UK Sanctions Compliance: Who Must Comply, What to Report and the Penalties

Who has to comply with UK sanctions?

UK financial sanctions apply to anyone in the United Kingdom or its territorial sea and to any UK person anywhere in the world, which covers UK nationals and bodies incorporated or constituted under the law of any part of the United Kingdom. Section 21 of the Sanctions and Anti-Money Laundering Act 2018, usually shortened to SAMLA, sets the outer limit for what sanctions regulations may reach. The regimes then apply prohibitions within those limits. Regulation 3 of the Russia (Sanctions) (EU Exit) Regulations 2019, the Russia Regulations, is the working provision for that regime. The Office of Financial Sanctions Implementation (OFSI) adds that branches of UK entities are included wherever they operate.

What is a UK nexus?

For an organisation outside the United Kingdom the question is what creates a connection to the UK. A non-UK person can be caught where part of the conduct takes place in the United Kingdom. OFSI calls that connection a UK nexus. Its enforcement guidance gives transactions using clearing services in the United Kingdom as an example, together with a UK company working overseas, actions by a local subsidiary of a UK company depending on the governance, action taking place abroad but directed from within the country and financial products or insurance bought on UK markets but used elsewhere. OFSI adds that its examples are not exhaustive or definitive and that every case turns on its own facts. This means that an organisation does not necessarily need a UK entity for OFSI's enforcement authority to be engaged. Even so, a payment provider in Zurich or Frankfurt with no UK entity could potentially create a UK nexus through the clearing leg of a payment.

Who enforces UK sanctions?

Responsibility for UK sanctions is split across several government bodies and regulators. Which body you are dealing with determines who you apply to for a licence and who you report to when you hold frozen funds. The Foreign, Commonwealth and Development Office (FCDO) publishes the UK Sanctions List and is responsible for most UK sanctions designations. Designations under the UK's domestic counter-terrorism regime are made by HM Treasury, which OFSI sits inside, because regulation 5(1) of the Counter-Terrorism (Sanctions) (EU Exit) Regulations 2019 gives that power to the Treasury rather than to the FCDO. OFSI implements and enforces financial sanctions, issues licences and receives reports.

Trade sanctions responsibilities are also split. The Office of Trade Sanctions Implementation (OTSI) has civil enforcement responsibilities for certain services sanctions and trade sanctions involving goods outside the United Kingdom. Since 27 April 2026 it also licenses goods for export to sanctioned destinations, in addition to services. Licensing of goods and ancillary services subject to both strategic export controls and sanctions stays with the Export Control Joint Unit, while HM Revenue and Customs handles trade sanctions at the border. The remaining measures sit with the bodies that run them, the Home Office for travel bans, the Department for Transport for transport sanctions, Ofcom for internet services and the Insolvency Service for director disqualification. Criminal enforcement of financial and transport sanctions is led by the National Crime Agency. Supervision of firms' sanctions systems and controls sits with the Financial Conduct Authority, or FCA.

The Bank of England is sometimes named as the UK sanctions regulator. As checked on 25 September 2026, neither OFSI's allocation of departmental responsibilities nor the cross-government strategic approach of March 2026 gives the Bank a sanctions role: that strategy names the FCA, the Solicitors Regulation Authority and the Office for Professional Body Anti-Money Laundering Supervision among the independent regulators. Neither the Bank nor the Prudential Regulation Authority appears. The Bank co-signed a joint regulatory statement on sanctions in March 2022 without that making it an enforcement authority.

What should you do when you get a UK sanctions hit?

Check the rest of the entry before you act, because a name match is not yet a target match, a distinction OFSI draws in its general guidance. You compare the date of birth, address and identifiers on the entry with what you know about the party in front of you before deciding whether the match can be discounted. Where a close name match comes with a similar date of birth but a different address, OFSI treats that as a potential target match and asks to be contacted, because it may be a new alias.

Where a match is confirmed as a designated person, OFSI's general guidance sets out what follows for a person holding the assets. The funds or economic resources are frozen. They may not be dealt with and funds or economic resources may not be made available to or for the benefit of the designated person, unless an exception applies or a licence is held. A freeze does not transfer ownership and nothing is passed to OFSI for safekeeping.

Separate reporting obligations apply to relevant firms, a category defined in the financial sanctions regulations. It includes authorised financial firms and money service businesses as well as auditors, accountants, legal professionals, trust or company service providers, estate agents, casinos and cryptoasset businesses. Four further sectors joined on 14 May 2025, namely high value dealers, art market participants, insolvency practitioners and letting agents. The trigger is knowing, or having reasonable cause to suspect, where the information came to the firm in the course of carrying on its business. The report is due as soon as practicable, to the Treasury and in practice to OFSI. A report to your regulator or a suspicious activity report does not by itself discharge that duty.

A separate annual duty applies to persons who know or have reasonable cause to suspect that they hold funds or economic resources owned, held or controlled by a designated person. Under regulation 70 of the Russia Regulations and equivalent provisions in other regimes, relevant assets held as at 30 September must be reported to OFSI by 30 November each year. Since December 2024 that has been a standalone obligation with an offence attached for failure to comply without reasonable excuse. A firm that holds nothing frozen for a designated person falls outside regulation 70(4A) in the first place. Regulation 70(4B) covers the firm that reported last year and no longer holds those assets.

Licences come from OFSI for financial sanctions, either specific to an applicant or general and open to anyone who meets the conditions. OFSI's guidance states that a licence cannot be issued retrospectively, so an act carried out before a licence was granted may already be a breach. An OFSI licence also covers financial sanctions only, so a transaction may still need a trade licence from OTSI or an export licence from the Export Control Joint Unit on top.

What are the penalties for breaching UK sanctions?

A breach of UK financial sanctions can give rise to both civil and criminal consequences, which follow different standards. The civil standard is set by statute, not by guidance. Section 146(1) of the Policing and Crime Act 2017 allows the Treasury to impose a monetary penalty on any person, individual or entity, where it is satisfied on the balance of probabilities that the person has breached a prohibition or failed to comply with an obligation imposed by or under financial sanctions legislation. Section 146(1A), inserted by the Economic Crime (Transparency and Enforcement) Act 2022 with effect from 15 June 2022, provides that any requirement in that legislation for the person to have known, suspected or believed any matter is to be ignored for this purpose.

The penalty runs to one million pounds. Where the breach or failure relates to particular funds or economic resources and it is possible to estimate their value, the permitted maximum is instead the greater of one million pounds and 50 percent of that estimated value. A penalty can be imposed on an officer of a body corporate as well as on the body itself. Those are the civil figures as of September 2026. OFSI announced in January 2026 that it will seek to raise them to two million pounds and 100 percent of the breach value, which requires regulations under section 146(7) of that Act, approved by a resolution of each House under section 146(10). It is not yet in force.

Criminal liability is a separate route and depends on the elements of the particular offence. Regulation 11(1) of the Russia Regulations, for example, prohibits a person from dealing with funds or economic resources owned, held or controlled by a designated person where that person knows, or has reasonable cause to suspect, that they are dealing with such funds or economic resources. In a criminal prosecution, the prosecutor must prove that to the criminal standard. The decision to prosecute is a matter for the investigating and prosecuting authorities. Under the Russia Regulations, certain financial sanctions offences carry a maximum of seven years' imprisonment on conviction on indictment, while certain trade sanctions offences can carry a maximum of ten years. Section 17 of SAMLA sets ten years as the maximum term that sanctions regulations may prescribe on conviction on indictment.

Screening UK and global sources with dilisense

With dilisense you can search OFAC's SDN and consolidated lists, alongside EU, UN, UK and other sources, through a single API. The data updates hourly and every match is traceable to its origin.