UK sanctions update – the summer of sanctions is set to be a heatwave

Several recent developments demonstrate that sanctions remain a top priority for the UK enforcement authorities.

In particular, two high-profile cases confirm that those committing sanctions breaches face significant penalties and damage to reputation following extensive publicity.

To manage the risk of a sanctions breach, businesses across all sectors should implement effective compliance measures.

In this article, we summarise recent UK sanctions developments, provide our views on their likely impact and explain the compliance measures businesses can take.

Enforcement – a tale of two cases

Two recent cases demonstrate that sanctions breaches will not be tolerated by the UK authorities.

First, in March 2025, the UK Office of Financial Sanctions Implementation (“OFSI”) imposed a monetary penalty of £465,000 on Herbert Smith Freehills CIS LLP Moscow. The breach arose from six payments made by the firm to sanctioned parties subject to an asset freeze. The decision has been the subject of extensive media commentary.

Following the case, OFSI made it clear that it expects businesses to: “take sufficient time and care to properly assess the applicability of sanctions to the specific legal entities they are dealing with”. This exercise involves (1) identifying whether a potential business partner is itself subject to sanctions and (2) whether the potential business partner is “owned or controlled directly or indirectly” by parties subject to sanctions. There are several recent court decisions around the ownership and control test, and it can often be challenging to reach a settled conclusion particularly where complex corporate structures exist. To manage the risk associated with reaching the wrong conclusion and / or failing to fulfil OFSI’s expectation that “sufficient time and care” is taken when considering the owned or controlled aspect, legal advice should be taken prior to a take-on decision.

Second, in April 2025, two individuals were the first to be convicted of offences for breaching the UK’s Russia sanctions regime. Both individuals received custodial sentences with the sentencing court noting: “The Crown rightly emphasised that there are some 3,600 individuals listed on the UK sanctions list and that it is if not imperative, at least important, that the Court sends a strong message to those designated individuals, to encourage compliance with the regime and deter breaches.”

In imposing custodial sentences, the sentencing court sent a clear message that those engaging in sanctions breaches will face serious consequences.

Following the convictions, the Director General of the National Crime Agency sent his own clear message: “These convictions demonstrate not only that designated individuals are on our radar, but so are those who enable breaches of the regulations.”

We therefore have enforcement agencies determined to take enforcement action and a willingness from courts to impose serious sentences.

We expect the trend of robust investigation and enforcement action to continue with increasing regularity – experience tells us that enforcement authorities are galvanised by positive outcomes. The likes of OFSI, the NCA and other UK regulatory and prosecution agencies will be emboldened by these cases. It feels inevitable that we will see a growing pattern of active investigation and enforcement in relation to sanction breaches.

In addition to the sentences imposed, the case is striking because it demonstrates that businesses must continually monitor the effectiveness of existing compliance systems. One of the convicted individuals applied to a UK bank for an account. Under the sanctions regime, the bank should not have accepted the application. In fact, bank employees initially opened the account in error. Businesses should ensure staff are aware of the required steps to identify whether a potential customer is sanctioned and, if so, the appropriate action to take. Training is one way of ensuring staff understand their role.

Reporting obligations

In parallel with increased enforcement action, we have seen a recent expansion of the types of business required to proactively report sanctions concerns. For instance, from 14 May 2025, letting agents are required to report breaches or suspected breaches of UK financial sanctions regulations. There is no monetary threshold – the reporting obligations apply irrespective of the value of any rental agreement.

OFSI has produced guidance explaining that: “Under the reporting obligations, a relevant firm is required to report to OFSI as soon as practicable if it knows or has reasonable cause to suspect that a person (i) is a designated person; or (ii) has committed a breach of financial sanctions regulations. Where the designated person is a customer of the relevant firm, the relevant firm must also report to OFSI the nature and amount or quantity of any funds or economic resources held by it for the customer at the time when it first had the knowledge or suspicion.”

A similar approach now applies in relation to high value dealers – again OFSI has produced guidance confirming the proactive reporting requirements.

These developments demonstrate the increased appetite of OFSI to require businesses to identify and report suspected sanctions breaches. The impact is three-fold. First, an extension of the reporting obligations will inevitably lead to OFSI identifying a greater number of sanctions breaches and accordingly taking enforcement action more regularly. Second, businesses must implement due diligence processes allowing them to identify if a customer may be in breach of UK sanctions and, if so, to make a report. Third, there is potential liability for firms that fail to report – it is an offence to fail to comply.

Whistleblowing

On 15 May 2025, a policy paper on sanctions implementation and enforcement was published. The paper follows a review of the UK sanctions regime.

One of the aims of the review was to: “increase the deterrent effect of enforcement”, again emphasising the commitment to increased enforcement.

There has already been action in conjunction with the paper’s publication. For instance, whistleblowing protections will be extended to those that report sanctions concerns. In order to encourage individuals to report sanctions concerns, the policy paper identified that: “Ensuring that workers who disclose prescribed information relating to breaches of financial, transport, and certain trade sanctions to the relevant government departments can qualify for whistleblowing protections may increase the number of disclosures made to government, supporting sanctions implementation and enforcement.” As a result, The Public Interest Disclosure (Prescribed Persons) (Amendment) Order 2025 will come into force on 26 June 2025 and will provide statutory protection for those that report sanctions concerns.

As a result, businesses can expect more whistleblowing reports relating to sanctions. Similarly, businesses can expect more whistleblowing reports in relation to fraud concerns as a result of changes introduced in the Economic Crime and Corporate Transparency Act 2023. Whistleblowing systems must be equipped to handle an increasing volume of reports. In addition, effective action must be taken following receipt of a report – the authorities will take a dim view of an organisation that fails to properly investigate a report received in relation to sanctions and other financial crimes.

What should businesses be doing?

In a word: act. The recent developments summarised in this article confirm that breaches are more likely than ever to be identified and to result in enforcement action, penalties and damage to reputation. Doing nothing creates a risk of a business finding itself in a breach situation.

The following steps are examples of the action businesses can take to demonstrate compliance:

1. Take professional advice on the relevant sanctions obligations and developments that impact your business.
2. Identify an individual or team within the business with responsibility for implementing an effective sanctions compliance system.
3. Implement a sanctions compliance system / update an existing system. The starting point is to assess the risk of sanctions breaches across business activities. Risk control measures can then be rolled out. The relevant risks will vary from sector to sector and from business to business. Project specific risk assessments may also be required.
4. Communicate expectations to staff and business partners. This step can be taken via training, updating contractual obligations and monitoring conduct.
5. Carry out robust due diligence prior to take-on. Every business must have an effective system to check whether a potential partner is subject to sanctions and, crucially, to check whether those parties are owned or controlled by those subject to sanctions. Legal advice should be taken on whether a potential partner is owned or controlled by sanctioned parties. OFSI’s position on this point is clear: “Failure to properly consider and identify clear ownership is viewed more poorly by OFSI than an incorrect but good faith assessment of control.” Taking professional advice from subject experts prior to a take-on decision is an effective way of demonstrating that there was proper consideration of the ownership and control aspect.
6. Monitor partners during the course of the relationship. If ownership structures change, a sanctions review should be conducted. Similarly, when the list of those subject to UK sanctions is updated (a regular occurrence), reviews should be conducted. That point applies to EU and US sanctions regime as much as it does to UK sanctions. By way of example, the US Department of Justice published guidance on 12 May 2025 identifying its areas of focus. Sanctions breaches are identified as one of the “high-impact areas” in relation to which the DOJ will prioritise investigation and prosecution. The alignment between the UK and US authorities demonstrates that sanctions breaches should be treated as a global risk requiring careful management.

Take-away comments

The recent legal and regulatory developments explained in this article confirm that UK sanctions enforcement will continue to trend upwards. Far better, then, for businesses to invest in compliance than risk a breach.

For advice on sanctions, please contact Ramsay Hall.