A UK-headquartered trading group receives a routine internal audit query: has its sanctions screening been calibrated correctly since OFSI updated its enforcement guidance? The compliance team suspects gaps in the ownership-and-control mapping but cannot quantify the exposure. A voluntary disclosure window may already be running. Decisions taken in the next few days will shape whether this becomes a minor file-review or a formal enforcement matter.
Compliance audit and testing under OFSI – the UK's Office of Financial Sanctions Implementation – is the structured process by which a business tests its financial-sanctions controls against the legal standard OFSI applies when assessing whether a breach has occurred and whether it warrants a civil monetary penalty. The governing legislation is the Sanctions and Anti-Money Laundering Act ("SAMLA") and the relevant thematic UK sanctions regulations made under it. Done properly, an audit produces a documented record that can reduce penalty exposure, support a voluntary self-disclosure ("VSD"), or demonstrate good-faith compliance to OFSI during an investigation.
This page explains what an OFSI compliance audit covers, how the testing methodology maps against OFSI's enforcement guidance, where the cross-border dimensions – OFAC, the EU, and others – complicate the picture, and how Calder & Vance structures an engagement for a client at any stage of the process.
What does an OFSI compliance audit cover?
An OFSI compliance audit assesses a business's financial-sanctions controls against the obligations that arise under SAMLA and the applicable thematic UK sanctions regulations. The audit typically covers screening systems, ownership-and-control analysis, transaction monitoring, licensing procedures, reporting workflows, and record-keeping – the full chain from counterparty identification to post-transaction review.
OFSI has published enforcement guidance that sets out the factors it weighs when deciding whether to impose a civil monetary penalty and at what level. Those factors include the quality of a firm's compliance programme, whether the breach was identified internally or externally, and whether a VSD was made promptly. An audit structured around those factors produces findings that are directly useful in any future dialogue with OFSI. In our experience, firms that commission a purpose-built audit – one that mirrors OFSI's own assessment criteria – are better placed to demonstrate a positive compliance posture than those that rely on a generic controls review.
The scope typically divides into three workstreams. The first is legal-standard mapping: identifying every prohibition that applies to the business, including asset-freeze obligations, financial services restrictions, and trade-finance controls. The second is control testing: stress-testing the screening system against known designations, variant spellings, and aggregated ownership chains. The third is gap analysis: documenting where controls fall short and recommending a prioritised remediation plan.
What triggers an audit? Regulatory scrutiny is the most common prompt – a query from OFSI, a suspicious-activity report, or a correspondent bank's request for evidence of controls. Transactional pressure is another: a counterparty due-diligence questionnaire, an M&A process, or a new business line touching a higher-risk market. Some clients commission periodic audits on a fixed schedule as part of their broader risk-governance cycle.
The legal standard OFSI applies – and why it matters for testing design
OFSI's civil monetary penalty regime operates on a "reasonable grounds to suspect" standard for strict-liability penalties, and OFSI's enforcement guidance makes clear that the quality of a firm's compliance programme is a significant mitigating factor. Any testing methodology that does not map to those specific criteria will miss the most important dimension of the exercise.
The ownership-and-control test under UK sanctions regulations asks whether a designated person owns or controls the entity in question. Ownership and control (the UK and EU test for whether a non-listed entity is caught through a listed person) is assessed by OFSI by reference to both formal shareholding and effective control – the ability to direct the entity's affairs through board composition, voting arrangements, or contractual rights. This is a broader test than the US position. Under OFAC's rules, the trigger is mechanical ownership of 50 percent or more in the aggregate. Under OFSI and in the EU, a person can be "controlled" even at a sub-majority stake if they direct the entity's commercial or financial conduct.
That divergence matters for testing design. A screening tool calibrated purely to the OFAC 50 percent threshold will not catch entities that OFSI considers controlled by a designated person at a lower stake. The audit must therefore include a qualitative control-assessment layer that looks beyond shareholding percentages. In our experience, this gap is one of the most frequently identified findings when we review the screening methodologies of firms that operate in both the US and UK markets.
Record-keeping obligations under the UK sanctions regime require firms to maintain documentation of compliance decisions for a defined period. Verify the current record-keeping period applicable to your business before relying on any general statement; OFSI's guidance should be taken as the primary reference. An audit must confirm not only that records exist but that they are sufficient in content to support a compliance defence or a VSD submission.
The position above covers the standard case. Your facts – the sector you operate in, the counterparties you screen, the thematic regulations that apply to your business, and whether a potential breach has already occurred – change the analysis significantly. For a structured assessment of where your controls stand against OFSI's enforcement criteria, contact Calder & Vance at info@caldervance.com.
