Mark Beardsworth, Duncan Grieve, Sharon Takhar and Nikara Rangesh discuss the £4.73 million fine recently levied by OFSI, in Thomson Reuters Regulatory Intelligence

A £4.73 million fine was recently levied by the Office of Financial Sanctions Implementation (OFSI) on Citibank NA London. The record penalty - for multiple breaches of the Russia (Sanctions) (EU Exit) Regulations 2019 and the Global Anti-Corruption (GAC) Sanctions Regulations 2021 - was imposed on 11 August 2026 in relation to 970 payments between February 2022 and July 2025, totalling c.£19.7 million.

Although some of these payments were made soon after Russia’s invasion of Ukraine, the case demonstrates the long tail that characterises investigations and the UK sanctions regime’s overall direction of travel. In future, firms can anticipate tougher enforcement, bigger incentives for early disclosure and cooperation, and raised expectations of their sanctions systems and controls.

Amid intensified action against Russian sanctions evasion and targeting of covert Russian networks which seek to circumvent international financial and trade sanctions, the Citibank case acts as a timely indicator of more robust enforcement. It highlights the practical challenges of responding to rapidly expanding sanctions regimes and geopolitical developments.

If their sanctions controls are not up to speed or fail altogether, firms cannot realistically hope to be shielded from enforcement action.

UK sanctions policy developments

UK sanctions enforcement operates on a strict liability basis: OFSI can impose penalties without having to prove that the person or company knew, or had reasonable cause to suspect, that it was in breach.

Following a public consultation, OFSI introduced a revised enforcement framework in February, which confirms that, irrespective of knowledge or intent, penalties can be imposed with discounts for voluntary disclosure and cooperation.

The updated framework introduces:

• A new Voluntary Disclosure and Co-operation discount, available in every case with a maximum discount capped at 30%, reduced from the maximum 50% discount for self-disclosure in serious breaches under the previous regime.
• A time-limited settlement period of 30 business days. During this time, persons or companies that are subject to prosecution can waive their rights to Ministerial Review and judicial appeal and agree not to challenge OFSI findings, in exchange for a 20% settlement discount to the baseline penalty and input into the public penalty notice.
• An Early Account Scheme (EAS) designed to expedite an investigation. At OFSI’s discretion, this can lead to a discount of up to 20% for providing an early detailed account of potential breaches (independent of the settlement scheme).

Discounts may be aggregated, reducing penalties by up to 70%. Collectively, the changes suggest an assertive, mature regime which incentivises early cooperation and increases the financial penalties for non-compliance.

On 13 May 2026, regulations introduced Sanctions End-Use Controls (SEUC). Under SEUC, a licence is required for exports to a non-sanctioned third country where the Government has identified a risk of diversion to a sanctioned destination. The need for due diligence is reinforced - not only for direct counterparties, but also for end use, ownership and onward destination.

On 31 August 2026, the Government confirmed plans to strengthen deterrence and drive better compliance by doubling OFSI’s maximum monetary penalty: from the greater of £1 million or 50% of the breach value (under the previous regime), to the greater of £2 million or 100%. Specific legislation is required before it comes into force. The Chancellor said the increase would "further strengthen the deterrent effect of the UK’s sanctions regime and drive better enforcement" .

Increased penalties form part of wider Government action against Russian sanctions evasion. Other elements include: the National Crime Agency’s (NCA’s) recent nationwide alert against Kremlin-backed cross-border payment platform A7; the NCA’s Operation Destabilise, which has targeted a significant Russian-speaking professional money-laundering network since 2021 (with the latest updates published last November); and 500+ sanctions on individuals, entities and ships under the Russia sanctions regime so far this year.

Published on 22 September 2026, a Financial Times investigation based on leaked A7 files found that a “Kremlin-backed forgery scheme” had moved $6.9 billion via major international banks, despite sanctions on Russia. These developments highlight the intensified scrutiny of Russian sanctions evasion and the necessity of robust controls.

