UK sanctions compliance for businesses

CRITICAL: UK Sanctions List transition deadline

From 28 January 2026 at 09:00 GMT, the UK Sanctions List becomes the sole authoritative source for UK sanctions compliance. The OFSI Consolidated List will close and no longer be updated after this date.

You must take action before 28 January 2026:

1. Switch all compliance systems to reference the UK Sanctions List only
2. Update sanctions screening software and data feed providers
3. Revise internal policies, procedures, and compliance manuals
4. Amend contracts, terms of business, and transactional documents that reference the OFSI Consolidated List
5. Train staff on the new single list system

Failure to transition by the deadline will mean your systems are checking outdated information, creating serious compliance and legal risks.

OFSI's role and enforcement powers

Understanding OFSI's enforcement authority and how sanctions enforcement works across UK government is critical to compliance.

Cross-government enforcement

Since November 2025, OFSI has coordinated with other enforcement agencies through a unified cross-government enforcement page. This means sanctions breaches can trigger action from multiple authorities simultaneously:

• Civil penalties from OFSI (up to £1 million or 50% of breach value)
• Criminal prosecutions via NCA or SFO (up to 7 years imprisonment)
• Trade sanctions enforcement by HMRC or OTSI
• Regulatory action by sector regulators (FCA, SRA, etc.)

With 240 active cases and over 900 licensing decisions in 2024-25, OFSI enforcement is highly active.

Penalties for sanctions breaches

UK sanctions carry both criminal and civil penalties. OFSI operates a strict liability civil penalty regime - you can be fined even if you did not know or have reasonable cause to suspect a breach occurred.

Proposed penalty reforms

HM Treasury consulted in summer 2025 on doubling civil penalties to £2 million or 100% of breach value. The consultation closed in October 2025 and reforms are pending final approval. This signals the government's intention to significantly increase enforcement severity.

Voluntary disclosure remains important: Under current rules, early disclosure and self-investigation can reduce penalties by up to 50% (serious cases) or 30% (most serious cases). The proposed reforms would standardise this to a unified 30% cap for all cases.

Asset freeze requirements

When you know or have reasonable cause to suspect funds or economic resources belong to a designated person, immediate action is required by law.

The 'reasonable cause to suspect' test

This is an objective test, not a subjective one. The question is: would an honest and reasonable person in your position, with your knowledge and experience, infer from the facts and circumstances that the person might be designated?

You do not need actual knowledge or proof. Suspicious circumstances, patterns, or risk indicators can trigger the obligation to freeze and report. Deliberate ignorance or failure to ask obvious questions will not protect you.

Common triggers for reasonable suspicion:

• Name matches or partial matches to sanctions list entries
• Business or personal connections to sanctioned jurisdictions (Russia, Iran, DPRK, Belarus)
• Ownership links to known designated persons or entities
• Use of complex structures, nominees, or intermediaries to obscure ownership
• Client reluctance to provide ownership or source of funds information
• Transactions involving high-risk sectors (defence, extractives, luxury goods, technology) with sanctioned country connections

The 50% ownership rule explained

This is one of the most commonly misunderstood aspects of UK sanctions. If a designated person owns more than 50% of an entity (directly or indirectly through intermediary companies), that entity is automatically subject to the same asset freeze restrictions - even if it is not listed by name on the sanctions list.

Practical implications:

• You must trace ownership through corporate structures
• Check beneficial ownership registers and ask clients to disclose ultimate beneficial owners
• Aggregated holdings count (e.g., person owns 30% directly and 25% via another entity = 55% total)
• Indirect ownership counts (designated person owns 100% of Company A, which owns 60% of Company B - Company B is caught)
• Joint ownership is aggregated if designated persons act together

The 50% rule means thousands of unlisted subsidiaries, affiliates, and controlled entities are automatically sanctioned. Your screening systems must capture ownership, not just entity names.