How does the audit process work in practice?
A structured OFSI compliance audit runs through four sequential phases, each with defined outputs that can be used in a regulatory submission or presented to a board risk committee.
Phase 1 – Scoping and legal mapping. We identify the thematic UK sanctions regulations applicable to the business (financial services, trade, transport, or others), confirm the designated-person lists that the screening system must cover, and map the regulatory obligations specific to the client's sector. Scoping typically takes three to five business days for a firm with a defined product set and counterparty base.
Phase 2 – Control documentation review. We examine the compliance policy, the screening configuration, the ownership-tracing methodology, the licensing log, the escalation protocols, and the training records. This is a documentation audit, not yet an operational test. The output is a control inventory that identifies what exists, what is missing, and what is documented but not functioning as described.
Phase 3 – Operational testing. We run structured test scenarios through the screening system: designated individuals and entities in clear cases, variant spellings, transliterations, and partial matches. We also run ownership-chain scenarios – testing whether the system flags an entity that a designated person controls below the 50 percent ownership line but at a level that OFSI's control test would catch. Test results are recorded in a format suitable for disclosure to OFSI if required.
Phase 4 – Findings and remediation plan. We produce a written report that maps each finding to the relevant OFSI enforcement factor, rates the severity, and proposes a prioritised remediation sequence. For clients with an active regulatory matter, the report is structured as privileged legal advice. For clients using the audit as a routine governance tool, it can be formatted as a board-ready compliance assessment.
Timeline for a full four-phase audit typically runs four to eight weeks for a mid-sized firm, depending on the complexity of the ownership chains, the number of business lines in scope, and whether a regulatory matter is already live. Where urgency requires it – a correspondent bank demand or an imminent OFSI enquiry – we can compress the critical path.
Cross-border dimensions: where OFAC, EU, and other regimes interact with OFSI
A UK firm whose counterparties or transactions also touch the United States, the EU, or another major sanctions jurisdiction faces overlapping compliance obligations that an OFSI-only audit will not capture. The cross-border dimension is not peripheral; it is often where the highest-severity exposure sits.
OFAC's secondary-sanctions reach means that a non-US firm conducting activity in a third-country market can face US penalties even without a US nexus in the traditional sense. A compliance audit that addresses only OFSI's reach will leave a firm blind to that exposure. We integrate an OFAC-dimension check into every cross-border audit – mapping the client's transaction flows against the US primary and secondary-sanctions programmes that overlap with the UK regime – and we identify where the "stricter prohibition governs" principle applies. Where two regimes cover the same transaction, the obligation that is more restrictive takes precedence for the firm that is subject to both.
The EU sanctions regime, administered through Council regulations, applies a control test broadly similar to OFSI's but with procedural differences in how it is assessed and documented. For a UK firm with a European subsidiary or a European counterparty, the audit must address both sets of obligations. The EU General Court has developed a body of annulment-action case law that gives guidance on how control is assessed when a designated person's influence is exercised through indirect or informal means; that practice informs the qualitative layer of our EU-dimension testing.
For firms with exposure to the Singapore, Australian, or UAE regimes – whether through trade flows, fund structures, or holding-company chains – the relevant national instruments add further layers. Singapore's Monetary Authority applies its own asset-freeze and prohibition regime. Australia's DFAT administers an autonomous sanctions regime with thematic regulations that are, in certain respects, broader than the UN Consolidated List requirements. We map those exposures where they are material and flag them as a distinct finding in the audit report.
If a transaction has already been flagged across multiple regimes, or a filing in one jurisdiction has prompted enquiries in another, an early cross-border review can preserve options that narrow with time. Contact Calder & Vance at info@caldervance.com to discuss a multi-regime compliance review.
Risk flags: when a compliance audit becomes urgent
Certain indicators signal that a compliance audit has moved from a good-governance exercise to an urgent legal matter. Recognising them early is the single most important factor in preserving a firm's options.
The first and most serious indicator is a known or suspected breach. If a transaction has been processed that involved a designated person or a blocked asset, the clock on a VSD begins running. OFSI's enforcement guidance treats the promptness of a VSD as a significant mitigating factor. A VSD that follows an audit-driven breach identification, submitted with a complete account of the facts and a credible remediation plan, sits in a materially better position than one forced by an external discovery. We assist clients in scoping the apparent violation, advising on whether and when a VSD is appropriate, and preparing the submission to OFSI.
