Mr. Sanctions

Category: Enforcement

  • The EU sings in perfect (ahem) harmony on sanctions enforcement

    I asked Claude to explain the EU Harmomization Directive with respect to sanctions enforcement:

    The formal name is Directive (EU) 2024/1226 — “on the definition of criminal offences and penalties for the violation of Union restrictive measures, and amending Directive (EU) 2018/1673.” “Harmonization Directive” isn’t its official title, but it’s a fair and widely used shorthand; several firms (White & Case, Gleiss Lutz) use “harmonized” or “harmonised” in their own headlines for it, so I’ll treat that as the subject and flag the naming distinction for your readers up front.

    Where it comes from

    Sanctions violations weren’t always something the EU could legislate criminal minimums for. Article 83(1) TFEU limits that competence to a defined list of “euro-crimes” (terrorism, trafficking, corruption, money laundering, and similar). Council Decision (EU) 2022/2332 of 28 November 2022 added violation of Union restrictive measures to that list, which cleared the way for a directive. The Commission proposed the text in December 2022, Parliament and Council reached provisional agreement in December 2023, Parliament adopted it on 12 March 2024, and Council gave final approval on 12 April 2024. It was published in the Official Journal on 29 April 2024, entered into force 19 May 2024, and set a transposition deadline of 20 May 2025.

    What conduct it criminalizes (Article 3)

    Member states must treat the following as criminal offenses when committed intentionally in breach of an EU restrictive measure (or a national provision implementing one):

    • Making funds or economic resources available to a designated person, or failing to freeze assets belonging to or controlled by one
    • Enabling a designated person to enter or transit through a member state’s territory
    • Entering into or continuing transactions with a sanctioned third country, or bodies and entities owned or controlled by it, including public or concession contracts
    • Trading, importing, exporting, or providing brokering or technical assistance in breach of trade-control measures
    • Providing financial services or carrying out financial activities in violation of restrictive measures
    • Providing other services in violation of restrictive measures — legal advisory, trust, PR, accounting, auditing, tax consulting, business or management consulting, IT consulting, architectural and engineering services are all named
    • Supplying false or misleading information to conceal that a designated person is the true owner or beneficiary of funds or resources
    • Failing to meet a reporting obligation owed to competent administrative authorities
    • Breaching conditions attached to an authorization or license issued by a competent authority

    Article 4 extends liability to incitement, aiding and abetting, and attempt. Notably, for the trade-control offense involving items on the EU Common Military List or dual-use goods under Annex I/IV of Regulation (EU) 2021/821, member states must also criminalize conduct amounting to serious negligence, not just intent — a real departure from the intent-only baseline elsewhere in the directive.

    Threshold and exemptions: member states generally aren’t obligated to criminalize conduct involving less than €10,000 in funds, resources, goods, services, or transactions, though a series of linked acts by the same offender can be aggregated to meet that figure. The threshold doesn’t apply to travel-ban violations. Two exemptions exist: legal professional privilege for advice given in the course of ascertaining a client’s legal position or representing them in proceedings (this falls away if the lawyer knowingly participates in or facilitates the violation), and humanitarian assistance delivered in line with the principles of impartiality, humanity, neutrality, and independence.

    Penalties for natural persons (Article 5)

    Maximum prison terms scale by offense type and value. Assuming the €100,000 threshold is met — which can also be reached by aggregating linked offenses — maximum terms run from at least one year up to at least five years, calibrated by which category of Article 3(1) conduct is involved. Where the offense involves Common Military List items or Annex I/IV dual-use goods, the maximum must be at least five years regardless of value. Accessory penalties can include disqualification from leadership positions, withdrawal of permits and authorizations, and temporary bans from public office.

    Corporate liability and penalties for legal persons (Articles 6-7)

    A legal person can be held liable where an offense is committed for its benefit by someone in a leading position, or where a lack of supervision by such a person allowed a subordinate to commit it. Fines are tiered by offense severity: most offenses carry a maximum of at least 5% of total worldwide turnover or €40 million (member states choose the calculation method); two lesser reporting-related offenses carry a maximum of at least 1% of turnover or €8 million. Non-criminal measures can include exclusion from public funding and tenders, judicial supervision, withdrawal of permits, and judicial winding-up.

    Aggravating and mitigating circumstances (Articles 8-9)

    Aggravating factors include use of false or forged documents, commission by a professional service provider in breach of their professional obligations, and destroying evidence or intimidating witnesses. These push penalties up without changing the underlying offense definitions.

    Other structural elements

    • Freezing and confiscation (Article 10): member states must be able to freeze and confiscate instrumentalities and proceeds of these offenses, plus the sanctioned funds or resources themselves.
    • Limitation periods (Article 11): generally at least five years for offenses carrying a five-year maximum sentence, with a floor of three years permitted in narrower circumstances.
    • Jurisdiction (Article 12): territoriality-based, with room to extend to habitual residents, officials acting in an official capacity, and conduct benefiting a locally established legal person.
    • Investigative tools (Article 13): member states must make organized-crime-style investigative tools available for these cases.
    • Whistleblower protection (Article 14): ties reporting persons back to the protections in the EU Whistleblower Directive (2019/1937).
    • Cooperation (Articles 15-16): each member state designates a coordinating unit domestically, and the directive builds in cooperation channels with the Commission, Europol, Eurojust, and the European Public Prosecutor’s Office. It stops short of centralizing enforcement — expanding EPPO’s own mandate to cover these offenses would require a separate unanimous Council decision under Article 86 TFEU, which hasn’t happened.
    • Statistics (Article 17): member states report prosecution data to the Commission annually.
    • AML predicate offense: the directive amends Directive (EU) 2018/1673 so that violating Union restrictive measures is now itself a predicate offense for money laundering.

    Commission reporting obligations run forward: an implementation report is due by 20 May 2027, and a fuller effectiveness evaluation by 20 May 2030.

    Where transposition actually stands (as of August 2026)

    This is the part worth flagging for readers who assume “harmonization” means it’s already harmonized. It isn’t, in practice. Almost no member state met the 20 May 2025 deadline — the Institute of Legislative Ideas’ transposition study found only Estonia and Finland fully compliant on time, with Lithuania, Latvia, and Sweden close behind. On 24 July 2025 the Commission opened infringement proceedings (letters of formal notice) against 18 member states. By the Commission’s June 2026 infringements package, that had progressed for at least three of them — Spain, France, and Austria received reasoned opinions, the next escalation step before a possible referral to the Court of Justice. Germany, meanwhile, got a separate formal notice over a narrower gap (a residence requirement specific to North Rhine-Westphalia) despite having transposed the bulk of the directive through its Sanctions Act published 5 February 2026. France was still working through its domestic legislative process as of March 2026. So national approaches remain visibly uneven well over a year past the deadline, which somewhat undercuts the “harmonization” framing in the near term even as the underlying legal architecture is genuinely unified at the EU level.

    Verification notes

    Article-level detail (offense categories, penalty tiers, article numbers for aggravating/mitigating factors, jurisdiction, and cooperation provisions) is cross-checked against the EUR-Lex text itself alongside multiple independent law-firm summaries (Clyde & Co, White & Case, Gleiss Lutz, DLA Piper, Paul Hastings), which converge closely on the figures. The one area I’d flag as an assumption rather than a verified fact: I wasn’t able to pull a complete letter-by-letter mapping of which specific Article 3(1) sub-points carry which exact imprisonment tier from the raw text — the secondary sources agree on the general 1-to-5-year structure and the €100,000/military-goods triggers, but I’m not fully confident in a precise point-by-point table, so I’ve described the structure rather than asserting an exhaustive breakdown. If you want that level of granularity for the piece, it’s worth pulling the full Article 5 text directly before publishing.

    Sources

    Primary legislative text

    Substantive analysis

    • eucrim (Max Planck Institute for the Study of Crime, Security and Law), “New Directive Criminalises Violation/Circumvention of EU Restrictive Measures,” 9 July 2024
    • Clyde & Co, “EU Sanctions Update: criminal offences and penalties (Directive EU 2024/1226),” 2 May 2024
    • White & Case, “EU establishes harmonized enforcement and penalties for sanctions violations”
    • Gleiss Lutz, “EU introduces stricter, harmonised rules for criminal prosecution of sanctions violations”
    • European Studies Unit (University of Liège), “Publication of Directive (UE) 2024/1226…”

    Current implementation status

    • Paul Hastings, “Addressing Gaps and Inconsistencies in the EU Sanctions’ Enforcement: The Commission Urges Member States to Transpose Directive (EU) 2024/1226”
    • National Law Review, “EU Launches Infringement Actions on Sanctions Directive 2024/1226”
    • EUbusiness.com, “June 2026 EU infringements package: key decisions,” 4 June 2026
    • Gleiss Lutz, “Stricter criminal sanctions law: Germany’s transposition of the EU Sanctions Directive”
    • Lexology (White & Case), “EU: France advances first steps to transpose the EU Sanctions Enforcement Directive”
    • Institute of Legislative Ideas, “Transposition of EU Directive 2024/1226 by EU Member States”

    —

    , ,

  • August 7, 2026: Burning Question: Has the EU plugged up the holes in the dike?

    So, I’m a beta tester for ACSS‘ CSS-EU certification exam, and I’ve been studying. In the midst of it, I came across the following “non-paper” issued by the Dutch government in February 2023 about sanctions enforcement:

    non-paper-on-russia-sanctions-circumventionDownload

    and I was curious – how much of this actually got promulgated by the EU? So, I asked Claude – here’s the response:

    Quick note on dating: the paper’s reference to the 9 February 2023 European Council conclusions places it right around the EU’s 10th sanctions package. Everything below covers what’s happened across the roughly eleven packages adopted since (11th through 21st, the last landing July 23, 2026).

    Context

    The paper came from the Dutch government in the run-up to what it called “the year of success in countering circumvention.” It made five clusters of asks. Here’s each one, and where it actually stands 3.5 years on.

    1. Strengthen the feedback loop between national enforcement and EU-level policy

    Proposed: Better cooperation between customs, tax authorities, prosecutors, intelligence services, and statistics agencies at the national level, with that intelligence routed up to Brussels so loopholes in the sanctions text itself could get closed.

    What happened: The concrete deliverable here is Directive (EU) 2024/1226, adopted April 24, 2024, which harmonizes the definition of criminal offenses and penalties for sanctions violations across Member States and builds a formal cooperation channel among national authorities, the Commission, Europol, Eurojust, and the European Public Prosecutor’s Office though it stops short of a single EU-level entry point for reporting breaches that span multiple Member States. Transposition was due by May 20, 2025. The Commission opened infringement proceedings against 18 Member States in July 2025 for failing to fully transpose it. As of early 2026, practitioner commentary is still describing EU sanctions enforcement as structurally fragmented, with divergent penalty regimes and investigative approaches across Member States encouraging forum shopping by operators seeking softer enforcement jurisdictions, and a mid-2026 industry survey went so far as to call fragmentation, not designation volume, the defining sanctions challenge of the year, with regulators now moving in different directions rather than the relative coordination seen earlier in the war.

    Verdict: Real legislative architecture exists now that didn’t in February 2023. But this is the one proposal area where the paper’s own diagnosis (uneven application among Member States) is, by the EU’s own admission via infringement actions, still an open problem.

    2. Strengthen the EU point of contact for circumvention

    Proposed: A safe channel for Member States to share circumvention intelligence in Brussels, a platform for common analysis, and explicit use of the incoming Anti-Money Laundering Authority (AMLA, cited at 500 FTE) for this purpose.

    What happened: The Sanctions Coordinators Forum, chaired by the EU Sanctions Envoy, has become the closest thing to the coordination venue described. By its seventh meeting in 2026 it was gathering high-level representatives from all Member States plus the US, UK, Canada, Japan, South Korea, Liechtenstein, New Zealand, Norway, and Switzerland, with Ukraine joining for dedicated sessions. That’s broader (and more diplomatic in character) than the narrower Brussels analysis cell the paper described.

    AMLA itself did get built, though its link to circumvention specifically is thinner than the paper implied. It was formed June 26, 2024, headquartered in Frankfurt, and took up operations July 1, 2025. It absorbed the European Banking Authority’s AML/CFT mandates on January 1, 2026, and direct supervision of roughly 40 selected high-risk entities is scheduled to begin in 2028. Its core mandate is money laundering and terrorist financing; sanctions-compliance monitoring by obliged entities sits within that broader remit rather than as a dedicated anti-circumvention function, and its staffing trajectory (roughly 430 by end-2027) is smaller than the 500 FTE figure the paper cited.

    Verdict: A coordination venue exists and meets regularly, and AMLA exists roughly on schedule. But I couldn’t find evidence of a discrete, named “circumvention information-sharing platform” as such. What exists instead is a layered patchwork: the Forum, the Europol/Eurojust/EPPO channel created by the 2024 Directive, and AMLA on the financial-intelligence side, which is a looser outcome than a single point of contact.

    3. Diplomatic outreach

    Proposed: A Special Envoy, EU démarches, letters from EU institutions, coordination with G7-plus partners.

    What happened: This is the proposal that landed most cleanly, largely because it was already in motion. David O’Sullivan took up the role of International Special Envoy for the Implementation of EU Sanctions in January 2023, essentially contemporaneous with the paper itself. He’s since made the outreach role highly visible: in February 2026 he traveled to Kyrgyzstan and told reporters that trade data showed goods being imported there for the specific purpose of re-export to Russia, singling out radio equipment and machine tools; he’s made joint trips to Kazakhstan and Kyrgyzstan with his UK counterpart; and in June 2026 he told Euronews that China remained a “very big problem” for circumvention, with no sign of it abating.

    Verdict: The most fully and durably realized of the five clusters.

    4. Expand the EU toolbox

    This proposal had several distinct sub-parts, worth taking one at a time.

    Guidance for companies: The Commission published practical guidance for EU operators on September 7, 2023, setting out enhanced due-diligence expectations for strategic risk assessment and best practices for screening business partners, transactions, and goods, plus a list of circumvention red flags. It’s been refreshed since in coordination with G7 partners as part of joint industry guidance on preventing sanctions evasion. Realized, and fast.

    Contractual end-use obligations: The “no-Russia clause” under Article 12g of Regulation 833/2014 was introduced in the 12th package in December 2023, requiring exporters to contractually prohibit re-export to Russia, and was later extended to Belarus. Realized.

    Trade toolbox against a non-cooperative state: The anti-circumvention tool, Article 12f of Regulation 833/2014, was introduced as an “exceptional and last resort measure” in the 11th package in June 2023. It then sat unused for nearly three years. It was first activated in the 20th package, imposing targeted export restrictions on Kyrgyzstan in response to systemic evasion, specifically covering CNC machine tools and telecommunications equipment being diverted to Russia for drone and missile manufacturing. Realized, though the multi-year gap between creation and first use suggests Member States found it politically harder to invoke than the paper anticipated.

    Watch list / published suspicions: The closest analog is the Common High Priority List, a jointly maintained EU-US-UK-Japan list of dual-use and advanced-technology items found on the battlefield or critical to Russian weapons production, first published in 2023 and expanded since. That’s a goods list, though, not the entity-level “watch list” or publication of unproven “suspicions” the paper floated as a way to enable due diligence short of formal listing. I didn’t find evidence the EU adopted that softer mechanism; where it had sufficient evidence, it moved straight to formal designation rather than a public warning step.

    Verdict: Substantially realized across three of four sub-elements, with the “publish suspicions” idea appearing to be the one that wasn’t taken up.

    5. Expand listing capacities

    Proposed: Broaden the ability to list third-country persons and entities beyond the narrow original criteria, which required proving a link to circumvention by an EU actor, and cover a wider category of components tied to weapons production.

    What happened: The 11th package amended Regulation 269/2014’s listing criteria to add persons and entities that “significantly frustrate” EU sanctions. Since then, successive packages have repeatedly added third-country entities under Annex IV of Regulation 833/2014, language in the Council’s own 2026 texts describes entities “in third countries other than Russia that indirectly contribute to Russia’s military and technological enhancement thereby enabling the circumvention of Union restrictive measures or frustrating their purpose”, which tracks the non-paper’s ask almost verbatim. The 19th package, in late 2025, specifically designated non-Russian operators in the UAE and China producing or supplying military and dual-use goods to Russia, and the EU’s asset-freeze list by that point already included entities established in the UK, China, Hong Kong, the UAE, and Kyrgyzstan.

    Verdict: The second most fully realized cluster, with a clear and repeated pattern of use across nearly a dozen packages rather than a one-off change.

