OFSI Deutsche Bank London Branch £165,000 Penalty: Ownership Data Lessons

When a payment is sent through a UK bank for a customer, who is responsible if the payee turns out to be owned by a designated person? OFSI's answer in May 2026 was that the bank is, if its screening should have caught it. On 30 April 2026 OFSI settled a £165,000 monetary penalty with Deutsche Bank AG London Branch (DBLB), published in May 2026, for processing two payments to a Russian streaming platform owned by a designated person. For compliance teams the case is a clean example of how a screening gap in ownership data became a sanctions breach. To build your own sanctions knowledge, see our CPD courses.

This guide is based on OFSI's public penalty notice. We read it through a summarising tool, so check every figure against the notice before you quote it.

What happened

Sberbank was designated on 6 April 2022. On 17 May 2022 it sold Okko, a Russian streaming platform, to JSC New Opportunities, which was not yet designated. JSC New Opportunities was designated at 11:00 BST on 29 June 2022. That made Okko an entity owned by a designated person from that moment.

DBLB processed two SWIFT payments to Okko LLC for its customer, a non-UK firm, an Irish-incorporated subsidiary of a multinational. Okko was not a DBLB customer. Payment A, £356,429.27, was processed on 29 June 2022 with a value date of 30 June. Payment B, £279,189.48, was processed on 27 July 2022 with a value date of 28 July. Together they make a breach value of £635,618.75. A third payment in April 2022 (£1,129,785.87) was not treated as a breach because it predated strict liability, but OFSI considered it when assessing the bank's conduct. The amounts and recipient are the same as in OFSI's separate notice on Apple Distribution International, which suggests the same payments were examined from both the payer's and the bank's side, but neither notice says so.

Why screening did not alert

The bank's screening did not alert on Okko because its vendor's lists lacked Okko ownership data at the time. OFSI noted that the vendor missed the May 2022 press reports about the sale, and that Russian registry withdrawals and concealment laws in mid-2022 contributed to the missing data. OFSI treated reliance on the vendor as neither aggravating nor mitigating. It did, however, count the bank's wider approach as a failing: screening relied on third-party ownership data without supplementing it with in-house processes.

The legal basis

The penalty was imposed under section 146 of the Policing and Crime Act 2017 for a breach of regulation 12 of the Russia (Sanctions) (EU Exit) Regulations 2019, which prohibits making funds available to a person owned or controlled by a designated person. Ownership and control are defined in regulation 7. The strict liability amendments took effect on 15 June 2022, which is why the first payment, in April, was not a breach and the June and July ones were. OFSI applied its November 2024 enforcement guidance. Our guide to the ownership and control test explains how a payee can be caught without being named on a list.

How the penalty was calculated

OFSI set a baseline penalty of £300,000 and applied a total discount of 45% covering voluntary disclosure and settlement under transitional arrangements, which gave £165,000. The statutory maximum is stated as £1,000,000, and the split of the discount between disclosure and settlement is not stated. OFSI rated the case "serious". The timeline shows how long these cases take: DBLB disclosed on 20 September 2022, OFSI issued a notice of intention on 12 September 2025, the bank made representations in October 2025 and asked for a ministerial review in January 2026, a new enforcement framework was introduced on 9 February 2026, settlement talks began on 4 March 2026 and the penalty was imposed on 30 April 2026.

Aggravating and mitigating factors

• Aggravating: a high combined value; payments to an entity owned and controlled by a designated person, undermining the asset freeze; the strategic priority of Russia sanctions; weak risk management of the customer, including not uncovering its reliance on self-certification and an onboarding questionnaire that did not refer to Russia sanctions until 2024; the earlier similar payment; and cooperation that was at times delayed and below the standard expected of a large regulated institution.
• Mitigating: no intent, knowledge or cause to suspect a breach, with the press reports unknown to the bank or its vendor; Payment A being processed very shortly after designation; a voluntary disclosure; and remediation, including stronger oversight of vendors, wider list coverage, improved due diligence and a changed Russia risk appetite.

OFSI described the voluntary disclosure as prompt but incomplete, lacking detail and giving limited insight into the causes. That limited the discount.

Compliance failings

• Screening relied on third-party ownership data without in-house supplementation.
• Limited understanding of how the customer managed its own sanctions risk, including its self-certification model and its handling of downstream ownership.
• Onboarding and periodic reviews did not explicitly address Russia sanctions until 2024.
• Incomplete and slow cooperation with OFSI.

Lessons for industry

1. Maintain screening proportionate to your sanctions exposure, and supplement third-party tools where needed, especially for ownership and control cases.
2. Run strong onboarding and risk-based reviews of customers in Russia or other higher-risk jurisdictions, including how those customers manage their own sanctions compliance.
3. Make prompt, complete and detailed voluntary disclosures, because the quality of disclosure affects the discount.

Our guide to sanctions screening and alert resolution covers how to test screening against ownership changes.

Frequently asked questions

How much was the penalty?

£165,000, after a 45% discount from a baseline of £300,000.

Was the bank's customer the payee?

No. The payee, Okko LLC, was not a DBLB customer. The bank processed the payments for a customer that was paying it.

Why was the bank liable if its vendor missed the ownership?

OFSI treated vendor reliance as neutral, but criticised the bank for not supplementing vendor data with its own processes and for weak customer risk management.

What we could not confirm

We read OFSI's notice through a summarising tool. The customer's name, the basis for the stated statutory maximum and the split of the discount are not given in the text we read. OFSI's enforcement list shows publication on 19 May 2026. Please check all figures against the notice.