regulatory question OFSI will ask, or only by reference to the transaction that triggered the alert?
The ownership and control test under OFSI: how it shapes the investigation
The UK ownership and control test under OFSI is not mechanical in the way the OFAC 50 percent rule (OFAC's rule treating entities owned 50 percent or more by blocked persons as themselves blocked) operates. Under UK sanctions law, an entity may be caught if a designated person owns or controls it, and "control" is assessed by reference to a broader set of indicators – holding a majority of voting rights, the right to appoint or remove the majority of the board, or the ability to exercise dominant influence.
This distinction is significant for internal investigations. An OFAC-style screen that stops at the aggregated ownership percentage may clear a counterparty under a US analysis while leaving a control-based UK exposure unaddressed. In our cross-border practice, we see this gap most often in structures where a designated individual holds a minority economic stake but retains contractual rights over strategic decisions – a position that may not trigger OFAC's test but warrants careful analysis under OFSI's.
The EU position is broadly similar to OFSI's in that it incorporates a control limb. However, the EU's application can differ across member states, and the interaction between UK and EU designations – which no longer automatically mirror each other following the UK's departure from the EU – means that a firm with both UK and EU regulatory exposure must run two separate analyses. The practical consequence: a transaction may be permissible under one regime and prohibited under the other. The stricter prohibition governs whichever jurisdiction's law applies to that transaction.
Reporting obligations: what must be disclosed to OFSI and when?
OFSI imposes a legal obligation to report on a defined class of persons – including financial institutions, credit institutions, and others subject to the applicable thematic regulations – when they know or have reasonable cause to suspect that a person they deal with is a designated person, or has committed an offence under the relevant financial sanctions rules. This is not a discretionary disclosure. It is a statutory duty, and OFSI expects it to be fulfilled promptly.
The report must include information about the person concerned and the basis for the knowledge or suspicion. It is made to OFSI directly. Importantly, making a report does not insulate the reporter from enforcement: OFSI may still investigate and may still impose a penalty if a breach occurred. What the report does is place the firm on the right side of the transparency obligation, and it is a factor that OFSI weighs in any subsequent penalty assessment alongside a voluntary self-disclosure (VSD – a proactive submission to a regulator setting out the apparent violation and the steps taken to address it).
Timing matters. OFSI does not publish a fixed calendar-day window in the same way some other regimes do, but the expectation expressed in OFSI's guidance is that the report is made as soon as practicable after the knowledge or suspicion arises. A firm that conducts a protracted internal investigation before reporting, and cannot demonstrate why that time was necessary, faces a harder conversation with OFSI than one that reports promptly and supplements that report as the investigation develops.
The position bridges into AML reporting obligations. Where a sanctions suspicion also gives rise to a suspicion of money laundering, a Suspicious Activity Report to the National Crime Agency may be required concurrently. The two obligations are separate and must be addressed separately. In a recent matter, a payments firm identified a sanctions issue late in a customer review and discovered that the same set of facts had already generated AML indicators requiring an SAR. Co-ordinating the two reporting streams – and managing the tipping-off risk – required immediate counsel involvement to avoid inadvertent disclosure to the subject.
How does OFSI's enforcement approach compare with OFAC and the EU?
OFSI's enforcement posture shares features with OFAC's but differs in ways that affect how an internal investigation should be structured. OFAC applies a detailed framework of aggravating and mitigating factors – including whether the subject had a sanctions compliance programme, whether a VSD was made, and the degree of wilfulness – in arriving at a penalty figure. OFSI applies its own set of factors, set out in its published enforcement guidance, and its graduated response includes the option to issue a warning letter rather than a monetary penalty for lower-severity matters.
A key procedural difference is the monetary penalty basis. OFAC's civil monetary penalty is calculated by reference to the value of the transactions at issue, subject to statutory ranges, whereas OFSI's is calculated either as a percentage of the value of the breach or as an absolute cap, whichever is higher. The effect is that large-value transactions can generate substantial OFSI penalties even for conduct that might attract a lower OFAC penalty in a comparable case – or vice versa.
The EU regime presents a third variant. Enforcement of EU financial sanctions is primarily a matter for member-state authorities, not a single EU-level body, and penalty structures and enforcement cultures differ considerably across the EU27. A firm with simultaneous OFSI and EU exposure should not assume that the two investigations will run at the same pace or produce comparable outcomes.
What does this mean for the internal investigation? It means scope decisions should be made by reference to the most demanding regime that applies to the facts. If the firm has US nexus, OFAC's framework applies alongside OFSI's. The investigation must be capable of satisfying both.
Common risk flags and where internal investigations go wrong
Scope creep in reverse is the most common failure we see. A firm defines the investigation too narrowly – examining only the transaction that generated the alert – and misses a pattern. OFSI's subsequent inquiry then surfaces related transactions that the internal investigation ignored, undermining the firm's position significantly.
Privilege errors come second. An internal investigation that uses in-house counsel to conduct interviews, gather documents, and draft the findings may produce a report that is not protected by legal professional privilege. Whether that matters depends on whether the matter reaches enforcement, but a firm that has not structured the investigation correctly from the start cannot reconstruct privilege later.
Third: the myth that a small breach does not require a formal investigation. OFSI does not publish a de minimis threshold below which the reporting obligation does not apply. The value of the transaction is relevant to penalty quantum, not to whether the obligation to report was triggered. We regularly advise firms that have delayed investigation on the assumption that the value is "too small to matter" – an assumption OFSI's guidance does not support.
Fourth: failure to freeze. Where a firm identifies property that may be owned or controlled by a designated person, the obligation to freeze arises at the point of knowledge or suspicion. Continuing to operate the account, process payments, or allow withdrawals while the investigation runs may itself constitute a further breach. The investigation must include an immediate assessment of whether any freezing obligation has been triggered and whether it has been satisfied.
Fifth: inadequate documentation. OFSI will assess not only what happened but how the firm responded. An investigation that produces no written scope document, no interview notes, no decision log, and no record of legal advice taken leaves the firm unable to demonstrate the quality and completeness of its response.
When to involve sanctions counsel and what that engagement produces
Sanctions counsel should be involved at the earliest practicable point after an issue is identified – ideally before the internal investigation formally begins. The first decisions – who investigates, on what brief, under what privilege structure, and whether a contemporaneous OFSI report is required – shape everything that follows. Reversing a bad decision about privilege or scope after the investigation is under way is difficult and sometimes impossible.
In our practice, we typically assist firms by: scoping the investigation by reference to OFSI's enforcement guidance and the applicable thematic regulations; advising on whether an immediate report to OFSI is required or whether preliminary steps can properly precede it; conducting or supervising interviews and document review under a privilege structure appropriate to the facts; preparing the VSD or the OFSI report; and advising on any concurrent AML or other reporting obligations.
Where the same facts generate exposure under more than one regime – OFAC, the EU, or another jurisdiction – we co-ordinate the cross-border analysis to produce a single, coherent investigation record that can be presented to each authority in the appropriate form.
The OFSI guidance itself signals that the quality of a regulated person's response to a discovered breach is relevant to penalty outcome. That is not a guarantee of any particular result. But a firm that can show OFSI a careful, complete, and promptly disclosed internal investigation is in a materially better position than one that cannot. Is your current incident-response procedure built to that standard?
Related practices
- Apparent violation assessment – EU – assessing and managing apparent EU sanctions violations across member-state enforcement regimes
- Internal investigation under OFSI – advanced considerations – deeper analysis of privilege, disclosure sequencing, and cross-authority co-ordination