Criminal liability for sanctions breaches under OFSI: legal support

A financial institution receives a letter from the Office of Financial Sanctions Implementation. The inquiry is framed as a review. But behind the civil-penalty questions sits a harder possibility: could the conduct amount to a criminal offence under the UK sanctions regime? That question demands a different quality of legal response – and the window to shape the outcome narrows quickly.

Criminal liability for sanctions breaches under OFSI arises where a person knowingly or intentionally contravenes a financial-sanctions prohibition. The criminal standard is higher than the strict-liability civil test, but the consequences are categorically more serious. Under the Sanctions and Anti-Money Laundering Act (SAMLA) and the relevant thematic regulations, a conviction can result in a custodial sentence, an unlimited fine, and – for a business – reputational damage that civil penalties cannot match.

This page explains the scope of OFSI criminal enforcement, the procedure from initial inquiry through to charging decisions, how the UK position compares with OFAC and EU criminal exposure, the practical risk flags that escalate a matter, and how Calder & Vance supports businesses and individuals facing that exposure. As of January 2026, OFSI's enforcement posture has sharpened, and the question of whether a matter is civil, criminal, or both is live from the first contact.

What conduct falls within the criminal liability regime under OFSI?

Criminal liability under the UK financial-sanctions regime attaches to conduct that is both prohibited by the relevant thematic regulations and done knowingly or intentionally. Unlike OFSI's civil monetary-penalty power – which operates on a strict-liability basis, requiring no proof of knowledge – the criminal standard demands that prosecutors establish a mental element. That distinction is foundational: a business that processes a transaction through administrative error may face a civil penalty; a business that makes a deliberate choice to deal with a designated person faces a criminal investigation.

The relevant prohibitions cover a wide class of conduct. Making funds or economic resources available to a designated person is prohibited. So is participating, knowingly and deliberately, in activities whose object or effect is to circumvent those prohibitions. The reporting obligation also has a criminal dimension: a regulated firm that knows or suspects it holds funds belonging to a designated person and fails to report that knowledge to OFSI commits a separate offence. Each element is analysed on its own; a business may clear one and still be exposed on another.

In our experience, the cases that escalate to criminal referral are rarely those involving a single, isolated transaction. They tend to involve a pattern: repeated dealings, internal documentation showing awareness, compliance failures that senior management were told about but did not correct. The presence of internal records – emails, risk assessments, board papers – is therefore both a vulnerability and a potential asset, depending on what they show.

How does the criminal enforcement process work in practice?

OFSI conducts the initial investigation under its civil and criminal powers concurrently. An enforcement inquiry does not arrive labelled "civil" or "criminal"; the same set of facts may support either outcome, and OFSI regularly pursues the parallel track. The practical consequence is that any response to an OFSI inquiry must be prepared as if criminal exposure is on the table, even when the letter does not say so explicitly.

The process typically runs in defined phases. OFSI issues an information-gathering notice or a request for voluntary disclosure. The recipient's response – what it says, what it produces, and how promptly it acts – shapes OFSI's assessment of whether the matter is egregious and whether voluntary disclosure credit applies. OFSI then makes an internal referral decision: civil penalty only, referral to the Crown Prosecution Service (CPS) or His Majesty's Revenue and Customs (HMRC) for criminal consideration, or both. That decision is not published, but it is influenced by the quality and candour of cooperation.

Where criminal prosecution is pursued, the case follows the standard Crown Court or magistrates' court route depending on seriousness. OFSI does not prosecute directly: it investigates and refers. The CPS and HMRC each have roles depending on the nature of the breach. For businesses, the Proceeds of Crime Act consequences – confiscation orders, civil recovery – can layer on top of a criminal conviction and extend the financial exposure well beyond the original transaction value.

Timing matters. Blocked-property and rejected-transaction reports are required within a defined statutory window after the triggering event. Missing that deadline is itself an offence. A business that identifies a potential breach and delays its response while waiting to understand the scale of exposure may, paradoxically, be deepening it.

What is in scope, and what falls outside the criminal threshold?

The criminal regime applies to persons subject to UK jurisdiction: UK-incorporated entities, their branches wherever located, and individuals in the United Kingdom. It also reaches non-UK persons in certain circumstances where conduct takes place in the United Kingdom or has a UK nexus. The threshold question is therefore not only what happened, but who the legal entity is and where the transaction touched the UK.

