Corporate liability and attribution under OFSI: compliance counsel

A UK-incorporated holding company receives an OFSI inquiry. The relevant transaction was carried out by a wholly-owned operating subsidiary. The parent board was not involved in the decision. Two questions immediately arise: is the parent exposed, and can the conduct of the subsidiary be attributed to it? Those questions are not academic. Under UK financial-sanctions law, attribution can extend liability upward, sideways, and outward in ways that surprise even experienced compliance teams.

As of January 2026, corporate liability and attribution under OFSI (the Office of Financial Sanctions Implementation, the UK authority responsible for financial-sanctions enforcement) turns on a statutory strict-liability standard combined with common-law attribution principles that can bind a parent to a subsidiary's breach without any board-level knowledge. OFSI can impose a monetary penalty of the greater of £1,000,000 or 50 percent of the breach value per violation, as currently in force. Where the breach also discloses criminal conduct, the exposure multiplies. The earlier specialist counsel is engaged, the more options remain available.

This page explains how corporate liability and attribution operates under OFSI, where it diverges from OFAC and EU approaches, what the main risk flags look like in practice, and how Calder & Vance assists businesses that find themselves under inquiry or that want to assess their exposure before a notice arrives.

What is the problem that corporate attribution creates for a group structure?

Corporate groups are not insulated from OFSI liability simply because the entity that conducted the transaction is a separate legal person. Attribution doctrine, applied to the UK sanctions regime, can treat the acts and knowledge of an employee, an agent, or a subsidiary as those of the parent – depending on whose authority the actor was discharging and at what level. This is the central operational risk for any multi-entity business with UK nexus.

The strict-liability standard compounds it. OFSI does not need to prove that the parent company knew the transaction was prohibited. It needs to show that the transaction occurred and that the entity before it had the relevant nexus to the prohibition. Knowledge and intent affect the severity of the penalty and the availability of certain representations, but they do not defeat the liability finding. For a group compliance team, this means the question is rarely "were we aware?" and almost always "can the conduct be attributed to us?"

In our experience, the most exposed position is a group that has delegated sanctions compliance downward without implementing adequate oversight, record-keeping, or escalation channels. When OFSI investigates, it looks not just at the transaction but at what governance existed around it. A well-documented compliance structure limits attribution risk. An absent or nominal one extends it.

What makes this particularly sharp for cross-border groups is that OFSI's reach is not limited to UK-incorporated entities. A foreign company that processes a transaction denominated in sterling, routes through a UK correspondent, or benefits from UK-provided financial services can fall within the regime. Do you know which entities in your group carry UK nexus for financial-sanctions purposes?

The governing authority and legal basis for OFSI enforcement

OFSI administers the UK financial-sanctions regime under the Sanctions and Anti-Money Laundering Act 2018 ("SAMLA") and the relevant thematic regulations – the instruments that implement specific sanctions programmes. The monetary-penalty power operates on a strict-liability basis, meaning that OFSI assesses whether a prohibition was breached and whether the requisite nexus to the entity exists; it does not need to prove knowledge for a civil penalty.

The strict-liability power has been in force since 2022. Before that amendment, OFSI required proof of knowledge or reasonable cause to suspect. The shift materially changed the enforcement picture for corporates. A business that structured its compliance programme around the pre-2022 knowledge-based model may find it inadequate against the current standard.

Attribution in the corporate context draws on common-law principles developed across company law and regulatory enforcement. The courts and OFSI look at whether the natural person whose act or knowledge is in question was the "directing mind and will" of the entity at the relevant time, or whether the act is attributable on agency or vicarious-liability grounds. Neither test produces a mechanical result. They are applied to the specific facts: the actor's seniority, the scope of their authority, and the nature of the conduct.

There is also a distinct statutory provision in OFSI's regime for officers of bodies corporate. Where a corporate body commits a breach and an officer has consented, connived, or acted negligently in relation to it, that officer can face personal liability alongside the company. This provision creates a direct line from a corporate breach to individual enforcement, and it is among the points we address earliest when advising groups under inquiry.

Parallel to the civil regime, criminal liability for sanctions offences is prosecuted by the Crown Prosecution Service. OFSI can refer a matter for criminal consideration. The criminal standard requires knowledge or reasonable cause to suspect, but the criminal exposure – including imprisonment – is materially more severe. Managing the interaction between the civil investigation and any potential criminal referral is one of the most consequential decisions an advised business faces.

How does the attribution test apply in practice?

