UK OFSI Consults on Amending its Civil Enforcement Processes

• Following a sharp increase in the number of enforcement actions taken this year by the UK Office of Financial Sanctions Implementation (OFSI), the regulator has issued a consultation on amending its enforcement processes.
• The proposed changes, if proceeded with, are material. The statutory maximum for civil penalties could rise from £1 million or 50% of the breach’s value, to a cap of £2 million or 100% of the estimated value of the breach (whichever is greater).
• Other proposals are positioned as facilitating enhanced transparency and simplicity. This includes the possible introduction of a settlement scheme for appropriate cases, as well as an “early account scheme” and capping discounts for voluntary self-disclosure.
• Many of these proposals, draw parallels with enforcement mechanisms operated by other UK regulators and in particular the UK Financial Conduct Authority (FCA) and the UK Prudential Regulation Authority (PRA).
• The consultation is open until 13 October 2025, though the timeline for the implementation of any changes is not yet known, given that some changes may require legislation. What is clear, however, is that OFSI is sharpening its focus on enforcement and firms should be prepared for greater scrutiny and an increased number of investigations.
• Firms should use this time to proactively consider their systems and controls framework, performing gap analyses and implementing improvements where necessary.

Background

OFSI reports that since 2022 and the imposition of sanctions on Russia, it has been pursuing a higher number of complex investigations, with a record number of cases being opened in recent years.¹  This is also reflected in the number of civil enforcement actions taken by OFSI, with six civil enforcement actions having been reported already this year (up from a single case in 2024).² With this change in the regulatory landscape, it is natural that the enforcement process itself should evolve and become more sophisticated. It is in this context that OFSI has published a consultation paper proposing amendments to its enforcement processes (the Consultation Paper).³ The Consultation Paper positions itself as pursuing common regulatory aims of increasing transparency, efficiency, and proportionality. It also proposes amending the calculation of the maximum penalty available, which will be of particular interest to firms.

Penalty Transparency

As required by statute, OFSI has already issued guidance on how it will assess the “severity” of a particular case.⁴
This guidance has multiple factors, divided themselves into (potentially confusingly) “severity"⁵  and “conduct” factors.⁶ OFSI is proposing to add two additional tables to the guidance, to explain how it combines the severity factors and the conduct factors into an overall assessment of severity, which will then be used to determine the appropriate outcome:

The second table which is proposed to be added would then set out the likely outcomes arising from four categories of cases – lesser severity, potentially serious, serious, and most serious:

• Lesser Severity: “likely to be dealt with via private warning letter”, provided there are no aggravating factors and the breach is not part of a wider pattern.
• Potentially Serious: “likely to be assessed as either Moderate Severity or at the lower end of Serious”, and unlikely to be dealt with by private warning letter. Moderate Severity cases are likely to be dealt with by publication without monetary penalty.
• Serious: “likely to result in a civil monetary penalty”, with a baseline of “up to 75% of the statutory maximum” (see more below regarding amounts). This is a proposed increase from the present baseline of 0-50% of the statutory maximum.
• Most Serious: “may be referred for criminal investigation”, alternatively if a civil penalty is imposed, then a penalty baseline set at “between 75% and 100% of the statutory maximum amount”. This is a proposed increase from the present baseline of 50% of the statutory maximum.

Generally, transparency is welcomed. It is helpful for parties where something has gone wrong/who find themselves under investigation to know in advance what the likely outcome (or at least the worst case scenario) may be. These proposals do, though, significantly increase the baseline penalties for serious (and most serious) cases, and firms would be well advised to take notice of the direction of travel proposed by OFSI in this area.

OFSI is also proposing additional transparency on information and reporting penalties, including, £5,000 where there is a failure to respond to an information requirement or other reporting obligation without reasonable excuse, or £10,000 in respect of an aggravated failing. The proposed guidance would suggest that the “aggravated” failing fine might be appropriate in cases where (a) the person has exhibited repeated poor behaviour, such as where a £5,000 fine has previously been issued, or (b) where the person has recklessly provided information which is materially false or incomplete. This proposed guidance would be consistent with the fine laid against Svarog Shipping & Trading Company Limited on 11 April 2025, where a £5,000 fine was imposed for failing to respond to a request for information within the requisite time period, but where they had ultimately provided a response.

Maximum Penalty Changes

Under the proposals, OFSI has suggested that there should be changes to the maximum penalties available. In particular, the maximum penalty would increase as follows:

• Where a breach or failure relates to particular funds, and it is possible to estimate the value of the funds, the current maximum is the greater of £1,000,000 or 50% of the estimated value. This would be increased to the greater of £2,000,000 or 100% of the estimated value.
• In all other cases, the maximum is currently £1,000,000, but this would be raised to £2,000,000.

OFSI is also consulting on more wholesale changes to the way in which the maximum penalty is calculated, such as basing it on turnover or penalties per breach. The outcome of the consultation will obviously be important in determining what the final position will be on the maximum penalty.

Voluntary Disclosure

At present, reductions in penalty are available for “prompt and complete voluntary self-disclosure”, where OFSI has not already become aware of the breach by other means. The discount can currently command up to 50% for serious cases, and up to 30% for most serious cases.

OFSI is proposing that this framework should be changed, in order to ensure that:

(i)        Parties make the self-disclosure as soon as practicable, providing a complete account of the circumstances, and that they cooperate with OFSI’s investigation.

(ii)       Parties are not perversely more incentivised to make disclosures in cases which are serious, but not most serious (because the discount available would be lower in the latter case).

As such, OFSI is proposing that the maximum discount be 30%, and that the maximum amount is only available where the disclosure and cooperation is complete and timely.

The timeliness of a self-report is a matter of some concern for OFSI at present. In the recent enforcement action against Colorcon Limited,⁷ there was a delay of four months between the company becoming aware of the breach and making an initial disclosure. As a result of this delay Colorcon was given a 35% reduction, rather than the 50% reduction which would have been available for prompt disclosure. Under the newly proposed regime, we might expect OFSI to take an even more strict approach.

Settlement Scheme

The proposed settlement scheme has the potential to lead to perhaps the most significant change in practice for firms under investigation. In making these proposals, OFSI has had regard to the settlement schemes of other regulators, including the FCA as well as the PRA. The FCA and PRA’s settlement schemes are very commonly used, with a significant proportion of investigations into firms ultimately being settled rather than contested. It appears that under these proposals, OFSI’s investigation and settlement scheme would be fairly closely aligned with that of the FCA.

Under the proposals, OFSI would conduct its preliminary investigation (including imposing document and information requirements). Thereafter, the OFSI enforcement team, in consultation with the relevant OFSI ‘decision maker’ would determine whether or not they think that the case is suitable for settlement by way of a penalty. At that point, the decision maker would also determine what the level of settlement discount should be. This decision would then be communicated to the subject, who would then be given 10 business days to determine whether they would like to enter settlement discussions.

If the investigation subject decides that they do want to engage in settlement discussions, they would be sent a draft penalty notice, and there would be a 30-day period (which would not normally be extendable) for without prejudice discussions on settlement. If settlement is possible, there would then be a settlement discount of 20% of the remaining penalty (calculated after any disclosure and cooperation discount has already been applied). If there is no settlement during the 30-day period, but the subject does agree to settle thereafter, then there would not normally be any discount, as the discount is intended to encourage focused settlement agreements.

OFSI has said that it does not propose to offer the settlement scheme in circumstances where the breaches were committed knowingly or intentionally, where the subject is or has previously been suspected of circumventing financial sanctions (including where the proposed breach relates to circumvention), or when the subject has not cooperated with OFSI in good faith.

The use of a fixed 30-day period for settlement discussions is common with (e.g. the FCA’s usual 28-day settlement period). From experience, this timeframe can be tight and can require significant management time. Assuming that these proposals do go into effect, firms will need to use the 10-day warning period carefully and productively to ensure that they are in a position to start settlement discussions.

One positive aspect for firms from the proposal is that OFSI explicitly suggests that during the settlement negotiations, a firm may be able to make submissions to OFSI about the terms of the penalty notice, including avoiding admitting liability, such that the final notice might refer only to “apparent or suspected breaches”, rather than concrete findings. For some firms, this can be a very valuable part of a settlement.

Early Account Scheme

In addition to the Settlement Scheme, OFSI has proposed that there should be an “Early Account Scheme”, under which a firm could (in effect) investigate itself (or appoint a law firm or other third party to do so), and then make a full account of the breach to OFSI. A senior individual at the firm would need to attest to the results of that investigation being a full and fair account of the circumstances of the case. OFSI predicts that this process would generally take no longer than 6 months.

Where the Early Account Scheme is used, OFSI’s proposal is that this would attract a 40% settlement discount, rather than the 20% discount proposed for settlement scheme cases.

The proposed Early Account Scheme is similar to one introduced by the PRA in early 2024. We are yet to see a use of the PRA’s scheme made public, though given the PRA has historically brought relatively few enforcement cases, this is not necessarily an indication that it will not be popular or appropriate for a firm in a suitable case. Firms may be reluctant to use these types of scheme for a number of reasons, including the cost of having an independent investigation (albeit that this might be offset by the scheme discount), as well as the personal liability generally imposed on the senior individual who has to sign the ultimate report.

Next Steps

We must await the outcome of the consultation to know precisely what will happen. What appears clear, however, is that OFSI has recognised that it has become a more active regulator for enforcement matters, and that it is appropriate to update and modernise its systems in line with other regulators.

Assuming that some form of these changes are implemented, firms should be mindful that any interaction with OFSI’s enforcement teams may be more structured, and it may be necessary to engage counsel earlier in order to ensure the best outcomes. This will be particularly true if the Settlement Scheme and Early Account Schemes take effect, as these can require a significant amount of upfront work in order to minimise the detriment to a firm under investigation. In the meantime, firms should that the opportunity to consider their systems and controls framework, performing gap analyses and implementing improvements where necessary.

^{1 For example, in financial year 2021/22, there were 147 recorded cases, which rose to 473 in financial year 2022/23, and there were 396 in financial year 2023/24: see https://www.gov.uk/government/publications/ofsi-annual-review-2023-24-engage-enhance-enforce/ofsi-annual-review-2023-24-engage-enhance-enforce.}

^{2 https://www.gov.uk/government/collections/enforcement-of-financial-sanctions}

^{3 https://assets.publishing.service.gov.uk/media/687a2e443f4bde279ef45271/OFSI_s_enforcement_processes.pdf.}

^{4 https://www.gov.uk/government/publications/financial-sanctions-enforcement-and-monetary-penalties-guidance/financial-sanctions-enforcement-and-monetary-penalties-guidance#case-assessment.}

^{5 Circumvention of sanctions, the value of the breach, and harm or risk of harm to the sanction regime’s objectives.}

^{6 Intent/knowledge/reasonable cause to suspect, knowledge of the sanctions and compliance systems, ownership and control, failure to apply for a licence/breaching licence terms, professional facilitation, repeated/persistent/extended breaches, reporting of breaches to OFSI, co-operation, failure to provide information on breaches, and “other relevant factors”.}

^{7 https://assets.publishing.service.gov.uk/media/68db9df2ef1c2f72bc1e4bf0/Colorcon_Penalty_Notice.pdf.}