Pure administrative failures – a screening tool that did not flag a name, an ownership chain that was not traced, an automated payment that cleared before a designation was loaded – will typically be assessed under the civil-penalty regime rather than the criminal one. OFSI's revised guidance, current as of early 2026, sets out factors that push toward criminal referral: evidence of intent, suppression of records, deliberate structuring of transactions to avoid the designation, and conduct by a person who had been warned previously.

It is worth noting that the criminal threshold does not require proof that the designated person actually benefited. The offence is complete on the dealing, not on the downstream effect. A business that transfers funds to an account it knows to be associated with a designated person commits the offence even if those funds are subsequently frozen elsewhere. That is a significant trap for firms managing payments across multiple jurisdictions in real time.

How does OFSI criminal exposure compare with OFAC and the EU?

A business operating across the Atlantic faces different criminal regimes with meaningful differences in scope, mental-element requirements, and penalty ranges. Understanding the cross-border picture is not optional: a transaction that generates both OFAC and OFSI exposure must be managed as a multi-regime problem from the outset.

Under OFAC, criminal violations under IEEPA require willfulness. The standard is demanding, but OFAC's civil-penalty regime – which does not require intent – is itself severe. The statute of limitations for civil and criminal violations under IEEPA and the Trading with the Enemy Act was extended to 10 years as of 2024, materially increasing the period during which a historic transaction can generate exposure. US criminal prosecutions have historically followed the most egregious cases: sustained dealing, senior-level authorisation, and concealment. That pattern is not uniform, and the direction of US enforcement travel is toward broader criminal engagement, not narrower.

Under EU law, a Directive on the criminalisation of sanctions violations has established minimum standards across Member States: maximum terms of at least five years' imprisonment for the most serious offences, with corporate fines expressed as a percentage of worldwide turnover. Member States were required to transpose that Directive by May 2025; enforcement and transposition continued into 2026. The practical implication for a business operating in both the UK and the EU is that a single transaction may generate parallel criminal inquiries in different jurisdictions, each with its own mental-element requirements, procedural rules, and disclosure obligations. Where two regimes both apply, the stricter prohibition governs, and the firm must account for both tracks simultaneously.

We regularly advise businesses that identify a potential breach across multiple regimes, and the sequencing of voluntary disclosure – whether to OFSI, to OFAC, or to both – is one of the most consequential tactical decisions in any enforcement matter. Missteps in that sequence can compromise privilege, waive procedural protections, or trigger a more aggressive response from a regulator that learns of the matter from a counterpart rather than from the business itself.

What are the principal risk flags that escalate civil matters toward criminal referral?

Several characteristics, taken individually or in combination, distinguish a matter likely to resolve as a civil penalty from one that generates a criminal referral. Early identification of these flags – before engaging with OFSI – is among the most valuable services specialist counsel can provide.

• Evidence of knowledge or intent. Internal communications showing that relevant personnel knew about the designated status of a counterparty, or knew about the designation and continued to deal, are the single strongest escalating factor. Preservation – and early review – of the internal record is therefore a priority from the moment exposure is identified.
• Pattern of conduct. A single transaction is different from a programme of dealing. Where OFSI identifies multiple transactions, multiple counterparties, or a sustained commercial relationship with a designated person or entity, the pattern itself is an aggravating feature.
• Deliberate structuring or obfuscation. Any suggestion that a transaction was structured to avoid triggering a sanctions screen, or that records were altered or withheld after a concern was raised, moves a matter from civil into criminal territory with significant speed.
• Failure to report. A business with a reporting obligation that identifies a problem and does not report it within the statutory window has compounded its exposure. The failure-to-report offence sits alongside the dealing offence and is assessed separately.
• Senior management involvement. Where board-level or senior executive awareness of a breach can be shown, the business faces both criminal liability for the offence itself and the personal criminal exposure of the individuals involved.
• Prior enforcement history. A business that has received an OFSI enforcement decision previously, and then commits a further breach, is in a materially worse position. OFSI's current guidance treats recidivism as a significant aggravating factor.

