A UK-based financial institution processes a payment. A routine post-transaction review flags the beneficiary's parent company as a designated person under OFSI (His Majesty's Treasury's Office of Financial Sanctions Implementation, the UK authority responsible for financial-sanctions enforcement). The transaction is done. The funds have moved. What happens next?
Once a potential breach of UK financial sanctions has occurred, enforcement risk after a breach under OFSI is real and immediate. OFSI holds powers to impose monetary penalties, refer matters for criminal prosecution, and publish details of enforcement action. The governing legislation is the Sanctions and Anti-Money Laundering Act 2018 ("SAMLA") and the relevant thematic sanctions regulations made under it. As of April 2026, OFSI operates a two-tier civil monetary penalty regime, and the obligation to report a known or suspected breach arises without delay.
This page sets out how OFSI's enforcement process works, where it diverges from the OFAC and EU positions, what the key risk flags are, and how Calder & Vance assists businesses and individuals working through the aftermath of a potential sanctions breach.
What does OFSI's enforcement regime cover?
OFSI's mandate runs to any person in the United Kingdom, any UK national or entity acting abroad, and any conduct that touches a UK nexus – including sterling payments cleared through UK correspondent banks. The relevant thematic sanctions regulations translate Security Council measures and UK autonomous designations into directly enforceable prohibitions: dealing with the funds or economic resources of a designated person, making funds or economic resources available, and circumventing those prohibitions.
The regime is strict-liability for the civil penalty. OFSI does not need to prove that a firm intended to breach. It must show only that the person knew, or had reasonable cause to suspect, that they were dealing with a designated person's assets. That test is lower than wilful intent and higher than pure inadvertence. Where the standard is met, the question moves immediately from liability to penalty.
OFSI also exercises a broader compliance function: it publishes guidance, issues licences, and receives voluntary reports. Those functions are not separate from enforcement. A firm's cooperation, the quality of its compliance programme, and its prompt engagement with OFSI all feed directly into the penalty calculation. In our experience, businesses that treat the reporting obligation as an opportunity to frame the narrative – rather than a burden to delay – consistently achieve more favourable outcomes.
What is the two-tier civil monetary penalty structure?
OFSI's civil monetary penalty regime operates at two levels, determined by the gravity of the breach. The lower tier applies where a breach is established but falls short of the higher threshold. The upper tier applies where OFSI is satisfied that the person knew or had reasonable cause to suspect the breach at the time of the conduct.
At the upper tier, the maximum penalty is the greater of a fixed statutory ceiling or a percentage of the value of the breach. OFSI's published enforcement guidance sets out the factors it weighs: the severity and duration of the conduct, the extent of any financial benefit, the degree of cooperation or obstruction, the quality of the firm's compliance programme, and whether a voluntary self-disclosure was made. None of these factors is determinative alone. The combination produces a penalty figure that OFSI then tests against a proportionality standard before issuing.
A voluntary self-disclosure at the right moment – and presented correctly – can shift the calculation substantially. It signals cooperation, it frames the facts before OFSI constructs its own account, and it brings the matter within OFSI's published policy of treating proactive disclosure as a mitigating factor. It is not a guarantee of reduced penalty. It is, however, among the most reliable tools available to a business in the days immediately after a breach is identified.
Do you know whether your breach triggers the upper tier or the lower? That question should be answered before any contact with OFSI, not after.
The position above covers the standard civil enforcement pathway. Your facts – the asset value involved, the counterparty type, the screening controls in place, the jurisdiction of the entity – change the analysis. For an assessment of your exposure and the most effective response, contact Calder & Vance at info@caldervance.com.
How does the OFSI reporting obligation work?
The reporting obligation bites on any person who knows or has reasonable cause to suspect that a person is a designated person, or has committed an offence under the relevant thematic regulations, and the information on which that knowledge or suspicion is based came to them in the course of a business. The obligation runs to OFSI and the report must be made as soon as practicable.
There is no grace period of defined length in which a business may conduct a full internal investigation before reporting. "As soon as practicable" is measured from the point at which the knowledge or suspicion arises – not from when the internal review is complete. In practice, this creates a tension between the obligation to report promptly and the practical need to understand what has happened before committing to a position. Managing that tension is one of the central tasks of post-breach legal advice.
A report to OFSI does not resolve the enforcement risk. It opens a dialogue. OFSI will typically acknowledge receipt, may request further information, and may open a formal investigation. The report is therefore the beginning of a managed process, not a transaction that closes the matter. The framing of the initial report – what it says, what it does not say, and how it characterises the firm's conduct and controls – matters more than most compliance teams expect.
How does OFSI's approach compare with OFAC and EU enforcement?
For any business with operations across the Atlantic or within the European Union, the OFSI breach does not exist in isolation. The same transaction that triggers OFSI exposure may simultaneously engage OFAC jurisdiction over a US-nexus payment, or EU sanctions jurisdiction over a subsidiary incorporated in a Member State. The analysis of cross-border exposure must run in parallel, not in sequence.
OFAC's enforcement framework shares a voluntary self-disclosure mechanism with OFSI, and OFAC's published guidance also treats a VSD (voluntary self-disclosure to a regulator) as a significant mitigating factor. However, OFAC's penalty base and its aggravating/mitigating factors differ materially from OFSI's. OFAC applies an IEEPA-derived regime with per-transaction statutory maximums that can be very large. OFSI operates on a proportionality model tied to the value of the breach. A business that has already filed a VSD with OFAC should not assume that an equivalent UK report to OFSI is covered.
