On 10 November 2025, the UK’s Office of Financial Sanctions Implementation (OFSI) issued a £160,000 penalty against the Bank of Scotland Plc (Bank of Scotland).
The conduct at issue was the processing of 24 payments made in February 2023, totalling over £77,000, into and out of a personal current account held by Dmitrii Ovsyannikov, a designated person under the Russia (Sanctions) (EU Exit) Regulations 2019 (the Russia Regulations). OFSI found that (i) the processing of the 24 payments breached Regulation 11 (dealing with funds owned, held, or controlled by a designated person) and (ii) the four payments that Bank of Scotland credited to the account also breached Regulation 12 (making funds available to a designated person).
There are a number of points of interest from this enforcement action:
a) After considering aggravating and mitigating factors in line with OFSI’s Enforcement Guidance (last updated in November 2024), OFSI determined the case fell into the “serious” category.
Relevant aggravating factors included that: (i) the bank made significant funds directly available to a designated person; (ii) sanctions imposed in respect of Russia remain a strategic priority for the UK and its foreign policy; (iii) the bank had information that inferred that a sanctioned individual owned the account; (iv) the compliance function did not use a commercial sanctions list, only a politically exposed person (PEP) list, and OFSI considers it reasonable to expect firms with greater sanctions exposure to enhance sufficiently the lists they use in sanctions screening, either via a commercial package or through their own enhancement using available information; (v) there were no explicit PEP procedural instructions for escalating all potential sanctions connections for review; and (vi) the mandatory and advanced sanctions training was out of date.
In this case, the designated person’s passport details differed slightly from the OFSI Consolidated List (having four differences in the spelling). Additionally, although the designated person triggered a PEP alert (and a commercial list was used here), upon manual review, it was wrongly determined that OFSI had removed Ovsyannikov from its UK List. While Ovsyannikov had been removed from the EU list, he had not been removed from the UK List. OFSI also criticised internal PEP procedure failures as there should have been an explicit instruction to escalate all potential sanctions connections to the relevant sanctions team, given that many sanctioned individuals are PEPs.
b) The breaches were formally disclosed to OFSI promptly after they occurred, and Bank of Scotland benefitted from the full 50% voluntary disclosure discount, as well as a further reduction in the fine levied following consideration of representations made after the issuance of a Notice of Intention to impose a £175,000 penalty.
Takeaways
The decision emphasises the importance of adequate and up-to-date internal compliance procedures and policies, particularly for entities with greater sanctions exposure. Aggravating factors (iv) to (vi) listed above highlight the potential for failures in compliance procedures, including where businesses lack robust guidance or up-to-date staff training. Businesses may wish to consider and revise internal procedures as necessary to support thorough, risk-assessed, and effective processes. They may also wish to consider whether they are taking sufficient advantage of commercially available compliance tools, particularly if they have a high risk of sanctions exposure.
Although Bank of Scotland received a smaller fine than it otherwise may have, the final figure represents more than double the value of the payments in issue. Regardless of the sums involved in transactions found to be in breach of the Russia Regulations, errors may have significant financial consequences.