Mr. Sanctions

Category: Settlement Agreements

  • June 30, 2026: Not just OFSI: HMRC gets a 500K GBP settlement for Russia sanctions breaches

    First, Notice to Exporters 2026/15:

    Notice to exporters 2026/15: firm named after Russia sanctions breach settlement

    Published 29 June 2026

    1. Introduction

    Petrofac Facilities Management Limited (PFML) have paid HM Revenue and Customs a compound settlement of £569,157.07 for offences under  The Russia (Sanctions) (EU Exit) Regulations 2019 (the Russia Regulations). The offences were committed while PFML was divesting its operations in Russia in 2022 to 2023.  

    PFML  breached Regulation 46Y(2)(c) on 2 occasions in relation to industrial goods, sanctioned under the G7 Dependency and Further Goods chapter of the Russia Regulations. The first offence was for making the sanctioned goods available to a person connected to Russia. The second offence was for making available sanctioned goods for  use in Russia. PFML  also breached Regulation 46Z(1)(b) by providing technical  assistance in respect of the goods they made available.   

    This case was brought to HMRC’s attention following a voluntary disclosure by PFML, who have fully cooperated with HMRC’s investigation.

    2. Compound settlements criteria

    Compound settlements may be offered where an exporter has both:

    • committed a breach that was inadvertent or due to weaknesses in internal controls – HMRC will not normally offer a compound settlement where an exporter intended to breach the controls
    • voluntarily told HMRC about sanctions or export control breaches

    And a press release, to boot:

    Energy firm named after £500,000 Russia sanctions settlement

    An energy services firm has paid more than £500,000 to HM Revenue and Customs (HMRC) for breaching Russia sanctions regulations.From:HM Revenue & CustomsPublished29 June 2026

    Petrofac Facilities Management Limited (PFML) paid a £569,157 compound settlement and has become the first company to be publicly named by HMRC for accepting such a penalty. 

    The breaches by PFML occurred in 2022 and 2023 while the company was winding down its Russian operations. The company supplied sanctioned industrial goods to individuals connected to Russia and provided technical assistance relating to those goods.  

    PFML self-reported the breaches to HMRC and fully cooperated with the investigation. 

    Naming the company marks a shift in how HMRC handles compound settlements in relation to strategic exports and sanctions. 

    Edwige Hill, Deputy Director in HMRC’s Fraud Investigation Service, said: 

    Non-compliance with Russia sanctions is a serious offence and together with our international partners, the UK Government has implemented the most severe package of sanctions ever imposed on a major economy.  

    Naming those involved brings us into line with other enforcement partners whilst sending a clear message on the consequences of breaching sanctions rules.

    Where appropriate, HMRC will now include naming as a condition when offering a compound settlement for strategic export and sanctions offences.  

    The new approach will improve transparency and ensure greater consistency with other UK sanctions enforcement bodies such as the Office of Financial Sanctions Implementation (OFSI). 

    Further information

    Non-compliance with sanctions is a serious offence and those who breach them may be subject to a range of enforcement actions by HMRC, including large financial penalties or referral for criminal prosecution.

    A compound settlement is the means where, through payment of a sum of money, HMRC may offer to settle alleged Sanction and Strategic Export offences committed under the Customs and Excise Management Act and the Export Control Order, out of court. This saves time and money – both for the offender and HMRC – by avoiding the need for legal proceedings. HMRC will only offer a compound settlement where it is believed there is sufficient evidence to prosecute.

    When deciding if a compound settlement is appropriate and the level of the offer; HMRC’s considerations will include:

    • the seriousness of the alleged offence
    • whether fraudulent intent can be proven
    • the extent of the efforts to perpetrate the alleged offence
    • the type and value of any goods involved
    • the offender’s previous history
    • the extent to which the offender has co-operated with any investigation
    • the level of financial penalties known to have been imposed by courts for similar offences

    Information on payments of compound settlements is published by the Export Control Joint Unit (ECJU) via Notices to Exporters (NTEs)

    Further guidance on the voluntary disclosure regime is available on GOV.UK

    You can find out more about HMRC’s approach to strategic export violationson GOV.UK.

    —

    , , , , ,

  • May 19, 2026: OFSI fines Deutsche Bank AG for 2 Russian sanctions breaches

    Office of Financial Sanctions Implementation HM Treasury
    Deutsche Bank AG PenaltyOFSI has imposed a £165,000 monetary penalty on Deutsche Bank AG London Branch (DBLB) for breaches of the Russia financial sanctions regime. 

    Between June and July 2022, DBLB processed two payments totalling £635,618.75 to an entity wholly owned by a designated person. 

    This is the second OFSI monetary penalty case resolved through settlement, demonstrating how proportionate and effective enforcement outcomes can support the rapid communication of compliance lessons to industry. 

    It also underlines the importance of firms maintaining effective sanctions controls, particularly where ownership and control structures determine whether restrictions apply. 