The attribution analysis begins by identifying which legal entity or entities had the relevant nexus to the prohibited transaction. "Nexus" here means being the counterparty, the payer, the recipient, the facilitator, or the provider of funds or economic resources. Once nexus is established, OFSI and, if relevant, a court or the tribunal, asks whose act it was – and whether that act is attributable to the entity under inquiry.

For large corporates, this typically proceeds through three layers. First, was the relevant employee or manager acting within the scope of their authority? Second, at what level of the organisation did they sit, and did their role carry responsibility for sanctions decisions? Third, was there a system or governance structure that should have prevented the act but failed to do so? Each layer informs not just attribution but also the aggravating or mitigating weight OFSI assigns to the breach.

Aggregation matters here in a different sense. Where multiple transactions or multiple entities are involved, OFSI may assess each occurrence as a separate breach. A group that has conducted a series of payments that each individually cross the prohibited line can face a cumulative penalty position that is substantially larger than any single transaction would suggest. In our cross-border practice, we map every transaction in the alleged period before the first substantive engagement with OFSI, so the total exposure is known before any representations are made.

Documentation is the practical linchpin. OFSI's investigators will request transaction records, screening logs, escalation communications, and board or senior management materials. Where documentation is organised, complete, and consistent with a good-faith compliance posture, the evidential picture is materially better. Where records are absent, inconsistent, or – worse – altered after the fact, the attribution analysis tends to run against the business. UK sanctions records must be kept for five years, as currently in force; gaps in that record are themselves a negative indicator.

Cross-regime comparison: how does OFSI's approach differ from OFAC and the EU?

For a group with operations in the United States, the European Union, or both, attribution under OFSI does not operate in isolation. Each regime has its own corporate-liability logic, and the divergences are operationally significant.

Under OFAC, corporate liability also rests on a strict-liability basis for civil penalties. But OFAC's attribution analysis is shaped by its own guidance framework, which places substantial weight on whether the entity had knowledge or reason to know of the facts giving rise to the breach, and on the sophistication and apparent adequacy of the sanctions compliance programme. A business that can demonstrate a genuine, tested compliance programme before the OFAC breach tends to receive more favourable treatment in the penalty calculation, even under strict liability. Voluntary self-disclosure (a mechanism by which a business reports its own apparent violation to OFAC before the regulator discovers it) is a formally recognised mitigating factor under OFAC's Enforcement Guidelines, and it can reduce the penalty band applied.

The EU corporate-liability position is more varied because it depends on the Member State in which the breach is prosecuted; the applicable country regime will determine the specific civil and criminal consequences. What unifies the EU picture is the asset-freeze prohibition itself – EU Council regulations directly apply and extend to making funds or economic resources available directly or indirectly to or for the benefit of a listed person. Attribution of that conduct to a corporate entity follows national law. An EU directive on the criminalisation of sanctions violations sets minimum criminal standards, including maximum imprisonment terms of at least five years for serious offences and corporate fines expressed as a percentage of worldwide turnover, as currently in force.

Where two regimes both apply – for example, where a UK-based group has conducted a transaction that also has a US nexus – the stricter prohibition governs. A business cannot net out the less demanding regime against the more demanding one; it must satisfy both. We regularly advise groups on how to structure their representations and their compliance remediation so that the response to one regulator does not create an admission or an inconsistency that prejudices the position before another.

What are the key risk flags that suggest immediate counsel is needed?

Not every compliance concern rises to the level of an OFSI enforcement matter. But certain indicators, individually or in combination, signal that specialist corporate liability and attribution ofsi legal advice is the immediate priority rather than an internal review on existing resource.

The first and most urgent is receipt of an OFSI information request, a civil-investigation notice, or any other formal communication from the regulator. At that point the clock is running, document-preservation obligations attach, and every response carries evidential weight. The instinct to reply promptly and in full without legal review can close options that a structured response would have kept open.

The second is discovery by internal audit, external counsel on another matter, or a counterparty notification of a transaction that appears to have involved a designated person or entity. The question is no longer whether a breach occurred; it is whether the breach should be disclosed, and on what basis and timeline. OFSI operates a licensing regime with reporting obligations for "relevant firms", and voluntary disclosure is a mitigating factor in OFSI's enforcement approach. But the decision to self-disclose is legally consequential and should not be made without understanding how it interacts with any parallel criminal exposure.

The third is a change in the designated status of a counterparty, shareholder, or group entity that may have retroactive implications – designations take effect from publication and can catch transactions that were in flight before the compliance team saw the update. Have your screening systems flagged a retroactive match against a recent designation?

