The United Kingdom’s Office of Financial Sanctions Implementation (OFSI) has imposed its first monetary penalties under its new settlement scheme for breaches of the United Kingdom’s Russian sanctions regime (the Russia Regulations)¹ and separately published a three-year strategy and cross-government policy paper on sanctions enforcement. Taken together these developments provide an early indication of how OFSI’s revised enforcement framework is taking shape.

Monetary penalties

On 19 May 2026, OFSI imposed a monetary penalty on a bank for breaches of Regulation 12 of the Russia Regulations, which prohibits making funds available to a person owned or controlled by a designated person.

The penalty relates to two payments processed on behalf of an entity that had recently been acquired by a designated person. Although the bank screened the entity prior to processing the payments, no alert was generated, as the data provided by the bank’s third-party screening vendor did not include information on the entity’s ownership.

The first payment was processed on the same day the owner of the entity was designated. It is clear that OFSI would have taken this into account in mitigation, but the fact that there was a subsequent breach a month later was identified by OFSI as a significant factor for including the first payment in the penalty. This suggests a degree of regulatory tolerance of isolated failures at the point of designation where those failures are not indicative of wider control failures.

On 19 March 2026, OFSI imposed a monetary penalty on a tech company for an equivalent Regulation 12 breach in respect of two payments of identical amounts, made to the same entity. This suggests that both enforcement actions arose from the same underlying transactions, although OFSI has not confirmed this.

Strict liability

These penalties neatly illustrate the effect of the United Kingdom’s strict liability civil sanctions regime, which came into effect on 15 June 2022. Earlier payments to the same entity were not treated as breaches because they predated that regime. Under the old standard, OFSI was required to establish knowledge of or reasonable cause to suspect a breach before deploying its civil penalty powers. Both penalty notices record that OFSI found no evidence of intent, knowledge or actual suspicion on the part of the bank or the tech company. While absence of fault may operate as a mitigating factor, it is not sufficient to avoid a penalty.

Jurisdiction

The second of these cases also demonstrates the application of UK financial sanctions to non-UK entities where payments are made via UK financial institutions. Although the tech company is not UK-incorporated, OFSI found jurisdiction on the basis that the company’s failure to cancel its payment instructions amounted to conduct in the United Kingdom because the payments were made from a UK-based bank account that the company controlled. For multinational firms, this is a reminder that UK sanctions exposure can arise from the use of UK-based payment infrastructure, even where accounts are managed outside the United Kingdom.

Enforcement timeline

In both cases, there was a three-year gap between voluntary disclosure of the payments and the penalty notices. As we have previously noted, the length of OFSI’s enforcement cycle remains a concern for the subjects involved and acts as a potential disincentive for voluntary disclosure.

Settlement

Both cases were resolved through OFSI’s new settlement scheme, introduced on 9 February 2026 as part of a broader package of reforms which also included the introduction of the Early Account Scheme, under which subjects of an investigation provide OFSI with an account of a breach in return for a discount of up to 20%, and a revised Voluntary Disclosure and Co-operation discount of up to 30%.

Under the new scheme, the subject agrees to pay the penalty and to waive rights of review or appeal in return for an additional discount and the opportunity to input into the published summary of the case. The precise interaction between the Voluntary Disclosure discount and the settlement discount is not evident from the published notices. What is clear is that both parties achieved significant reductions (35% and 45%) against the respective baseline penalties.

Three-year strategy and policy paper

On 15 April 2026, OFSI published its strategy for 2026–29 (the Strategy), coinciding with its 10th anniversary. The Strategy reflects on a decade in which OFSI’s mandate has fundamentally expanded from a relatively low-profile licensing body to an agency that since 2021 has progressed over 1,400 enforcement cases, issued 18 public enforcement decisions and imposed more than £22 million in monetary penalties.

The Strategy adopts a new operating model—Promote, Enable, Respond, Change—signalling OFSI’s ambition to move beyond reactive enforcement towards a more proactive, intelligence-led approach. Several elements are worth highlighting, with OFSI committing to:

• Submit 90% of new enforcement investigations for decision within 18 months.
• Increasingly pursue intelligence-originated cases, beginning in 2027, bringing it closer to the proactive model adopted by the Office of Foreign Assets Control (OFAC) in the United States.
• A target of closing 50% of licensing cases within six months.
• Sector-specific engagement and delivering quarterly joint or co-branded output with international partners, including guidance, advisories and case studies. In support of OFSI’s deepening international alignment, the Strategy cites its Enhanced Partnership with OFAC, in place since 2022, and cooperation with the European Commission on sanctions design.

The Strategy sits within a broader move towards greater coordination across the UK sanctions enforcement landscape. In March 2026, the UK Government published a cross-government policy paper (the Policy Paper), setting out its strategic approach to sanctions enforcement.

The Policy Paper serves as a useful, albeit basic, resource and first port of call. It sets out the various government bodies and agencies with responsibility for criminal and civil enforcement across the various types of sanctions. It outlines the range of potential consequences for different types of breaches and mitigating and aggravating factors that may be considered in enforcement decisions.

Separately, on 28 May 2026, the United Kingdom’s Financial Conduct Authority (FCA) published findings from its review of firms’ sanctions systems and controls, identifying weaknesses in due diligence and screening as among the most common root causes of reported breaches. We have written on the key takeaways from the FCA’s findings here.

Read together, the Strategy, the Policy Paper and the FCA’s review point towards a more coordinated and structured enforcement framework across the UK sanctions landscape.

The path ahead

These enforcement cases underline OFSI’s continued reliance on self-reported breaches and cooperative resolution to produce enforcement outcomes. The Strategy, however, points to more structured, and potentially more assertive, enforcement. Whether that shift materialises will depend on OFSI’s ability to originate and progress intelligence-led cases within its stated timelines.