Western governments have announced wave after wave of sanctions against Russia since the invasion of Ukraine in 2022. The real test has always been whether those measures can be enforced.
The UK Chancellor recently called for allies to "step up" pressure on A7, a Russian state-backed shadow payments network reportedly handling more than US$100 billion of Russian trade annually, is a reminder of that challenge. Another significant aspect of this week's announcement for UK businesses was the Government's renewed commitment to double the Office of Financial Sanctions Implementation's (OFSI) maximum monetary penalty from 50% to 100% of the value of a sanctions breach. [gov.uk]
Although the proposal formed part of HM Treasury's wider OFSI enforcement reforms announced earlier in 2026, it requires legislative change before it can take effect. With the Autumn Budget expected next month, businesses may reasonably expect that the required legislation will feature prominently in the Government's forthcoming sanctions and enforcement agenda. Until then, OFSI's existing statutory penalty limits remain in force.
The renewed focus on increasing OFSI's penalty ceiling reflects a broader recognition that the effectiveness of sanctions is determined less by the number of entities added to sanctions lists than by the ability of authorities to detect circumvention, investigate breaches and influence corporate behaviour. Whether higher penalties will achieve those objectives, however, is a separate question. The emergence of A7 highlights a central tension in modern sanctions policy: the more extensive sanctions become, the stronger the incentive to develop alternative routes around them. [gov.uk]
Enforcement in practice
The emergence of A7 is a reminder that sanctions enforcement is inherently political, economic, and dynamic: the more expansive their reach, the stronger the incentive to develop alternative mechanisms capable of operating outside Western-controlled financial channels.
For multinational businesses, however, the more immediate significance lies in what the announcement reveals about the future direction of UK sanctions enforcement. The practical difficulty of disrupting sophisticated international networks operating across multiple jurisdictions makes effective domestic enforcement all the more important.
Importantly, the proposed increase in OFSI's maximum penalty forms only one part of a broader package of enforcement reforms introduced during 2026. Earlier this year OFSI revised its enforcement guidance, introducing a new case assessment framework, an Early Account Scheme, a settlement mechanism, revised disclosure and cooperation incentives, and fixed monetary penalties for certain reporting, licensing and information offences. Taken together, those reforms point towards a regulator seeking a more structured, transparent and active enforcement model. [gov.uk].
Recent enforcement activity illustrates the direction of travel. Most recently, OFSI imposed a £4.7 million monetary penalty on Citibank N.A. London Branch for breaches of the Russia sanctions regime. Over the past year, OFSI has also issued penalties against several major businesses, including Sabre Global Technologies, Apple Distribution International, Deutsche Bank AG London Branch and Bank of Scotland. [gov.uk]
While policy attention is increasingly directed towards sophisticated sanctions-evasion networks, OFSI's enforcement activity has largely focused on the effectiveness of sanctions controls within regulated businesses. Recent cases have centred on deficiencies in screening, escalation procedures, governance and compliance controls rather than deliberate participation in sanctions-evasion schemes. OFSI's own published commentary has repeatedly emphasised operational weaknesses rather than intentional misconduct. [ofsi.blog.gov.uk]
That distinction is important. Disrupting networks such as A7 depends on international cooperation, intelligence sharing and coordinated enforcement action across multiple jurisdictions. By contrast, regulated businesses remain firmly within UK regulators' reach. As a result, the practical limits of international sanctions enforcement are unlikely to reduce pressure on corporates. They may instead reinforce it.
The UK's expanding enforcement ecosystem
For businesses, this represents increased regulatory and prosecutorial concern about sophisticated sanctions-evasion networks. As law enforcement authorities seek to demonstrate the effectiveness of sanctions regimes, the scrutiny of and enforcement against corporates will remain a central feature of the UK sanctions landscape.
That scrutiny will not come from OFSI alone. The UK's sanctions enforcement framework extends across multiple law enforcement and regulatory agencies. While OFSI is responsible for the civil enforcement of financial sanctions and the Oil Price Cap, the National Crime Agency investigates criminal breaches of financial sanctions and transport sanctions, supported by the National Economic Crime Centre. Alongside OFSI and the NCA, the Department for Transport exercises civil enforcement powers in relation to transport sanctions, the Office of Trade Sanctions Implementation enforces certain trade sanctions, and HMRC remains responsible for sanctions enforcement at the UK border. Criminal sanctions cases may ultimately be prosecuted by the CPS or, in the most serious and complex cases, the Serious Fraud Office. [gov.uk]
The practical consequence is that sanctions compliance is increasingly scrutinised through a coordinated enforcement ecosystem rather than a single regulator, with intelligence sharing and cross-agency cooperation becoming increasingly prominent features of the UK's approach.
Why this matters for businesses
The Government's renewed focus on OFSI's penalty powers underlines a wider shift from sanctions-making to sanctions enforcement. Four years into the Russia sanctions regime, adding names to sanctions lists is just the starting point. The UK’s sanctions policy is increasingly focussed on implementation, circumvention and enforcement effectiveness.
The compliance challenge extends far beyond mitigating the immediate risks of a sanctions breach, such as dealing with a designated person, or conducting other prohibited transactions. The focus is on whether that company’s systems and controls are capable of identifying sanctions risks arising through intermediaries, affiliates, payment chains and beneficial ownership structures, and the effectiveness of sanctions enforcement policies and procedures.
Recent UK reforms introducing corporate criminal liability for sanctions breaches attributable to senior management only increase the stakes, elevating sanctions compliance from a specialist legal issue to a matter of board-level governance (see our recent Law Now on the wider reforms here: Crime and Policing Act 2026: corporate criminal liability unbound).
What is clear is that businesses are being asked to shoulder an ever-greater share of responsibility for making sanctions effective in practice. As governments continue to grapple with the realities of cross-border enforcement, they are likely to continue to place increasing expectations on firms to identify, prevent and report sanctions risks within their own operations. For multinational companies, the lesson from the UK Chancellor’s recent announcement is therefore a simple one: the more difficult it becomes for authorities to demonstrate success against sophisticated international sanctions-evasion networks, the greater the incentive to demonstrate the credibility of sanctions regimes through robust domestic enforcement.
What should businesses do now?
In practice, businesses should use the latest developments as an opportunity to review whether their sanctions compliance framework is calibrated to current enforcement expectations. In particular, firms should consider whether:
- sanctions screening systems are appropriately configured, tested and updated;
- escalation, investigation and decision-making procedures are sufficiently robust;
- controls adequately address evidence-based risks arising through intermediaries, affiliates and beneficial ownership structures;
- sanctions compliance receives appropriate board and senior management oversight; and
- the business can demonstrate, through evidence and documentation, that its controls operate effectively in practice.
In an environment of increasing enforcement activity, the expansion of corporate criminal liability at large, and closer cooperation between UK enforcement agencies, firms should be prepared not only to demonstrate that sanctions policies exist, but that they are capable of identifying and mitigating sanctions risks in practice.
For further information please email the authors or your usual CMS contact.