    Key lessons for firms include the importance of: 

    – maintaining suitably robust sanctions screening systems and processes, commensurate with their level of exposure to sanctions risk  
    – having strong onboarding procedures and regular, risk‑based customer reviews especially in higher risk jurisdictions 
    – complete, detailed, and prompt voluntary disclosure of potential breaches to OFSI  

    A 45% discount was applied, reflecting voluntary disclosure and settlement. 

    I had Claude summarize the Penalty Notice:

    OFSI Penalty Notice: Deutsche Bank AG London Branch

    Plain-Language Summary

    SUMMARY

    The UK’s Office of Financial Sanctions Implementation (OFSI) fined Deutsche Bank’s London branch (DBLB) £165,000 for violating UK Russia sanctions. The core violation: DBLB processed two payments in 2022 — totalling about £635,000 — to a company called Okko, which was owned by a sanctioned Russian entity. Because DBLB voluntarily reported the problem and later agreed to settle the case, its original penalty was reduced. The final £165,000 figure reflects both a voluntary disclosure discount and a settlement discount.

    BACKGROUND

    Okko is a Russian streaming service (think a Russian Netflix). Russia’s largest bank, Sberbank, owned Okko until May 2022, when it sold the company to another Russian firm, JSC New Opportunities. The timing matters: Sberbank had just been sanctioned by the UK in April 2022, and JSC New Opportunities was then sanctioned in late June 2022. The moment JSC New Opportunities was designated, Okko automatically became off-limits under UK sanctions — even though Okko itself was never directly listed — because it was wholly owned by a sanctioned party. DBLB’s customer (an Irish-incorporated subsidiary of a multinational firm) instructed DBLB to send the payments to Okko via the SWIFT network.

    THE BREACHES

    Two payments are at the heart of the case:

    • Payment A (~£356,000): Processed on June 29, 2022 — the same day JSC New Opportunities was publicly designated as sanctioned. The funds actually left the account the following day.
    • Payment B (~£279,000): Processed about a month later, on July 27, 2022.

    DBLB did run sanctions screening on both payments, but its third-party screening vendor’s data didn’t include ownership information linking Okko to the newly sanctioned JSC New Opportunities. So no alert was triggered, and the payments went through.

    A third payment (Payment C, ~£1.1 million) was made in April 2022 but was not treated as a breach, because it pre-dated the UK’s strict liability sanctions rules taking effect in June 2022.

    CASE ASSESSMENT

    OFSI weighed factors both for and against DBLB when deciding how serious the case was.

    Factors that made things worse (aggravating):

    • The combined payment value was significant — over £635,000.
    • The money went directly to an entity owned by a sanctioned person, which effectively undermined the asset freeze the UK had put in place against Russia.
    • Russia sanctions were a top UK foreign policy priority in 2022 and remain so.
    • Although DBLB had conversations with its customer about Russia-related payment risks between March and May 2022, it never probed how the customer itself assessed sanctions ownership risks — specifically, that the customer relied on self-certification from its own customers rather than verifying ownership information independently. DBLB missed an opportunity to catch this gap.
    • The earlier Payment C — though not itself penalized — showed DBLB had a pattern of processing payments to Okko and was relevant context.

    Factors treated as neutral:

    • DBLB’s use of a third-party screening vendor is understandable and common practice, but DBLB remained ultimately responsible for its own compliance. The vendor failed to capture publicly available information about Okko’s change of ownership, highlighting a known risk of relying on such providers — made worse by Russia withdrawing information from its public corporate registries in mid-2022.
    • DBLB cooperated with OFSI’s investigation, but its responses were sometimes slow and thin on detail — below what OFSI expects from a large regulated institution.

    Factors that helped DBLB (mitigating):

    • There is no evidence DBLB knew, or had reason to suspect, that the payments were in breach of sanctions — no intent or prior knowledge.
    • Payment A happened on the very day of the designation. The window for cancelling it was extremely narrow, and OFSI acknowledged this. It was only included in the penalty because Payment B followed a month later.
    • DBLB voluntarily disclosed the breaches to OFSI in September 2022 — an important positive step.
    • Since the breaches, DBLB has significantly overhauled its sanctions compliance program: better oversight of third-party vendors, broader Russia-related list coverage, stronger due diligence procedures, and a much more cautious approach to Russia-related payments overall.

    Overall, OFSI rated the case as “serious” — but not the most serious category.

    THE PENALTY CALCULATION

    StepAmount
    Maximum statutory penalty£1,000,000
    Baseline penalty set by OFSI£300,000
    Discount applied (45% — for voluntary disclosure + settlement)–£135,000
    Final penalty imposed£165,000

    The 45% discount was slightly below the maximum 50% available, because while DBLB disclosed promptly, its initial disclosure lacked the detail OFSI expected from a firm of its size and sophistication.

    COMPLIANCE LESSONS

    OFSI used the notice to flag three takeaways for the broader financial industry:

    1. Don’t over-rely on third-party screening tools. They are valuable but have gaps — especially for ownership-and-control risks. Firms must understand those limitations and fill them with their own processes.
    2. Know your customer’s compliance practices. It’s not enough to screen transactions; firms should understand how their customers manage their own sanctions risks, especially where payments go to higher-risk jurisdictions like Russia.
    3. Voluntary disclosure pays — but only if it’s thorough. OFSI rewards early disclosure, but incomplete or vague reporting limits the discount available. Firms should take time to provide a full, detailed account when reporting suspected breaches.

    NOTES ON SETTLEMENT

    This was OFSI’s first (or among its first) cases resolved through its new formal settlement process, introduced in February 2026. Settlement allows both sides to reach a negotiated outcome more quickly than a full contested process. In exchange for a penalty discount and input into the published case summary, DBLB agreed to pay the penalty and waive its right to challenge OFSI’s decision. OFSI views early settlement as being in the public interest — it’s faster, cheaper, and gets compliance messages out sooner.

    The full Penalty Notice:

    DB_Penalty_NoticeDownload

    I do wonder about the severity of the fine, and the relatively harsh assessment of these sanctions violations. Perhaps it’s because patterns of conduct are just smaller outside the US, so the penalties need to be harsher to get people’s attention.

    I will admit, the penalty notice is much more detailed than it used to be. I will note that it took me a while to find that the 3rd party vendor did include ownership and control data, but was either slow or deficient in providing the needed info in this case.

    I also wonder what would have happened had the 2nd payment been stopped. After all, the first payment was processed on the same day as the designation of the parent company (even if value date was the best day).

    All in all, instructive – I will see if I need to tweak the fairly generic prompt for summarizing the penalty notice.

    —

    , , , ,

  • The updated enforcement action post: what changed and why

    So, I asked Claude to enhance its response from 3rd party sources if there was anything notable – and to conduct a fact check. The good part about all this?

    What was added

    The only section that warranted substantive enhancement based on third-party sources was “Discovery and Response.”The original draft characterized AEL’s reaction to the June 2025 public reports as a clean, cooperative pivot. Third-party reporting reveals a more complicated picture:

    • The trigger was specifically the Wall Street Journal‘s investigative report tracking LPG tankers between Gulf ports and Mundra Port — worth naming rather than leaving as generic “public reports.”
    • At the same moment AEL was suspending imports and retaining U.S. counsel privately, it was publicly filing a stock exchange statement calling the allegations “baseless and mischievous” and denying awareness of any investigation. This tension is directly material to understanding why the case doesn’t qualify for voluntary self-disclosure credit.

    One minor enhancement in the Mitigating Factors section: AEL’s own public statements confirmed the “less than 1.5%” revenue figure at 1.46% specifically, so that precision was added there.

    No factual corrections were required — the enforcement release is well-supported by contemporaneous reporting on the underlying facts.

    Additional sources consulted:

    • Wall Street Journal — investigative report on Adani LPG tankers (June 2, 2025); original source that triggered the public reports referenced in the enforcement release
    • Adani Enterprises stock exchange filing (June 2025) — via multiple Indian financial press outlets (Business Upturn, MENAFN, Outlook Business, Lokmattimes)
    • Bloomberg, Reuters/U.S. News, IANS, BizzBuzz News — day-of settlement reporting confirming key facts (May 18, 2026)
    • The Tribune India, DT Next, The Federal — pre-settlement reporting (May 15, 2026) on the broader Adani Group legal resolution context

    The bad part? I didn’t tell it to make a new post with the additional info – so it updated the post. Oopsie! But I like this, so I will amend my base prompt for enforcement actions to do this same thing for all future enforcement action posts.

    —

    , ,

  • May 18, 2026: Adani Enterprises Limited’s Iran sanctions violations cost it $275 Million (updated)

    What Happened

    Adani Enterprises Limited (AEL), a large Indian multinational conglomerate with operations across energy, infrastructure, and other sectors, has agreed to pay $275,000,000 to settle potential civil liability for apparent violations of U.S. sanctions on Iran.

    From November 2023 to June 2025, AEL purchased shipments of liquified petroleum gas (LPG) from a Dubai-based trading company (the “Dubai Supplier”) that claimed to be supplying gas from Oman and Iraq. Multiple red flags should have put AEL on notice that the LPG actually originated from Iran. During this period, AEL caused U.S. financial institutions to process 32 U.S. dollar (USD)-denominated payments totaling approximately $192,104,044 for the shipments.

    Background: How AEL Got Into the LPG Business

    AEL entered the LPG market in June 2023, importing gas for sale to customers in India through Mundra Port — a major port on India’s western coast operated by AEL’s affiliate, Adani Ports and Special Economic Zone Ltd. (APSEZ). Neither AEL nor any of its affiliates had previously traded LPG on its own account through Mundra Port, making this a brand-new business line.

