UK sanctions compliance: what businesses need to know

Contents

1. Introduction
2. Why sanctions compliance is a board-level issue
3. The UK sanctions framework in brief
4. Ownership and control risk
5. Screening and due diligence
6. Red flags and high-risk scenarios
7. Reporting obligations and OFSI investigations
8. Civil and criminal liability
9. Cross-border exposure and secondary risk
10. Frequently asked questions
11. How Gherson can help

1. Introduction

Sanctions compliance is no longer a niche regulatory issue. For many businesses, particularly those operating internationally, it is a core legal and governance risk.
The UK sanctions regime has expanded significantly in recent years. Enforcement powers have strengthened, civil penalties may be imposed on a strict liability basis and the reputational consequences of any breaches can be severe.

As discussed in our article “What Happens If You Are Subject to UK Sanctions?”, designation can have immediate and disruptive consequences. However, businesses do not need to be designated themselves to face serious risk. Dealings with sanctioned individuals, entities or controlled companies may expose organisations to liability.

This article outlines what businesses need to understand about UK sanctions compliance and how to mitigate risk effectively.

For a broader overview of the UK sanctions regime and advisory support, see our sanctions page: UK sanctions legal advisory services.

2. Why sanctions compliance is a board-level issue

Sanctions compliance is not purely an operational matter for compliance teams – it is a governance issue that can engage directors’ duties and personal liability.

Breaches may result in:

• Criminal prosecution;
• Civil monetary penalties;
• Regulatory investigation; and
• Significant reputational damage.

Given the potential consequences, boards should ensure that sanctions risk is appropriately assessed, documented and monitored.

3. The UK sanctions framework in brief

UK sanctions are imposed under the Sanctions and Anti-Money Laundering Act 2018 and related regulations.

The regime typically prohibits:

• Dealing with frozen funds or economic resources;
• Making funds or economic resources available to designated persons; and
• Certain trade and financial activities.

Importantly, civil penalties may be imposed by the Office of Financial Sanctions Implementation (OFSI) on a strict liability basis. This means that a breach may give rise to a penalty even where there was no intention to violate sanctions.

4. Ownership and control risk

One of the most complex areas of sanctions compliance concerns ownership and control.

UK sanctions may apply not only to a designated person, but also to entities owned or controlled by that person. Ownership structures can be layered, cross-border and opaque.

Assessing control requires more than reviewing shareholding percentages. It may involve examining voting rights, board influence and other forms of decisive control.

Failure to identify ownership or control links can result in inadvertent breaches.

Where ownership structures are complex or uncertain, specialist advice should be sought: UK sanctions compliance advice.

5. Screening and due diligence

Effective sanctions compliance depends on proportionate and risk-based screening processes.

Businesses should consider:

•  Screening counterparties against UK and relevant international sanctions lists;
• Assessing beneficial ownership;
• Reviewing transaction patterns; and
• Documenting risk assessments.

Automated screening tools are widely used, but they are not sufficient on their own. False positives and false negatives both require careful human assessment.

Due diligence should be tailored to the nature of the transaction, the jurisdiction involved and the sector risk profile.

6. Red flags and high-risk scenarios

Certain scenarios warrant enhanced scrutiny, including:

• Transactions involving high-risk jurisdictions;
• Complex ownership chains;
• Sudden changes in counterparties;
• Requests for unusual payment structures; and
• Dealings involving politically exposed persons (PEPs).

Sanctions risk often intersects with anti-money laundering and fraud risk. A siloed approach to compliance can leave material gaps.

7. Reporting obligations and OFSI investigations

In certain circumstances, businesses are required to report suspected sanctions breaches or frozen assets to OFSI.

Failure to report when required can itself constitute a breach.

OFSI has broad powers to:

• Request information;
• Conduct investigations; and
• Impose civil monetary penalties.

Investigations can be intrusive and time-consuming. Early, structured engagement with regulators can significantly influence outcomes.

As explored in our article “Challenging a Sanctions Designation in the UK”, enforcement action may raise complex evidential and procedural issues.

8. Civil and criminal liability

Sanctions breaches may result in:

• Criminal prosecution;
• Civil monetary penalties; or
• Public naming by OFSI.

Directors and senior managers may face personal exposure where breaches occur with their consent or through neglect.

In addition to formal penalties, the reputational consequences of a sanctions investigation can be significant, particularly for regulated businesses.

9. Cross-border exposure and secondary risk

Businesses operating internationally must consider not only UK sanctions, but also the interaction with other regimes, including US and EU measures.

Financial institutions and multinational partners often apply global sanctions standards, which may exceed minimum UK requirements.

The concept of secondary sanctions, particularly in the US context, can create additional risk even where UK law has not been breached.

A coordinated cross-border strategy is often necessary: cross-border sanctions legal advice.

10. Frequently asked questions

Can a company be fined even if it did not intend to breach sanctions?
Yes. Civil penalties may be imposed on a strict liability basis.

Are directors personally liable for sanctions breaches?
They may be, particularly where breaches occur with their consent or through neglect.

Is screening alone sufficient for compliance?
No. Screening must be part of a broader, risk-based compliance framework.

What should a business do if it identifies a potential breach?
Immediate legal advice should be sought. Early action can mitigate enforcement risk and reputational damage.

11. How Gherson can help

Gherson advises businesses on sanctions compliance, investigations and enforcement risk within the UK sanctions framework: UK sanctions compliance and investigations advice.

We assist with:

• Sanctions risk assessments;
• Compliance framework development;
• Ownership and control analysis;
• Advising on reporting obligations;
• Responding to OFSI investigations; and
• Managing cross-border sanctions exposure.

Our approach is strategic and proportionate. Sanctions compliance is not about overreaction, it is about identifying real risk, mitigating exposure and protecting long-term commercial stability.

If you have any questions arising from this blog, please do not hesitate to contact us for advice, send us an e-mail, or, alternatively, follow us on X, Facebook, Instagram, or LinkedIn to stay-up-to-date.

The information in this blog is for general information purposes only and does not purport to be comprehensive or to provide legal advice. Whilst every effort is made to ensure the information and law is current as of the date of publication it should be stressed that, due to the passage of time, this does not necessarily reflect the present legal position. Gherson accepts no responsibility for loss which may arise from accessing or reliance on information contained in this blog. For formal advice on the current law please do not hesitate to contact Gherson. Legal advice is only provided pursuant to a written agreement, identified as such, and signed by the client and by or on behalf of Gherson.

©Gherson 2026