Nobody at Colorcon was trying to pay a designated bank. The company paid ordinary salaries and bills from a Moscow office, and the only check that would have caught the problem was one it assumed its bank was already running.
What the Moscow office paid
Colorcon is the UK subsidiary of a global supplier to the pharmaceutical and nutritional industries, and it had run a representative office in Moscow for more than 15 years. Between 23 March and 2 December 2022 that office made 123 payments, worth £191,290.57 in total, to employees and a few service providers whose accounts were held at Alfa Bank, Promsvyazbank, Sberbank and VTB Bank, all of which were designated entities. Most of the payments were salaries. A small number covered bookkeeping and payroll services, car and medical insurance for staff, and contracts for additional services.
OFSI treated 44 of those payments (£63,012.85, made between 12 August and 31 October 2022) as covered by its general licence for companies winding down operations in Russia. That left 79 payments worth £128,277.72 as breaches. Colorcon had not met the licence’s reporting requirement for the licensed payments, and OFSI counted that as an aggravating factor.
How the payments were authorised
The payment flow was simple. A Russian bookkeeper entered each instruction into a financial institution’s electronic payment system, and a summary went to Colorcon’s authorised signatories in the UK, who confirmed the payments on that system. OFSI’s finding was that those approvals checked that the sums and the payees were right. They did not include a review of the sanctions status of the bank where the recipient’s account was held.
Colorcon had reviewed its sanctions measures before the invasion of Ukraine and later decided to close the Moscow office. But the notice says the review concentrated on direct customers, shareholders and remitting banks, not on the company’s own employees and service providers. The company’s sanctions documentation had not been materially updated since 2018.
The assumption nobody checked
Colorcon told OFSI it understood that its bank would apply UK sanctions across its business, so any payments to the Moscow office would be screened. OFSI noted that this was “never explicitly tested” by making enquiries with the bank. In its compliance notes OFSI states the general point directly: a company cannot rely on a third party to do its sanctions checks, and it remains liable for any breach.
This is the untested screening controls pattern in a different form from the brokerage cases that page describes. There, a firm’s own control stopped working and nobody confirmed that it still did. Here, the control was a third party’s, the firm’s own approval step did not include it, and the belief that it existed was never confirmed. The notice does not say what the bank’s screening did or did not do. It says only that the assumption was not tested.
The penalty
OFSI assessed the case as “serious” rather than “most serious”. For the payments made before the strict civil liability regime began in June 2022, it found Colorcon had knowledge or reasonable cause to suspect that funds would be made available to designated persons. Aggravating factors included the value, the payments going directly to accounts at designated institutions, the company’s long presence in Russia and its awareness of the risk, the unmet licence reporting requirement, and the repeated errors from March to December 2022. Mitigating factors were that the payments related to medical and humanitarian purposes, the company’s disclosures and cooperation, and its August 2022 decision to leave the Russian market.
The statutory maximum was £1,000,000. OFSI set a penalty of £235,000 and applied a 35% discount instead of the full 50%, because four months passed between Colorcon becoming aware of the breaches and its first notification. The fuller report followed two months after that. Colorcon made no representations and did not seek a review.
What the record shows
- The control that mattered was the one nobody owned. The UK signatories checked amounts and payees, and the bank’s sanctions screening was treated as someone else’s job without being confirmed.
- Risk reviews follow the company’s model of itself. A review that covered customers, shareholders and remitting banks missed the staff and suppliers who made up the actual payments.
- A general licence is not a standing permission. The payments outside its terms, and the missed reporting, were assessed as breaches in their own right.