    To compete in an established market, AEL needed a discounted supply source. In July 2023, AEL representatives — including the head of its newly formed LPG unit — met with the Dubai Supplier, which was already involved in supplying purportedly Omani-origin LPG to another Indian buyer. By September 2023, a deal was taking shape. Internal AEL documents at the time described the arrangement as “discounted LPG from Middle East” on a spot basis.

    AEL ran its standard Know Your Customer (KYC) process on the Dubai Supplier and its affiliates and found no matches on OFAC’s SDN List. It also relied on APSEZ’s existing 2020 sanctions compliance program, which prohibited Iranian-origin cargo from entering APSEZ-controlled ports. On paper, AEL appeared to have done its homework.

    What AEL apparently did not know — and did not dig deeply enough to uncover — was that the Dubai Supplier was operating as a conduit for Iranian LPG. An affiliate of the Dubai Supplier had already been designated by OFAC in March 2023 for purchasing LPG from a sanctioned Iranian petrochemical company. Iran, practically alone among Middle Eastern producers, was offering deeply discounted LPG — exactly the kind of deal AEL was looking for.

    The Purchases

    AEL completed its first purchase in November 2023: a cargo of fully refrigerated propane shipped on a 25-year-old Handysize LPG tanker, with documents listing the origin as Sohar, Oman. AEL paid approximately $5.67 million. Over the next year and a half, AEL purchased 34 additional cargos of what turned out to be Iranian-origin LPG from the Dubai Supplier and its affiliates, using similar documentation and payment structures.

    Payments were generally made in USD or UAE dirhams (AED) from accounts at UAE or Indian banks. In total, U.S. financial institutions processed $192,104,044 in USD payments across 32 of the 35 shipments. (The remaining three shipments were either paid entirely in AED or were never completed.)

    Red Flags AEL Overlooked

    From early in the relationship, there were multiple warning signs that the Dubai Supplier’s cargo wasn’t what it claimed to be. AEL failed to act meaningfully on any of them.

    • Third-party warnings: On at least four separate occasions between March 2023 and February 2024, AEL and APSEZ received inquiries from outside parties alleging that the Dubai Supplier’s cargos may have originated in Iran. AEL appears to have dismissed these as interference from competitors trying to block it from entering the LPG market. Its response was limited to reviewing shipping documentation and obtaining verbal assurances from the Dubai Supplier itself.
    • Suspicious vessel behavior: Ships carrying the Dubai Supplier’s cargos routinely engaged in conduct associated with sanctions evasion: manipulating or disabling their Automatic Identification System (AIS) transponders, making commercially illogical port calls, and frequently changing their names, ownership, and flag state. AEL and APSEZ did not monitor for these vessel-level red flags.
    • Implausible origin claims: The very first shipment claimed to be loaded in Sohar, Oman — but Sohar is not a significant source of Omani LPG exports (those primarily come from Salalah), and Sohar lacked the refrigerated storage and loading infrastructure needed to load fully refrigerated LPG at the time. The claimed origin simply didn’t make logistical sense.
    • Document irregularities: Certificates of origin provided by the Dubai Supplier showed illogical and non-sequential numbering, were repeatedly issued long after the shipments had been made, and used outdated document templates — all indicators of potential falsification.
    • Below-market pricing: Iran — virtually alone among Middle Eastern LPG sources — offered significantly discounted gas. The prices AEL received from the Dubai Supplier were sufficiently below prevailing market rates that, accounting for realistic freight costs, port fees, and profit margins, the economics of the claimed Omani or Iraqi origin simply didn’t add up. AEL should have treated this as grounds for heightened scrutiny.
    • A blocked payment: In February 2024, the Dubai Supplier’s bank stopped a payment due to “internal policy,” raising concerns about whether the cargo was actually from Iraq or Iran. The supplier directed AEL to a new bank account at a different Dubai bank. Payment was eventually released after the supplier provided additional shipping documentation that later appeared to be falsified.

    Discovery and Response

    In June 2025, the Wall Street Journal published an investigative report tracking LPG tankers traveling between Gulf ports and Adani-operated Mundra Port, alleging that Adani Group entities had been importing Iranian-origin LPG. AEL responded publicly with a stock exchange filing calling the allegations “baseless and mischievous,” categorically denying “any deliberate engagement in sanctions evasion or trade involving Iranian-origin LPG,” and stating that it was “not aware of any investigation by US authorities on this subject.”

    Privately, the picture was different. AEL simultaneously suspended all LPG imports and retained U.S.-based legal counsel to conduct a comprehensive internal investigation. Whatever the public posture, the private pivot was prompt: AEL cooperated extensively with OFAC’s subsequent investigation, proactively sharing the findings of its internal review, producing large volumes of documents, responding to all agency requests, and moving quickly toward a resolution. OFAC credited AEL for this cooperation in determining the final settlement amount — though the public denial at the moment of disclosure is precisely why the case does not qualify for voluntary self-disclosure credit.