    Bottom line

    Ranked by how faithfully the EU followed through: diplomatic outreach and expanded listing capacity were both substantially delivered and are still actively used today. Toolbox expansion was mostly delivered, guidance, the no-Russia clause, and the anti-circumvention tool are all real and in force, with the softer “publish suspicions” idea being the exception. The feedback-loop proposal produced genuine legislation in Directive 2024/1226, but its central goal (unified application) remains, by the Commission’s own infringement actions, unfinished. And the “point of contact” proposal exists in a more diffuse form (Forum plus Europol/Eurojust/EPPO plus AMLA) than the single Brussels platform the paper described.

    Worth flagging something the non-paper didn’t address at all: unanimity. Every package still needs all 27 Council votes, and that friction has visibly shaped recent outcomes, the 20th package had to clear a Hungarian veto threat before adoption, and the 21st package in July 2026 emerged narrower than the Commission’s original June proposal after Member States pushed back on scope. None of the five proposals touch that structural constraint, and it’s arguably the single biggest brake on how fast anti-circumvention policy can move regardless of how well the other five workstreams perform.

    Self-check

    High confidence, multiple independent sources: O’Sullivan’s appointment and role, the anti-circumvention tool’s creation and first (Kyrgyzstan) use, the no-Russia clause, Directive 2024/1226 and its transposition shortfall, the AMLA timeline, the September 2023 Commission guidance, and the pattern of third-country Annex IV listings.

    Lower confidence: I could not confirm or rule out whether the EU seriously considered and rejected a formal “publish suspicions short of listing” mechanism, versus simply never taking it up, my read is an absence of evidence in press and legal-alert coverage, which isn’t the same as proof it doesn’t exist. Similarly, “no discrete circumvention information-sharing platform” is an inference from silence rather than a confirmed negative, worth a targeted follow-up search if it matters for the piece.

    Sources

    It’s nice to see “asks” become real, don’t you think?

    —

    , ,

  • Burning Questions; My Dinner with Claude – Strict Liability, Different Scales: OFAC and OFSI Compared

    My prompt:

    well, OFAC is also a strict liability regime – all who touch the transaction have violated the regulations, but the consequences, if any, vary according to the Enforcement Guidelines. So, OFAC just balances the scales differently, wouldn’t you say?

    Claude responded:

    Yes — and that’s a genuinely better way to put it than how it was left last message, so it’s worth correcting rather than defending the weaker version.

    The mechanics check out

    OFAC’s civil liability is strict: a violation exists the moment a blockable transaction occurs, full stop — OFAC need not prove fault or intent to bring an enforcement action and issue a civil penalty, and a civil penalty can be assessed even if the violator had no idea they were dealing with a sanctioned party. What actually happens next is calibrated entirely by the Enforcement Guidelines at 31 CFR Part 501, Appendix A — egregious versus non-egregious, voluntary self-disclosure, willfulness or recklessness, quality of the compliance program, awareness of the conduct, harm to program objectives. So the fault inquiry hasn’t been discarded, it’s just been relocated to the remedy stage instead of the liability stage. “Balances the scales differently” describes that far more precisely than the earlier “bets on speed vs. bets on accuracy” line, which overstated the contrast.

    And here’s the part that actually strengthens the parallel rather than just conceding it: the UK made exactly this same move. For breaches committed on or after 15 June 2022, OFSI can impose civil monetary penalties on a strict liability basis, regardless of the absence of knowledge or a reasonable cause to suspect — before that date, OFSI had to show knowledge or reasonable cause to suspect on the balance of probabilities. So the “we wait for fault before we act” framing offered earlier doesn’t even hold up as a clean description of the UK’s own penalty regime anymore. Knowledge and intent still matter there, but now as a severity factor within OFSI’s case assessment, not as a threshold for liability — the same architecture as OFAC’s General Factors.

    So where does the real difference actually live now?

    Not in whether fault matters — both regimes have converged on “fault affects the size of the punishment, not whether a violation occurred.” It survives in what strict liability is allowed to reach. OFAC’s fault-blindness attaches to an immediate, automatic property action: the money gets locked up the moment the objective trigger exists, and that seizure doesn’t reverse just because a later fault inquiry clears the customer — unblocking still requires its own separate license. The UK’s 2022 reform, notably, didn’t build an equivalent mechanism. It made it easier to fine someone for the underlying conduct without proving they knew — but it stopped there. It didn’t create a parallel power to seize Customer A’s payment while that question gets sorted out, because there’s still nothing belonging to the designated person to seize in Scenario A, for the reasons worked through earlier.

    That’s actually a more interesting finding than where things were left before: it isn’t that UK-style regimes are squeamish about strict liability in general — 2022 proves they aren’t. It’s that they’ve kept strict liability confined to punishing conduct after the fact, and never extended it into a mechanism for provisionally seizing an uninvolved party’s property before fault is even alleged. OFAC does both.

    —

    , , , , ,

  • Burning Question: When OFAC and the EU Spell the Same Name Differently, What Are You Liable For?

    When OFAC and the EU Spell the Same Name Differently, What Are You Liable For?

    It is a question experienced practitioners run into constantly but rarely see answered head-on. A person is designated by both OFAC and the EU. OFAC’s SDN entry romanizes the name one way; the EU’s Official Journal renders it another. Your screening system matches one string cleanly and scores the other below threshold. If a transaction slips through against the spelling you did not catch, what exactly is the liability – and is “we ran a standard edit-distance match” a defense?

    The short version: you are liable for the person, not the spelling, and the expectation clearly goes beyond raw edit distance. Here is the reasoning, with the supporting regulatory language.

    1. The obligation attaches to the designated person, not to a romanization

    OFAC’s prohibitions run against the designated person and that person’s property and interests in property. The name spellings, aliases, and other identifiers published in an SDN entry are aids to identification; they are not the legal definition of the target. That distinction matters because it means a spelling discrepancy between OFAC’s list and another regulator’s list is not, by itself, a shield. You cannot defend a missed match by pointing out that OFAC and the EU transliterated the underlying name differently, because your obligation was never keyed to a specific Latin string in the first place.

    This is reinforced by the strict-liability character of most OFAC prohibitions. Civil liability under IEEPA-based programs does not require intent or knowledge, so “the file we screened against spelled it differently” is not a recognized excuse. It goes to mitigation, not to whether an apparent violation occurred.

    2. Each list is authoritative in its own jurisdiction – so you screen against each as published

    OFAC, the EU, the UN, and OFSI transliterate Arabic, Cyrillic, Farsi, and Chinese names using different conventions. The same human being legitimately produces different Latin strings across the lists – Mohammed / Muhammad / Mohamed; Qadhafi / Gaddafi / Kadafi; hyphenated, spaced, or dropped “Al-” prefixes. Each list is, in its own jurisdiction, the authoritative legal instrument. A firm subject to more than one regime is therefore expected to screen against each list as published and to reconcile the fact that one person maps to several spellings across them. There is no regulator that publishes an explicit “you must reconcile our transliteration against the EU’s” rule – the expectation is inferred from how the obligations are framed and enforced, not from a single on-point statement.

    3. Does the expectation go beyond standard edit-distance matching? Yes – and OFAC has said so in substance

    Edit distance (Levenshtein, Jaro-Winkler, and similar) is treated as necessary but not sufficient. OFAC does not prescribe an algorithm, but its guidance and enforcement record point squarely at the failure modes that character-level distance handles poorly.

    In A Framework for OFAC Compliance Commitments (May 2, 2019), OFAC identifies deficient screening as a recurring root cause of apparent violations, and it specifically calls out the failure to account for alternative spellings of designated parties. Commentators summarizing the Framework note that OFAC warns screening software must, among other things, account for alternative spellings of prohibited firms or people – the Habana / Havana example is OFAC’s own. That is the closest thing to a direct statement that naive string matching is not enough.

    Why edit distance alone falls short in the cross-list transliteration scenario:

    • Cross-alphabet variance. Two valid romanizations of one name can sit at a large character-level distance from each other. “Qadhafi” versus “Kadafi” is a big edit distance but the same person. A threshold tight enough to suppress false positives will miss these; a threshold loose enough to catch them floods the review queue.
    • Phonetic equivalence. Names that sound alike but score as distant (the “Mohammed” / “Muhammad” family) are better bridged by phonetic logic (Soundex, Metaphone) or transliteration-aware normalization than by raw distance.
    • Name-order and segmentation. Arabic kunya/nasab structures, Chinese surname-first ordering, and dropped or added particles defeat token-by-token distance scoring.
    • Culture and script-specific normalization rather than a single global threshold applied to every population.

    4. The enforcement record: tool tuning for name variants is a cited deficiency

    Two settlements make the point concretely, and neither turns on willful conduct – both are about how the screening tool was configured.

