Guide
UK sanctions compliance for businesses
How to comply with UK financial sanctions. Includes OFSI enforcement powers, asset freeze requirements, screening obligations, breach reporting, licensing procedures, and major sanctions regimes.
UK businesses must comply with financial sanctions administered by the Office of Financial Sanctions Implementation (OFSI), part of HM Treasury. Sanctions restrict dealings with designated persons, entities, and countries to support UK foreign policy and national security objectives.
Who must comply:
- UK persons - UK nationals, UK registered businesses, UK residents (anywhere in the world)
- Anyone in the UK - Foreign nationals and businesses operating in the UK
- UK-connected conduct - Activities using UK infrastructure, services, or carried out in UK territorial waters or airspace
This includes all sectors: financial services, legal and professional services, property, retail, manufacturing, technology, and any business dealing with international clients, suppliers, or transactions.
CRITICAL: UK Sanctions List transition deadline
From 28 January 2026 at 09:00 GMT, the UK Sanctions List becomes the sole authoritative source for UK sanctions compliance. The OFSI Consolidated List will close and no longer be updated after this date.
You must take action before 28 January 2026:
- Switch all compliance systems to reference the UK Sanctions List only
- Update sanctions screening software and data feed providers
- Revise internal policies, procedures, and compliance manuals
- Amend contracts, terms of business, and transactional documents that reference the OFSI Consolidated List
- Train staff on the new single list system
Failure to transition by the deadline will mean your systems are checking outdated information, creating serious compliance and legal risks.
OFSI's role and enforcement powers
Understanding OFSI's enforcement authority and how sanctions enforcement works across UK government is critical to compliance.
Cross-government enforcement
Since November 2025, OFSI has coordinated with other enforcement agencies through a unified cross-government enforcement page. This means sanctions breaches can trigger action from multiple authorities simultaneously:
- Civil penalties from OFSI (up to £1 million or 50% of breach value)
- Criminal prosecutions via NCA or SFO (up to 7 years imprisonment)
- Trade sanctions enforcement by HMRC or OTSI
- Regulatory action by sector regulators (FCA, SRA, etc.)
With 240 active cases and over 900 licensing decisions in 2024-25, OFSI enforcement is highly active.
Penalties for sanctions breaches
UK sanctions carry both criminal and civil penalties. OFSI operates a strict liability civil penalty regime - you can be fined even if you did not know or have reasonable cause to suspect a breach occurred.
Proposed penalty reforms
HM Treasury consulted in summer 2025 on doubling civil penalties to £2 million or 100% of breach value. The consultation closed in October 2025 and reforms are pending final approval. This signals the government's intention to significantly increase enforcement severity.
Voluntary disclosure remains important: Under current rules, early disclosure and self-investigation can reduce penalties by up to 50% (serious cases) or 30% (most serious cases). The proposed reforms would standardise this to a unified 30% cap for all cases.
Enhanced obligations for financial institutions
Financial services firms face enhanced sanctions compliance expectations beyond the general statutory requirements:
- FCA position on wilful blindness: The Financial Conduct Authority treats wilful blindness in relation to sanctions checks as involvement in sanctions offences. Deliberately avoiding knowledge will not protect you.
- Transaction monitoring: Real-time screening of payments, transfers, and transactions against sanctions lists is expected. Batch processing or delayed screening creates unacceptable risks.
- Customer due diligence: Enhanced due diligence is required for high-risk jurisdictions (Russia, Iran, North Korea, Belarus) and sectors (defence, extractives, luxury goods, technology).
- Ownership and control: You must trace beneficial ownership through complex structures to identify 50% ownership triggers. Shell companies and nominee arrangements require enhanced scrutiny.
- Regulatory reporting: Separate reporting obligations apply to FCA, in addition to OFSI breach reporting and SAR filing to NCA.
OFSI's 2023 guidance explicitly states that "failure to carry out appropriate due diligence will be an aggravating factor when deciding penalty." For financial institutions, this means industry-leading screening systems and controls are expected, not just minimum statutory compliance.
SRA guidance on sanctions for legal professionals
Solicitors and legal professionals have specific obligations under SRA regulatory requirements in addition to OFSI statutory compliance:
- Client due diligence: Anti-money laundering checks must include sanctions screening. Verify all clients, beneficial owners, and third-party funders against UK Sanctions List before engagement.