    The Violations

    OFAC found 32 apparent violations of the Iranian Transactions and Sanctions Regulations (ITSR), 31 C.F.R. part 560, specifically § 560.203(a) — by causing U.S. financial institutions to facilitate trade-related transactions involving goods of Iranian origin, in violation of § 560.206 of the ITSR. The settlement agreement is available on OFAC’s website.

    The Penalty

    Because AEL did not voluntarily self-disclose the violations and OFAC determined the case to be egregious, the applicable starting point under OFAC’s Economic Sanctions Enforcement Guidelines was the statutory maximum base penalty: $384,208,088.

    All 32 apparent violations were treated as egregious.

    After weighing the aggravating and mitigating factors described below, OFAC agreed to settle for $275,000,000 — a reduction of approximately $109 million from the base penalty.

    Aggravating Factors

    • Reckless conduct despite clear warning signs
      • General Factor: Willfulness or Recklessness of the Conduct; Awareness of Conduct at Issue
      • AEL received multiple third-party warnings that its LPG cargos may have come from Iran, yet failed to conduct meaningful additional investigation. It also ignored commercially implausible pricing, suspicious vessel behavior, and document red flags. Moreover, AEL’s own sanctions compliance program at the time explicitly acknowledged that causing U.S. financial institutions to process Iran-related transactions could expose the company to civil or criminal penalties — meaning AEL knew the legal stakes but still did not act on the warning signs.
    • Substantial harm to the goals of Iran sanctions
      • General Factor: Harm to Sanctions Program Objectives
      • A central goal of U.S. Iran sanctions is to cut off Iran’s ability to earn revenue from its energy sector. By purchasing Iranian LPG and routing USD payments through the U.S. financial system, AEL provided Iran with significant economic benefit — money the Iranian government uses to fund its nuclear program, support terrorist proxy groups, and oppress its own population.
    • Size and sophistication of the company
      • General Factor: Individual Characteristics
      • AEL is a large, diversified international conglomerate with extensive operations in energy and infrastructure sectors. A company of that scale and global experience is expected to maintain correspondingly robust sanctions compliance capabilities.

    Mitigating Factors

    • Clean prior record
      • General Factor: History of Prior OFAC Actions
      • AEL had not received any OFAC penalty notice or Finding of Violation in the five years preceding the earliest transaction at issue.
    • LPG business was a small part of AEL’s overall operations
      • General Factor: Individual Characteristics
      • AEL’s LPG unit was newly formed and represented less than 1.5% of the company’s consolidated revenue for 2025 — a figure consistent with AEL’s own public statements, which put the LPG segment at approximately 1.46% of consolidated revenue. The violations arose from a nascent, peripheral part of a much larger enterprise.
    • Substantial cooperation with OFAC
      • General Factor: Cooperation with OFAC
      • AEL conducted a thorough, independent internal investigation on an expedited basis and at significant cost; responded promptly to all OFAC requests for information; and produced large volumes of data to support the agency’s investigation.
    • Meaningful remedial action
      • General Factor: Remedial Response
      • AEL took significant steps to address the root causes of the violations, including: (1) ceasing all LPG imports into India; (2) creating and adopting a new, robust risk-based sanctions compliance policy overseen by a dedicated Group Head of Compliance; (3) applying the enhanced policy across all of AEL’s business units for consistency and comprehensiveness; (4) incorporating maritime hydrocarbon transport risks — including those identified in OFAC’s published guidance — into its sanctions risk assessment; and (5) deploying specialized maritime intelligence technology designed to flag sanctions evasion activity in the marine transport sector.

    The $275,000,000 settlement amount reflects OFAC’s determination that while the violations were serious and egregious — and AEL did not come forward before the government became aware — the company’s prompt response, extensive cooperation, and significant compliance overhaul after the conduct came to light all warranted meaningful credit.

    What are the Takeaways?

    Non-U.S. companies using the U.S. dollar face real U.S. sanctions exposure. If your company routes payments through the U.S. financial system — even indirectly through correspondent banking — you can be held liable under U.S. sanctions law, even if your company is not based in the United States. AEL is an Indian company that never directly held a U.S. bank account, but the USD-denominated payments it initiated passed through U.S. financial institutions, giving OFAC jurisdiction. The lesson: if your payments touch the dollar, they touch U.S. sanctions law.

    Buying energy products from or near the Middle East is high-risk territory for Iran sanctions. Restricting Iran’s energy exports has been a consistent, bipartisan U.S. policy priority, and OFAC has issued multiple rounds of guidance — in 2019, 2020, 2024, and most recently in 2025 — specifically warning the energy industry about Iran’s sophisticated evasion tactics. If you’re importing petroleum products, LPG, or petrochemicals with any connection to that region, treat it as a high-risk environment requiring enhanced due diligence from the start.

