Changes on the Horizon: Proposed New UK Sanctions Enforcement Framework Poses Increased Risks for Businesses
Client Alert | October 20, 2025
If implemented, the changes could materially increase penalties, reduce discounts for voluntary disclosure, and introduce new ways of resolving cases involving breaches, such as settlement options.
The UK Office of Financial Sanctions Implementation (OFSI)—the UK government entity in charge of financial sanctions implementation and enforcement—is considering substantial reforms to its enforcement practices for financial sanctions breaches. If implemented, these changes could materially increase penalties, reduce discounts for voluntary disclosure, and introduce new ways of resolving cases involving breaches, such as settlement options. These proposed changes would move OFSI even closer to the enforcement model used by its U.S. analog—the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC)—with which it has had an increasingly comprehensive partnership since 2022. OFSI—which celebrates its 10th anniversary in 2026—is also drawing inspiration from other more-established UK regulators, such as the Financial Conduct Authority (FCA), with which it is collaborating extensively. OFSI is evolving, and with it are the UK sanctions risks faced by banks and companies within UK enforcement jurisdiction.
Background: OFSI’s Expanding Enforcement Activity
Much like sanctions enforcers throughout the G7, the inflection point for OFSI’s development as a consequential enforcer can be traced to Russia’s invasion of Ukraine in 2022. Since then, OFSI has more than doubled its staff—with a particular focus on licensing and enforcement—to 135 current employees and created a dedicated Compliance Enforcement team in 2024-2025 to better identify and enforce against breaches of license terms. During the 2023-2024 financial year, OFSI opened a record 396 investigations, more than double the previous year’s figure. This trend continued into 2024-2025, during which OFSI opened 394 investigations. This increased activity has brought growing recognition that OFSI’s enforcement procedures, largely unchanged since OFSI’s establishment in 2016, need updating to handle the volume and complexity of current sanctions cases.
The UK enforcement landscape fundamentally shifted in June 2022 when the UK moved to enforce financial sanctions breaches on a strict liability basis, i.e. using the same standard that OFAC uses. This means that OFSI no longer needs to demonstrate that a person knew or suspected they were breaching sanctions to impose a penalty. While OFSI may choose not to pursue such cases, even a de minimis misstep can be a violation. Similarly (and also in line with OFAC practice), OFSI now has the power to publicize breaches even when it chooses not to impose a monetary penalty. These changes, combined with the unprecedented expansion of the UK sanctions list, which now includes over 4,700 designated persons and entities, the increase in scope and sophistication of the UK’s sanctions programs, and the increasingly extraterritorial reach of UK sanctions, leads to a material increase in compliance challenges and enforcement risk for those subject to UK jurisdiction.
OFSI has already demonstrated its willingness to use this expanded toolkit. For the first time in August 2023, OFSI publicized details of sanctions breaches without imposing a monetary penalty. It used this power again in March 2025, indicating that this will likely be common practice for OFSI in cases of non-serious breaches. In August 2024, OFSI issued its first penalty related to the 2022 Russia sanctions, and has indicated that several more Russia-related enforcement actions are in its pipeline. In April 2025, OFSI issued a penalty to a company solely for the failure to respond to an information request, and in September 2025 it reduced voluntary disclosure credit from 50% to 35%, having deemed that a four month delay between detection of breaches and initial notification to OFSI mitigated the positive effects of cooperation.
Proposed Changes to OFSI’s Enforcement Approach
Material changes to OFSI’s enforcement practices are under consideration. As part of the review, OFSI published a consultation paper, on which it invited comment, setting out five main areas of reform. This process of consultation is also similar to how OFAC proceeded when it proposed its current enforcement guidelines.
I. Increased Statutory Maximum Penalties
OFSI has proposed raising the maximum penalties that it can impose. The current statutory maximum is the greater of £1 million or 50% of the breach value. OFSI proposes increasing this to the greater of £2 million or 100% of the breach value.
It is important to note that these changes would not automatically result in higher penalties across the board. OFSI would still assess what penalty is reasonable and proportionate within the new maximum. Indeed, eight of OFSI’s twelve penalties to date have only been 5% or less of the maximum available. However, the higher ceiling would give OFSI more scope to impose substantial penalties in the most serious cases.
