Sanctions: The UK Perspective

This is an Insight article, written by a selected partner as part of GIR's co-published content. Read more on Insight

29.1 Introduction

Sanctions are restrictive measures aimed at achieving foreign policy or national security objectives. With the creation of the Office of Financial Sanctions Implementation (OFSI) in March 2016 and its continued issuance of penalties for sanctions breaches, sanctions enforcement is a growing area of economic crime enforcement in the United Kingdom. The United Kingdom implemented its autonomous sanctions regime following its exit from the European Union on 31 December 2020.

The United Kingdom currently implements and enforces sanctions implemented by the United Nations and its own domestic sanctions regime (which includes the sanctions imposed by the European Union, which were retained in UK law after Brexit) against individuals, entities and jurisdictions. These include various restrictive measures, such as trade sanctions (e.g., arms embargoes and restrictions on dual-use items); economic or financial sanctions (e.g., asset freezes and restrictions on a variety of financial markets and services); and immigration sanctions (e.g., travel bans).

While the Foreign and Commonwealth Office has overall responsibility for UK government policy on international sanctions, trade sanctions are generally implemented and administered by the Department for Business and Trade (DBT) (acting through the UK Export Control Joint Unit (ECJU)) and enforced by HM Revenue and Customs (HMRC). Financial sanctions are administered and enforced by OFSI (with support from the National Crime Agency (NCA)), and immigration sanctions by the Home Office.

In addition to civil enforcement, criminal prosecution of sanctions violations may be pursued by HMRC or the Serious Fraud Office (SFO) upon referral by OFSI, or by the Crown Prosecution Service (CPS) for breaches of trade sanctions. Regulators, such as the Financial Conduct Authority (FCA), also ensure that regulated firms have adequate systems and controls in place to enable them to meet their sanctions obligations.

In this chapter, we set out an overview of the UK sanctions framework and consider how investigations may arise and best practices when initiating or responding to investigations.

29.2 Overview of the UK sanctions regime

29.2.1 Statutes and official guidance

The United Kingdom has historically followed the United Nations and the European Union in applying sanctions. EU sanctions are implemented through regulations with direct legal effect in Member States,[2] with individual Member States being responsible for enforcement of EU sanctions.[3] Post-Brexit, EU sanctions no longer apply in the United Kingdom, but EU sanctions have been implemented into national law through secondary legislation. Existing EU sanctions regimes are addressed under the Sanctions and Anti-Money Laundering Act 2018 (SAMLA), which provides the legal basis for the United Kingdom to impose, update and lift sanctions following Brexit. The United Kingdom also has its own terrorist sanctions regime. Entities in the regulated sector are subject to the Anti-Terrorism, Crime and Security Act 2001, the Counter-Terrorism Act 2008 and the Terrorist Asset-Freezing etc. Act 2010.

OFSI has issued guidance regarding its approach to financial sanctions under SAMLA,[4] an enforcement guide that summarises its approach to compliance and enforcement, including the imposition of penalties,[5] and, together with the National Crime Agency and working in conjunction with law enforcement and financial sector partners, has issued ‘red alert’ notices that promote awareness and provide guidance on specific urgent issues.[6] Broadly speaking, the guidance issued by OFSI shows that it has high expectations with regard to sanctions compliance. In particular, licensing grounds are interpreted narrowly, and it is clear that general and specific reporting obligations are a key aspect of the United Kingdom’s sanctions enforcement apparatus. When assessing sanctions violations, OFSI will treat each breach on its own merits based on a number of aggravating and mitigating factors, and in particular, will place substantial value on cooperation and timely voluntary disclosure.

29.2.2 Persons to whom sanctions apply

UK nationals and entities established under UK law, and their overseas branches, must comply with UK sanctions regardless of where they are located or their activities take place. UK financial sanctions also apply to any individual or entity that is located or that carries out activities within the United Kingdom. OFSI provides a number of non-exhaustive examples of how a UK nexus might arise, including a UK company working overseas, transactions using clearing services in the United Kingdom, actions by a local subsidiary of a UK company or actions taking place overseas but directed from within the United Kingdom.[7]

Restrictive sanctions measures apply to named individuals, entities, groups, sectors and countries. OFSI maintains a list of individuals and entities subject to financial sanctions to help individuals and businesses comply with those sanctions. Consistent with EU guidance, OFSI considers that if a designated person owns more than 50 per cent of, or otherwise controls, an entity (directly or indirectly),[8] financial sanctions will apply to that entity as well.