Sanctions screening requirements

All UK persons must screen clients, transactions, suppliers, and business contacts against official sanctions lists. The frequency and depth of screening depends on your risk profile and sector.

Building effective screening procedures

OFSI's 2023 guidance makes clear that inadequate screening will be treated as an aggravating factor in penalty decisions. Your screening programme should include:

1. Pre-engagement screening:

• Screen all new clients, customers, and counterparties before onboarding
• Check individuals (name, date of birth, nationality, address)
• Check entities (registered name, trading names, registration numbers, addresses)
• Check beneficial owners (persons with more than 25% ownership or control)
• Check related parties (directors, shareholders, funders, introducers)

2. Transaction screening:

• Real-time screening of payments, transfers, and high-value transactions
• Check all parties to the transaction (payer, payee, beneficiary, intermediaries)
• Particular vigilance for transactions over €10,000 or involving high-risk jurisdictions

3. Ongoing monitoring:

• Re-screen existing clients at least annually (quarterly for high-risk)
• Immediate re-screening when sanctions lists update (subscribe to daily alerts)
• Event-driven screening (when client circumstances change, new ownership, jurisdiction change)

4. Name match vs target match:

• Name match: Similar name only - investigate further, request additional identifiers, document decision
• Target match: Name plus other identifiers align (DOB, address, passport number, registration number) - freeze immediately and report to OFSI

Screening tools: Use commercial sanctions screening software with daily list updates, fuzzy matching algorithms, and automated workflows. Manual spreadsheet checks are inadequate for any but the smallest, lowest-risk businesses.

Breach reporting obligations

You must report to OFSI as soon as practicable if you know or have reasonable cause to suspect a sanctions breach has occurred or a person is designated.

What counts as 'as soon as practicable'

OFSI expects immediate reporting once you have reasonable certainty of a breach or designation. "As soon as practicable" typically means:

• Within hours for straightforward cases (clear match, obvious breach)
• Within days for cases requiring initial investigation (name match needing verification, fact-finding)
• Not weeks or months - delayed reporting is a compliance failure

Important: The obligation is to report suspicion, not proven breaches. Do not delay reporting while conducting lengthy investigations to "be sure". Report early with available information and update OFSI as your investigation progresses.

Reporting is separate from other obligations

OFSI breach reporting does not satisfy other reporting requirements. You may need to make multiple reports for the same incident:

• OFSI: Suspected sanctions breach via online form
• National Crime Agency (NCA): Suspicious Activity Report (SAR) if potential money laundering
• Counter-terrorism: Section 19 report under Terrorism Act 2000 if terrorist property
• Sector regulators: FCA (financial services), SRA (legal), etc. have separate reporting obligations

Each agency requires separate reports with different content, formats, and timeframes. Reporting to one does not discharge obligations to others.

Annual frozen asset reporting

If you hold frozen assets for designated persons, additional annual reporting applies:

• Measurement date: 30 September each year
• Reporting deadline: 30 November each year
• What to report: Value of frozen assets held, interest/credits accrued, designated person details
• Russia/Belarus specific: Assets exceeding £10,000 require reporting within 10 weeks of designation
• Nil returns: Only required if you previously held frozen assets and no longer do

Failure to submit frozen asset reports is a breach of sanctions obligations and can result in OFSI penalties.

Licensing regime

If you need to undertake an activity that would otherwise breach sanctions, you must obtain a licence from OFSI. Licences cannot be issued retrospectively - apply before acting.

Practical licensing guidance

Always check for general licences first: OFSI publishes 19 general licences covering common scenarios (legal services, humanitarian activity, diplomatic missions, etc.). If a general licence covers your activity, you can rely on it without individual application. Ensure you comply with all licence conditions and record-keeping requirements.