OFSI is also seeking feedback on alternative approaches to calculating maximum penalties, such as basing them on a percentage of company turnover or setting a maximum penalty per breach rather than per case. The idea of basing breaches on percentages of turnover resembles the practices of the UK’s Competition and Markets Authority. The European Union has recently also recently adopted this idea, and issued EU-wide legislation requiring Member States to set maximum corporate fines of at least 1–5% of worldwide turnover, or €8–€40 million, depending on the violation’s gravity.
II. Clearer Assessment Framework and Adjusted Discounts
OFSI has proposed publishing a more transparent matrix showing how it combines severity and conduct factors to reach an overall case assessment. This also mirrors the OFAC model which is based on a matrix. The proposed OFSI matrix would guide businesses on likely outcomes: less severe cases would typically receive warning letters, moderately severe cases would be publicly disclosed without penalties, while serious cases would face monetary penalties.
Importantly, OFSI has proposed to increase not only the maximum potential penalty, but also the baseline penalty ranges for serious cases. Currently, serious cases attract baseline penalties of 0-50% of the statutory maximum, while most serious cases range from 50-100%. Under the proposals, serious cases would attract up to 75% of the maximum, and most serious cases would range from 75-100%.
OFSI has also proposed altering how it rewards voluntary disclosure. The current system offers up to 50% discount for serious cases and up to 30% for most serious cases. The proposal would cap the disclosure benefit at 30% for both categories, and would make the discount conditional on more stringent requirements: in order to benefit a respondent would have to demonstrate prompt reporting, the provision of a complete account of the facts, and fully cooperate with OFSI throughout the investigation. Where OFSI considers that the requirements are only partially met, a discount of lower than 30% could still be applied. These changes reflect OFSI’s view that the current 50% discount for a voluntary self-disclosure can sometimes undermine the penalty’s deterrent effect.
III. Streamlined Resolution Through Settlement
Drawing inspiration from the FCA’s approach (and OFAC’s process), OFSI has proposed introducing a formal settlement scheme. Under this model, once OFSI completes its investigation and determines a penalty is warranted, it could offer companies an opportunity to settle the case within 30 business days.
The proposed settlement process would proceed as follows: OFSI would provide a draft penalty notice to a party found to have violated sanctions and would allow without-prejudice discussions about the terms. If OFSI and the party reach agreement within the timeframe, the party under investigation would receive a 20% discount on top of any voluntary disclosure discount already applied. In exchange, the company would accept OFSI’s findings and waive their rights to ministerial review and tribunal appeal.
OFSI has indicated it would not offer settlement in cases involving knowing or intentional breaches, suspected circumvention, or where the company has failed to cooperate in good faith. During settlement discussions, companies may be able to negotiate the wording of the public penalty notice, potentially avoiding explicit admissions of liability (though OFSI has mentioned that such an approach could reduce the significance and deterrent effect of its enforcement notices). This process allowing for the negotiation of language in public notices is also parallel to the OFAC approach.
IV. Early Account Scheme for Expedited Investigations
While the suite of proposed changes could prove seismic, OFSI’s most innovative proposal is the Early Account Scheme (EAS), which would allow investigation subjects to effectively investigate themselves and provide OFSI with a comprehensive factual account. A similar scheme was introduced by the Prudential Regulation Authority, part of the Bank of England, in 2024. This option would be particularly attractive for well-resourced organizations with strong compliance functions.
Under the EAS, a company would conduct an internal investigation (or engage a third party to do so) and provide OFSI with a detailed report covering all suspected breaches, relevant materials, and an assessment against OFSI’s case factors. A senior officer would need to attest that the account is complete and fair. OFSI anticipates this process would typically take six months. The EAS will not be available in all cases. For instance, OFSI may not deem that it is appropriate when cases involve circumvention breaches, particularly serious breaches, or when the company has previously been investigated or penalized. Similarly, OFSI considers it would be very unlikely to permit access to the EAS to a company that had failed to report suspected breaches.
The incentive for using the EAS is significant: if the case proceeds to a penalty and settles, the settlement discount would increase from 20% to 40%. However, OFSI would retain discretion to reduce this discount if it determines the account was incomplete or required substantial additional investigation.
