Last month, the UK’s Office of Financial Sanctions Implementation’s (“OFSI”) published a Threat Assessment analyzing sanctions compliance involving UK financial services firms since February 2022, when Russia invaded Ukraine.

In the first of our two-part article (available here), we summarized the six key areas of risk that OFSI identified in its Threat Assessment.

In this concluding part, we consider next steps for UK financial services firms, including performing targeted lookbacks and assessing whether existing sanctions compliance programs and controls are properly attuned to the threats and vulnerabilities that OFSI identified, or whether urgent remediation is necessary.

Recapping the Key Threats

Briefly, according to OFSI’s “Threat Assessment” report[1], the six key sanctions-related threats posed to the UK by firms operating in the UK’s financial services sector are the following:

1. Failures to report suspected breaches to OFSI.

• Frozen funds being improperly maintained, and license conditions being breached.
• Usage of new professional and non-professional enablers to evade sanctions.
• Usage of enablers to make the payments necessary to maintain the lifestyles or assets of Russian Designated Persons (“DPs”).
• Enablers “fronting” for Russian DPs and claiming ownership of frozen assets.
• Usage of alternative payment methods and intermediary countries.

Overall, OFSI’s report very clearly signals the growing sophistication of the sanctions evasive tactics being deployed by Russian DPs.

Next Steps for UK Financial Services Firms

Given the potential for serious civil penalties, including fines of up to GBP 1 million or 50% of the total value of each violation, whichever is higher, on a strict liability basis, criminal prosecutions and jail terms of up to seven years, and the indeterminate reputational damage that can follow from sanctions violations, all financial services firms subject to UK sanctions must carefully review their sanctions compliance frameworks in light of OFSI’s findings and recommendations to ensure that they are not falling short in any of the areas identified.

In particular, UK financial services firms would be well-advised to respond to the Threat Assessment by:

1. Self-reporting any suspected breaches of UK financial sanctions in a timely manner. This necessitates two action items and possibly the support of specialist counsel:

• A lookback exercise to identify any past suspected breaches that might not have been reported but ought to have been.
• Clear and reasoned internal policies and procedures to ensure efficient alert management and dispositioning, the timely escalation and investigation of suspicious activities or transactions, and the prompt regulatory reporting of suspected breaches on an ongoing basis.

2. Updating existing sanctions compliance training plans and materials to ensure they pay careful attention to OFSI’s insights and recommendations. Where necessary, firms should consider arranging external training by specialist counsel.
3. Closely monitoring transactions for indicators of violative conduct, and particularly the many red flags that OFSI identifies in its report, including:

• New individuals or entities making payments to satisfy an obligation that previously was satisfied by a Russian DP.
• Individuals associated with Russian DPs, including possible professional or non-professional enablers, receiving significant amounts without adequate explanation.
• Frequent payments between companies owned or controlled by a DP.
• Attempts to deposit large sums of cash without adequate explanation.
• Crypto-to-fiat transactions (or vice versa) involving a Russian DP’s family members or associates.

4. Conducting appropriate due diligence on customers, scrutinizing arrangements for signs of “fronting”, and considering the following OFSI observations as triggers for enhanced due diligence:

• Individuals with limited profiles in the public domain, including those with little relevant professional experience.
• Inconsistencies in name spellings or transliterations, particularly those stemming from Cyrillic spellings.
• Recently acquired non-Russian citizenships, including from countries which offer “golden visa” schemes.
• Frequent or unexplained changes of name or locations of operation.

5. Determining which correspondent banks are part of the System for Transfer of Financial Messages (“SPFS”), which is Russia’s alternative to SWIFT and which has kept Russia connected to the international financial system and neutralized to some degree the intended effect of related restrictive measures. Since the European Counsel has banned EU banks operating outside of Russia from joining SPFS and since OFAC has warned in recent alerts that it will aggressively target foreign financial institutions who do so, it is important for financial services firms to factor into their sanctions risk assessments any ongoing transactional relationships with institutions using SPFS.

6. Understanding the requirements of all applicable sanctions regimes and remaining cognizant of the fact that there are many sanctions targets under the UK, EU, and US regimes that do not relate to Russia. For example, in its report, OFSI reminds UK financial services firms of the need to comply with sanctions relating to Iran, Libya, and North Korea.

7. Updating sanctions risk assessments to properly account for geographic exposure. For example, in its report, OFSI posits that, in the first quarter of 2024, of all the jurisdictions involved in breaches of UK financial sanctions, the UAE featured the most, followed by Luxembourg. This is valuable information and should be leveraged during any tailored and well-conducted risk assessment.

Additional Considerations

We understand that this is the first in a series of sector-specific assessments that OFSI plans to undertake, with the intention of assisting stakeholders in key UK sectors to understand and comply with UK sanctions. We will monitor for others and keep our readership updated.

[1] UK Government, Financial Services Threat Assessment, (February 2025).