Citibank penalty: key takeaways

Citibank was fined £4.73 million by OFSI for multiple breaches across a range of activities over more than three years up to July 2025. These included corporate and correspondent banking, its role as Principal Paying Agent, and the handling of sanctions alerts.

During a surge in Russia-related designations after February 2022, many breaches stemmed from systems and controls issues, or staff errors. These include:

• Screening calibration: the system failed to account for a Russian corporate prefix in its KYC records and to generate alerts for Sovcomflot, a major designated entity.
• Alert-handling backlogs: the number of potential sanctions matches overwhelmed the bank’s manual review processes, causing some alerts to remain unadjudicated for several weeks.
• Automated payment processing: an internal correspondent bank list was not screened against sanctions lists; when correspondent banks were added, the payment processor did not re-screen the full payment chain.
• Information sharing: information that could have prevented breaches was not shared effectively between teams.
• Ownership and control: ownership was incorrectly determined for one entity, and staff failed to identify relevant subsidiaries of a designated person.

Given its Russian client base and affiliate, the unprecedented scale and complexity of Russia-related sanctions measures put significant operational strain on Citibank. Despite taking this into account, OFSI concluded that a penalty was nevertheless warranted. The case was assessed as Level 4, the highest rating in OFSI’s seriousness framework, justified by aggravating factors: the high aggregate breach value, the strategic priority of the Russia sanctions regime, sustained material harm to sanctions objectives, and reasonably foreseeable systems and controls failures.

The decision underscores the regulatory expectation that firms continuously calibrate their compliance frameworks to evolving geopolitical risks. It also reinforces the principle that an absence of deliberate wrongdoing does not excuse the absence of effective controls.

Having voluntarily disclosed most breaches, Citibank received a 20% penalty discount for its cooperation with OFSI and a further 20% discount for settling within the relevant period. Overall, the baseline penalty of approximately £7.9 million was reduced by 40% to £4.73 million.

The penalty demonstrates the importance of early disclosure and cooperation, reflecting OFSI’s increasingly robust approach to enforcement – akin to the US, where large fines provide a genuine deterrent. It counters criticism of the UK regime for levying insufficient penalties that could be regarded simply as a cost of doing business. When it comes into force, the doubling of statutory maximum penalties will raise the stakes further, with the UK Government stating that it aims to "strengthen deterrence and increase OFSI’s flexibility to enforce breaches".

Practical next steps

Against this backdrop, firms should take practical steps to strengthen their sanctions compliance frameworks and mitigate enforcement risk.

Governance, accountability and risk ownership

Ensure that senior management owns sanctions risks and implements effective oversight and escalation mechanisms, particularly in relation to group structures or third parties. Compliance frameworks should be refreshed regularly to remain calibrated to current geopolitical risks and sanctions developments.

Risk assessment and due diligence

Strengthen the onboarding, renewal and due diligence processes for intermediaries, customers, vendors and joint venture partners. Make sure to include appropriate contractual protections, such as warranties, audit rights and termination triggers. Risk assessments need to account for current sanctions designations, high-risk jurisdictions and complex ownership structures, and identify where sanctions exposure arises across business lines, payment chains and third parties.

Screening systems and controls

Effective screening systems need appropriate calibration and testing against how information is captured in practice, including name variations, transliterations, corporate prefixes and other data inconsistencies. Similarly, screening methodologies and sanctions data sources should be reviewed and updated regularly.

Avoid over-reliance on automation: stress-test systems against realistic scenarios and ensure that manual oversight, escalation and review processes remain effective, particularly where payment chains or internal lists change.

Training, escalation and timely response to red flags

Front-line staff must be appropriately trained on sanctions risks, escalation procedures and spotting red flags. Update training materials regularly to reflect evolving sanctions risks and geopolitical developments. Prompt responses once potential issues are identified require clear escalation and investigation procedures, and effective information flows between teams.

Consider early voluntary disclosure where breaches are identified. Do not delay reporting whilst attempting to establish every detail internally: prompt cooperation can materially reduce penalties, provided the regulator is updated as the facts develop.