    Apple / SIS (FNKSR, 2023 settlement). As part of resolving apparent violations tied to a designated Slovenian developer, OFAC highlighted remedial measures Apple undertook, including reconfiguring its primary screening tool to fully capture spelling and capitalization variations and to account for country-specific business suffixes, plus annual review of the tool’s logic and configuration. The remediation itself tells you what OFAC viewed as the gap: a tool that did not adequately capture variant spellings.

    JPMorgan Chase (FNKSR and Syria, 2018 Finding of Violation). OFAC found that the bank’s screening system, as configured over a multi-year period, failed to identify customer names with hyphens, initials, or additional middle or last names as potential matches to identical or similar names on the SDN List – and that staff did not escalate the red flags despite matching addresses and dates of birth. Again, the deficiency is in the matching logic and the procedures around it, not in the absence of screening.

    The through-line: OFAC does not penalize you for the existence of a spelling difference. It looks at whether a reasonable, risk-appropriate program – with fuzzy matching, phonetic and transliteration handling, and periodic tuning and testing – should have caught the target. A tool that “ran” but was mis-tuned to variant spellings is treated as a deficient program.

    5. How the liability actually resolves

    Put the pieces together and the liability is not “for the spelling” as such. It is for processing a transaction involving a designated person you should reasonably have identified. If your program screens against OFAC’s spelling with matching logic calibrated to catch reasonable variants, and a genuinely divergent EU transliteration was the only version that would have matched, OFAC’s inquiry is whether a reasonable, risk-based program should have caught it anyway. A documented, risk-based methodology – fuzzy plus phonetic and transliteration-aware matching, with periodic tuning and testing – is simultaneously the compliance expectation and, under OFAC’s Economic Sanctions Enforcement Guidelines, a mitigating factor if something still slips through.

    Bottom line

    No regulator publishes an express “reconcile our transliteration against the EU’s” instruction. But the combination of three things – strict liability, the principle that the obligation runs to the designated person rather than to a designated spelling, and OFAC’s explicit citation of alternate-spelling failures as an enforcement root cause – produces a clear expectation. Screen against each authoritative list as published, and use matching logic that goes beyond raw edit distance to account for transliteration, phonetic, and structural name variation. Edit distance alone, without transliteration and phonetic handling and risk-based tuning, would most likely be viewed as a deficient program.

    Source confidence. The Framework‘s treatment of alternate spellings as a screening root cause, and the Apple/SIS and JPMorgan Chase remediation details, are well supported by OFAC’s published materials and settlement summaries. The broader proposition – that this framework requires cross-list transliteration reconciliation – is inference drawn from the Framework, the enforcement record, and the strict-liability structure, rather than from a single on-point OFAC statement, because OFAC has not issued express guidance addressing cross-regulator transliteration divergence directly.

    Key references: OFAC, A Framework for OFAC Compliance Commitments (May 2, 2019), Appendix root-cause analysis; OFAC settlement with Apple Inc. under the Foreign Narcotics Kingpin Sanctions Regulations; OFAC Finding of Violation involving JPMorgan Chase (FNKSR and Syrian Sanctions Regulations, 2018).

    —

    , , , , , , ,

  • Burning Questions; My Dinner with Claude – Forceful Against Whom? The Hidden Cost of Freezing First

    My prompt:

    In a practical sense, isn’t freezing the assets in Scenario A a more forceful way to accomplish the goals of sanctions policy, even if the transaction can get accomplished through some other means – by creating immediate real-world economic consequences for the failed attempt that even reporting on attempted transactions just can’t measure up to?

    Claude responded:

    This is the crux of it, and the sharpest way to answer is: forceful against whom?

    Walk through what actually happens to the designated person under each model

    In Scenario A, freeze and reject produce the identical outcome for the sanctioned party: they don’t get paid, either way. They’re equally free, either way, to go find the same money — or different money — through Beijing or Istanbul. Freezing the funds doesn’t touch anything the designated person owns, because as established previously, nothing was theirs yet. So the marginal “forcefulness” being described isn’t landing on the sanctions target at all. It’s landing on Customer A — the non-designated party whose money actually gets locked away, indefinitely, based on nothing more than their instruction to pay someone.

    That’s a real distinction worth sitting with: freezing in Scenario A is expropriating an unadjudicated third party’s property because of what they attempted, not punishing the person the sanctions regime actually targets.

    But there’s something real here too

    There is a genuine difference between freeze and reject that survives this reframing, and it’s not nothing: reject hands Customer A their money back, fully unencumbered, free to try the exact same payment again five minutes later through a different bank — the “ammunition” is untouched. Freeze removes that specific pool of liquidity from anyone’s use entirely. If the underlying deal is going to happen at all now, it needs fresh capital, not this capital. That’s a real cost, and it’s the honest, defensible case for the US approach here — it just achieves that cost by seizing the property of someone who hasn’t been found to have done anything wrong, rather than the property of someone who has.

    And the EU-family model doesn’t actually leave the attempt costless — it just sequences the cost differently

    If Customer A knowingly tried to pay a designated person, that attempt is itself a prosecutable sanctions offense in every jurisdiction covered — participating in or facilitating a breach of the making-available prohibition carries real civil and often criminal penalties, frequently well beyond the value of the blocked transaction itself. So both models are capable of imposing a serious, real cost on Customer A specifically. The difference is procedural: OFAC’s block is automatic and immediate, applied the instant the instruction is given, regardless of whether Customer A knew anything about the designation. The EU-family model waits for an investigation to actually establish knowledge or intent before it converts “you tried this” into a penalty. One bets on speed and volume (freeze everything that touches you, sort out culpability later, if ever); the other bets on accuracy (don’t touch anyone’s property until you can show they did something wrong).

    So a gentle pushback on “even reporting can’t measure up” — reporting isn’t the alternative to a real economic consequence, it’s the on-ramp to one. It’s slower and it requires someone to actually build the case. Whether that trade-off is worth it depends on how much you weight “we caught more bystanders along with more real violators, faster” against “we only touched people we could actually show did something wrong.” That’s a genuine values question in sanctions design, not a case of one side simply declining to try.

    —

    , , , ,

  • Burning Questions; My Dinner with Claude – Is ‘Just Say No’ a Cop-Out? The Politics Behind Freeze vs. Refuse

    My prompt:

    By refusing or rejecting a transaction, isn’t the regulator copping out? After all, the transaction could be accomplished somewhere else – say, in China or Turkey

    Claude responded:

    It’s a fair gut reaction, but it conflates two different questions: “does this stop the sanctioned party from ever getting the money” and “what happens to the specific transaction sitting in front of this specific firm.” Those aren’t the same question, and once you separate them, block doesn’t actually beat reject on the first one.

    The workaround problem is real, but it’s not a reject-specific problem

    If a UK bank refuses to send the payment, sure, the customer can try Beijing, Istanbul, or Dubai. But if a US bank blocks the payment instead, the designated person’s next attempt at financing can just as easily route through those same channels — blocking one wire doesn’t inoculate the rest of their commercial life. This is a well documented, general limitation of unilateral and even coordinated multilateral sanctions: research on sanctions evasion has tracked how Chinese and Russian arms have continued flowing to embargoed destinations for decades through non-dollar channels that sit outside any single regime’s reach. So “they’ll just go elsewhere” is a real critique of sanctions regimes in general — it applies to block just as much as reject. Neither mechanism solves global circumvention; both only capture what happens to already be within a given firm’s grasp at a given moment.

    So is releasing that specific transaction really nothing?

    Not quite. A rejected payment still comes with a mandatory report to the competent authority in every jurisdiction covered so far — so even though the money moves on, the attempt gets logged: who tried to pay whom, through which counterparties, on what pretext. That’s raw material for future listings, for identifying facilitators, and for building the kind of evidentiary record these regimes’ own courts increasingly demand. It’s a much thinner form of “action” than seizing the money, and it isn’t honest to pretend otherwise — but it isn’t nothing either.

    The real reason isn’t laziness, it’s legal exposure

    Here’s the part that actually answers the question. The EU, UK, Switzerland, Canada, and Australia are all legal systems where courts have been genuinely aggressive about policing sanctions listings on due-process and property-rights grounds — and the cleanest illustration is that the same person, Mr. Kadi, brought parallel challenges in EU and US courts over the same asset freeze, and the EU courts ruled the listing process lacked fundamental protections while the US courts rejected the equivalent constitutional claims. If that’s how exacting these courts are about freezing a person who has actually been designated, extending that seizure power further — to a non-designated customer’s own money, based solely on their stated intent to pay someone else — would be a considerably bigger and more legally exposed step, one these systems have chosen not to take. The US, operating under IEEPA’s far more executive-deferential tradition, doesn’t face the same internal constraint, which is a large part of why it’s comfortable blocking property whose ownership hasn’t fully vested yet.

