OFSI Colorcon £152,750 Penalty: Russia Payroll Payments and General Licence Lessons

Paying a salary is not an obvious sanctions risk. Yet in 2022 a UK company paid employees and suppliers in Russia through accounts held at banks that had since been designated, and in September 2025 OFSI imposed a £152,750 monetary penalty on Colorcon Limited, a subsidiary of a global specialty coatings group. The case is a practical lesson for finance teams: payroll, insurance and bookkeeping payments are in scope for sanctions, and a general licence helps only if you spot it and meet its conditions. To build your own sanctions knowledge, see our CPD courses.

This guide is based on OFSI's public penalty notice. We read it through a summarising tool, so check every figure against the notice before you quote it.

What happened

Colorcon Limited is a UK company and subsidiary of Colorcon Inc. with a Russian office that had operated for more than 15 years. Between 23 March and 2 December 2022 it made 123 payments totalling £191,290.57, made in Russian roubles and converted at the daily rate. The recipients were not themselves designated: they were employees and service providers whose accounts were held at four designated banks, Alfa Bank, Promsvyazbank, Sberbank and VTB Bank. The payments were mostly salaries for the Moscow office, plus bookkeeping and payroll services, car and medical insurance for employees and contract payments for extra services.

The payments were initiated by the company's Russian bookkeeper and approved by UK-based authorised signatories. The signatories checked amounts and payee details but not whether the payee's bank was designated. Under regulation 12 of the Russia (Sanctions) (EU Exit) Regulations 2019, making funds available to a designated person is prohibited, and a payment into a designated bank's account can have that effect.

The general licence angle

A general licence for companies winding down operations in Russia (INT/2022/2055384) could have covered some payments. OFSI assessed that 44 payments, worth £63,012.85, made between 12 August and 31 October 2022, were permitted under it before it expired. That left 79 payments with a breach value of £128,277.72. Colorcon had not recognised that the licence could apply and had not met its 30-day reporting requirement, which OFSI says is an offence in itself and counted as an aggravating factor. For payments made before strict liability was introduced in June 2022, OFSI found the company had knowledge or reasonable cause to suspect a breach.

How the penalty was calculated

The statutory maximum was £1,000,000. OFSI set a baseline penalty of £235,000 and applied a 35% discount for voluntary disclosure, against a maximum available of 50%, to reach £152,750 (£235,000 less £82,250). The company did not make representations or seek a review. OFSI rated the case "serious", not "most serious".

Disclosure: slow to start, then thorough

The company submitted its breach report on 21 April 2023 and a detailed report on 30 June 2023, when OFSI opened its investigation. OFSI noted a four-month delay between Colorcon becoming aware of the breaches and its first notification, which it did not consider prompt. The first notice was only a pre-notification, and the fuller disclosure followed about two months later and was detailed and complete. That mix explains why the discount was 35% and not the maximum.

Aggravating and mitigating factors

• Aggravating: the total value; payments going directly to accounts at designated institutions; a global company with long Russian experience that failed to take reasonable care; insufficient procedures for payments to employees and service providers; failure to recognise the general licence and meet its reporting condition; repeated errors over nine months; and delayed disclosure.
• Mitigating: links to medical and humanitarian purposes; detailed disclosure, full cooperation and a largely timely response to OFSI; and the company's August 2022 decision to exit the Russian market.

The compliance failings

• Relying on the bank to apply sanctions screening without testing that with the bank.
• Sanctions policies last materially updated in 2018.
• No consideration of the risks in payments to employees and service providers.
• Failure to comply with the general licence reporting requirement.

Our guide to sanctions screening and alert resolution explains why screening has to look at the payee's bank as well as the payee's name.

Lessons OFSI draws

• Relying on a third party does not shift liability. Understand what third parties do on your behalf and make proportionate enquiries.
• Review sanctions policies regularly. They should cover financial and trade sanctions and be updated as regimes change.
• Payments outside a general licence are not automatically less serious. Do not assume a licence applies, or that missing one is a minor matter.
• Licence reporting conditions are legal obligations. Failure to report is an offence and can be an aggravating factor.
• Disclose as soon as reasonably practicable after discovery.

Other recent OFSI cases show similar patterns around ownership and bank data; see our guide to the Apple Distribution International penalty.

Practical steps for finance teams

Check whether your payment approval process asks about the status of the payee's bank, not only the payee. Keep a list of the general licences you rely on, with their conditions and reporting deadlines. Make sure local bookkeepers and payroll providers are covered by your sanctions policy, because the instruction may start with them but the legal responsibility sits with the UK company.

Frequently asked questions

How much was the Colorcon penalty?

£152,750, after a 35% discount from a £235,000 baseline.

Were the employees sanctioned?

No. They were not designated, but their salaries were paid into accounts at designated banks, which OFSI treated as making funds available to designated persons.

Did the licence help?

Partly. 44 payments were assessed as permitted under the winding-down general licence, but the company had not recognised the licence or met its reporting condition.

What we could not confirm

We read OFSI's notice through a summarising tool. The notice does not state a separate penalty for the licence reporting offence or the number of Colorcon's employees in Russia. The date shown in the notice is 10 September 2025; OFSI's enforcement list shows publication on 30 September 2025. Please check all figures against the notice.