OFSI has made clear it would be highly unlikely to introduce the EAS without also introducing the settlement scheme, as the two mechanisms are designed to work together.
V. Streamlined Process for Information and Licensing Breaches
Recognizing that not all breaches are equal, OFSI has proposed a simplified process for certain categories of less serious offences. These more minor breaches would include failures to respond to information requests, non-compliance with license conditions, and late reporting.
Under this proposal, OFSI would publish indicative penalty amounts: £5,000 for standard failures and £10,000 for aggravated failures (such as repeated non-compliance or recklessly providing false information). These cases would follow a shortened timeline, with just 15 business days for representations at each stage rather than the standard 30 days.
OFSI is also considering whether these penalties should be set out in legislation as fixed penalties, which would provide greater legal certainty but reduce OFSI’s flexibility to adjust amounts based on circumstances.
What Happens Next: The Consultation Process
The consultation on OFSI’s paper closed on October 13, 2025. OFSI will now analyze all input received and publish a government response setting out its next steps. Some proposed changes could be implemented relatively quickly through updated OFSI guidance. However, changes to statutory maximum penalties would require secondary legislation (regulations), while changes to the percentage of breach value in the penalty calculation would require primary legislation (an Act of Parliament).
Practical Implications for Businesses
These proposed changes reflect OFSI’s evolution into a more sophisticated and robust enforcement regulator. In order prepare for the likely changes, businesses could consider several actions:
- Review compliance programs. With higher baseline penalties and more stringent disclosure requirements proposed, the cost of compliance failures is likely to increase. This is an opportune moment to conduct gap analyses of sanctions screening, due diligence, and reporting processes. Businesses can also ensure that existing policies specifically cater for UK sanctions risks, as opposed to just U.S. or EU sanctions risks. While the degree of overlap between U.S., EU and UK sanctions remains significant, material differences exist.
- Understand voluntary disclosure requirements. If the proposals are adopted, achieving the full voluntary disclosure discount will require not just prompt reporting but complete cooperation throughout an investigation. Businesses should ensure they have processes in place to identify potential breaches quickly and gather relevant information efficiently.
- Consider settlement and EAS implications. Well-resourced organizations may find the EAS attractive, but it requires the ability to conduct thorough, independent, internal investigations. Smaller businesses may prefer the standard settlement route. Businesses should understand these options and how they might apply to potential cases.
- Prepare for increased enforcement. With 240 active investigations as of April 2025 and a significantly expanded enforcement team, OFSI has made clear that more public enforcement actions are coming. The combination of expanded resources, enhanced tools, and streamlined processes means businesses should expect heightened scrutiny.
The following Gibson Dunn lawyers prepared this update: Irene Polieri, Adam M. Smith, Scott Toussaint, and Josephine Kroneberger*.
Gibson Dunn’s lawyers are available to assist in addressing any questions you may have regarding UK enforcement practices and advising on engagement with UK regulators. For additional information about how we may assist you, please contact the Gibson Dunn lawyer with whom you usually work, the authors, or the following leaders and members of the firm’s International Trade Advisory & Enforcement practice groups:
United States:
Adam M. Smith – Co-Chair, Washington, D.C. (+1 202.887.3547, asmith@gibsondunn.com)