    Certificates of origin and supplier warranties aren’t enough — you need to independently verify. Iran actively uses neighboring jurisdictions — particularly Oman, the UAE, and Iraq — as cover for its petroleum exports. Importers cannot rely solely on counterparty-provided documentation or supplier assurances to satisfy their sanctions due diligence obligations. Those documents need to be independently corroborated, with particular attention to whether the claimed loading ports and infrastructure are consistent with the claimed product type and origin.

    Know Iran’s shadow fleet — and actively monitor for it. Iran moves a large share of its petroleum exports using a “shadow fleet” of vessels that engage in well-documented evasion tactics: turning off or falsifying AIS transponders, conducting ship-to-ship transfers at sea, making economically illogical port calls, and frequently cycling through new names, owners, and flag states. The majority of the vessels involved in AEL’s purchases were subsequently designated by OFAC. Energy importers should build real-time maritime intelligence monitoring into their compliance programs — and stay current as evasion typologies evolve. OFAC’s 2025 Guidance for Shipping and Maritime Stakeholders on Detecting and Mitigating Iranian Oil Sanctions Evasion is required reading.

    If a deal is too good to be true, it probably involves sanctions evasion. Buyers of energy products from high-risk regions should treat prices significantly below prevailing market rates as a red flag requiring enhanced scrutiny — not an opportunity. Heightened caution is especially warranted when the below-market prices come from a counterparty with a limited public profile or trading history, or when multiple affiliated entities are used to structure similar transactions for no clear commercial reason.

    Compliance isn’t box-checking — investigate allegations promptly and seriously. When a third party alleges that your supply chain involves sanctioned goods or origins, that allegation requires a thorough, good-faith investigation — not a shrug and a request for assurances from the counterparty under scrutiny. AEL received at least four separate third-party warnings over more than a year and essentially took the Dubai Supplier’s word that everything was fine. The result was a $275 million settlement.

    Even without voluntary self-disclosure, cooperation with OFAC pays off. This case makes clear that OFAC will offer meaningful penalty reductions in exchange for prompt internal investigation, transparent sharing of findings, and genuine cooperation with the agency’s inquiry — even when a company doesn’t come forward before OFAC initiates its investigation. AEL received roughly a $109 million reduction from the statutory maximum base penalty. Voluntary self-disclosure would likely have produced a lower starting point still, but cooperation alone had real, quantifiable value here.

    Other Resources

    OFAC Compliance Framework

    In May 2019, OFAC published A Framework for OFAC Compliance Commitments, which lays out what OFAC considers to be the essential building blocks of an effective sanctions compliance program. The Framework also explains how OFAC takes compliance program quality into account when resolving enforcement cases, and includes an appendix identifying common root causes of sanctions violations that OFAC has observed in its investigations.

    Civil Penalties and Enforcement Rules

    The rules governing OFAC’s civil penalties process are set out in the regulations for each individual sanctions program, the Reporting, Procedures, and Penalties Regulations (31 C.F.R. part 501), and the Economic Sanctions Enforcement Guidelines (31 C.F.R. part 501, app. A). Recent enforcement actions and civil penalties information, including the settlement agreement in this case, are available at https://ofac.treasury.gov/civil-penalties-and-enforcement-information.

    FinCEN Whistleblower Program

    The U.S. Treasury’s Financial Crimes Enforcement Network (FinCEN) operates a whistleblower incentive program that covers OFAC sanctions violations, violations of the International Emergency Economic Powers Act (IEEPA), and Bank Secrecy Act violations. Individuals located anywhere in the world who provide information about potential sanctions violations may be eligible for a financial award if their tip leads to a successful enforcement action resulting in penalties exceeding $1,000,000. The program is open across all commercial sectors.

    —

    , , ,

  • OFSI teaches us lessons about the Bank of Scotland enforcement action

    From OFSI’s blog:

    Sanctions compliance in practice: lessons from OFSI’s £160,000 Bank of Scotland penalty

    OFSI, 23 February 2026 – OFSI Blog

    In January 2026, OFSI published the details of an £160,000 monetary penalty imposed on Bank of Scotland Plc, a subsidiary of the Lloyds Banking Group, for breaching the Russia financial sanctions regime. 

    The lessons in this case go beyond one bank and one customer. OFSI’s published outcomes demonstrate how OFSI assesses breaches, the circumstances surrounding them, and how weaknesses in screening, escalation and training are taken into account when breaches have occurred. These lessons can help firms better understand how to run sanctions controls in practice, and how weaknesses in screening, escalation and training can expose firms to the risk of breaching.

    UK financial sanctions apply to any conduct in the UK and to all UK persons (including UK legal entities) anywhere in the world.

    Lesson 1: Screening data and configuration really matter

    OFSI strongly encourages firms to utilise all information available to them to optimise sanctions controls relative to their risk. Firms are advised to assess and employ appropriate resources to enhance the effectiveness of such systems.

    In this case, Lloyds Banking Group had taken measures to implement sanctions screening. However, its automated sanctions systems failed to detect a spelling variation of a designated individual’s name.

