Sanctions compliance has moved from a specialist compliance function to a board-level corporate risk in the space of a few years. The intensification and expansion of UK, US, and EU sanctions regimes — particularly since 2022 — the significant penalties imposed on organisations that breach them, and the increasing extraterritorial reach of US measures that affect UK businesses operating in affected sectors, have made sanctions risk a mainstream corporate governance concern.
When a potential sanctions breach is identified — through a transaction screening hit, an internal compliance review, a regulatory inquiry, an external intelligence tip-off, or a due diligence exercise that surfaces an unexpected connection — a rapid and thorough investigation is required. This type of corporate investigation establishes the facts, assesses the exposure, and provides the foundation for the organisation’s response to OFSI and, where relevant, to OFAC and other authorities.
Bond Rees provides sanctions compliance investigation support for businesses, financial institutions, law firms, and compliance teams facing a potential breach or seeking to investigate a compliance concern. This article explains the legal framework, the investigation methodology, the voluntary disclosure process, and the most common questions we are asked.
The UK Sanctions Framework
The UK’s financial sanctions regime is administered by the Office of Financial Sanctions Implementation (OFSI), part of HM Treasury. Following Brexit, the UK operates its own autonomous sanctions regime, maintained under the Sanctions and Anti-Money Laundering Act 2018 (SAMLA) and implemented through a series of financial sanctions regulations covering specific countries, regimes, and themes.
Financial sanctions prohibit UK persons and entities from dealing with designated individuals and entities, making funds available to them, or enabling any activity that circumvents the sanctions. The prohibitions extend to the economic resources owned, held, or controlled by a designated person, as well as funds.
OFSI has civil enforcement powers to impose monetary penalties of up to £1 million or 50% of the estimated value of the breach, whichever is higher, without the requirement to prove criminal intent. The Policing and Crime Act 2017 amended OFSI’s enforcement powers to allow civil penalties on a strict liability basis: a person is liable if they knew or had reasonable cause to suspect that they were in breach. Criminal sanctions for deliberate evasion can result in imprisonment and unlimited fines.
The US Extraterritorial Dimension
Many UK businesses face sanctions exposure not only under the UK regime but under US measures administered by the Office of Foreign Assets Control (OFAC). OFAC’s reach extends beyond US persons and US-incorporated entities to any transaction that touches the US financial system, involves US-origin goods or technology, or is conducted by a non-US entity that has US nexus. The penalties for OFAC violations are substantial — civil penalties can reach the greater of $20 million per violation or twice the value of the transaction — and OFAC’s enforcement record against non-US firms is well-established.
A UK business involved in a transaction that may engage both UK OFSI and US OFAC sanctions needs coordinated advice across both regimes, and the investigation must address the nexus questions for each. Bond Rees works alongside international sanctions counsel to ensure that investigations address all relevant regulatory authorities.
What a Sanctions Investigation Establishes
A sanctions investigation addresses the following factual questions in a documented and evidential form:
The Specific Transaction or Relationship
What funds, goods, services, or economic resources were involved? With whom? At what value? Through what mechanism? On what date or over what period? The transaction picture must be established with specificity: a general characterisation is insufficient for the purposes of OFSI engagement or voluntary disclosure.
The Sanctions Nexus
Which sanctions regime is engaged? What is the connection between the transaction and the designated person or entity: direct transaction with a listed person; transaction involving an entity owned or controlled by a listed person; transaction with an entity in which a listed person has an interest; or transaction involving a jurisdiction subject to comprehensive sanctions. Establishing the nexus requires analysis of the ownership and control structure of the entities involved, the role of any designated individuals, and the specific provisions of the relevant sanctions regulation.
Knowledge and Intent
Whether the breach was deliberate, reckless, or inadvertent, and what the organisation knew or should have known at the time. Knowledge and intent do not affect civil liability under OFSI’s strict liability framework, but they are directly relevant to OFSI’s assessment of the appropriate penalty and to any criminal referral. An inadvertent breach resulting from a failure of screening systems is a different matter from a deliberate circumvention of sanctions, and the investigation must establish which is the case.