Fourth, and directly relevant to the cross-regime point, is a situation where a foreign regulator – OFAC, a European authority, or another national enforcement agency – has already initiated contact. In that scenario, the UK and foreign investigations interact, and the management of both requires a coordinated strategy.

A fifth indicator is a transaction involving a corporate structure in which one of the parties is more than 50 percent owned or controlled by a designated person, even where that party is not itself listed. The ownership and control test – the UK and EU concept by which a non-listed entity may still be caught through a listed person's ownership or control – applies independently of whether the beneficial owner appears on the UK Consolidated List. Failing to apply the test is itself an exposure, not a defence.

The myth that silence is safer than self-disclosure

A persistent belief among boards and compliance teams facing a potential OFSI breach is that doing nothing – taking no proactive step until the regulator contacts the business – is the lower-risk path. That belief is, in our experience, incorrect and sometimes seriously damaging.

OFSI operates a voluntary-disclosure framework that treats a proactive, well-documented disclosure as a mitigating factor. It also has investigative powers that do not depend on the business co-operating proactively; transaction data, correspondent-bank records, and Companies House filings are available to it without the business's assistance. When OFSI discovers an apparent breach through its own investigation rather than from the entity, the absence of a voluntary disclosure is an aggravating factor rather than a neutral one.

The calculation is more precise than "disclose versus stay silent." The question is whether the facts, if disclosed, produce a penalty that is materially lower than the penalty that would follow from a discovered breach; whether disclosure eliminates or reduces criminal referral risk; and whether the disclosure can be made in a form that preserves privilege and controls the evidential record. Those are analytical determinations that specialist counsel is best placed to make. Making them unilaterally, without a full picture of the relevant obligations and mitigating routes, is where businesses most often compound an initial problem.

This is a point on which the UK and US regimes converge. Under OFAC's Enforcement Guidelines, voluntary self-disclosure is a formally recognised mitigating factor. Under OFSI's current enforcement framework, it is similarly weighed. Neither regime guarantees an outcome, and neither can be made to do so. But the direction of the evidence is consistent: an early, well-prepared disclosure from a business that has remediated the failing tends to produce a better result than a discovered breach from a business that has not.

How Calder & Vance assists on corporate liability and attribution under OFSI

Our enforcement and investigations practice supports businesses at every stage of the OFSI attribution and liability cycle. We work with General Counsel, Chief Compliance Officers, and boards at the point where the immediate priority is to understand what exposure exists and what options remain.

In the pre-enforcement phase, we assess the conduct and map the attribution chain. We identify which entities and individuals within a group carry potential liability, review the transaction record, analyse the compliance structures in place at the time of the relevant conduct, and advise on whether voluntary disclosure is the appropriate route, and how to structure it if so. We prepare the disclosure package, manage the regulator's information requests, and coordinate across jurisdictions where OFAC, an EU authority, or another national regulator is also involved.

In the penalty phase, we prepare the formal representations to OFSI, engage on the penalty calculation and any aggravating or mitigating factors, and advise on whether a ministerial review or judicial review challenge is appropriate. We also advise officers and directors who face personal liability alongside the corporate entity.

In the remediation phase, we assist the business in redesigning its sanctions compliance programme to meet the standard OFSI and, where relevant, other regulators will expect to see demonstrated. That work – testing screening logic, mapping ownership and control structures, redesigning escalation and reporting channels, and training relevant staff – is both a genuine risk-reduction measure and an important element of any future penalty mitigation argument.

We act for multinationals, financial institutions, and exporters on sanctions and export-control matters across the major regimes. For a law firm for corporate liability and attribution under OFSI matters, cross-regime coverage under one instruction – UK, US, and EU counsel co-ordinated by a single team – materially reduces the co-ordination risk that arises when enforcement touches multiple regulators simultaneously.

In a recent matter, a financial institution operating across three jurisdictions identified a series of correspondent payments that appeared to involve an entity within the ownership structure of a designated person. We mapped the complete ownership chain, assessed attribution to each relevant legal entity, prepared a voluntary disclosure to OFSI, and co-ordinated the UK position with the business's response to its US and EU regulators. The matter was handled within a defined timeline, with representations addressing both the civil penalty and the criminal-referral question. No outcome guarantee is given or implied; what the process illustrated is the importance of early, integrated advice before any communication is sent to the regulator.

Related practices

• Criminal liability for sanctions breaches under OFSI – advising on the criminal dimension of OFSI enforcement, including referral risk and defence
• Early account and settlement in Australia – guidance on the early account and settlement process under the Australian autonomous sanctions regime
• Early account and settlement in the EU – advising on disclosure and settlement approaches under EU sanctions enforcement

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.