    There’s a structural reason layered on top of the legal one. The US can afford to cast that wide a net because so much of world trade has no way to avoid touching dollar clearing — roughly 88 percent of foreign-exchange transactions involve the dollar, and the correspondent banking system that actually moves the money concentrates through a small number of banks in New York and London. Blocking a dollar payment captures real marginal value precisely because rerouting around the dollar is genuinely hard. A rejected euro, pound, franc, Canadian, or Australian dollar payment is comparatively easy to complete elsewhere without touching that currency’s clearing system at all, so the deterrent value of seizing a non-designated customer’s funds is lower relative to the legal and political cost of doing it — this half of the explanation is an original synthesis of the two facts above, not something any regulator has stated as its rationale.

    And this isn’t a “the EU goes soft” story — the freeze side still bites, hard

    Worth remembering: none of this caution applies once a resource actually belongs to the designated party. The clearest proof is sitting in Belgium right now — roughly €210 billion of Russian Central Bank reserves are frozen in Europe, most of it at the Euroclear depository, and that’s a Scenario B freeze, not a reject outcome, because those securities already belonged to the CBR the moment it was designated. And the EU’s own hesitation about going one step further — from freezing that money to actually using it for a reparations loan — is itself a live demonstration of the exact caution just described: Belgium has resisted precisely on expropriation grounds, warning other reserve holders might flee European custody, and Russia’s central bank has already sued Euroclear for roughly $230 billion over the freeze itself. That’s not a regime being casual about property rights; if anything it’s the same instinct that keeps the reject rule in place for in-flight payments, now playing out at nation-state scale.

    Self-check

    • Kadi I/II outcomes and the EU/US divergence: confirmed across multiple sources including a direct comparison piece and the CJEU’s own case summary.
    • Dollar/FX and correspondent-concentration figures: from a 2026 explainer drawing on the Farrell & Newman “weaponized interdependence” literature — solid secondary sourcing, not a primary BIS/Fed data pull.
    • Euroclear/CBR figures (~€210bn, ~€193bn at Euroclear, Belgium’s objections, the Russian lawsuit): converging figures across CFR, CEPR, Squire Patton Boggs, and AP reporting from November 2025–January 2026 — figures move slightly by source and date, so treat the exact number as “roughly €200–210bn” rather than a fixed figure if publishing this.
    • The causal argument connecting legal-rights culture and dollar centrality to the reject/block design choice is original synthesis — no regulator has published that rationale in those terms.

    —

    , , , , ,

  • Burning Questions; My Dinner with Claude – Six Countries, Two Wires: A Sanctions Compliance Cheat Sheet

    My prompt:

    ok… let’s open the aperture a bit. Explain what a compliant firm is supposed to do, for the US, UK, EU, Canada, Australia and Switzerland, in the following 2 scenarios – assuming we’re talking blocking/freezing sanctions only: Scenario A: You receive instructions to make a payment that involved a sanctioned party. Scenario B: You receive funds that involve a sanctioned party. For each scenario, also denote whether the answer is different in the case you are the beneficiary bank or an intermediary bank. Phrase this for a sanctions novice, but feel free to quote text (not full regulatory sections) – like “make economic resources available”, for example. Assume that my goal is to eventually, once I refine the response, make a “Burning Questions” post out of this

    Claude responded:

    This is exactly the kind of question that makes a good Burning Questions piece, because the honest answer isn’t “six jurisdictions, six rules” — it’s one rule almost everyone agrees on, and one narrow but consequential place where the US breaks from the rest.

    Two moves, and two roles, defined simply

    A compliant firm facing a sanctioned party has two different levers available, and confusing them is the single most common mistake:

    • Freeze/block: take the resource into your own custody, lock it away from everyone — including the customer who originally owned it — and report it. Nobody gets it until a regulator says otherwise.
    • Refuse/reject: simply decline to carry out the instruction. The money never leaves the paying customer’s account, so there’s nothing to freeze.

    And two roles matter for how this plays out:

    • Beneficiary bank: the bank holding the account of the person or entity who’s supposed to end up with the money.
    • Intermediary (correspondent) bank: a bank in the middle of the chain, routing the payment onward, with no account relationship to either the sender or the ultimate recipient.

    Scenario A: you receive instructions to make a payment that involves a sanctioned party

    Picture a customer who isn’t sanctioned asking you to send money to someone who is.

    JurisdictionWhat you doBeneficiary vs. intermediary bank
    US (OFAC)Block. Take the funds into a blocked, interest-bearing account. Don’t send them, and don’t hand them back to the customer either.No difference in principle — blocking applies regardless of whether it is the originating or intermediary bank in the chain. A purely blind intermediary with no account relationship to a non-listed related party gets a narrow pass on investigating what it has no way of knowing, but the moment it knows or should know a designated person is involved, it blocks too.
    UK (OFSI)Refuse. Don’t execute the payment; the customer’s own funds are untouched.Same principle for any bank in the chain — but correspondent banks caught mid-chain have created a genuine practical headache here (see below).
    EURefuse — going ahead would mean making economic resources available to the designated person, which every EU regulation prohibits directly or indirectly.Same in principle for whoever in the chain is asked to move the money.
    Switzerland (SECO)Refuse, for the same reason — Swiss ordinances closely mirror the EU wording, prohibiting third parties from making economic resources available to a listed person.Same in principle.
    CanadaRefuse — completing the payment would breach the ban on making any goods available to a designated person, or providing services to their benefit.Same in principle, though published Canadian guidance addressing intermediary banks specifically the way the US and UK have could not be located.
    Australia (DFAT/ASO)Refuse — a person commits an offence if they make assets available to a designated person or entity.Same in principle.

    The one country that flips the answer is the US, and it’s worth pausing on why. OFAC treats a designated person’s status as intended beneficiary of a payment as itself an “interest” in the funds, so the moment the firm has possession or control of the money for the purpose of sending it their way, it’s already blockable property — even though it started out as the customer’s own money and never actually reached anyone. Everyone else in this table requires the resource to actually belong to, or be held or controlled by, the designated person before the freeze duty exists — and a payment instruction that hasn’t been executed yet doesn’t meet that bar. So the divergence isn’t really about freeze versus reject as competing philosophies; it’s about how early each regime decides a sanctioned party has acquired an interest in money that hasn’t arrived yet.

    Scenario B: you receive funds that involve a sanctioned party

    Now flip it: money has actually arrived, or is already sitting in an account, where a designated person has a real, present interest — as the account holder, or as the completed beneficiary of an inbound transfer.

    JurisdictionWhat you doBeneficiary vs. intermediary bank
    US (OFAC)Block, and report within 10 business days.No difference — whoever’s possession or control the funds come within, blocks, subject to the same narrow intermediary safe harbor as above.
    UK (OFSI)Freeze, and report.The beneficiary bank freezes without question. An intermediary bank is generally fine to keep routing a payment onward provided the funds aren’t owned, held, or controlled by a designated person at the point it’s dealing with them — which gets complicated fast if a designated bank sat somewhere upstream (see below).
    EUFreeze, and report to the national competent authority. Notably, a bank is explicitly permitted to credit an incoming third-party payment into a frozen account without needing prior authorization for that specific act — the funds simply join the frozen pool once they land.Same logic as the UK: a true intermediary that never holds the designated person’s resources has nothing to freeze; a beneficiary bank freezes on receipt.
    SwitzerlandFreeze, and report to SECO.Same principle as the EU.
    CanadaFreeze (functionally, by disclosing the property to the RCMP and being barred from dealing with it) — firms must report property in their possession or control that is owned or controlled by designated persons and freeze such property.Same principle, applied to whoever holds it.
    AustraliaFreeze, and notify the Australian Federal Police.Same principle for whoever is holding the asset.

    This is really the headline finding: on receipt, all six jurisdictions land in the same place. The freeze duty is nearly universal once a designated person actually has a stake in the resource — the interesting divergence lives entirely in Scenario A, where the US alone extends that duty backward to cover an unexecuted instruction.