The myth that staying silent is safer than self-disclosing is one we encounter regularly. It is wrong. OFSI's revised enforcement guidance, current as of early 2026, gives credit for voluntary self-disclosure as a mitigating factor. Voluntary self-disclosure (a disclosure made to OFSI before the regulator is otherwise aware of the breach) is recognised in the guidance and is consistent with the longstanding position under OFAC's Enforcement Guidelines. Silence, by contrast, provides no credit and – if OFSI discovers the breach through its own inquiries or a third-party report – becomes a feature of the case against the business.

When should a business instruct specialist counsel?

Specialist counsel should be instructed before a business responds to any OFSI inquiry, not after. The first response to OFSI shapes the entire trajectory of a matter. A response that is candid, structured, and legally privileged is categorically different from an unadvised response that makes concessions, waives privilege, or fails to raise available defences.

The triggers for immediate instruction are clear. If a business has received a letter from OFSI – whether an information request, a notice of investigation, or a request for voluntary disclosure – it needs counsel with specific OFSI enforcement experience, not general corporate law advice. If a business has identified a potential breach and is deciding whether to self-disclose, it needs a privileged assessment of the exposure before that decision is made. And if a business is facing parallel inquiries – OFSI and OFAC, or OFSI and a Member State authority – it needs counsel who can manage the multi-regime sequencing.

In a recent matter, a financial institution identified a series of transactions that had processed through its correspondent network to an account associated with a designated person. The question was whether to self-disclose to OFSI, to OFAC, or to both, and in what order. We assessed the criminal exposure under both regimes, identified the jurisdiction in which the primary risk lay, prepared a disclosure that was candid and legally privileged, and managed OFSI's subsequent inquiry. The matter resolved without criminal referral. That outcome was not guaranteed – it never is – but the early intervention preserved options that would not have been available had the business waited.

The position above covers the standard pattern. Your specific facts – the nature of the transaction, the identity of the counterparty, the internal documentation, the regime in play, and the cross-border dimension – will change the analysis. An early privileged review is the only way to know which track you are on.

If a matter has already been flagged, or OFSI has already made contact, the window for voluntary disclosure credit may still be open. It will not remain open indefinitely.

To discuss your position with an OFSI enforcement specialist, contact Calder & Vance at info@caldervance.com.

What does Calder & Vance do in an OFSI criminal-liability matter?

Our Enforcement & Investigations practice covers the full arc of an OFSI matter with criminal dimensions. We act for multinationals, financial institutions, and exporters on sanctions and export-control matters across the major regimes.

In scope for criminal-liability matters under OFSI, our work includes the following:

• Exposure assessment. We scope the apparent violation, identify the criminal and civil dimensions, and advise on the realistic range of outcomes. That assessment is conducted under privilege and is structured to be non-disclosable without the client's consent.
• Voluntary self-disclosure. Where disclosure is appropriate, we prepare the disclosure, manage OFSI's queries, and position the submission to attract maximum mitigation credit. We handle parallel disclosure to OFAC, EU Member State authorities, or other relevant regulators where the matter has a cross-border dimension.
• Investigation response. Where OFSI has opened a formal inquiry, we manage the information-production process, advise on the scope of any privilege claim, and prepare the business's formal response.
• Penalty defence and settlement. We prepare representations against a draft monetary penalty decision and manage the settlement process, including early account and voluntary disclosure discounts as available under current guidance.
• Criminal-proceedings support. Where OFSI refers a matter to the CPS or HMRC, we coordinate with criminal-defence counsel, manage the civil and criminal tracks concurrently, and advise on the procedural interactions between them.
• Regulatory relationship management. For businesses with ongoing OFSI exposure – because of sector, geography, or transaction type – we design the engagement strategy and manage the relationship with the regulator over time.

We also advise on the parallel EU and OFAC dimensions that frequently arise in the same matter. A business that believes its problem is a UK-only issue often discovers, on proper analysis, that it has US or EU exposure as well. Our cross-regime coverage means that analysis is done once, consistently, by a team that understands all three tracks.

Related practices:

• Corporate liability and attribution under OFSI – how corporate criminal responsibility is assessed and attributed under the UK financial-sanctions regime.
• Early account and settlement – Australia – the early account and settlement options available under the Australian autonomous-sanctions enforcement regime.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.