Unlike the situation in the United States, the UK sanctions regime does not include secondary sanctions. Council Regulation (EC) No. 2271/96, known as the Blocking Statute, enshrined into law in the United Kingdom,[9] prohibits UK residents and companies from complying with certain extraterritorial legislation, specifically in relation to US sanctions on Cuba and Iran, unless they are exceptionally authorised to do so by the Secretary of State. It also allows UK residents and companies to recover damages arising from such legislation from the persons or entities causing them and prevents any foreign court rulings based on the blocked legislation from having effect in the United Kingdom.[10]

29.2.3 Exemptions and licensing

The UK sanctions regime provides for certain exceptions from the restrictive measures imposed under sanctions legislation in the form of exemptions or licences. With respect to exemptions, in certain limited situations and conditions as set out in the legislation, particular activities are automatically exempt, meaning that parties may engage in the activity without a licence or authorisation. Alternatively, for activities that would otherwise be prohibited, parties may apply for a licence.

OFSI oversees applications for licences in relation to financial sanctions, and the DBT for trade sanctions. OFSI will only grant a licence where it falls within the specific grounds identified in the underlying legislation. Generally these cover areas such as basic needs, legal fees and disbursements, fees or charges relating to frozen accounts and other economic resources, payment of court judgments or arbitration decisions against a designated person, satisfaction of prior contractual obligations and other extraordinary expenses.[11]

OFSI may also grant licences in accordance with the United Kingdom’s domestic terrorist sanctions regimes (without the need for specific licensing grounds) and can issue licences specific to individuals or generally applicable to all persons designated under particular domestic terror sanctions regimes.[12] As at August 2023, there is only one active general licence under the United Kingdom’s domestic terrorist sanctions regime.[13] General licences can be used without making an application to OFSI, but each general licence will include requirements for prior notification of use, record-keeping and reporting.[14]

Where an individual or entity seeks to import or export goods restricted by sanctions, such as dual-use goods (items with both a military and civilian use), a licence may be required by the ECJU alongside one from OFSI.

29.2.4 Key jurisdictions

While a number of jurisdictions are sanctioned by the United Kingdom, three are particularly significant: Russia, Iran and North Korea. Russia

The United Kingdom has retained numerous economic, trade and financial restrictive measures on Russia originally imposed by the European Union in response to the annexation of Crimea and Sevastopol, and actions that undermine or threaten the territorial sovereignty and independence of Ukraine, which were further expanded in response to Russia’s invasion of Ukraine in 2022. Alongside asset freezes and travel bans, it is also prohibited to:

  • import or export arms and related material to or from Russia;
  • sell, supply, transfer or export a wide range of goods and technology (e.g., military, dual-use, luxury, critical-industry, quantum computing and advanced materials, or energy-related or oil refining goods) for use in Russia or to ‘persons connected with Russia’,[15] or to provide technical and financial assistance or other services in connection with the export, sale or transfer of such goods and technology;
  • deal in certain transferable securities or money market instruments issued by persons connected with Russia;
  • provide loans or credit with a maturity exceeding 30 days to persons connected with Russia;
  • provide financial services to certain Russian state entities relating to foreign exchange reserve and asset management;
  • make investments in relation to non-government-controlled Ukrainian territory; and
  • provide various services for certain sectors, including oil exploration and production, tourism, professional and business services, trust services, legal advisory services and internet services.[16]

This means that any persons to which UK sanctions apply must carefully consider and assess any proposed transaction or engagement with Russia, or persons connected with Russia that could fall within these categories of restrictions.

For legal professionals in particular, the restrictions on legal advisory services broadly prohibit the provision of legal advice by a UK person (or any person located in the United Kingdom) to any non-UK person in relation to activity that would otherwise be prohibited by UK sanctions targeting Russia if the activity was undertaken by a UK person or within the United Kingdom; however, the DBT issued a general trade licence on 11 August 2023[17] in this regard, which broadly authorises the provision of legal advisory services if the advice concerns (1) compliance with sanctions or import and export controls relating to Russia as imposed by any jurisdiction, (2) compliance with counter-sanctions measures concerning Russia, or any criminal law, imposed by any jurisdiction and (3) compliance with UK statutory or regulatory obligations. As use of the general trade licence requires record-keeping for inspection by the government, legal professionals should take care regarding how such information is recorded to minimise the risk of breaching legal professional privilege. Iran

On 16 January 2016, the European Union lifted all its economic and financial sanctions in connection with the Iranian nuclear programme pursuant to the Joint Comprehensive Plan of Action (JCPOA) between the E3/EU+3 (France, Germany and the United Kingdom, plus Russia, China and the United States) and Iran. There are, however, certain measures and restrictions relating to proliferation that remain in place for the United Kingdom, including an arms embargo, restrictive measures relating to missile technology, restrictions on nuclear-related transfers and activities, and an authorisation regime for certain metals and software.[18]

Separate restrictive measures independent of the JCPOA also still apply. These were historically imposed by the European Union in relation to serious human rights violations in Iran and include asset freezes, travel bans and a ban of exports to Iran of equipment that may be used for internal repression or equipment for monitoring telecommunications.

Following the withdrawal of the United States from the JCPOA and the re-implementation of US secondary sanctions on Iran, the European Union amended the Blocking Statute to include the list of extraterritorial US sanctions on Iran. This change was retained by the United Kingdom following Brexit.[19] North Korea

North Korea is subject to a number of counter-proliferation measures aimed at preventing individuals and entities from obtaining funds, goods or services that could contribute to North Korea’s nuclear proliferation programme. These measures are wide-ranging and include asset freezes, travel bans, sectoral financial sanctions, restrictions on particular services and financial assistance, and prohibitions on the export and procurement of arms and on the export of luxury or dual-use goods.[20]

29.3 Offences and penalties

The various regulations for each sanctions regime set out prohibited conduct. Offences typically arise from dealing with funds or economic resources belonging to, owned, controlled or held by a designated person without a licence while knowing or suspecting that the transaction is prohibited. This can include making funds or economic resources (including cryptoassets[21]) available to a designated person, dealing with funds or economic resources that must be frozen, circumventing an asset freeze or breaching licensing conditions.[22] For example, OFSI imposed a monetary penalty on Telia Carrier UK Limited for indirectly facilitating international phone calls to a designated Syrian entity, which counted as making funds and economic resources indirectly available to it.[23] However, offences can also occur in relation to the breach of other financial sanctions or export controls, including where a person attempts to circumvent the restrictions in question. The sanctions regime allows criminal or civil cases to be brought for sanctions violations depending on the facts and the conduct in question.

29.3.1 Criminal penalties

Criminal prosecutions can only be brought if there is sufficient evidence to provide a realistic prospect of conviction, and the prosecution is in the public interest.[24] Criminal prosecutions of corporates for sanctions breaches are, however, unlikely, not least due to the difficulty of establishing corporate criminal liability in the United Kingdom. Civil breaches are enforced by OFSI, and criminal breaches are enforced by the SFO, HMRC and the CPS.

The penalties for breaches of sanctions in the United Kingdom are set out in the relevant statutory instruments. Criminal violations typically include unlimited criminal fines and up to seven years’ imprisonment for sanctions violations, as set by the Policing and Crime Act 2017 (PACA).[25]

Criminal breaches of sanctions may also have money laundering implications. The Proceeds of Crime Act 2002 (POCA), which broadly prohibits the handling of criminal property (defined as any benefit resulting from criminal conduct) has extraterritorial application, and even property resulting from criminal conduct that occurs abroad may be caught by POCA. For example, any payments received in the United Kingdom as part of a transaction that would constitute a sanctions offence would fall within the definition of ‘criminal property’ in POCA. The subsequent handling of those funds with the knowledge that they were criminal property would then constitute a money laundering offence. The maximum penalties for breaching POCA include an unlimited fine and up to 14 years’ imprisonment.[26]

The Serious Crime Act 2007 also allows a High Court judge to impose a serious crime prevention order on an individual or entity that has been involved in a serious crime, including breaches of financial sanctions.

29.3.2 Civil penalties

For breaches of sanctions that satisfy the civil standard of proof, OFSI may also impose monetary penalties of up to £1 million or 50 per cent of the value of the breach, whichever is higher.[27] For breaches committed on or after 15 June 2022, OFSI may impose civil monetary penalties on a strict liability basis, regardless of the absence of knowledge or a reasonable cause to suspect.[28] For earlier breaches, OFSI must show that, on the balance of probabilities, offenders had knowledge or reasonable cause to suspect that they were in breach of sanctions.[29]

29.4 Sanctions investigations

Sanctions investigations can arise in a number of ways. Internally, a company may become aware of a whistleblower report, red flags arising from automated compliance systems and controls, or findings from internal or external audits. A company may also receive notification from a bank of a blocked payment. UK authorities also increasingly commence investigations based on suspicious activity reports (SARs) filed with the NCA, voluntary self-reports by the company itself,[30] or reports from other individuals, entities or enforcement agencies.

There is no general notification requirement to inform a suspect that they are under investigation. As a result, a suspect may not become aware of an investigation without an overt act such as the service of production orders, the arrest of one or more individuals, an asset freeze or the execution of a search warrant.

OFSI has broad investigative powers to require any person located or resident in the United Kingdom to produce or provide information or documents to allow it to establish the extent of funds and economic resources linked to a designated person, obtain information concerning the disposal or transfer of such funds or economic resources, monitor compliance with or evasion of sanctions, or obtain evidence of the commission of an offence. Failure to comply with such requests without a reasonable excuse or obstructing OFSI in its investigation is a criminal offence.

Although OFSI is the primary agency responsible for sanctions, it may also refer a matter to other government agencies, such as the SFO or HMRC, both of which may also pursue a criminal prosecution. The SFO and HMRC also have broad powers to request or require information,[31] and HMRC may also make arrests.

OFSI also works closely with the NCA and may receive information on suspected breaches from the NCA’s International Corruption Unit.[32] The NCA typically refers cases for prosecution to the CPS, which may also prosecute breaches of trade sanctions pursuant to the Crown and Excise Management Act 1979.

Regulated entities could also be subject to enforcement action by the FCA for failure to maintain effective systems and controls to address the risk of sanctions violations,[33] effective systems and controls relating to compliance, financial crime and money laundering,[34] and adequate policies and procedures to counter the risk of financial crime.[35] Since May 2022, the FCA has invited the public to provide any information regarding sanctions evasion issues or weaknesses where they relate to regulated entities or persons, or a listed security.[36]

The FCA may issue notices to authorised persons requiring them to produce specified documents or information.[37] It may choose to request that documents be provided voluntarily, in the first instance. Although regulated entities need not comply with voluntary requests, they must deal with the FCA ‘in an open and cooperative way, and must disclose to the FCA appropriately anything relating to the firm of which that regulator would reasonably expect notice’.[38]

Once the FCA has formally commenced an investigation, it may require the subject of the investigation (or a person connected to the subject) to produce documents, attend interviews and answer questions, or otherwise provide information required by the investigator, where the documents or information sought are reasonably relevant to the investigation.[39] Furthermore, the FCA may seek answers and documents from persons who are not actually subject to investigation or connected to a person subject to investigation, where ‘necessary or expedient for the purposes of the investigation’.[40]

29.5 Best practices in investigations

29.5.1 Factors to consider

The creation of OFSI and its enforcement activity in the United Kingdom demonstrates that sanctions enforcement and investigations is a key area in the prosecution of economic crime. There is also a pronounced emphasis by UK enforcement authorities on voluntary disclosure and ongoing cooperation, with the FCA noting that ‘the requirement on firms to deal with their regulator openly and cooperatively is a central part of the Authority’s regulatory regime’,[41] and the SFO similarly stating that ‘co-operation will be a relevant consideration in the SFO’s charging decisions’.[42]

For that reason, it is important for a company to move quickly, while balancing speed against substance to ensure that it understands the nature of the alleged violation and the risks it presents. Issues for consideration may include:

  • to whom and when to give notice of the issue or investigation;
  • identifying who was involved in or responsible for the alleged breach;
  • preserving relevant information regarding the alleged breach and the company’s response;
  • conducting an internal investigation into the alleged breach and potentially any related transactions or departments;
  • remediation;
  • dealing with auditors;
  • disciplinary action; and
  • external communication strategy.

29.5.2 Cooperation

Cooperation with a UK authority may be mandatory where, for example, the authority has exercised its investigative powers and has issued notices requiring the provision of information or production of documents.

Where cooperation is voluntary, an individual or entity under investigation may still wish to cooperate fully with the UK authority for various reasons. Cooperation may result in a more positive outcome, such as a civil rather than criminal penalty, or conclusion of a criminal investigation by way of a deferred prosecution agreement (DPA). It may also result in a faster resolution of the matter, which may reduce legal fees and save valuable management time.

Other tangible benefits to cooperation include being able to work with the authority in shaping any public announcements as well as internal communications associated with the investigation, or the ability to gently influence an investigation through increased contact and rapport with the relevant authorities. Self-reporting


In April 2021, OFSI updated its enforcement guidance to state that breaches of financial sanctions ‘must’ be reported to it (a change from the previous ‘should’).[43] Specific reporting obligations also apply to certain ‘relevant firms’. Given the potential benefits, self-reporting is an important consideration when faced with a potential sanctions violation.

When assessing the seriousness of a case, authorities will take self-reporting into account and may consequently offer a more lenient outcome.[44] Any delay in self-reporting risks the authorities discovering the violation through other sources. This may prevent a person from qualifying for the penalty reduction given by OFSI for prompt and complete voluntary self-disclosures, although OFSI does consider it reasonable for a person to take ‘some time to assess the nature and extent of the breach, or seek legal advice’ as long as this does not delay an effective response to the breach.[45] By way of example, in its investigation of Standard Chartered Bank, OFSI allowed the bank first to disclose the suspected breaches, followed by interim updates of its internal investigation and a final report at the end of the bank’s internal investigation.[46]

Self-reporting is not without risk. A self-report, especially if incomplete, may lead authorities to conduct further investigations of the company’s activities, which could be expensive and lengthy and expose new issues. There is also no guarantee of a lenient approach, especially if the violations were carried out knowingly, were egregious or were avoidable with an effective compliance programme. It is best practice, therefore, to consider a self-report with the guidance of experienced legal counsel and after a preliminary investigation of the facts.

Reporting obligations

All individuals and entities subject to UK sanctions must report any breaches of financial sanctions to OFSI. Specific reporting obligations also apply to the following ‘relevant firms’:

  • persons with permission to carry out regulated activities;[47]
  • businesses that transmit money by any means, operate a currency exchange office or cash cheques payable to customers;
  • a firm or sole practitioner that is a statutory auditor or local auditor;
  • a firm or sole practitioner that provides by way of business accountancy services, legal or notarial services, advice about tax affairs or certain trust or company services;
  • a firm or sole practitioner that carries out, or whose employees carry out, estate agency work;
  • the holder of a casino operating licence;
  • a person engaged in the business of making, supplying, selling or exchanging articles made from gold, silver, platinum, palladium or precious stones or pearls;
  • a cryptoasset exchange provider; or
  • a custodian wallet provider.[48]

Relevant firms must report to OFSI if they have knowledge or reasonable cause to suspect that a third party is a designated person or has committed an offence under the regulations. If a relevant firm knows or has reasonable cause to suspect that a third party is a designated person, and is also a customer of the relevant firm, then the relevant firm must also state the nature and amount or quantity of any funds or economic resources held for that customer.

Additional reporting to other authorities may be necessary, such as to the FCA or the NCA. Specific reporting obligations may also arise under section 19 of the Terrorism Act 2000 for any act known or suspected to be linked to terrorist financing, as well as under the statutory scheme for each sanctions regime. Where the violation also involves complex fraud or international bribery and corruption, a person may also consider self-reporting to the SFO.

29.5.3 Settlement

OFSI has discretion in how it responds to breaches of financial sanctions. For example, it may simply require a company to provide additional information about its compliance practices, but may also impose monetary penalties or refer a matter to other regulators or criminal authorities for prosecution.[49] For minor breaches, OFSI may choose to publish information pertaining to a breach, even where no monetary penalty is imposed, if this would be in the public interest.

Criminal breaches of sanctions are eligible for DPAs with the CPS and the SFO, allowing an organisation to make reparations for its behaviour without many of the consequences of a conviction.

For breaches that only satisfy the civil standard and would incur a monetary penalty from OFSI, it is also possible to minimise penalties by making a voluntary self-report in the first instance, making representations during the penalty decision process and appealing OFSI’s penalty recommendation through ministerial review.

In reaching a penalty decision, OFSI will assess the seriousness of a case based on a number of mitigating and aggravating factors, including:

  • due diligence on ownership and control;
  • whether there was an intentional circumvention of sanctions;
  • the value of the breach;
  • knowledge of sanctions and compliance systems (although ignorance is no defence);
  • the behaviour at issue, such as whether the breach was deliberate or negligent, and any management involvement in the breach;
  • repeated, persistent or extended breaches;
  • professional facilitation;
  • reporting of breaches to OFSI, including whether the disclosure was voluntary, materially complete and made in good faith; and
  • public interest.

Where OFSI concludes that the threshold for imposing a civil penalty has been met, it will begin with the statutory maximum penalty it can impose, which is the greater of £1 million or 50 per cent of the value of the breach. It then decides what level of penalty, between zero and the maximum, is reasonable and proportionate, based on aggravating and mitigating factors. Up to a 50 per cent reduction in the final penalty is available to persons who provide a prompt and complete voluntary disclosure. This applies to cases assessed as ‘serious’, while a 30 per cent reduction is available for cases assessed to be ‘most serious’. OFSI then produces a penalty recommendation, in respect of which the company can make representations.

Section 147 of the Policing and Crime Act 2017 also confers a right on any subject of OFSI enforcement action to appeal the fine by requesting a ministerial review of the penalty recommendation. Some OFSI enforcement decisions indicate that invoking this right may result in substantially reduced penalties.


29.6 Trends and key issues

29.6.1 Recent enforcement activity

As at August 2023, OFSI had imposed eight monetary penalties for breaches of financial sanctions since it was first given powers to do so in April 2017. These fines have varied in size, and only two have exceeded £100,000.[50] Standard Chartered Bank (SCB) was fined £20.47 million in February 2020 for violating EU sanctions, making it the first fine in the United Kingdom relating to the EU Ukraine (Sovereignty and Territorial Integrity) sanctions regime.[51] Based on these violations, OFSI reached a penalty recommendation of £31.5 million. This was appealed by SCB through the ministerial review process, and the penalty was subsequently reduced. Telia Carrier UK Limited likewise successfully appealed its original penalty recommendation of £300,000 through ministerial review, reducing it by roughly half in relation to sanctions violations targeting Syria.[52]

In June 2021, TransferGo was fined £50,000 for transferring funds to accounts held with the Russian National Commercial Bank, an entity subject to an asset freeze.[53] Although TransferGo’s fine is substantially lower than those levied on SCB or Telia, the total value of transactions in breach of sanctions was just £7,764.77. The size of the penalty therefore demonstrates that the financial value of relevant transactions is only one component in OFSI’s overall assessment of sanctions breaches.[54] Furthermore, notwithstanding later cooperation with OFSI, because TransferGo did not voluntarily disclose the transactions, it was not eligible for voluntary disclosure credit. TransferGo’s attempt to appeal the fine was unsuccessful.

In August 2023, OFSI published its first-ever report for a breach that was not sufficiently serious to warrant a penalty, in effect naming and shaming Wise Payments Limited, a financial services company. The breach related to a cash withdrawal of £250 by a company owned or controlled by a person designated under the UK sanctions targeting Russia. Despite the low value, OFSI considered that Wise’s systems and controls were ‘inappropriate’, which made the case ‘moderately severe’ overall and enabled the prohibited withdrawal in question.[55]

In April 2019, the FCA fined SCB £102.2 million for anti-money laundering (AML) breaches connected in part to violations of US sanctions, based on findings of shortcomings in SCB’s internal assessments of the adequacy of its AML controls, its approach to identifying and mitigating money laundering risks and its escalation of money laundering risk.[56] This matter serves as a reminder that even if a particular transaction does not breach UK or EU sanctions, it may still face collateral enforcement action in the United Kingdom for compliance programme failures.

29.6.2 Potential pitfalls

While OFSI’s enforcement activity still pales in comparison to its US counter- part – the US Department of the Treasury’s Office of Foreign Assets Control – which issued US$1.29 billion of monetary penalties in 2019[57] (although this figure decreased to US$42.67 million in 2022[58]), the current trend of OFSI’s fines, combined with the recent rapid expansion of the sanctions regime relating to Russia, suggests that enforcement activity will only intensify. As an enforcement agency, OFSI continues to mature, and it is likely that OFSI has numerous investigations in the pipeline.

Brexit has also led to a divergence between the EU and UK sanctions regimes. For example, EU sanctions provide an exemption to restrictions on particular financial activities in Russia for EU-based subsidiaries of designated entities. After 31 December 2020, any UK-based subsidiaries of designated entities under this sanctions regime will only be exempt from the UK equivalent of this restriction and vice versa. The United Kingdom has also expanded the prohibition of ‘financial assistance’ relating to the supply of certain goods. While the Court of Justice of the European Union has held that ‘financial assistance’ does not include payment processing,[59] the UK equivalent of this sanctions regime refers to the provision of ‘financial services’ instead, which includes payment processing.[60]

Additionally, OFSI has issued post-Brexit guidance extending the scope of financial sanctions to entities owned or controlled, directly or indirectly, by a designated person.[61] Substantial changes to the designation process have also been implemented. SAMLA brings with it a lower threshold for the imposition of sanctions as compared with the EU regime, requiring only that it be ‘appropriate’ to designate a person, rather than having to satisfy the ‘necessity test’ under EU law.[62] It also provides for the designation of persons by description,[63] which does not currently feature in the EU sanctions regime and which may result in identification challenges for sanctions screening and compliance processes in future.

Finally, instead of seeking redress in the EU courts, a person designated under the United Kingdom’s autonomous sanctions regime post-Brexit may seek variation or revocation of the designation by the Secretary of State or HM Treasury.[64]

SAMLA introduces US-style general licence exemptions (separate from OFSI’s existing powers to issue general licences around the United Kingdom’s domestic terror sanctions regime), which allow a person to undertake acts that would otherwise be prohibited without the need to apply for a specific licence.[65]

Further divergence from the European Union can be seen in the United Kingdom’s enactment of the Global Anti-Corruption Sanctions Regulations 2021 on 26 April 2021, which specifically target individuals involved in serious corruption and authorise asset freezes and travel bans on individuals and asset freezes on entities.[66] This is in addition to the Global Human Rights Sanctions Regulations 2020,[67] representing the United Kingdom’s first use of Magnitsky-style sanctions and preceding the European Union’s own set of human rights sanctions legislation by four months.[68] These important developments demonstrate that the United Kingdom is still able and willing to take the lead on sanctions enforcement, instead of reacting and following in European footsteps.

In light of the above, individuals and entities are well advised to stay informed of any developments in this sphere, and to ensure that any sanctions compliance programme is sufficiently robust and agile to adapt to the shifting landscape of the United Kingdom’s autonomous sanctions regime.


[1] Rita Mitchell and Simon Osborn-King are partners and Yannis Yuen is an associate at Willkie Farr & Gallagher LLP.

[2] See, e.g., Council Regulation (EU) 2017/1509 of 30 August 2017 concerning restrictive measures against the Democratic People’s Republic of Korea and repealing Regulation (EC) No. 329/2007,

[3] See, e.g., The Democratic People’s Republic of Korea (European Union Financial Sanctions) Regulations 2017,

[4] UK Financial Sanctions: General guidance for financial sanctions under the Sanctions and Anti-Money Laundering Act 2018, Office of Financial Sanctions Implementation (OFSI), (OFSI Financial Sanctions Guidance).

[5] OFSI enforcement and monetary penalties for breaches of financial sanctions: Guidance, OFSI, (OFSI Enforcement Guidance).

[6] See, e.g., Red ALERT – Financial Sanctions Evasion Typologies: Russian Elites and Enablers, National Economic Crime Centre (July 2022),

[7] OFSI Enforcement Guidance, para. 3.8.

[8] OFSI Financial Sanctions Guidance, para. 4.