- Source of funds: Enhanced scrutiny required for clients or funders connected to Russia, Belarus, Iran, North Korea, or sanctioned sectors. Identify ultimate source of funds to avoid facilitating sanctions evasion.
- General licence for legal services: Legal Services General Licence (INT/2025/7323088, expires 28 April 2026) allows provision of legal services to designated persons subject to strict fee caps, reset every 6 months. You must comply with licence conditions and record-keeping requirements.
- Specific licences: For work outside general licence scope (e.g., exceeding fee caps, non-litigation work), apply for specific licence from OFSI. Licence applications can take weeks or months for complex cases.
- SRA reporting: Report sanctions concerns to SRA in addition to OFSI breach reports. SRA expects policies, training, and systems demonstrating proactive compliance.
- Professional conduct: Breaching sanctions is misconduct under SRA Standards and Regulations. Can result in regulatory sanctions, fines, or striking off in addition to OFSI penalties.
Key SRA position: "You cannot accept or continue instructions if doing so would breach sanctions legislation." This applies even if the client is willing to pay or claims ignorance.
Asset freeze requirements
When you know or have reasonable cause to suspect funds or economic resources belong to a designated person, immediate action is required by law.
The 'reasonable cause to suspect' test
This is an objective test, not a subjective one. The question is: would an honest and reasonable person in your position, with your knowledge and experience, infer from the facts and circumstances that the person might be designated?
You do not need actual knowledge or proof. Suspicious circumstances, patterns, or risk indicators can trigger the obligation to freeze and report. Deliberate ignorance or failure to ask obvious questions will not protect you.
Common triggers for reasonable suspicion:
- Name matches or partial matches to sanctions list entries
- Business or personal connections to sanctioned jurisdictions (Russia, Iran, DPRK, Belarus)
- Ownership links to known designated persons or entities
- Use of complex structures, nominees, or intermediaries to obscure ownership
- Client reluctance to provide ownership or source of funds information
- Transactions involving high-risk sectors (defence, extractives, luxury goods, technology) with sanctioned country connections
The 50% ownership rule explained
This is one of the most commonly misunderstood aspects of UK sanctions. If a designated person owns more than 50% of an entity (directly or indirectly through intermediary companies), that entity is automatically subject to the same asset freeze restrictions - even if it is not listed by name on the sanctions list.
Practical implications:
- You must trace ownership through corporate structures
- Check beneficial ownership registers and ask clients to disclose ultimate beneficial owners
- Aggregated holdings count (e.g., person owns 30% directly and 25% via another entity = 55% total)
- Indirect ownership counts (designated person owns 100% of Company A, which owns 60% of Company B - Company B is caught)
- Joint ownership is aggregated if designated persons act together
The 50% rule means thousands of unlisted subsidiaries, affiliates, and controlled entities are automatically sanctioned. Your screening systems must capture ownership, not just entity names.
Sanctions screening requirements
All UK persons must screen clients, transactions, suppliers, and business contacts against official sanctions lists. The frequency and depth of screening depends on your risk profile and sector.
Building effective screening procedures
OFSI's 2023 guidance makes clear that inadequate screening will be treated as an aggravating factor in penalty decisions. Your screening programme should include:
1. Pre-engagement screening:
- Screen all new clients, customers, and counterparties before onboarding
- Check individuals (name, date of birth, nationality, address)
- Check entities (registered name, trading names, registration numbers, addresses)
- Check beneficial owners (persons with more than 25% ownership or control)
- Check related parties (directors, shareholders, funders, introducers)
2. Transaction screening:
- Real-time screening of payments, transfers, and high-value transactions
- Check all parties to the transaction (payer, payee, beneficiary, intermediaries)
- Particular vigilance for transactions over €10,000 or involving high-risk jurisdictions
3. Ongoing monitoring:
- Re-screen existing clients at least annually (quarterly for high-risk)
- Immediate re-screening when sanctions lists update (subscribe to daily alerts)
- Event-driven screening (when client circumstances change, new ownership, jurisdiction change)
4. Name match vs target match:
- Name match: Similar name only - investigate further, request additional identifiers, document decision
- Target match: Name plus other identifiers align (DOB, address, passport number, registration number) - freeze immediately and report to OFSI
Screening tools: Use commercial sanctions screening software with daily list updates, fuzzy matching algorithms, and automated workflows. Manual spreadsheet checks are inadequate for any but the smallest, lowest-risk businesses.