Ronald Kirk – Co-Chair, Dallas (+1 214.698.3295, rkirk@gibsondunn.com)
Stephenie Gosnell Handler – Washington, D.C. (+1 202.955.8510, shandler@gibsondunn.com)
Donald Harrison – Washington, D.C. (+1 202.955.8560, dharrison@gibsondunn.com)
Christopher T. Timura – Washington, D.C. (+1 202.887.3690, ctimura@gibsondunn.com)
Matthew S. Axelrod – Washington, D.C. (+1 202.955.8517, maxelrod@gibsondunn.com)
David P. Burns – Washington, D.C. (+1 202.887.3786, dburns@gibsondunn.com)
Nicola T. Hanna – Los Angeles (+1 213.229.7269, nhanna@gibsondunn.com)
Courtney M. Brown – Washington, D.C. (+1 202.955.8685, cmbrown@gibsondunn.com)
Amanda H. Neely – Washington, D.C. (+1 202.777.9566, aneely@gibsondunn.com)
Samantha Sewall – Washington, D.C. (+1 202.887.3509, ssewall@gibsondunn.com)
Michelle A. Weinbaum – Washington, D.C. (+1 202.955.8274, mweinbaum@gibsondunn.com)
Roxana Akbari – Orange County (+1 949.475.4650, rakbari@gibsondunn.com)
Karsten Ball – Washington, D.C. (+1 202.777.9341, kball@gibsondunn.com)
Sarah Burns – Washington, D.C. (+1 202.777.9320, sburns@gibsondunn.com)
Hugh N. Danilack – Washington, D.C. (+1 202.777.9536, hdanilack@gibsondunn.com)
Justin duRivage – Palo Alto (+1 650.849.5323, jdurivage@gibsondunn.com)
Zach Kosbie – Washington, D.C. (+1 202.777.9425, zkosbie@gibsondunn.com)
Chris R. Mullen – Washington, D.C. (+1 202.955.8250, cmullen@gibsondunn.com)
Sarah L. Pongrace – New York (+1 212.351.3972, spongrace@gibsondunn.com)
Anna Searcey – Washington, D.C. (+1 202.887.3655, asearcey@gibsondunn.com)
Erika Suh Holmberg – Washington, D.C. (+1 202.777.9539, eholmberg@gibsondunn.com)
Audi K. Syarief – Washington, D.C. (+1 202.955.8266, asyarief@gibsondunn.com)
Scott R. Toussaint – Washington, D.C. (+1 202.887.3588, stoussaint@gibsondunn.com)
Lindsay Bernsen Wardlaw – Washington, D.C. (+1 202.777.9475, lwardlaw@gibsondunn.com)
Shuo (Josh) Zhang – Washington, D.C. (+1 202.955.8270, szhang@gibsondunn.com)
Asia:
Kelly Austin – Denver/Hong Kong (+1 303.298.5980, kaustin@gibsondunn.com)
David A. Wolber – Hong Kong (+852 2214 3764, dwolber@gibsondunn.com)
Fang Xue – Beijing (+86 10 6502 8687, fxue@gibsondunn.com)
Qi Yue – Beijing (+86 10 6502 8534, qyue@gibsondunn.com)
Dharak Bhavsar – Hong Kong (+852 2214 3755, dbhavsar@gibsondunn.com)
Hui Fang – Hong Kong (+852 2214 3805, hfang@gibsondunn.com)
Arnold Pun – Hong Kong (+852 2214 3838, apun@gibsondunn.com)
Europe:
Attila Borsos – Brussels (+32 2 554 72 10, aborsos@gibsondunn.com)
Patrick Doris – London (+44 207 071 4276, pdoris@gibsondunn.com)
Michelle M. Kirschner – London (+44 20 7071 4212, mkirschner@gibsondunn.com)
Penny Madden KC – London (+44 20 7071 4226, pmadden@gibsondunn.com)
Irene Polieri – London (+44 20 7071 4199, ipolieri@gibsondunn.com)
Benno Schwarz – Munich (+49 89 189 33 110, bschwarz@gibsondunn.com)
Nikita Malevanny – Munich (+49 89 189 33 224, nmalevanny@gibsondunn.com)
Melina Kronester – Munich (+49 89 189 33 225, mkronester@gibsondunn.com)
Vanessa Ludwig – Frankfurt (+49 69 247 411 531, vludwig@gibsondunn.com)
*Josephine Kroneberger, a trainee solicitor in the London office, is not admitted to practice law.
© 2025 Gibson, Dunn & Crutcher LLP. All rights reserved. For contact and other information, please visit us at www.gibsondunn.com.
Attorney Advertising: These materials were prepared for general informational purposes only based on information available at the time of publication and are not intended as, do not constitute, and should not be relied upon as, legal advice or a legal opinion on any specific facts or circumstances. Gibson Dunn (and its affiliates, attorneys, and employees) shall not have any liability in connection with any use of these materials. The sharing of these materials does not establish an attorney-client relationship with the recipient and should not be relied upon as an alternative for advice from qualified counsel. Please note that facts and circumstances may vary, and prior results do not guarantee a similar outcome.