    What this means for you:

    • Ask whether your screening can cope with spelling and transliteration variants.
    • Where your risk justifies it, consider enriched screening and commercial list providers alongside the new UK Sanctions List.

    Lesson 2: Automation is not a safety net

    This case illustrates that there are inherent risks associated with automated sanctions screening. It is essential that firms establish robust and explicit contingency procedures.

    Internal policies should provide robust and explicit guidance to staff regarding the escalation of potential sanctions concerns. This is particularly pertinent for areas of business that are more exposed to sanctions risk, such as those involving Politically Exposed Persons (PEPs).

    What this means for you:

    • Make sure front‑line teams know when to escalate, who to contact and how – not just that they “should escalate”.

    Lesson 3: Training must match today’s sanctions landscape

    The sanctions landscape has evolved significantly since the Russian invasion of Ukraine in February 2022, and continues to develop with ever-shifting geopolitical events. It is imperative that all training and associated materials relating to sanctions are regularly reviewed and updated.

    What this means for you:

    • Training content must be regularly reviewed and updated to accurately reflect relevant regulatory and geographical developments to ensure continued compliance.

    Lesson 4: Voluntary disclosure can shape the outcome

    This case is an example of prompt, voluntary disclosure of a potential breach. Lloyds Banking Group, on behalf of Bank of Scotland, made an initial notification within two weeks of identifying a potential breach. OFSI seeks to reward prompt and complete voluntary disclosures through penalty discounts, which alongside co-operation can result in a discount of up to 30% under new guidance.

    What this means for you:

    • You should report suspected breaches to OFSI as soon as practicable.
    • Where full disclosure is not possible, a person should make an early disclosure with partial information on the basis that they are still working out the facts and will make a further and full disclosure as soon as possible.
    • Reporting breaches protects the integrity of financial sanctions and assists government and law enforcement agencies in tackling serious crime.

    What firms should do next

    This case shows that OFSI is focused not only on whether firms have sanctions controls, but on how effectively those controls operate in practice. From the way screening data is configured, to how concerns are escalated, how often training is refreshed, and how quickly potential breaches are reported.

    Firms with UK touchpoints, including those operating internationally, should:

    • review their sanctions screening, escalation procedures and training considering these lessons
    • ensure they understand and comply with their reporting obligations, including reporting “as soon as practicable” where required.

    You can read the full penalty notice here: https://www.gov.uk/government/publications/imposition-of-monetary-penalty-bank-of-scotland-plc

    Further information and guidance on reporting information to OFSI is available here: https://www.gov.uk/government/organisations/office-of-financial-sanctions-implementation

    —

    , , ,

  • February 12, 2026: OFAC Settles for $1.7MM from IMG Academy

    Settlement Agreement between the U.S. Department of the Treasury’s Office of Foreign Assets Control and IMG Academy, LLC

    The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) today announced a $1,720,000 settlement with IMG Academy, LLC to settle its potential civil liability for 89 apparent violations of OFAC counternarcotics sanctions. Between 2019 and 2025, IMG Academy dealt in the property or interests in property of two Specially Designated Nationals (SDNs) sanctioned for their ties to a sanctioned Mexico-based drug cartel. Specifically, IMG Academy entered into yearly tuition agreements with the SDNs and received and processed payments pursuant to those agreements. The settlement amount reflects OFAC’s determination that IMG Academy’s conduct was non-egregious and not voluntarily disclosed.

    Here’s Gemini’s take:

    Based on the OFAC Enforcement Release regarding IMG Academy, LLC (the document referenced by the URL provided), here is the reformatted and simplified breakdown as requested.

    What Happened

    The Core Issue

    IMG Academy, a Florida-based sports prep school, agreed to settle its legal liability after it was discovered they had been doing business with two people on the U.S. sanctions list. These individuals were sanctioned due to their ties to a major Mexican drug cartel.

    The Two Sets of Violations

    The school entered into two separate tracks of business dealings:

    • Customer 1 (SDN 1): Between 2018 and 2022, the school signed three separate yearly tuition contracts with this individual.
    • Customer 2 (SDN 2): During that same period, the school signed another three yearly tuition contracts with this second individual.

    In both cases, the school provided “elite academic and athletic training” for the children of these individuals. Even though the parents’ names were clearly listed on the U.S. government’s “No-Business” list (the SDN List), the school continued to invoice them, communicate with them about payments, and process their money.

    How the Money Moved

    The school didn’t just take one-off payments. They processed 89 total transactions over several years. This included:

    1. Direct Charges: Using credit cards the sanctioned parents had left on file.
    2. Third-Party Wires: Accepting wire transfers from other people and companies in Mexico intended to cover the students’ costs.

    Description of the Apparent Violations

    IMG Academy appears to have violated § 598.202 of the Foreign Narcotics Kingpin Sanctions Regulations. Essentially, the school “dealt in the property” of sanctioned persons by providing services in exchange for their money, which is a violation of federal law.

