OFSI Citibank London Branch £4.7 Million Penalty: Sanctions Screening Lessons

On 11 August 2026 the UK's Office of Financial Sanctions Implementation (OFSI) imposed a monetary penalty of £4,732,830.58 on Citibank, N.A., London Branch (CBNA London), and published the penalty on 2 September 2026. It is the largest OFSI penalty we have covered, and well above the roughly £1 million penalty on Sabre Global Technologies announced in June. What makes the notice unusual is its detail. It does not describe one mistake; it lists a series of operational weaknesses that together led to 970 payments, worth about £19.7 million, breaching UK sanctions. For compliance teams the notice reads like a checklist of how screening fails in practice. To build your own sanctions knowledge, see our CPD courses.

This guide is based on OFSI's public penalty notice and the GOV.UK publication page. We read them through a summarising tool, so check every figure against the notice before you quote it.

The penalty and the breaches in outline

The penalty was imposed under section 146 of the Policing and Crime Act 2017. The notice sets the total breach value at £19,720,127.43, the statutory maximum at £9,860,063.72 (50% of breach value, which exceeds the £1 million floor), and the baseline penalty at £7,888,050.97. A 20% discount for voluntary disclosure and cooperation and a further 20% for early settlement brought it down to £4,732,830.58. OFSI issued its notice of intention on 15 June 2026, settlement discussions began on 1 July 2026 and the settlement was agreed on 11 August 2026. CBNA London waived its rights to ministerial review and appeal to the Upper Tribunal.

The breaches were of the Russia (Sanctions) (EU Exit) Regulations 2019 (regulations 11 and 12) and the Global Anti-Corruption Sanctions Regulations 2021 (regulation 13). Most occurred between February and November 2022, with some in 2023 and 2025. OFSI rated the case at its highest seriousness level, with high severity and aggravating conduct, while finding no intent to breach sanctions.

How the 970 payments breached sanctions

The notice groups the breaches by cause. Reading them together shows how many different control gaps were involved.

Corporate clients majority owned by a designated person

242 payments, about £5.9 million, from 24 accounts of 11 companies linked to a designated Russian individual, with about £4.3 million paid within 24 hours of the designation. OFSI also found that the bank had wrongly concluded the individual held only a minority stake. The notice cites a different count of 244 in one place, so confirm the figure against the original.

Sovcomflot entities and a screening calibration problem

328 transactions, about £5.4 million, from 32 accounts of 29 entities owned or controlled by PJSC Sovcomflot. A prefix used in the bank's customer records prevented alerts from being generated, which is a pure calibration failure. Our guide to sanctions screening and alert resolution explains how to test matching logic against name variations.

Internal charges and interest corrections

177 transactions, about £135,000, where the bank deducted its own fees and tax from restricted accounts and processed bulk interest corrections without sanctions flags. OFSI treated these as low value and commonly licensed.

Correspondent banking and unscreened lists

19 payments, about £26,000, went to designated Russian banks between February and June 2022 because an automated processor chose correspondent banks from an unscreened internal list. Separately, 165 payments between March and May 2022, about £729,000, went to designated banks as beneficiaries because internal screening lists lacked bank identifier codes, and a human error delayed adding one. A further 14 payments, about £4 million, were added to a payment chain after screening, and a UK link was missed. Six return payments, about £1.2 million, were screened without the ultimate beneficiary details.

Alert handling errors and a paying agent role

Nine payments, about £500,000, were mishandled at the alert stage because handlers misapplied guidance, gave conflicting instructions or misidentified a designated bank's role. Separately, as principal paying agent for loan participation notes, the bank received about £1.5 million of interest and returned it after the issuer's parent became owned by a designated person; OFSI found the return indirectly made funds available.

Anti-corruption sanctions

Ten payments, about £300,000, between January and July 2025 involved a person designated under the Global Anti-Corruption regime. The notice says investigations were slow and one escalation went to the wrong team.

Compliance failings OFSI identifies

• Delays in alert handling and third-level review because of high alert volumes.
• A May 2022 change in OFSI's guidance, which required restriction only where designated ownership was 50% or more, increased the risk of unrestricted accounts.
• Screening done before correspondent banks were added, with no re-screening of the whole chain.
• Account restrictions that did not block internal charges.
• Payments processed without checking general licences because no alert was generated.
• Human error, poor escalation and poor information sharing between teams.

The ownership point is a recurring theme in UK enforcement; see our guide to the ownership and control test under UK and US sanctions.

Late reports of frozen assets

OFSI also treated late reporting as an aggravating factor. The bank reported frozen assets late on 53 occasions, all more than six weeks late, with 11 cases taking 518 days and an average delay of 274 days.

Aggravating and mitigating factors

Aggravating factors included the very high value and volume of payments, the strategic priority of Russia sanctions, sustained harm to sanctions objectives, systems issues that were foreseeable and inadequately prepared for before February 2022, information in the bank's systems that was not properly shared, and repeated breaches with common root causes. Mitigating factors included the low value of the internal-charge breaches, the fact that many corporate payments occurred shortly after designation, a remediation programme with openness in sharing corrective action plans, and the bank's withdrawal from Russia. OFSI recognised that the scale of the 2022 sanctions created operational challenges but said this did not excuse the breaches.

Disclosure and cooperation

Most breaches were self-reported, but breaches worth about £6.9 million were not voluntarily disclosed and came to light through OFSI's enquiries. About £4 million of breaches were disclosed late, and some initial disclosures were incomplete or inaccurate. Cooperation was otherwise prompt and complete, so the discount was 20% against a possible maximum of 30%. Settling within the settlement period earned a further 20%.

Lessons OFSI draws

• Test your automation. Firms using automated systems should assess whether the same problems could arise in their own processes.
• Analyse vulnerabilities before sanctions change. Firms with elevated exposure should do detailed analysis in advance of rapid changes.
• General licences are purpose-limited. Check that a licence applies before processing payments, and keep a record of the check.
• Disclose early and completely. A discount of up to 30% is available.
• Settle early. Early settlement is in the public interest and can reduce the penalty.

For a smaller case on the same theme of circumvention and weak oversight, see our guide to the OFSI Sabre Global Technologies penalty.

Frequently asked questions

How much was the Citibank penalty?

£4,732,830.58, after a 40% total discount from a baseline of £7,888,050.97.

Was there intent to breach sanctions?

No. OFSI found no intent, but intent is not needed for a civil penalty.

Which sanctions regimes were involved?

Russia and, for a small number of payments in 2025, the Global Anti-Corruption regime.

What we could not confirm

We read OFSI's notice through a summarising tool. The notice gives two different counts for one group of payments (242 and 244), and it does not state a separate publication date; the GOV.UK page gives 2 September 2026. Please check all figures against the notice.