Sharon Takhar comments on Citibank’s fine for violating the U.K. sanctions regime, in Law360

"The Citibank penalty is significant not simply because of its size, but because of what it says about the standard OFSI expects from sanctions compliance programmes. The case demonstrates that automated screening is not a substitute for effective controls, oversight and human judgement. Screening systems need to be appropriately configured and tested, including against the way information is actually captured within a firm’s systems, while firms also need robust processes for dealing with alerts, escalation and changes in sanctions risk. In Citibank’s case, OFSI identified a combination of systems and controls issues, operational pressures, delays in alert handling and human error across different parts of the bank’s business.

"The case also illustrates that OFSI is taking a more structured and increasingly rigorous approach to enforcement. The £4.73 million penalty reflects OFSI’s assessment of a high-severity case involving 970 payments and an aggregate breach value of approximately £19.7 million. Importantly, and indeed consistent with prior OFSI enforcement action, the absence of an intention to breach sanctions did not prevent enforcement: OFSI emphasised that the relevant information was in some cases available within the bank, but was not properly identified or disseminated.

"At the same time, the outcome demonstrates the value of early disclosure and cooperation. Citibank voluntarily disclosed the majority of the breaches and cooperated with OFSI’s investigation, resulting in a 20% discount. That should reinforce the message that firms should not delay reporting while attempting to establish every detail internally; where a potential breach is identified, early engagement with OFSI can be important both from a regulatory perspective and in limiting the eventual enforcement consequences.

"The deterrent effect of UK sanctions enforcement is also likely to increase. OFSI’s current statutory maximum is the greater of £1 million or 50% of the value of the breach, but the Government has said it intends to increase this to the greater of £2 million or 100% of the breach value, subject to legislation. The significance of that change is less about matching the headline figures seen in US enforcement and more about giving OFSI greater flexibility to impose penalties that are proportionate to the scale and seriousness of the conduct. For larger institutions, the prospect of a penalty that can more closely reflect the value of the underlying breach should sharpen the financial incentive to invest in effective sanctions controls.

"The broader lesson for firms is that sanctions compliance cannot be treated as a purely technical screening exercise. Firms need to understand where their sanctions exposure actually arises across the business, stress-test their systems against realistic scenarios, ensure that information is able to flow effectively between relevant teams, and have clear escalation and remediation procedures when controls fail. As sanctions regimes become more complex and enforcement becomes more sophisticated, the focus is increasingly likely to be on whether a firm’s compliance framework works effectively in practice, rather than simply whether it has policies and screening technology in place."