Nobody at Apple’s payments subsidiary lied, forged anything or looked away. The company they were paying changed owners, and the diligence built to catch that did not.
The company behind the app
Okko, a Russian media-streaming platform, sold apps through Apple’s App Store. Apple Distribution International (ADI), the Irish-incorporated Apple subsidiary that instructs App Store payments to developers from a UK bank account, paid Okko its revenue like any other developer.
Okko had been wholly owned by PJSC Sberbank since 2018. The UK designated Sberbank on 6 April 2022. On 17 May 2022, Sberbank sold Okko to JSC New Opportunities — at that point, still undesignated, so the sale itself broke no rule. On 29 June 2022, the UK designated JSC New Opportunities too, for having acquired digital-services companies previously owned by Sberbank. The moment that designation took effect, Okko was again covered by an asset freeze — this time under the UK’s ownership-and-control test rather than by name.
The two payments
ADI had instructed two payments to Okko that summer. Payment A, worth £356,429, had been instructed on 6 June, processed on 29 June — the day the designation of JSC New Opportunities was published — with a value date of 30 June. OFSI found the window to cancel it was too narrow to expect automated screening to have caught it, and treated the timing as mitigating. Payment B, worth £279,189, was instructed on 30 June, the day after the designation, and released on 28 July — a month after it, with no such excuse. It was Payment B, OFSI’s release makes clear, that turned Payment A into an enforcement case rather than a near-miss.
Two earlier 2022 payments to Okko, made before the UK’s strict-liability regime took effect in June that year, were considered by OFSI but not charged.
Why the diligence missed it
ADI ran onboarding checks through third-party ownership-and-control diligence vendors rather than requesting ownership information directly from Russian developers. Those vendors did not flag Okko’s change of ownership — even though, OFSI notes, open-source media articles reporting the Sberbank-to-JSC-New-Opportunities transfer were publicly available at the time. See ownership threshold structuring: the asset freeze followed the company through a change of hands that no screening system built to match names, rather than trace ownership, was positioned to see.
The penalty and the settlement framework
OFSI assessed the case “serious,” set a baseline of £600,000, and applied a 35% discount — for voluntary disclosure, made in October 2022, and for resolving the case under OFSI’s transitional settlement arrangements, introduced on 9 February 2026 as part of a new enforcement framework allowing penalty cases to be settled rather than fully adjudicated. This is the first case resolved that way.
What the record shows
- An asset freeze survives a change of ownership the payer never sees. Okko was covered from 29 June 2022 not because anything about Okko changed, but because the entity that had just bought it was designated that day.
- Third-party ownership screening is not a substitute for asking. ADI’s vendors missed a transfer that was already public. OFSI’s compliance note draws the direct lesson: request ownership information at onboarding, and periodically after.