The EU presents a further divergence. Enforcement of EU sanctions is a matter for each Member State's competent authority. Penalties, procedural timelines, and the weight given to voluntary disclosure vary significantly across the EU. A breach involving an EU subsidiary or an EU-routed payment requires a jurisdiction-by-jurisdiction analysis. We coordinate with local counsel in the relevant jurisdiction to ensure that the EU response is consistent with the UK filing rather than inadvertently contradicting it.
The UAE, Singapore, and Japanese regimes add a further layer for businesses with operations in those markets. Each operates its own designated-person lists and its own enforcement posture. Where a transaction touches multiple regimes simultaneously, the strictest applicable prohibition governs the analysis. Understanding which regime bites hardest is a prerequisite to sequencing the response correctly.
What are the principal risk flags after a breach?
Not every potential breach carries the same enforcement risk. The factors that elevate exposure are, in our experience, consistent across the matters we handle – and identifying them early determines the entire response strategy.
- High transaction value. The penalty base under OFSI's upper tier scales with the value of the breach. A large-value transaction that breaches sanctions attracts proportionately larger maximum penalties. Quantifying the exposure before approaching OFSI is essential.
- Repeated or pattern conduct. A single isolated transaction presents differently to OFSI than a series of payments over months. Pattern conduct suggests systemic control failure rather than a one-off gap.
- Absence of a compliance programme. OFSI's enforcement guidance treats the quality of the firm's programme as a mitigating or aggravating factor. A business with no screening protocol, or one that existed only on paper, starts from a weaker position.
- Delay in reporting. A firm that discovers a breach and takes weeks to report – without a documented reason for the delay – hands OFSI an aggravating factor it would otherwise not have.
- Senior management involvement. Where the evidence shows that a senior officer approved or directed the transaction, the enforcement risk extends beyond the firm to the individual.
- Obstruction or inconsistency. Providing OFSI with information that later proves incorrect, even unintentionally, can escalate a civil matter toward a criminal referral.
- Concurrent criminal exposure. The same conduct that supports a civil penalty can support a criminal prosecution under SAMLA. Where the transaction is large, deliberate, or involves senior personnel, criminal risk should be assessed at the same time as the civil exposure.
Have you run a full internal review against these factors before deciding how and when to contact OFSI? The sequence matters.
If a transaction has already been flagged internally, or OFSI has made contact, an early review can preserve options that narrow with time. Contact Calder & Vance at info@caldervance.com to discuss the position before committing to a course of action.
Addressing a common misconception: "we will self-disclose and the matter will close"
A persistent assumption among in-house teams is that a voluntary self-disclosure to OFSI operates like a settlement – that it closes the enforcement file in exchange for a reduced penalty. It does not.
A VSD is a mitigating factor in OFSI's published penalty guidance. It is not a resolution mechanism, a formal settlement process, or a guarantee of any particular outcome. OFSI retains full discretion to investigate further, to issue a penalty at any level it considers proportionate (including at the upper tier despite the VSD), and to refer the matter for criminal prosecution where the facts support it. We regularly advise clients who have submitted a VSD without legal input and have subsequently received a formal investigation notice. The disclosure itself was correct. The manner of it – what was said, what context was provided, what was omitted – complicated the matter.
A VSD prepared with counsel, timed correctly, and framed around the firm's genuine cooperation and control improvements is a materially different document from one prepared under urgency without legal review. Both are called a voluntary self-disclosure. Only one performs as intended.
How Calder & Vance assists on post-breach OFSI enforcement risk
Our Enforcement & Investigations practice handles the full range of post-breach work under OFSI's regime. We act from the point of internal discovery through to the resolution of any OFSI investigation, and we coordinate the cross-border response where OFAC, EU, or other regimes are simultaneously engaged.
In a recent matter, a financial services firm discovered that a series of payments had been processed for a corporate whose controlling shareholder was a designated person under the relevant thematic sanctions regulations. The breach had occurred across several months. We assessed the exposure, scoped the conduct, advised on the reporting obligation, and prepared the voluntary self-disclosure. We then managed OFSI's information requests through the investigation phase. The matter resolved at the civil level without criminal referral.
Our work typically includes:
- Scoping the apparent violation: identifying what conduct occurred, under which prohibition, and the regulatory standard applicable to the facts;
- Assessing the civil and criminal exposure in parallel across OFSI, OFAC, and EU where relevant;
- Advising on the reporting obligation – timing, content, and the relationship between the UK report and any parallel disclosure in another jurisdiction;
- Preparing the voluntary self-disclosure: structure, factual account, and the compliance narrative;
- Representing the firm through OFSI's investigation: responding to information notices, managing the regulator's queries, and where necessary preparing a penalty defence;
- Advising individuals where personal criminal exposure arises alongside the firm's civil risk;
- Designing and implementing the remediation programme to address the control failures that OFSI will expect to see corrected.
Our cross-regime coverage – OFSI and ECJU in the UK, OFAC and BIS in the United States, the EU Council regulations and Member State enforcement, and the regimes of the UAE, Singapore, and Japan – means that the UK response is designed with the full international picture in view from the outset.
Related practices
- EU apparent violation assessment – scoping and responding to potential breaches under EU sanctions
- Post-breach enforcement risk – UAE – enforcement risk assessment and response under UAE sanctions
- Post-breach remediation – BIS/EAR – remediation and disclosure under US export controls