Control Failures
The specific failures in the screening, due diligence, and transaction monitoring controls that allowed the breach to occur or go undetected. This element of the investigation is essential for the remediation programme that OFSI will expect, and for the credible demonstration that the organisation has addressed the underlying problem rather than simply reporting the specific incident.
The Scope of the Problem
Whether the specific breach identified is isolated or whether it is part of a wider pattern: other transactions with the same counterparty, other transactions involving the same designated entity or individual, or systemic failures in the screening process that may have allowed multiple breaches over an extended period. Voluntary disclosure to OFSI that addresses the full scope of the problem is more credible and more effective than disclosure that addresses only the specific transaction that triggered the investigation while leaving related matters unreported.
The OFSI Voluntary Disclosure Process
OFSI’s enforcement guidance provides a significant mitigation for organisations that voluntarily disclose a breach before it is identified by OFSI through its own monitoring or intelligence. A voluntary disclosure that is: made promptly after the organisation becomes aware of the potential breach; based on a thorough and honest internal investigation; accompanied by full cooperation with OFSI’s own review; and supported by credible remediation, is treated materially more favourably in OFSI’s enforcement decisions than non-voluntary disclosure.
The quality of the internal investigation is directly relevant to the credibility of the voluntary disclosure. A disclosure that says ‘we think something may have happened but we don’t know the details’ is less effective than one that says ‘we have investigated thoroughly, here is precisely what happened, here is the full scope of the breach, here are the control failures that allowed it, and here is the remediation programme we have implemented.’
Bond Rees structures its sanctions investigations specifically to support a credible voluntary disclosure: comprehensive fact-finding, documented chain of custody for all evidence, clear distinction between facts and conclusions, and production of findings in a form that OFSI can engage with directly.
OFAC Voluntary Self-Disclosure
OFAC operates a parallel voluntary self-disclosure programme. A voluntary self-disclosure to OFAC, meeting OFAC’s requirements for completeness and promptness, can result in a 50% reduction in the base penalty amount in civil enforcement cases. The requirements for an effective OFAC voluntary self-disclosure — particularly the requirement to provide a full and accurate account of the facts, the applicable sanctions provision, and the remediation steps taken — make the quality of the internal investigation as significant for OFAC purposes as for OFSI.
Frequently Asked Questions
What should we do first when we identify a potential sanctions breach?
The first priority is not to make the problem worse: stop the transaction or relationship in question immediately, freeze any relevant funds or economic resources, and take advice from sanctions counsel before taking any further steps. The second priority is to preserve the relevant evidence before it is overwritten or lost. Bond Rees can begin evidence preservation and initial investigation on an urgent basis, and we work closely with sanctions counsel to ensure that the investigation and the legal response are coordinated from the outset.
How long does a sanctions investigation take?
A targeted investigation into a specific transaction can be substantially complete within two to three weeks. An investigation into a wider pattern of potential breaches, or one that involves complex corporate structures across multiple jurisdictions, will take longer. OFSI expects voluntary disclosures to be made ‘as soon as reasonably practicable’, and the investigation timetable needs to be balanced against the disclosure obligation.
What if we are unsure whether there is a breach?
Uncertainty about whether a specific transaction or relationship constitutes a sanctions breach is common, particularly in cases involving indirect ownership or control of a sanctioned entity, or in cases where the sanctions nexus depends on complex corporate structure analysis. The investigation establishes the factual picture; the legal analysis of whether that picture constitutes a breach is the work of sanctions counsel. Bond Rees provides the factual foundation for that legal analysis.
Does reporting to OFSI mean we will be prosecuted?
Voluntary disclosure to OFSI does not automatically lead to prosecution. OFSI’s enforcement powers are primarily civil, and the significant majority of enforcement actions result in civil monetary penalties rather than criminal referrals. Criminal prosecution is reserved for deliberate or knowing breaches, and an inadvertent breach that is promptly disclosed, fully investigated, and properly remediated is unlikely to result in a criminal referral. The decision about whether to voluntarily disclose, and the timing, is one that requires specific legal advice in each case.
Investigating a potential sanctions breach? Contact Bond Rees for expert financial crime investigation support.