    The Bottom Line

    While the school eventually reported the issue, they only did so after the government had already started an investigation, meaning they did not get credit for a “voluntary” disclosure.

    The Penalty

    The final settlement amount is $1,720,000.

    Violation Breakdown

    OFAC categorized all 89 violations as non-egregious (meaning they weren’t considered a “worst-case scenario” of intentional defiance), but because the school didn’t self-report before the investigation began, the penalty was still substantial.

    • Total Violations: 89
    • Total Egregious Violations: 0
    • Total Non-Egregious Violations: 89
    • Base Penalty: $1,720,000 (The “schedule” amount for non-disclosed, non-egregious violations).

    Mitigating and Aggravating Factors

    Aggravating Factors (Why the penalty remained high)

    • Failure to Perform Basic Checks
      • General Factor: Reckless Disregard. The school failed to run the parents’ names through any sanctions screening software, even though the parents provided their real names which matched the SDN list exactly.
    • Management Awareness of the Relationship
      • General Factor: Awareness of Conduct. While the school might not have realized the parents were “sanctioned,” they had actual knowledge of the transactions. They sent invoices directly to the parents and spoke with them regularly about their accounts.
    • Providing a “Safety Valve” for Cartel Money
      • General Factor: Harm to Sanctions Program. By accepting this money, the school allowed people tied to a drug cartel to use the U.S. financial system and obtain high-end services in the U.S.

    Mitigating Factors (Why the penalty wasn’t higher)

    • A Clean Recent Record
      • General Factor: Compliance Record. IMG Academy had not been flagged for a sanctions violation in the five years before this happened.
    • Coming Clean and Cooperating
      • General Factor: Cooperation. Once they realized the government was looking into them, the school cooperated fully, shared information quickly, and agreed to extend the legal deadlines to help the investigation.
    • A Total Compliance Overhaul
      • General Factor: Remediation. After a change in ownership in 2023, the school hired a new Chief Legal Officer, conducted a deep audit of their past mistakes, and built a professional sanctions screening system.

    What are the Takeaways?

    • Screen the Payors: It is not enough to screen the student; you must screen the person signing the contract and the person sending the wire transfer.
    • Names are Enough: If a customer gives you their real name and it matches a sanctioned person, “I didn’t know” is not a valid excuse if you never bothered to check the list.
    • Non-Bank Businesses are at Risk: This case shows that OFAC is looking closely at “non-traditional” sectors like private schools, luxury goods, and specialized training centers.
    • Ownership Changes are an Opportunity: If you buy a company, conduct a “compliance lookback” immediately. IMG’s new management helped limit the damage by fixing the system as soon as they took over.

    Other Resources

    • OFAC Civil Penalties & Enforcement: Visit the official Treasury website to see a list of recent actions and understand how OFAC applies these rules to different industries.
    • Compliance Framework: Review the “Framework for OFAC Compliance Commitments” to see the five pillars of a strong legal safety net.
    • Contacting OFAC: If you find a potential violation, you can contact the OFAC Compliance Hotline or use their online reporting portal.

    Here’s the actual Enforcement Release:

    20260212_img_academyDownload

    Note: Gemini originally didn’t catch that there were 2 sets of violations with SDN 1 and SDN 2. What flagged this for me was that the date range of the violations was wrong.

    Fixing it was pretty simple – I just told Gemini to recheck its work and why I thought it had missed something.

    Probably a good thing to do with enforcement actions that have “multiple’ something – whether its sets of actions, sanctioned parties or affected sanctions programs. It’s generally good practice to have an AI tool check its work – since I asked for a simplified recap, I expected it to omit certain detail. But, this was not that…

    —

    , , ,

  • What did Exodus Movement agree to do with its compliance program?

    Based on the OFAC enforcement release and settlement agreement regarding Exodus Movement, Inc., here is a summary of the Compliance Commitments (often found in Section 2 or labeled as a specific point in the agreement terms):

    • Sanctions Compliance Program: Exodus agrees to maintain a comprehensive sanctions compliance program for at least five years.
    • Management Commitment: The company will ensure senior management support and the provision of adequate resources to the compliance function.
    • Risk Assessment: Exodus will conduct periodic risk assessments to identify and mitigate sanctions risks specific to its business.
    • Internal Controls: The company must implement and maintain written policies and procedures, including effective sanctions screening (such as IP blocking/geoblocking) and escalation protocols for potential matches.
    • Testing and Audit: Exodus is required to perform independent testing and audits to ensure the effectiveness of its compliance program.
    • Training: The company commits to providing regular (at least annual) sanctions compliance training to relevant employees.
    • Compliance Investment: Exodus has specifically agreed to invest $630,000 in additional sanctions compliance controls and measures.
    • Reporting: A senior executive must submit annual certifications to OFAC for a period of five years, confirming that the company is meeting these compliance obligations.

    —

    ,