The second indicator is a correspondent-bank or counterparty demand for evidence of controls. Banks de-risking their correspondent networks have become increasingly specific in what they require: documented screening methodology, ownership-tracing evidence, and assurance that the control testing is current. A compliance audit produces exactly that documentation. In our experience, firms that can produce a recent, professionally structured audit report resolve correspondent-bank queries faster and with less disruption to their payment flows.
The third indicator is an ownership chain that has changed – through an acquisition, a restructuring, or a new shareholder – without a corresponding review of the sanctions implications. The ownership and control analysis must be updated when the facts change. A dormant risk in an unchanged structure can become a live breach the moment the structure changes if no one re-runs the analysis.
A fourth risk flag is sector-specific: financial institutions, payment firms, and virtual-asset service providers (VASPs – businesses that exchange, transfer, or hold crypto-assets on behalf of clients) are subject to heightened OFSI scrutiny and have additional reporting obligations under the applicable UK regulations. An audit for a firm in one of these sectors must address the specific control expectations OFSI applies to that sector, which go beyond the baseline required of a non-financial business.
Is your screening system tested against the ownership-chain scenarios that OFSI's control test requires? If the answer is uncertain, the gap is worth closing before it becomes a regulatory question.
Common myths and the position our audit corrects
The most persistent myth we encounter is that a general AML compliance audit covers the sanctions obligations too. It does not. Anti-money-laundering controls and financial-sanctions controls share some common infrastructure – both use screening systems, both require customer due diligence – but they test for different things, are administered by different regulators, and carry different penalty regimes. OFSI enforces financial sanctions; the Financial Conduct Authority and the Prudential Regulation Authority enforce AML. An AML audit finding of "no issues" gives no assurance whatever about the adequacy of the firm's OFSI compliance.
A second myth is that only large financial institutions need a structured OFSI compliance audit. OFSI's civil monetary penalty regime applies to any person subject to UK financial sanctions, regardless of size or sector. A mid-market trading company, a freight forwarder, an asset manager with a smaller fund, or a professional-services firm providing advice to a client in a restricted sector can all face OFSI enforcement. The obligation is not scaled to the firm's size; only the proportionality assessment within OFSI's penalty discretion reflects size.
A third myth is that because the UK left the EU, EU sanctions are no longer relevant to UK businesses. The UK maintains its own sanctions regime under SAMLA, which replicates much but not all of the EU position. UK firms with EU group entities, EU counterparties, or EU-origin goods remain subject to EU Council regulations through those connections. The two regimes diverge in their list compositions, their licensing categories, and their enforcement postures. An OFSI audit that ignores the EU dimension is incomplete for any firm with a cross-border footprint.
How Calder & Vance structures the engagement
Henry Ashworth leads Calder & Vance's UK sanctions and export-control practice and structures compliance audit engagements around a clear scope, a defined output, and transparent pricing. We do not offer open-ended retainers where the audit scope drifts; each engagement is defined at the outset with a written scope letter that sets out what will be tested, what will be reported, and what privilege protections apply.
For the engagement, we assess eligibility for legal professional privilege at the outset and structure the work accordingly – which matters if a regulatory matter is live or foreseeable. We prepare and submit VSDs where they are warranted, and we manage OFSI's queries through the process. For firms that want ongoing assurance rather than a single-point audit, we design a periodic testing programme with agreed review intervals and a fixed-fee structure for each cycle.
In a recent matter, a mid-sized financial services firm in the UK identified a potential OFSI concern through an internal alert that had not been escalated correctly. We scoped the apparent exposure, conducted a targeted ownership-and-control analysis of the counterparty chain, advised on the VSD question, and redesigned the firm's escalation protocols to close the gap. The matter was resolved through a structured engagement with OFSI with a complete documentary record supporting the firm's compliance posture.
We regularly advise firms at different points in this cycle – some before any regulatory contact, some mid-investigation, and some at the point of receiving an OFSI penalty notice. The earlier we are involved, the wider the range of options available. Our practice covers the UK, US, EU, and the other major regimes from one team, which means the cross-border audit dimension does not require co-ordination delays with separate advisers.
Related practices
- Compliance audit and testing – Australia – testing DFAT sanctions controls and autonomous-regime obligations for businesses with Australian exposure.
- Compliance audit and testing – Singapore – assessing MAS financial-sanctions controls for firms operating in or through Singapore.
- Compliance audit and testing – UN sanctions – mapping compliance obligations under the UN Consolidated List and Security Council measures for multi-regime businesses.