    Two wrinkles worth knowing for intermediary banks specifically

    US: OFAC’s own guidance draws the safe-harbor line precisely. An intermediary bank with no account relationship to a non-listed party referenced in a wire, and no actual or constructive knowledge of a blocking issue, isn’t expected to go digging — but the instant it has information suggesting blocked status, the duty to block attaches regardless of its position in the chain.

    UK: because the UK (unlike the EU generally) has designated entire banks, correspondent banks kept finding themselves holding payments that had passed through a now-designated bank somewhere upstream, with no clean way to either complete or return them — the industry calls these “trapped payments.” OFSI’s analysis turned on whether the designated bank still had a right of countermand over the funds at that point in the chain: if it had already discharged its role and lost any right to pull the funds back, the funds were no longer considered owned, held, or controlled by that designated bank, so the freeze duty didn’t travel downstream with it. That general licence has since been superseded by later amendments, so it’s an illustration of the reasoning rather than current operative guidance — worth pulling OFSI’s live Russia guidance before citing the mechanism itself.

    Self-check

    • US: OFAC FAQ 36 (reject example), FAQ 116 (intermediary safe harbor), and 31 CFR 501.603 (blocked-property reporting) pulled directly from ofac.treasury.gov.
    • EU: Regulation 36/2012 Article 14 template and the Council’s July 2024 Best Practices document, both previously verified.
    • UK: OFSI’s general guidance and reporting pages (gov.uk, ofsi.blog.gov.uk) plus the Trapped Payments general licence publication notice — flagged above as superseded, useful for the reasoning, not for current citation.
    • Canada: Global Affairs Canada’s own “Dealings prohibition and asset freeze” and disclosure pages — solid primary sourcing, but nothing found specific to intermediary-bank treatment; that’s a gap in published guidance, not a claim made by extension.
    • Australia: DFAT/Australian Sanctions Office guidance notes, all primary and current (2024–2025 dated).
    • Switzerland: sourced mainly through a Swiss press account describing the ordinance language rather than a direct ordinance or SECO FAQ pull — worth swapping in the exact ordinance article, and worth checking whether SECO’s FAQs address this reject/freeze point directly before publishing.
    • The “when does an interest attach” framing that ties the whole piece together is an original synthesis of the sourced material above, not a line any one source states outright.

    —

    , , , , , ,

  • Burning Questions; My Dinner with Claude – Block vs. Refuse: Why the US and EU Handle the Same Wire Differently

    My prompt:

    so, let’s assume my customer A is neither listed nor implicated by ownership and control sanctions. It’s my understanding, therefore, if he instructs me to transfer some funds to a sanctioned part, in the EU, I can refuse the instruction. However, in the US, I am obligated to take the funds and freeze them. Am I mistaken?

    Claude responded:

    You’re not mistaken about the pattern, but the accurate version of it hinges on which US list the counterparty is on, so let’s walk through both sides properly.

    EU: refuse, don’t freeze A’s funds

    This is the “making available” half of the earlier discussion. Customer A isn’t designated and the money is still A’s property, so it never meets Article 2(1)’s trigger (belonging to, owned, held, or controlled by a designated person). Executing A’s instruction would be the firm making resources available to the designated person, which Article 2(2) flatly prohibits absent a derogation. So the firm declines to execute, and A’s account is untouched, not frozen. There is one obligation people miss here: the Council’s Best Practices guidance is explicit that firms must report attempted transactions, including customer attempts to make funds or economic resources available to a designated person without authorization, to their national competent authority. So “refuse” is the transaction-level answer, but it comes bundled with a reporting duty, not a freeze.

    US: block, don’t reject, don’t return to A

    This is where the mechanics genuinely diverge, and the reason is definitional. OFAC’s blocking obligation attaches to property or interests in property that are within the United States or come within the possession or control of a U.S. person, and “interest” is defined expansively as an interest of any nature whatsoever, direct or indirect, present, future, or contingent. A designated person named as the intended beneficiary of a payment has exactly that kind of interest in the funds the moment the firm, a U.S. person, has possession or control of them for the purpose of completing the transfer, even though the money started out as A’s and A was never designated. OFAC’s own FAQ on this is unambiguous: once property is blocked, title remains with the blocked person, and the exercise of ownership powers is suspended absent OFAC authorization; the funds must be frozen, not seized, and reported. And the obligation to block, rather than reject, applies regardless of whether the designated person is the originator or the intended recipient of the funds. So the firm takes custody of A’s payment, places it in a blocked, interest-bearing account, files the initial blocked-property report within 10 business days under 31 CFR 501.603, and then includes it in the comprehensive Annual Report of Blocked Property due every September 30 for anything still blocked as of the prior June 30. The money does not go back to A.

    The contrast, side by side

    EU (Art. 2(1)/(2) template)US (OFAC blocking programs)
    TriggerResource already belongs to/owned/held/controlled by the designated personAny interest of any nature — including a contingent interest as intended beneficiary — once the property is within a U.S. person’s possession or control
    What happens to A’s fundsNothing; instruction is simply not executed, funds stay in A’s ordinary accountRemoved from A’s ordinary account and placed in a blocked, interest-bearing account; A no longer has free use of them
    OwnershipA retains full ownership throughoutTitle is treated as passing to/vesting in the blocked person once blocked
    ReportingAttempted “making available” reported to the national competent authorityInitial blocked-property report within 10 business days (31 CFR 501.603), then annual reporting each September 30 while still blocked

    Where this framing needs a caveat

    This only holds for a US counterparty that’s a blocked person, meaning someone on the SDN list or otherwise subject to OFAC’s blocking authority (including via the 50 percent rule). If the “sanctioned party” is instead someone subject only to OFAC’s narrower sectoral-style restrictions, such as the Sectoral Sanctions Identifications List under the Russia/Ukraine directives, there’s no blockable interest at all: OFAC’s own FAQ 36 example is exactly this case, an underlying dealing that’s prohibited but has no SDN or blocked-government interest in it, and the answer there is reject, or don’t process and return to the originator, reported under the separate rejected-transaction regime at 31 CFR 501.604. So the real dividing line isn’t “EU versus US” as such, it’s whether the applicable regime treats the counterparty as subject to a full asset freeze/blocking designation (EU Annex listing, OFAC SDN) or a narrower restriction on specific dealings (OFAC SSI, and arguably the EU’s own sectoral trade and financial restrictions on Russia that don’t run through personal designation). Matched apples to apples, both EU and OFAC would tell you to reject; it’s specifically the blocked-person case where OFAC’s answer flips to block while the EU’s stays at refuse.

    Self-check

    • OFAC FAQ 9 (blocking definition, title/possession language) and FAQ 36 (reject vs. block, with the Iran third-country example) pulled directly from ofac.treasury.gov.
    • 31 CFR 501.603 (blocked-property reports, 10-business-day initial report, September 30 annual report) and 501.604 (rejected-transaction reports) confirmed against Cornell/GovInfo CFR text and a recent OFAC annual-report reminder.
    • The “regardless of originator or recipient” framing and the broad “interest of any nature whatsoever” phrasing came from secondary sources (a law-firm compliance blog and a client alert) rather than a direct CFR pull of that exact clause — both are standard, uncontroversial restatements of OFAC’s general definitions section, but if citing the definition itself for publication, pull the exact text from the specific program’s CFR part (the phrasing is boilerplate but repeated part by part, e.g. 31 CFR 594.311, 515.312, etc., rather than centralized in one place).
    • The claim that a blocked person’s title is treated as attaching to an unexecuted, in-process payment is a synthesis of FAQ 9’s title language plus the broad interest definition, not something one source states in that combined form — flagged as inference, not a verified single-source claim.

    —

    , , , , ,

  • June 30, 2026: Not just OFSI: HMRC gets a 500K GBP settlement for Russia sanctions breaches

    First, Notice to Exporters 2026/15:

    Notice to exporters 2026/15: firm named after Russia sanctions breach settlement

    Published 29 June 2026

    1. Introduction

    Petrofac Facilities Management Limited (PFML) have paid HM Revenue and Customs a compound settlement of £569,157.07 for offences under  The Russia (Sanctions) (EU Exit) Regulations 2019 (the Russia Regulations). The offences were committed while PFML was divesting its operations in Russia in 2022 to 2023.  

    PFML  breached Regulation 46Y(2)(c) on 2 occasions in relation to industrial goods, sanctioned under the G7 Dependency and Further Goods chapter of the Russia Regulations. The first offence was for making the sanctioned goods available to a person connected to Russia. The second offence was for making available sanctioned goods for  use in Russia. PFML  also breached Regulation 46Z(1)(b) by providing technical  assistance in respect of the goods they made available.   

    This case was brought to HMRC’s attention following a voluntary disclosure by PFML, who have fully cooperated with HMRC’s investigation.

    2. Compound settlements criteria

    Compound settlements may be offered where an exporter has both:

    • committed a breach that was inadvertent or due to weaknesses in internal controls – HMRC will not normally offer a compound settlement where an exporter intended to breach the controls
    • voluntarily told HMRC about sanctions or export control breaches

    And a press release, to boot:

    Energy firm named after £500,000 Russia sanctions settlement

    An energy services firm has paid more than £500,000 to HM Revenue and Customs (HMRC) for breaching Russia sanctions regulations.From:HM Revenue & CustomsPublished29 June 2026

    Petrofac Facilities Management Limited (PFML) paid a £569,157 compound settlement and has become the first company to be publicly named by HMRC for accepting such a penalty. 

    The breaches by PFML occurred in 2022 and 2023 while the company was winding down its Russian operations. The company supplied sanctioned industrial goods to individuals connected to Russia and provided technical assistance relating to those goods.  

    PFML self-reported the breaches to HMRC and fully cooperated with the investigation. 

    Naming the company marks a shift in how HMRC handles compound settlements in relation to strategic exports and sanctions. 

    Edwige Hill, Deputy Director in HMRC’s Fraud Investigation Service, said: 

    Non-compliance with Russia sanctions is a serious offence and together with our international partners, the UK Government has implemented the most severe package of sanctions ever imposed on a major economy.  

    Naming those involved brings us into line with other enforcement partners whilst sending a clear message on the consequences of breaching sanctions rules.

    Where appropriate, HMRC will now include naming as a condition when offering a compound settlement for strategic export and sanctions offences.  

    The new approach will improve transparency and ensure greater consistency with other UK sanctions enforcement bodies such as the Office of Financial Sanctions Implementation (OFSI). 

    Further information

    Non-compliance with sanctions is a serious offence and those who breach them may be subject to a range of enforcement actions by HMRC, including large financial penalties or referral for criminal prosecution.

    A compound settlement is the means where, through payment of a sum of money, HMRC may offer to settle alleged Sanction and Strategic Export offences committed under the Customs and Excise Management Act and the Export Control Order, out of court. This saves time and money – both for the offender and HMRC – by avoiding the need for legal proceedings. HMRC will only offer a compound settlement where it is believed there is sufficient evidence to prosecute.

    When deciding if a compound settlement is appropriate and the level of the offer; HMRC’s considerations will include:

    • the seriousness of the alleged offence
    • whether fraudulent intent can be proven
    • the extent of the efforts to perpetrate the alleged offence
    • the type and value of any goods involved
    • the offender’s previous history
    • the extent to which the offender has co-operated with any investigation
    • the level of financial penalties known to have been imposed by courts for similar offences

    Information on payments of compound settlements is published by the Export Control Joint Unit (ECJU) via Notices to Exporters (NTEs)

    Further guidance on the voluntary disclosure regime is available on GOV.UK

    You can find out more about HMRC’s approach to strategic export violationson GOV.UK.

    —

    , , , , ,

  • June 17, 2026: OFSI hands out 1MM GBP fine to Sabre Global Technologies Limited

    Claude’s Summary:

    Imposition of Monetary Penalty – Sabre Global Technologies Limited (SGTL)

    HM Treasury Press Release: UK issues largest penalty for financial sanctions breaches since Russia’s 2022 illegal invasion of Ukraine

    At a Glance

    • Subject: Sabre Global Technologies Limited (SGTL)
    • Sector: Travel technology; operates a Global Distribution System (GDS) giving travel-industry entities access to travel-supplier content
    • Authority: OFSI (HM Treasury), under section 146 of the Policing and Crime Act 2017
    • Date of Penalty: 26 May 2026
    • Penalty Amount: £1,000,920.59 (reduced from a baseline of £1,251,150.73 by a 20% discount)
    • Sanctions Regime: Russia (Sanctions) (EU Exit) Regulations 2019
    • Provisions Breached:
      • Regulation 13 — making funds available for the benefit of a designated person
      • Regulation 14 — making economic resources available to a designated person
      • Regulation 19 — circumventing prohibitions
    • Designated Person / Nexus: JSC Ural Airlines (Ural Airlines), designated under the Russia Regulations on 19 May 2022; unique ID RUS 1446
    • Guidance Applied: November 2024 Financial Sanctions Enforcement and Monetary Penalties Guidance (the version in force at the decision to issue notice); resolved by settlement under the transitional arrangements of OFSI’s new settlement policy introduced February 2026
    • Resolution: Settlement under transitional arrangements — the third penalty resolved this way, and OFSI’s first penalty for a circumvention offence

    What Happened

    SGTL had supplied services to Ural Airlines since 2007. The contract, signed on 14 September 2007, gave the airline access to SGTL’s GDS and was extended several times — most recently updated on 1 December 2021, with a later amendment on 1 September 2022.

    On 19 May 2022, Ural Airlines was designated under the Russia Regulations and added to the UK consolidated list. SGTL’s legal representatives told it the same day. Access did not stop. The airline kept its GDS connection until 6 December 2022 — roughly seven months — and SGTL chose simply not to renew the contract rather than cut off access on designation.

    The money moved in parallel. In April, May, and June 2022, SGTL invoiced Ural Airlines and instructed that funds be paid into its account, totalling $906,576.30 (£744,305.13). Three related payments followed between June and September 2022, and SGTL’s UK bank froze each of them.

    The warnings were not subtle. SGTL’s UK bank held a 3 June payment on 6 June, declined to process it on 27 June, and held the 1 July payment on 5 July; on 21 September, SGTL’s US bank flagged the September payment for compliance review. Through July and August 2022, rather than stopping, SGTL looked for another way to be paid — engaging its US bank to test whether funds from Ural Airlines could land in a US account, and expressly citing the sanctions problems on its UK account. Internal emails in August and October 2022 show the plan: if a test payment cleared, SGTL expected Ural Airlines to settle the full outstanding GDS fees by that route. On 21 September 2022, Ural Airlines sent a $200 (£176.48) test payment to the US account. OFSI considered the object or effect of that payment to be circumvention of the Russia Regulations.

    OFSI identified why the controls failed. The senior responsible officer misunderstood which Sabre-group entity held the Ural Airlines contract and, while transitioning out of the role, did not escalate what he knew. A wider restructuring left SGTL for a time without a permanent Chief Legal Officer or Chief Compliance Officer, and the legal team short-staffed. The firm’s sanctions documentation leaned on general procedures and US requirements rather than the UK regime — and its third-party screening software never automatically flagged the designation to compliance.

    SGTL made a voluntary disclosure to OFSI on 31 October 2022, covering the three frozen payments, and cooperated with the investigation that followed. OFSI issued a Notice of Intention to impose a penalty on 16 January 2026; SGTL submitted formal representations on 24 February 2026; the parties agreed to enter settlement discussions under transitional arrangements on 16 March 2026; and on 26 May 2026 settlement was agreed and the penalty imposed. As a condition of settlement, SGTL agreed to pay the penalty as imposed and to waive its rights to ministerial review and to appeal OFSI’s decision to the Upper Tribunal on matters within the settlement’s scope.

    The Breaches

    • Regulation 13 — making funds available for the benefit of a designated person: SGTL’s contract created a debt obligation. By invoicing Ural Airlines and instructing payment into its account, SGTL made funds available to its bank for the airline’s benefit. Under reg. 13(4)(a), funds are made available “for the benefit of” a designated person where that person thereby obtains or is able to obtain a significant financial benefit — and OFSI assessed that Ural Airlines did, because the payments discharged its financial obligations to SGTL.
    • Regulation 14 — making economic resources available to a designated person: SGTL provided an economic resource directly to Ural Airlines by allowing continued GDS access between 19 May and 6 December 2022.
    • Regulation 19 — circumventing prohibitions: During July–August 2022, SGTL explored alternative routes to receive funds from Ural Airlines via its US bank, expressly referencing the prior UK-account sanctions problems, and arranged a $200 (£176.48) test payment on 21 September 2022 with a view to routing the full outstanding amount the same way. OFSI assessed the object or effect of this as circumvention.

    Valuation of the Breach

    • Total Assessed Value: $3,222,379.89 (£2,634,001.54) — the combined value of funds and economic resources in breach of regs. 13, 14, and 19, calculated to avoid double-counting amounts already paid by Ural Airlines.
    • Regulation 14 — economic resource: $2,576,550.57 (£2,107,876.02), OFSI’s assessment of the value of the economic resource provided between 19 May and 6 December 2022 (includes VAT).
    • General Licence deduction: less $50 (£40.91) for booking fees paid by UK persons, in line with OFSI’s Russian Travel General Licence (INT/2022/1839676).
    • Regulation 13 — frozen June 2022 payment: $312,129.65 (£248,143.07), for services provided in April 2022, separate from the 19 May–6 December period (includes VAT).
    • Regulation 13 — pro rata July 2022 payment: $333,549.67 (£277,846.87), for services provided 1–18 May 2022 (includes VAT).
    • Regulation 19 — test payment: $200 (£176.48), the 21 September 2022 test payment.

    OFSI noted that the portion of the July payment for services 19–31 May 2022 and the September 2022 payment were not separately included in the reg. 13 value, being treated as captured within the economic-resource valuation.

    OFSI’s Case Assessment

    • Aggravating Factors:
      • (case factor A) SGTL actively explored alternative means to receive payment, including requesting a test payment to a non-UK account and planning to route future settlements through it — circumvention of the Russia Regulations.
      • (case factor B) The value of the breaches was high.
      • (case factor C) Ural Airlines was designated for supporting the Russian government in the strategically significant transport sector; by enabling GDS access, SGTL undermined the regime’s objectives. That the payments ran from Ural Airlines to SGTL was not mitigating to harm, as they were for continued provision of services.
      • (other relevant factors under severity) Sanctions against Russia are a strategic priority for the UK and its foreign policy.
      • (case factor D) SGTL had reasonable cause to suspect its actions could breach UK sanctions; seeking alternative payment routes and continuing the relationship after designation amounted to circumvention.
      • (case factor E) During the breach period SGTL lacked competent senior oversight of sanctions and could not properly assess or mitigate its exposure or understand its responsibilities. Although post-breach remediation was positive, knowledge and systems during the breach period were assessed overall as aggravating.
      • (case factor G) SGTL did not seek advice or consider applying for a licence to permit receipt of payments or continued service despite multiple red flags.
      • (case factor I) The provision of an economic resource ran over seven months (19 May–6 December 2022).
    • Mitigating Factors:
      • (case factor K) Although the initial report was incomplete, SGTL provided significant detail on the underlying causes throughout, conducted internal investigations, gave full and timely responses to voluntary questions, and demonstrated full co-operation with OFSI.
    • Neutral Factors:
      • (case factor J) SGTL’s disclosure was voluntary and unprompted but contained limited information; SGTL did not proactively submit further information before OFSI’s formal request in June 2023 and continued providing services after the initial report, yet cooperated fully and promptly with each subsequent request. On balance, neither aggravating nor mitigating.
    • Overall Assessment: “Most serious” (as opposed to “serious”). OFSI cited particularly poor conduct through circumvention, negligent conduct including continued provision of services for months after identifying potential breaches, and the direct undermining of the regime by providing an economic resource directly to a designated person. OFSI viewed SGTL’s remediation as constructive but largely addressing deficiencies that should have been in place at the time.

    How the Penalty Was Calculated

    • Total Breach Value: £2,634,001.54
    • Statutory Maximum: £1,317,000.77 (the greater of £1m or 50% of the breach value, under the framework applied)
    • Baseline Penalty: £1,251,150.73 (OFSI’s assessed reasonable and proportionate baseline)
    • Discount Applied:
      • Voluntary disclosure and settlement under transitional arrangements: 20%
    • Final Penalty: £1,000,920.59

    OFSI applied the November 2024 Enforcement Guidance, under which it may reduce a “most serious” case by up to 30% for voluntary disclosure; here it applied a 20% discount.

    Compliance Lessons

    • Do not engineer alternative payment routes to evade sanctions: Firms must not test, reroute, restructure, or otherwise manipulate payment pathways — including staging payments through third countries — to avoid, evade, or defeat UK sanctions. Such conduct may itself be circumvention and will be treated as aggravating.
    • Recognise intangible and digital services as “economic resources”: Economic resources are assets of every kind that are not funds but can be used to obtain funds, goods, or services. Software, data services, and digital tools are not assumed outside scope; a service that lets a designated person generate revenue, maintain operations, or gain an economic advantage may be an economic resource. Firms should assess all products and services and seek specialist legal advice where uncertain.
    • Maintain UK-tailored policies, oversight, and screening: Sanctions policies for UK operations must be tailored to the UK regime, supported by competent senior oversight and clear accountability. Firms should test that screening systems work as intended, maintain robust escalation, and act on red flags such as blocked payments or notifications of sanctions concerns from financial institutions.
    • Report breaches promptly, comprehensively, and in detail: Suspected breaches should be reported to OFSI as soon as reasonably practicable. Delay and incomplete submissions undermine mitigation. Where full disclosure is not yet possible, firms should make an early partial disclosure, provide a timeline for the full account, and follow up as indicated.

    Supplemental Information: Per the HM Treasury press release, this is the UK’s largest penalty for a breach of Russian financial sanctions since the 2022 invasion of Ukraine, and OFSI’s first penalty issued specifically for a circumvention offence. It is the third case resolved under the transitional arrangements of OFSI’s new settlement policy, introduced in February 2026. Ural Airlines — the designated nexus — is a Russian carrier sanctioned as part of the UK’s targeting of the Russian transport sector; the Russian Travel General Licence (INT/2022/1839676) referenced in the valuation permits certain UK-person travel-related payments to specified Russian carriers, which is why a small booking-fee amount was deducted from the breach value. More broadly, OFSI’s enforcement framework changed materially on 9 February 2026: for cases assessed under that newer framework, the voluntary-disclosure discount is capped at 30% and gated on a separate co-operation limb, settlement carries a discount of up to 20%, seriousness is assessed on a four-level matrix, and the statutory maximum is being raised toward the greater of £2m or 100% of the breach value. Those mechanics did not drive the calculation here, which OFSI made under the November 2024 guidance, but they are the standard the next comparable case will be measured against.

    Sources

    Validation Note

    Checks performed against the SGTL penalty notice and the HM Treasury press release.

    • Source-tracing: Every labelled value and narrative claim traces to the notice or the press release; supplemental context (largest-penalty / first-circumvention framing, settlement-policy context, General Licence purpose, Feb 2026 framework mechanics) is confined to the Supplemental block and Sources.
    • No paragraph coupling: Extraction was by meaning; the SGTL notice’s own paragraph numbering is not relied on anywhere in the output.
    • Figures: The breach-value components reconcile to the stated total once OFSI’s stated avoidance of double-counting is applied (reg. 14 economic resource £2,107,876.02 less £40.91 GL deduction, plus reg. 13 components £248,143.07 and £277,846.87, plus the £176.48 test payment ≈ £2,634,001.53, matching the stated £2,634,001.54 to within rounding). Statutory maximum £1,317,000.77 = 50% of the breach value, consistent with the framework applied. Baseline £1,251,150.73 less 20% = £1,000,920.58, matching the imposed £1,000,920.59 to within one penny of rounding. No figures were altered.
    • Guidance regime: The notice states it applied the November 2024 Enforcement Guidance (the version in force at the decision date), under which a “most serious” case may receive up to a 30% voluntary-disclosure reduction; the 20% discount applied is consistent. The newer 9 February 2026 framework is noted as context only and was not used to recompute anything.
    • Provisions: Regs. 13, 14, and 19 are mapped to the descriptors the notice itself uses.
    • Subject/nexus: Facts about SGTL are kept distinct from those about Ural Airlines; Ural’s designation date and unique ID (RUS 1446) are drawn from the notice.
    • Terminology: “Breach” used throughout; “violation” (the OFAC term) does not appear.
    • One discrepancy flagged: The notice gives the Notice of Intention as 16 January 2026 and representations as 24 February 2026, while also stating the settlement-enabling framework took effect 9 February 2026 — i.e. the framework post-dates the Notice of Intention, which is why the case proceeded under transitional arrangements rather than the new settlement scheme proper. This is reproduced as stated, not corrected.

    And the actual text of the penalty notice:

    SGTL_-_Public_Penalty_NoticeDownload

    Mr. Sanctions’ Note: I had Claude create a master prompt for OFSI penalty notices with the OFAC format as a guide. Since the actual notices differ in vocabulary, format and style, it is somewhat different – although I had Claude make the sentence structures more OFAC-like (fewer longer sentences). What do you think?

    —

    , , ,