A data note on OFSI’s published record counts 21 actions. Seven of the penalties in it have case pages on this site: Standard Chartered, Herbert Smith Freehills, Markom, Sabre, Apple Distribution International, Deutsche Bank London and Citibank London. This note reads the other fourteen, notice by notice, because the question the cases cannot answer is what the ordinary UK penalty looks like. Eleven of the fourteen carry a penalty, together about £625,000. Three are disclosures with no fine.
None gets a case page for a reason worth stating. This site’s cases are tagged to an evasion technique, and nothing in these notices describes anyone hiding anything. No front company, no nominee, no altered payment message. They describe firms that did not see a designated person, or saw one and did not act.
The fourteen
| Imposed | Firm | Penalty | What the notice says happened |
|---|---|---|---|
| Jan 2019 | Raphaels Bank | £5,000 | Dealt with a designated person’s funds (£200) while holding their passport |
| Mar 2019 | Travelex UK | £10,000 | The same designated person, £204, in person, with passport sight |
| Jul/Sep 2019 | Telia Carrier UK | £146,341 | Carried calls to a designated Syrian telecoms company over an extended period |
| Feb 2021 | Clear Junction | £36,393 | Seven payments to a designated Crimean bank after saying such payments would stop |
| 2021 | TransferGo | £50,000 | Sixteen payments to the same bank, on a belief that it was not a breach |
| Apr 2022 | Hong Kong International Wine and Spirits Competition | £30,000 | Took payments and bottles from a designated Ukrainian wine producer as competition entries, and gave it publicity |
| May 2022 | Tracerco | £15,000 | Flights home on a designated Syrian airline, booked through a travel agent |
| Aug 2024 | Integral Concierge Services | £15,000 | Kept managing a UK property for a designated client |
| Mar 2025 | Three charities | Disclosure | Did not answer OFSI’s request for information |
| Apr 2025 | Svarog Shipping & Trading | £5,000 | Did not answer a request for information |
| Sep 2025 | Colorcon | £152,750 | Paid staff in Moscow through designated banks, see the case |
| Aug 2023 | Wise Payments | Disclosure | Cash withdrawal on a debit card after the account was frozen |
| Sep 2025 | Vanquis Bank | Disclosure | Eight days to restrict an account after designation |
| Nov 2025 | Bank of Scotland | £160,000 | Opened an account for a designated person whose name was spelled differently |
Dates are those in each notice; OFSI’s own listing dates differ for several, and Clear Junction’s listing date is when a ministerial review concluded.
Five patterns
A check that someone else was meant to run. Colorcon believed its bank would screen the Moscow office’s payments, and OFSI recorded that this “was never explicitly tested.” Tracerco relied on a travel agency, and OFSI’s note says that is not sufficient. The Clear Junction notice makes the same point about relying on a client’s checks. Two of these, Colorcon and Tracerco, are the unglamorous version of the untested screening controls technique: a control the firm assumed existed.
Identity data in hand and not used. Raphaels and Travelex each held the designated person’s passport, with name, date of birth and nationality. The sums were £200 and £204. OFSI penalised both and wrote that the value does not change that the dealing contravened the freeze. Bank of Scotland is the larger form of it: a designated British citizen opened a Halifax account with a passport whose spelling differed from the sanctions list, no alert fired, and when a manual adverse-media check found the designation, a human error recorded the person as removed from the UK list. Twenty-four payments passed through before the account was restricted.
A process that could not keep up. Vanquis Bank had been told by OFSI the day before a designation that a customer would be named. Its screening alerted the next morning, but the first review took eight days, because staff had been reassigned to clean up an earlier screening failure. Wise’s screening suspended a business account on a possible match but its policy then left debit cards active, and the escalated alert was not reviewed over a weekend; a £250 cash withdrawal followed. Neither case involves a bad control. Both involve a good one that nobody had time to run.
Misreading what the law covers. TransferGo concluded that payments to customers’ accounts at a designated bank were not breaches because the customers were not designated. OFSI’s view was that funds in a bank account ultimately belong to the bank. Telia carried phone calls; OFSI’s reading is that calls are an economic resource. The competition operator took entry fees and gave publicity, which OFSI treated as an intangible resource. Integral Concierge, a small property manager, told OFSI its knowledge of sanctions was extremely limited and carried on collecting rent and paying bills for a designated client until May 2023.
Silence. Svarog’s £5,000 penalty is for not answering a letter by a deadline; OFSI found no other breach. The three charities are listed for the same failure. Stale contact details on the Charity Commission register were not treated as an excuse.
What the pattern says about detection
Compare the larger cases. Citibank London’s failure was a name-matching setting and a rule written around the 50 per cent threshold; Deutsche Bank’s was that screening lists carried no ownership data. They are failures of screening design at scale. The fourteen are mostly failures of attention at small scale: someone holds a passport, someone signs off a payment, someone does not open a letter. For a firm outside banking, the question these notices pose is not “is our screening software good enough” but “who looks at the thing we already have.”
Strict civil liability, in force since 15 June 2022, is what lets these be penalised at all without proof that the firm knew. The Colorcon and Integral Concierge notices each say that some of the payments pre-date it and were assessed under the older test; Bank of Scotland’s, from 2023, fell wholly under the strict regime. The penalties are small partly because the breaches are small. Colorcon’s 79 payments were £128,278. Bank of Scotland’s were £77,383.
What this does and does not establish
It is fourteen documents, chosen by being the ones without a technique, so the sample is biased towards the ordinary. It says nothing about how many firms made the same errors and were never reported or penalised. A published penalty is the end of a process that begins with a firm or a bank reporting itself, or OFSI finding it; the notices say disclosure reduced several penalties, up to half. The pattern they show is what the published record shows, not a map of the UK’s exposure.