r

OFSI Issues £160,000 penalty to Bank of Scotland Plc for Russia sanctions breaches

The Office of Financial Sanctions Implementation (OFSI) has imposed a £160,000 monetary penalty on Bank of Scotland Plc (part of Lloyds Banking Group), for breaching the Russia financial sanctions regime.

Between 8 and 24 February 2023, the bank processed 24 payments totalling £77,383.39 to and from a personal current account held by a UK‑designated person. OFSI concluded that the bank breached prohibitions on dealing with, and making funds available to, a designated person.

The case highlights several important lessons for firms to:

• Ensure that sanctions screening tools are sufficiently enriched with relevant information to optimise their capabilities. Firms with greater sanctions risk exposure may benefit from commercial packages, such as commercial sanctions lists to enrich their sanctions screening.
• Address the inherent risks of automated screening with robust contingency procedures and clear escalation routes, particularly in higher‑risk areas such as those involving Politically Exposed Persons.
• Keep sanctions training under regular review, so that its content accurately reflects relevant regulatory and geopolitical developments.
• Consider prompt, voluntary disclosure of potential breaches. OFSI seeks to reward prompt and complete voluntary disclosures through penalty discounts.

A 50% discount was applied in this case for prompt, voluntary disclosure.

The full penalty notice:

When I looked at this, my first reaction that this was way more than OFAC would have assessed:

• At best, the violations were due to poor decision-making relative to the Bank’s choice of screening solutions – there was no willfulness and no apparent management involvement
• Additionally, the amounts involved were pretty nominal – 77,000 GBP is somewhere around $100,000. The number of violations and the time period over which they occurred were both pretty limited. Coupled with the fact that there was voluntary self-disclosure, it would see the base penalty would land around $50,000 – 1/2 the transaction value.
• Even in terms of damage to sanctions program objectives, $100,000 pales in comparison to most things OFAC penalizes.
• The best comparison was the 2019 settlement with Apple, where the base penalty was also 1/2 the transaction value. And Apple ended up paying about 20% less than that figure, despite a number of significant aggravating factors, including damage to sanctions program objectives, failure to correct the deficiencies in their program in a timely manner, and reckless behavior (due to the long period of time over which violations occurred).

Apparently, Gemini agreed – I asked it to make a guess at what OFAC would have done:

Based on the details in the OFSI penalty notice and the OFAC Economic Sanctions Enforcement Guidelines (31 C.F.R. Part 501, Appendix A), here is the estimated equivalent OFAC penalty.

The Bottom Line

The estimated OFAC civil monetary penalty would likely be approximately $49,000 – $65,000.

Surprisingly, the OFAC penalty in this specific scenario would likely be lower than the OFSI penalty (£160,000 / ~$203,000). This is because OFAC’s calculation for “non-egregious” cases is strictly tied to the value of the transactions, whereas OFSI applied a discretionary “seriousness” baseline unrelated to the low transaction value.

---

Detailed Calculation

1. Fact Pattern & Assumptions

• Violations: 24 distinct payments.
• Total Transaction Value: £77,383.39.
  • Currency Conversion (approx. 2023 rates): ~1.27 GBP/USD = $98,276.
• Nature of Breach: Screening failure (name variation not caught) and human error (PEP match misidentified).
• Outcome: Voluntary Self-Disclosure (VSD) was submitted and accepted.

2. Classification: Egregious vs. Non-Egregious

• OFAC Standard: OFAC classifies cases as “Egregious” (involving willfulness or recklessness) or “Non-Egregious” (negligence or mistake).
• Assessment: While the bank “possessed information” (the PEP match), the root cause was identified as “human error” (misinterpreting the list status) and “system failure” (transliteration). There is no evidence of willful intent to violate sanctions or concealment.
• Conclusion: This would almost certainly be processed as a Non-Egregious case.

3. Base Penalty Calculation

For a Non-Egregious case with Voluntary Self-Disclosure (VSD), OFAC’s guidelines set the Base Penalty as follows:

• Formula:50% of the Transaction Value.
  • (Note: The alternative cap is ~$180,000 per violation, but since the transaction value is lower, the transaction value governs).
• Calculation: $98,276 (Total Value) × 50% = $49,138.

(Contrast this with OFSI, which set a baseline penalty of £320,000 based on “seriousness” rather than transaction value.)

4. Adjustments for General Factors

OFAC adjusts the Base Penalty up or down based on aggravating and mitigating factors.

Aggravating Factors (Increases Penalty)	Mitigating Factors (Decreases Penalty)
Large Institution: LBG is a sophisticated financial institution expected to have robust software.	Voluntary Self-Disclosure: Already accounted for in the 50% base, but reinforces cooperation.
Sanctions Harm: The payments benefited a designated person in a high-priority program (Russia).	Cooperation: LBG provided all documents and responded promptly.
Reason to Know: The bank had a PEP match that, if properly reviewed, would have stopped the payments.	Remediation: Likely updated training and screening logic (implied).

• Net Assessment: While the “Reason to Know” is a strong aggravator, the total value is very low ($98k). For large banks, OFAC typically does not nickel-and-dime small transaction-value cases unless they are part of a massive systemic pattern.
• It is likely OFAC would settle near the Base Amount ($49,138), perhaps slightly higher to account for the “sophistication” factor, but unlikely to exceed the transaction value ($98k) for a self-disclosed error.

---

Alternative Scenario: The “Egregious” Risk

If OFAC determined the ignoring of the PEP match constituted recklessness (ignoring clear warning signs), the math changes drastically:

• Formula (Egregious + VSD): 50% of the Statutory Maximum.
• Statutory Max (IEEPA): ~$377,700 per violation (2025 inflation adjustment) × 24 violations = ~$9.06 Million.
• Base Penalty: ~$4.53 Million.
• Probability: Low. OFAC rarely classifies pure screening/human errors as egregious unless there is evidence of management involvement or deliberate blindness.

Comparison Summary

• OFSI Penalty: £160,000 (~$203,000).
• OFAC Estimate: ~$49,000.

Why the difference?

OFSI’s enforcement model allows them to deem a case “Serious” and impose a penalty relative to the compliance failure (up to £1M) rather than the transaction value. OFAC’s non-egregious model is strictly arithmetic based on the dollar value of the payments processed.