The decision is significant for the wider UK sanctions compliance landscape. It provides a timely reminder of the strict liability nature of OFSI's civil enforcement regime and highlights OFSI's expectations regarding sanctions governance, resourcing and preparedness.
Nature of the breaches
OFSI found that CBNA London committed multiple sanctions breaches across its operations, including payment processing, correspondent banking and account management. The breaches involved:
- Processing 970 transactions with a cumulative value of approximately £19.7 million involving designated persons or entities owned or controlled by them.
- Failures to promptly freeze accounts connected to sanctioned Russian individuals and entities.
- Processing payments involving sanctioned Russian banks, including Alfa-Bank, Gazprombank and Sovcomflot-related entities.
- Deducting fees and charges from frozen accounts.
- Certain failures to report frozen assets to OFSI promptly.
- Additional breaches under the UK Global Anti-Corruption sanctions regime in 2025.
OFSI's assessment
OFSI assessed the case as "Level 4", the highest seriousness category under its enforcement framework.The regulator concluded that:
- The overall severity of the breaches was high and the bank's conduct was aggravating.
- The breaches caused material harm to the objectives of UK sanctions.
- Many breaches arose from foreseeable systems and controls weaknesses, delays in sanctions alert handling, inadequate escalation procedures and human error.
- CBNA London had substantial exposure to Russia-related sanctions risks and OFSI considered that the bank should have been better prepared for the increased sanctions risks arising from
- Russia's invasion of Ukraine in February 2022.
- The absence of intent was not a mitigating factor.
Mitigating factors and discounts
OFSI acknowledged that the unprecedented volume of sanctions introduced after Russia's invasion of Ukraine created significant operational challenges for firms with Russia exposure.It also recognised that:
- Citi voluntarily disclosed most of the breaches.
- The bank cooperated extensively with OFSI's investigation.
- Citi undertook extensive remediation and subsequently exited the Russian market.
The penalty was reduced through:
- A 20% voluntary disclosure and cooperation discount; and
- A further 20% settlement discount after the parties reached agreement during formal settlement discussions.
The final penalty of £4.73 million represents a 40% reduction from OFSI's baseline penalty of approximately £7.89 million.
Compliance lessons
OFSI emphasised that the case highlights the importance of:
- Robust sanctions screening and account-freezing controlsStress-testing sanctions compliance frameworks ahead of major geopolitical events.
- Timely and comprehensive self-reporting of suspected breaches.
- Careful assessment of whether general licences apply before processing transactions.
- Maintaining sanctions systems capable of managing large volumes of alerts during periods of rapid regulatory change.
Conclusion
OFSI recognised that the unprecedented size, scale and complexity of the sanctions measures introduced by the UK and its allies following Russia's invasion of Ukraine in 2022 created significant operational challenges for firms with exposure to Russia. While this context did not excuse the breaches, OFSI took it into account when assessing the case, particularly those breaches which occurred in early 2022 relating to sanctions screening, alert handling and investigation processes. Nevertheless, the penalty is among the most significant monetary penalties imposed by OFSI against a financial institution and reflects the increasing maturity of OFSI's enforcement activity. The decision serves as a reminder that OFSI's civil enforcement regime does not require proof of intent or knowledge. Firms may therefore face substantial penalties where sanctions controls fail, even in the absence of deliberate wrongdoing. Notably, OFSI appears to have assessed the adequacy of the firm's preparedness against the backdrop of escalating geopolitical tensions prior to February 2022. This suggests that firms are expected not only to react to sanctions developments, but also to assess and prepare for foreseeable sanctions risks where significant geopolitical events are unfolding. The notice also underscores the importance of senior management oversight of sanctions risk, including the allocation of sufficient resources, effective escalation procedures and governance arrangements capable of responding to rapidly changing sanctions requirements. More broadly, the decision provides a detailed roadmap of the controls, governance and alert management processes that OFSI expects firms to have in place to manage sanctions risk effectively.
The substantial reductions applied to the baseline penalty also reinforce the significant credit OFSI continues to give for voluntary disclosure, cooperation and remediation, even in cases involving serious and systemic compliance failures.
In a separate announcement, the UK Chancellor of the Exchequer, John Healey, has also recently suggested that the maximum monetary penalty available to OFSI will double, from 50% to 100% of the value of a sanctions breach.
As businesses navigate an increasingly complex sanctions landscape, they face growing challenges in keeping pace with new designations, evolving regulatory expectations and heightened enforcement activity across multiple jurisdictions. If you are a CEO, CFO, compliance officer, general counsel or director with concerns about sanctions exposure, potential enforcement action, financial penalties, or the possibility of individual liability, including criminal sanctions and custodial sentences, DWF's Sanctions Team can provide clear, practical and commercially focused advice. Please get in touch with Jonathan Moss or Laura Segger to discuss.
To find out more about our related services please contact:
