UK Publishes Financial Services Sector Threat Assessment for Financial Sanctions

The UK’s Office of Financial Sanctions Implementation (OFSI) has published a financial services sector threat assessment, to help UK firms better understand and protect against threats and vulnerabilities relating to financial sanctions. 

OFSI’s threat assessment identifies the growing sophistication of sanctions evasion tactics and key factors for firms to consider when complying with their legal and regulatory sanctions compliance obligations.

While the assessment is “not necessarily a direct reflection” of ongoing OFSI investigations or enforcement activity, recent statistics from the end of January 2025 report approximately 318 open investigations relating to Russian sanctions by OFSI, with 388 cases investigated and closed by OFSI since February 2022 (leading to two public enforcement actions). The assessment, as informed by OFSI’s mounting experience of enforcement investigations, is therefore likely to be taken into account not only by OFSI but also by the Financial Conduct Authority (FCA) when assessing firms’ compliance controls in this area.

OFSI report identifies six key risk areas

OFSI explicitly recognises that, given the complex nature of UK financial sanctions, “most suspected sanctions breaches involve UK financial services in some capacity”.

The assessment identifies six key sanctions threats relevant to the financial services sector and highlights evolving evasion tactics and red flags for firms to consider as part of their sanctions compliance framework.

The assessment also identifies intermediary countries frequently identified as involved in suspected sanctions breaches and the sanctions regimes of particular focus. 

1. Failure to self-disclose all suspected sanctions breaches

“It is likely that some UK financial services firms, including non-bank payment service providers (NBPSPs), have not self-disclosed all suspected breaches to OFSI. The timely identification and reporting of suspected breaches varies across the sector and across different UK sanctions regimes.”

OFSI has identified a likely under-reporting of suspected sanctions breaches, particularly among NBPSPs (which includes neo- or challenger- banks) and has identified some instances where there are substantial delays in identifying and reporting suspected breaches.

Whilst most suspected breaches reported to OFSI by UK financial services firms are self-disclosed, not all firms involved in a suspected breach have made self-reports.

Firms in the UK financial services sector have obligations to make self-reports to OFSI in applicable circumstances (and may also have obligations to report to the FCA and/or file Suspicious Activity Reports (SARs) with the National Crime Agency (NCA)). OFSI may raise questions with firms where they have not received breach notifications from some firms involved in a transaction where they have received notifications from other parties involved.

OFSI also encourages financial services firms to conduct lookback exercises to identify past potential breaches which have not been reported. This may also be an expectation of the FCA where deficiencies in a sanctions control environment have been identified.

2. Improper maintenance of frozen assets and licence breaches

“It is highly likely that most non-compliance by UK financial services firms has occurred due to several common issues, including the improper maintenance of frozen assets and licence conditions breaches. These issues are relevant to compliance with all UK sanctions regimes"

OFSI has identified that non-compliance by UK financial services firms arises in a significant proportion of cases due to improper maintenance of frozen assets and breaches of licence conditions.

In particular, OFSI has observed unauthorised debits being permitted from accounts held by Designated Persons (DPs) at UK banks. For example, controls may fail to block payments related to automatic renewals of insurance policies or other contracts.

OFSI has also noted failures to identify entities owned by DPs, including subsidiaries of Russian businesses, and advises firms to ensure they operate up-to-date due diligence software and conduct increased due diligence when presented with red flags. OFSI similarly observed failures in identifying UK connections in transactions involving multiple jurisdictions, leading to improper scrutiny of suspicious transactions and highlighting the importance of accurate assessments as to whether there is sufficient nexus to engage UK sanctions.

OFSI additionally identified three main causes of breaches of sanctions licences:

• transactions after licence expiry;
• use of bank accounts not specifically authorised under licences; and
• failure to meet reporting requirements.

OFSI actively monitors compliance with licence permissions and it is important for firms to ensure that once a licence has been obtained, controls are implemented to comply with its terms and to monitor the expiry period.

3. Use of enablers by designated persons to evade UK sanctions

“It is almost certain that Russian [DPs] have turned to new professional and non-professional enablers in their attempts to breach UK financial sanctions prohibitions. OFSI has observed significantly increased enabler activity since 2023.”

Since 2023, OFSI has observed a significant rise in enabler activity aimed at breaching UK financial sanctions by and on behalf of Russian DPs.

This trend involves both professional enablers and non-professional enablers (such as family members and associates of DPs):

• making payments to sustain the lifestyles and assets of DPs;
• acting on behalf of DPs to claim ownership or control of frozen assets; and
• providing liquidity through alternative payment methods (e.g. crypto-assets).

Financial services firms are advised to be alert to the increasingly sophisticated means used by DPs and their enablers to seek to breach UK sanctions. OFSI sees banks and NBPSPs as well-positioned to identify and report potential sanctions breaches, with over 65% of all suspected breach reports received by OFSI being made by financial services firms.

4. Maintaining lifestyles and assets

“It is highly likely that enablers have made payments through NBPSPs relating to the maintenance of Russian DPs’ lifestyles and assets, including superyachts and UK residential properties.”

Since February 2022, OFSI has observed that most enabler activity has been linked to maintaining the lifestyles and assets of Russian DPs. OFSI considers it highly likely that payments have been made through NBPSPs in particular to enable payments to be made to maintain DPs’ lifestyles (e.g. making payments for superyachts, concierge and personal security services, property management, school fees and high-value goods). 

OFSI has advised firms to consider the following red flags in particular:

• a new individual or entity making payments to meet an obligation previously met by a Russian DP;
• individuals associated with Russian DPs, including family members and professional enablers, receiving funds of significant value without adequate explanation;
• frequent payments between companies owned or controlled by a DP;
• attempts to deposit large sums of cash without adequate explanation;
• crypto-asset to fiat transactions (or vice versa) involving a Russian DP’s family members or associates; and 
• a family member of a DP is an additional cardholder on a purchasing card and regularly uses the card for personal expenses and overseas travel.

5. Fronting and concealed ownership

“It is likely a small number of enablers have attempted to front for Russian DPs and claim ownership of frozen assets.”

OFSI considers it likely that some enablers are using ‘fronting’ tactics, where third parties claim ownership of frozen assets to bypass sanctions against DPs. These schemes often involve complex corporate structures and offshore entities designed to obscure beneficial ownership. OFSI identifies fronting as particularly prevalent in high-value sectors, including real estate and luxury goods.

Therefore, it is important for firms to consider appropriate beneficial ownership checks and corporate structure analysis as well as monitoring of client relationships to identify changes in ownership patterns that may indicate sanctions evasion.

OFSI has advised firms to consider the following red flags in particular, where additional due diligence may be appropriate:

• individuals with limited profiles in the public domain, including those with little relevant professional experience;
• inconsistencies in name spellings or transliterations, particularly those stemming from Cyrillic spellings;
• recently acquired non-Russian citizenships, including from countries which offer golden visa schemes; and 
• frequent or unexplained changes of name or declared location of operation.

6. Use of crypto-assets / alternative payment methods to breach sanctions

“Enablers have almost certainly used alternative payment methods, in particular cryptoassets, to breach UK financial sanctions prohibitions on Russia.”

OFSI has identified that enablers are almost certainly using crypto-assets and other alternative payment methods to seek to evade UK financial sanctions.

OFSI has advised financial services firms to be alert to attempts at money laundering by DPs.

Whilst these methods often involve complex financial networks designed to obscure the origins of funds, firms are advised to consider indications of high-value transfers between crypto-assets and cash, which could be attempts at money laundering on behalf of DPs.

Intermediary countries

Suspected breaches of UK financial sanctions by Russian DPs often involve intermediary jurisdictions. Russian DPs have traditionally structured their interests through a few favoured intermediary jurisdictions, which offer either greater secrecy or attractive commercial services and links to major markets. Since February 2022, just over 25% of suspected breach reports received by OFSI from UK financial services firms have referenced intermediary jurisdictions. 

The most frequently mentioned jurisdictions include:

• Austria;
• the British Virgin Islands;
• Guernsey;
• Luxembourg;
• Switzerland;
• the Republic of Cyprus;
• the United Arab Emirates; and
• Türkiye.

OFSI has identified activities which may be indicative of UK financial sanctions breaches in particular countries and recommends that firms consider these activities in their triggers for increased due diligence.

OFSI focus across all UK sanctions regimes

Since February 2022, 87% of sanctions breach reports from UK financial services firms have related to Russia.

While Russian sanctions remain a priority, OFSI encourages UK financial services firms to ensure robust compliance with all UK sanctions regimes. Other regimes where OFSI has identified recent threats to compliance include those relating to Libya, Belarus, Iran and the Democratic People’s Republic of Korea.