On 11 August 2026, OFSI imposed a monetary penalty of £4,732,830.58 on Citibank, N.A., London Branch (“CBNA London”) for breaches of the Russia (Sanctions) (EU Exit) Regulations 2019 (“the Russia Regulations”) and the Global Anti-Corruption Sanctions Regulations 2021 (“the GAC Regulations”). OFSI identified 970 transactions with an aggregate value of approximately £19.7 million which it considered to be in breach of UK financial sanctions legislation. Most of the breaches occurred between February and November 2022, although ten payments falling under the GAC regime were processed as late as January to July 2025.
This was not a sanctions circumvention case. Rather, OFSI identified a series of systems and controls weaknesses and operational failures which resulted in repeated breaches across several areas of the bank’s business. The breaches arose in connection with corporate banking clients, correspondent banking activities, and CBNA London’s role as Principal Paying Agent (PPA) in relation to loan participation notes issued by an SPV on behalf of an entity whose beneficial owner subsequently became a designated person.
Several breaches stemmed from deficiencies in identifying designated persons and entities owned or controlled by them. In some instances, accounts were not restricted promptly because of errors in ownership and control assessments or because subsidiary companies linked to designated persons were not identified. OFSI notably observed that in May 2022 CBNA London temporarily amended its internal guidance so that staff were not required to seek restrictions on accounts under investigation unless they had evidence of 50% or greater ownership by a designated person. OFSI considered that this change increased both the risk that accounts would remain unrestricted and the duration of that exposure.
The case also highlights a number of screening failures. One system calibration issue prevented the bank from recognising that “PAO Sovcomflot” in its KYC records corresponded to “Sovcomflot” on OFSI’s Consolidated List. As a result, no sanctions alerts were generated despite the bank’s records indicating exposure to the designated person. In other cases, designated Russian banks or entities owned or controlled by them were not identified because Bank Identification Codes (BICs) had not been incorporated into internal screening records.
The correspondent banking breaches revealed further vulnerabilities. Some payment information was screened before the correspondent banking chain had been fully constructed, allowing designated persons to be added after screening had taken place. Returned payments were not always analysed using information already available to the bank, and in several cases potentially relevant general licences were never assessed because no sanctions alert had been generated. As OFSI observed, the absence of an alert meant that the bank carried out no prior assessment of whether the general licences applied before processing the transactions.
OFSI also identified multiple instances of human error. Alert handlers made incorrect determinations, staff applied inappropriate guidance, escalation procedures were not properly followed, sanctions cases were referred to the wrong teams, and relevant information was not shared effectively between functions. In one notable example, CBNA London returned approximately £1.5 million representing an interest payment received in its capacity as Principal Paying Agent for loan participation notes linked to an entity owned or controlled by a designated person. OFSI concluded that this resulted in funds being made available indirectly to a designated person.
OFSI considered the repeated, persistent and extended nature of many of the breaches to be an aggravating factor. The authority also highlighted 53 failures to report frozen assets “as soon as practicable”, with an average reporting delay of 274 days and, in eleven cases, delays of up to 518 days. On the other hand, OFSI acknowledged that CBNA London voluntarily disclosed most of the breaches and cooperated extensively throughout the investigation. A 20% voluntary disclosure and cooperation discount, combined with a further 20% settlement discount, reduced the penalty from a baseline amount of £7.89 million to £4.73 million.
Why could decisions of this kind become more frequent?
In the United Kingdom, for breaches committed on or after 15 June 2022, OFSI may impose a civil monetary penalty without having to establish that the person knew, or had reasonable cause to suspect, that sanctions were being breached. This strict liability regime does not apply retroactively and does not alter the threshold applicable to criminal offences. At the same time, OFSI’s enforcement approach demonstrates an increasingly robust focus on systems, controls and compliance frameworks, rather than solely on deliberate sanctions evasion.
This scrutiny of compliance frameworks is also visible within the European Union. In 2026, Wise Europe was sanctioned in Belgium for serious deficiencies relating to KYC procedures, beneficial ownership verification, ongoing monitoring of business relationships and the review of unusual transactions. Although that case arose in the anti-money laundering context, it reflects a similar regulatory concern: whether financial institutions possess adequate systems to identify, assess and manage compliance risks effectively.
Recent developments in EU sanctions case law point in the same direction. In Inter Rao Lietuva (C‑147/25), the Court of Justice further clarified the concepts of ownership and control, which are essential when determining which non-listed entities must also be treated as subject to asset-freezing measures. As these concepts become more clearly defined, expectations placed on financial institutions regarding ownership and control assessments, sanctions screening and asset-freeze implementation are likely to become increasingly demanding. We refer in this regard to our previous article on that judgment.
Those developments must also be viewed alongside Directive (EU) 2024/1226, which requires Member States to criminalise a broad range of violations of EU restrictive measures, and the new AML VI framework applicable from 10 July 2027. For financial institutions, the effectiveness of sanctions and financial crime control frameworks is becoming a central component of both regulatory and criminal risk management.