Breach reporting obligations
You must report to OFSI as soon as practicable if you know or have reasonable cause to suspect a sanctions breach has occurred or a person is designated.
What counts as 'as soon as practicable'
OFSI expects immediate reporting once you have reasonable certainty of a breach or designation. "As soon as practicable" typically means:
- Within hours for straightforward cases (clear match, obvious breach)
- Within days for cases requiring initial investigation (name match needing verification, fact-finding)
- Not weeks or months - delayed reporting is a compliance failure
Important: The obligation is to report suspicion, not proven breaches. Do not delay reporting while conducting lengthy investigations to "be sure". Report early with available information and update OFSI as your investigation progresses.
Reporting is separate from other obligations
OFSI breach reporting does not satisfy other reporting requirements. You may need to make multiple reports for the same incident:
- OFSI: Suspected sanctions breach via online form
- National Crime Agency (NCA): Suspicious Activity Report (SAR) if potential money laundering
- Counter-terrorism: Section 19 report under Terrorism Act 2000 if terrorist property
- Sector regulators: FCA (financial services), SRA (legal), etc. have separate reporting obligations
Each agency requires separate reports with different content, formats, and timeframes. Reporting to one does not discharge obligations to others.
Annual frozen asset reporting
If you hold frozen assets for designated persons, additional annual reporting applies:
- Measurement date: 30 September each year
- Reporting deadline: 30 November each year
- What to report: Value of frozen assets held, interest/credits accrued, designated person details
- Russia/Belarus specific: Assets exceeding £10,000 require reporting within 10 weeks of designation
- Nil returns: Only required if you previously held frozen assets and no longer do
Failure to submit frozen asset reports is a breach of sanctions obligations and can result in OFSI penalties.
Licensing regime
If you need to undertake an activity that would otherwise breach sanctions, you must obtain a licence from OFSI. Licences cannot be issued retrospectively - apply before acting.
Practical licensing guidance
Always check for general licences first: OFSI publishes 19 general licences covering common scenarios (legal services, humanitarian activity, diplomatic missions, etc.). If a general licence covers your activity, you can rely on it without individual application. Ensure you comply with all licence conditions and record-keeping requirements.
Specific licence applications: For activities not covered by general licences, apply as early as possible:
- Simple applications: Typically decided within weeks
- Complex applications: Can take months, especially for novel or contentious issues
- Incomplete applications: Returned without action, delaying decision further
Application tips:
- Clearly state the prohibited activity you seek permission for
- Identify the specific sanctions provision you would otherwise breach
- Explain which licensing ground applies (basic needs, legal services, humanitarian, etc.)
- Provide supporting evidence (contracts, invoices, court orders, etc.)
- Maximum 4 attachments, 7MB each - collate documents efficiently
- Use OFSI's online form or downloadable template for consistency
Licensing grounds - evidence requirements:
- Basic needs: Evidence of essential living costs (rent, utilities, food, medicine) or entity basic needs (insurance, salaries, statutory payments)
- Legal services: Engagement letter, fee estimate benchmarked against Supreme Court Cost Guides
- Judicial decisions: Court or arbitration order, proof judgment pre-dates designation
- Prior obligations: Contract pre-dating designation (non-trade related)
- Humanitarian activity: NGO/charity registration, project details, beneficiary identification
Exceptions - when no licence is needed
Two important exceptions mean you can proceed without a licence in specific circumstances:
1. Treasury securities exception:
- UK government debt: Gilts, Treasury bills, green gilts, sovereign sukuk
- Applies to all HM Treasury transferable securities
- No licence required to hold, trade, or settle these instruments even if owned by designated persons
- Purpose: Maintain functioning of UK sovereign debt markets
2. UN Designated Persons exception (from 9 July 2025):
- Applies only to: Libya, Central African Republic, South Sudan, Yemen sanctions regimes
- Only to the extent implementing UN sanctions on UN-designated persons
- Does not apply to UK autonomous designations in these regimes
- Purpose: Align UK implementation with UN Security Council requirements
These are narrow exceptions. Most sanctions activities require either a general licence or specific licence.
