OFSI Apple Distribution International £390,000 Penalty: Ownership and Control Lessons

On 19 March 2026 the UK's Office of Financial Sanctions Implementation (OFSI) imposed a £390,000 monetary penalty on Apple Distribution International Limited (ADI) for making funds available to an entity owned by a designated person. OFSI says it was the first case it resolved by settlement. The facts are ordinary rather than dramatic: two payments of app developer revenue were sent to a Russian streaming platform whose ownership changed shortly before they were paid. That is what makes it a useful case for compliance teams, because the risk is hidden in ownership, not in an obviously sanctioned name. If you are building your sanctions knowledge, see our CPD courses.

This guide is based on OFSI's public penalty notice. We read it through a summarising tool, so check every figure against the notice before you quote it.

What happened

ADI pays app developers their App Store revenue from a UK-based bank account that it controls. Two payments were owed to Okko LLC, a Russian online media streaming platform. Okko had been owned by Sberbank, which was designated on 6 April 2022, until it was sold to JSC New Opportunities on 17 May 2022. JSC New Opportunities was itself designated on 29 June 2022, so Okko became an entity owned by a designated person.

The two payments were:

• Payment A, £356,429.27, instructed on 6 June 2022 with a value date of 30 June 2022, which was the day of the designation; and
• Payment B, £279,189.48, instructed on 30 June 2022 with a value date of 28 July 2022.

ADI did not cancel either instruction. OFSI treated the breach as conduct in the UK through that omission, even though the business was managed from outside the UK. The total breach value was £635,618.75. Two earlier payments to Okko in April 2022, about £1.16 million, were considered but not treated as breaches because they came before the strict liability regime.

The legal basis and how the penalty was calculated

The penalty was imposed under section 146 of the Policing and Crime Act 2017 for a breach of regulation 12 of the Russia (Sanctions) (EU Exit) Regulations 2019, which prohibits making funds available to a person owned or controlled by a designated person. Our guide to UK financial sanctions and strict liability explains why intent is not needed for a civil penalty.

OFSI set the statutory maximum at £1,000,000 and a baseline penalty of £600,000, then applied a 35% discount for voluntary disclosure and settlement under transitional arrangements, giving £390,000. OFSI rated the case "serious" rather than "most serious". ADI issued its voluntary disclosure on 4 October 2022. The notice of intention was issued on 11 November 2025, and the settlement was agreed on 19 March 2026 after talks that began on 16 February 2026. ADI waived its rights to ministerial review and appeal to the Upper Tribunal.

What OFSI treated as aggravating

• A high breach value, with two payments instructed and not cancelled.
• Funds going directly to an entity owned by a designated person, undermining the asset freeze.
• A sanctions framework that was not calibrated to the heightened Russia risk after February 2022, because it relied on self-certification and third-party ownership checks.
• No affirmative request to Russian app developers for ownership information.
• Third-party tools missing the ownership change, and open-source media reports not being flagged.
• The earlier, similar payments, which were taken into account.
• The fact that Russia sanctions are a strategic UK priority.

What OFSI treated as mitigating

• No evidence that ADI or its providers knew of press reports linking Okko to the designated person.
• Payment A being completed soon after the designation, leaving a very narrow window to cancel it.
• ADI commissioning an external due diligence report after a third party raised unrelated concerns, and then telling its providers about the ownership link.
• ADI's commitment to improve its framework, including requiring ownership and control information from Russian app developers at onboarding and periodically.

Responding to all of OFSI's information requests was treated as neither aggravating nor mitigating.

The compliance failings

OFSI's concerns come down to three things. ADI relied on self-certification and third-party vendors for ownership checks. It did not make proactive ownership enquiries of Russian app developers during a period of heightened risk. And it did not detect the change in ownership in good time. Our guide to the ownership and control test under UK and US sanctions sets out why a payee that is not itself listed can still be caught.

Lessons OFSI draws

• UK sanctions apply to conduct in the UK. That includes payments by non-UK firms made through UK banks, even when the business is managed from abroad.
• Identify ownership and control at onboarding and monitor changes. Use enhanced checks for higher-risk structures.
• You remain responsible when you use vendors. Third-party screening tools do not transfer the obligation.
• Prompt, complete disclosure can reduce a penalty. The guidance applied allowed up to 50% for prompt, complete disclosure in serious cases; the final discount combined disclosure and settlement.

Practical steps for your own firm

Review whether your payee screening covers ownership as well as names, and whether it refreshes when ownership changes. Check how a payment instruction can be stopped after a new designation, because in this case the ability to cancel a pending payment was the difference between a breach and no breach. Our guide to sanctions screening and alert resolution covers how to test screening and handle alerts.

Frequently asked questions

How much was the penalty?

£390,000, after a 35% discount from a £600,000 baseline.

Was the firm UK-based?

The notice treats the breach as conduct in the UK because the payments were made from a UK bank account, even though the business was managed from abroad.

Why was the case called a first?

OFSI describes it as the first case it resolved by settlement.

What we could not confirm

We read OFSI's public penalty notice through a summarising tool. The notice's payment deadline and the country where Okko LLC is registered are not stated in the text we read. Please check all figures against the notice.