[9] Via The Protecting against the Effects of the Extraterritorial Application of Third Country Legislation (Amendment) (EU Exit) Regulations 2020,

[10] Council Regulation (EC) No. 2271/96,, Articles 4, 5 and 6, as amended by The Protecting against the Effects of the Extraterritorial Application of Third Country Legislation (Amendment) (EU Exit) Regulations 2020.

[11] OFSI Financial Sanctions Guidance, para. 6.5.

[12] For example, see the Terrorist Asset-Freezing etc. Act 2010,, s.17.

[14] OFSI Financial Sanctions Guidance, para. 6.8.

[15] Defined in section 19A of the Russian (Sanctions) (EU Exit) Regulations 2019 (as amended) as: ‘(a) an individual who is, or an association or combination of individuals who are, ordinarily resident in Russia, (b) an individual who is, or an association or combination of individuals who are, located in Russia, (c) a person, other than an individual, which is incorporated or constituted under the law of Russia, or (d) a person, other than an individual, which is domiciled in Russia’.

[16] ‘UK sanctions relating to Russia’,

[19] Council Regulation (EC) No. 2271/96,, as amended by the Protecting against the Effects of the Extraterritorial Application of Third Country Legislation (Amendment) (EU Exit) Regulations 2020.

[20] ‘UK sanctions relating to the Democratic People’s Republic of Korea’,

[21] OFSI Financial Sanctions Guidance, para. 3.1.3.

[22] OFSI Financial Sanctions Guidance.

[25] This was an increase on the previous maximum penalty of two years. See the European Communities Act 1972,, Schedule 2, para. 1(1)(d).

[26] Proceeds of Crime Act 2002,, s.334.

[27] Policing and Crime Act 2017 (as enacted),, s.146.

[28] ibid., s.146(1A); Economic Crime (Transparency and Enforcement) Act 2022,, s.54(3); OFSI Enforcement Guidance, para. 3.5.

[29] Policing and Crime Act 2017 (as enacted), s.146.

[30] For example, under the Terrorist Asset Freezing etc. Act 2010, certain institutions have an affirmative reporting obligation to the Treasury where they have knowledge or reasonable cause to suspect that someone is a designated person or has committed an offence involving certain prohibitions in relation to designated persons. See Terrorist Asset Freezing etc. Act 2010, s.19.

[31] See, e.g., Criminal Justice Act 1987,, s.2.

[32] ‘Bribery, corruption and sanctions evasion’, National Crime Agency,

[33] Financial Conduct Authority’s (FCA) Principles for Businesses,, Principle 3.

[34] FCA’s Senior Management Arrangements, Systems and Controls Sourcebook,, Rule 3.2.6.

[35] ibid. Rule 6.1.1.

[37] Financial Services and Markets Act (FSMA),, s.165.

[38] FCA’s Principles for Businesses, Principle 11.

[39] FSMA, s.171.

[40] ibid., s.172.

[41] Final Notice – Tullett Prebon (Europe) Limited (11 Oct. 2019),, para. 6.45.

[43] OFSI Enforcement Guidance, para. 3.39.

[44] For example, Standard Chartered Bank was able to secure a 30 per cent reduction for its voluntary self-disclosure,

[45] OFSI Enforcement Guidance, para. 3.44.

[47] Under FSMA, Part 4A.

[48] Definitions of each of these businesses and professions can be found in the relevant UK regulation for each sanctions regime.

[49] OFSI Enforcement Guidance, para. 3.2.

[54] OFSI Enforcement Guidance, para. 3.18.

[56] ‘Decision Notice – Standard Chartered Bank’ (5 Feb. 2019),

[57] Civil Penalties and Enforcement Information, US Department of the Treasury,

[58] ibid.

[59] PJSC Rosneft Oil Company v. Her Majesty’s Treasury and Others, Case C-72/15,

[60] The Russia (Sanctions) (EU Exit) Regulations 2019,, ss.28, 37, 44 and 52; Russia sanctions: guidance, (noting that financial services include payment processing).

[61] OFSI Financial Sanctions Guidance, s.4.

[62] Sanctions and Anti-Money Laundering Act 2018,, s.11.

[63] ibid., s.12.

[64] ibid., s.23.

[65] ibid., s.15.

[66] Global Anti-Corruption Sanctions Regulations 2021,

[67] Global Human Rights Sanctions Regulations 2020,

Unlock unlimited access to all Global Investigations Review content