Major sanctions regimes
Understanding the scale and focus of major UK sanctions regimes helps prioritise compliance resources and risk assessments.
Russia sanctions - the dominant regime
Russia sanctions have expanded dramatically since the February 2022 invasion of Ukraine. With £28.7 billion in frozen assets, 1,816 designated individuals, 562 designated entities, and 520 shadow fleet vessels, Russia is now the UK's largest and most complex sanctions regime.
Key compliance considerations:
- Sector-wide restrictions: Defence, dual-use goods, extractives (oil, gas, coal), aviation, maritime, luxury goods, technology
- Trade prohibitions: Import and export bans on specified goods and services
- Financial restrictions: Prohibition on correspondent banking, SWIFT exclusions for major banks
- Oil Price Cap: Restrictions on services for Russian oil transported above price cap (lowered 2 September 2025)
- Shadow fleet: 520 vessels designated - check against list before providing maritime services, insurance, or finance
Russia sanctions require enhanced due diligence for:
- Any Russian or Belarus counterparties or beneficial owners
- Transactions involving Russian goods, services, or entities
- Supply chain checks for goods containing Russian inputs
- Complex ownership structures potentially concealing Russian beneficial ownership
Iran, North Korea, Belarus - high-risk regimes
OFSI identifies Iran, Libya, Belarus, and DPRK as high-risk sanctions regimes requiring enhanced vigilance:
Iran:
- Nuclear programme sanctions (JCPOA-related)
- Funding of Hamas and Hezbollah
- Shadow oil economy and illicit procurement networks
- Sanctions tightening in 2025 on shadow oil trade and procurement commodities
North Korea (DPRK):
- Comprehensive UN Security Council sanctions since 2006
- Most sanctioned country globally (pre-Ukraine)
- Focus: Nuclear weapons programme, third-country facilitators
- Recent actions: North Korean generals sanctioned for intervention in Russia-Ukraine conflict
Belarus:
- Support for Russia's invasion of Ukraine
- Human rights violations
- Asset freeze targets and sectoral restrictions
For these regimes, adopt a presumption of high risk for all transactions, clients, and business relationships. Enhanced due diligence and senior management approval should be standard.
Building a compliance programme
Effective sanctions compliance requires policies, systems, training, and ongoing monitoring:
-
Establish written policies and procedures
Document sanctions compliance obligations, screening requirements, escalation procedures, breach reporting, and licensing processes. Tailor to your specific business model and risk profile.
-
Implement screening systems
Use commercial sanctions screening software with daily UK Sanctions List updates, fuzzy matching, and automated alerts. Integrate into onboarding and transaction processing workflows.
-
Assign compliance responsibility
Designate sanctions compliance officer (senior management level). Provide adequate resources, training, and authority. Report to board or equivalent governance body.
-
Conduct risk assessment
Identify sanctions risks based on your customers, suppliers, products, services, and geographic footprint. Focus compliance resources on highest risk areas.
-
Train your staff
Provide role-specific training: frontline staff (identifying red flags), compliance (screening and investigation), senior management (governance and reporting). Refresh training annually or when sanctions change.
-
Maintain audit trail
Record all screening checks, match investigations, decisions, escalations, and reports. Document why you concluded no match or proceeded despite concerns. OFSI expects evidence of proactive compliance.
-
Monitor and test controls
Regular internal audits of screening, reporting, and licensing controls. Test systems with sample checks. Review and update procedures when sanctions regimes change.
-
Subscribe to OFSI updates
Sign up for OFSI email alerts for new designations, general licences, and guidance updates. Review daily to ensure screening systems use latest lists.
-
Prepare for 28 January 2026 transition
Plan migration from OFSI Consolidated List to UK Sanctions List. Test systems, update contracts, train staff. Complete transition well before deadline to allow for issues.
-
Engage specialist advice
For complex sanctions issues, licensing applications, or breach investigations, consult sanctions lawyers or specialist compliance advisers. OFSI guidance is complex and fact-specific.