Specific licence applications: For activities not covered by general licences, apply as early as possible:

• Simple applications: Typically decided within weeks
• Complex applications: Can take months, especially for novel or contentious issues
• Incomplete applications: Returned without action, delaying decision further

Application tips:

• Clearly state the prohibited activity you seek permission for
• Identify the specific sanctions provision you would otherwise breach
• Explain which licensing ground applies (basic needs, legal services, humanitarian, etc.)
• Provide supporting evidence (contracts, invoices, court orders, etc.)
• Maximum 4 attachments, 7MB each - collate documents efficiently
• Use OFSI's online form or downloadable template for consistency

Licensing grounds - evidence requirements:

• Basic needs: Evidence of essential living costs (rent, utilities, food, medicine) or entity basic needs (insurance, salaries, statutory payments)
• Legal services: Engagement letter, fee estimate benchmarked against Supreme Court Cost Guides
• Judicial decisions: Court or arbitration order, proof judgment pre-dates designation
• Prior obligations: Contract pre-dating designation (non-trade related)
• Humanitarian activity: NGO/charity registration, project details, beneficiary identification

Exceptions - when no licence is needed

Two important exceptions mean you can proceed without a licence in specific circumstances:

1. Treasury securities exception:

• UK government debt: Gilts, Treasury bills, green gilts, sovereign sukuk
• Applies to all HM Treasury transferable securities
• No licence required to hold, trade, or settle these instruments even if owned by designated persons
• Purpose: Maintain functioning of UK sovereign debt markets

2. UN Designated Persons exception (from 9 July 2025):

• Applies only to: Libya, Central African Republic, South Sudan, Yemen sanctions regimes
• Only to the extent implementing UN sanctions on UN-designated persons
• Does not apply to UK autonomous designations in these regimes
• Purpose: Align UK implementation with UN Security Council requirements

These are narrow exceptions. Most sanctions activities require either a general licence or specific licence.

Major sanctions regimes

Understanding the scale and focus of major UK sanctions regimes helps prioritise compliance resources and risk assessments.

Russia sanctions - the dominant regime

Russia sanctions have expanded dramatically since the February 2022 invasion of Ukraine. With £28.7 billion in frozen assets, 1,816 designated individuals, 562 designated entities, and 520 shadow fleet vessels, Russia is now the UK's largest and most complex sanctions regime.

Key compliance considerations:

• Sector-wide restrictions: Defence, dual-use goods, extractives (oil, gas, coal), aviation, maritime, luxury goods, technology
• Trade prohibitions: Import and export bans on specified goods and services
• Financial restrictions: Prohibition on correspondent banking, SWIFT exclusions for major banks
• Oil Price Cap: Restrictions on services for Russian oil transported above price cap (lowered 2 September 2025)
• Shadow fleet: 520 vessels designated - check against list before providing maritime services, insurance, or finance

Russia sanctions require enhanced due diligence for:

• Any Russian or Belarus counterparties or beneficial owners
• Transactions involving Russian goods, services, or entities
• Supply chain checks for goods containing Russian inputs
• Complex ownership structures potentially concealing Russian beneficial ownership

Iran, North Korea, Belarus - high-risk regimes

OFSI identifies Iran, Libya, Belarus, and DPRK as high-risk sanctions regimes requiring enhanced vigilance:

Iran:

• Nuclear programme sanctions (JCPOA-related)
• Funding of Hamas and Hezbollah
• Shadow oil economy and illicit procurement networks
• Sanctions tightening in 2025 on shadow oil trade and procurement commodities

North Korea (DPRK):

• Comprehensive UN Security Council sanctions since 2006
• Most sanctioned country globally (pre-Ukraine)
• Focus: Nuclear weapons programme, third-country facilitators
• Recent actions: North Korean generals sanctioned for intervention in Russia-Ukraine conflict

Belarus:

• Support for Russia's invasion of Ukraine
• Human rights violations
• Asset freeze targets and sectoral restrictions

For these regimes, adopt a presumption of high risk for all transactions, clients, and business relationships. Enhanced due diligence and senior management approval should be standard.

Building a compliance programme

Effective sanctions compliance requires policies, systems, training, and ongoing monitoring: