Sanctions regimes: what law firms need to know

• A new case assessment framework, reducing the maximum discount for self-disclosure and cooperation from 50% to 30%.
• An “early account scheme” for corporates, offering up to an additional 20% discount where an internal investigation is conducted in line with OFSI’s expectations. This is designed for complex or novel cases which would be difficult or resource-intensive for OFSI to investigate.
• A settlement mechanism providing a further 20% discount where agreement is reached within 30 business days and the person concerned waives their right to seek either a ministerial or judicial review.

• Ownership is generally established where a person holds more than 50% of the shares or voting rights in an entity, or has the right to appoint or remove a majority of the board of directors.
• Control, by contrast, is a broader concept. It is met where it is reasonable to expect that a designated person could, if they chose to do so, direct the affairs of an entity so that they are conducted in accordance with their wishes – whether in most cases or in significant respects. This assessment requires a fact-specific analysis.

On the civil enforcement side, there has been a significant increase in enforcement investigations, particularly since the war in Ukraine began in 2022. As of April 2025, OFSI had 240 active cases under investigation, up from 172 in April 2023. However, there have been relatively few associated penalties. OFSI are trying to bring their caseload down by prioritising cases which have the greatest deterrent or compliance impact. It remains to be seen what impact the consultation will have here.

The increase in investigations indicates a more active enforcement environment, even if penalties remain limited. Firms should ensure their compliance frameworks are robust and capable of withstanding scrutiny.

The SRA’s proactive involvement in financial sanctions is a fairly recent development. Prior to 2022, the SRA’s focus was in providing information to firms. By way of background, following the invasion of Ukraine, the SRA came under increased political pressure to have an involvement in ensuring solicitors were upholding the financial sanctions regime. This political pressure latterly became enshrined in the Economic Crime and Corporate Transparency Act which gave the SRA a new regulatory objective of promoting the prevention and detection of economic crime. The oversight supervisor (the Legal Services Board) published guidance last year setting out their expectations for the SRA and other England and Wales legal services supervisors.

In the present day, the SRA has a three-fold approach to financial sanctions:

1. Providing information to firms
2. Risk assessment of firms, leading to targeted proactive supervision
3. Enforcement

The SRA has set out in guidance its expectations of firms in complying with the financial sanctions regime which they may take into account in any enforcement actions. The guidance sets out controls that would be appropriate for all firms and specific information for firms intending to advise designated persons.

In terms of a controls framework, the following will help your firm comply with the sanctions regimes:

1. A written sanctions risk assessment. This can be a standalone document, or many firms find it more helpful to incorporate sanctions risk into their AML firm-wide risk assessment. The SRA has published a template sanctions risk assessment and guidance on completing a risk assessment.
2. Written controls. These should include a policy on client screening, screening of counterparties and ongoing monitoring. Similarly, this may fit within your AML customer due diligence screening processes, where applicable, or you may need a separate process if this isn’t incorporated into your AML processes. The level, extent and frequency of screening is a tricky topic given the strict liability for any breaches, however in my view there has got to be an element of a risk-based approach here. This would mean that you undertake more comprehensive checks, take greater steps to fully understand whether the control test is met, and re-screen more frequently where the risk is higher.
3. Training. Ensuring relevant staff understand the legislation, the firm’s policies and their obligations is crucial in preventing sanctions breaches. Training doesn’t need to be formal or lengthy, but it does need to be relatively engaging and targeted to those who can play a part in preventing sanctions breaches. You will also need to do regular reminders.
4. Controls and decision-making when identifying a designated person. This should include documenting eliminating any false positive matches of designated persons, freezing any assets and placing a halt on taking payments from them. You will need to have a process in place, probably involving senior management sign off, in order to decide whether to act for any designated persons, and any controls you would put in place in these circumstances.
5. Reporting. You will need to have controls to ensure that any necessary reporting takes place. If you have identified a breach of the sanctions regime, you will need to establish whether any reporting is necessary, and then ensure that you make the appropriate reports to OFSI, the NCA and the SRA. You will also need to ensure that you comply with any reporting obligations if you are acting under a general licence.

Although the SRA is currently charged with supervising the profession for sanctions controls and breaches, the future of this is in doubt. With the transfer of responsibility for AML supervision from the SRA to the FCA in the future, it is not clear what the SRA’s residual role will be in financial sanctions supervision. It is possible that this responsibility also moves to the FCA, but it is then unclear how firms not in scope of the money laundering regulations would be supervised. Any transition of powers and responsibilities is likely to be a lengthy process, and in the meantime, the SRA continues to undertake desk-based reviews and onsite inspections of firms’ sanctions controls. I would advise firms to make sure they are meeting the SRA’s expectations, and this is likely to stand them in good stead if the FCA does ultimately take over responsibility for supervision of this area.