OFSI Markom Management £300,000 Penalty: Corporate Services and Refund Lessons

A refund sounds harmless. Money has been paid to your client by mistake, so you send it back. In February 2018 that instinct led a UK corporate services provider, Markom Management Limited (MML), to instruct a payment of about £416,590 to a person designated under the UK's Ukraine sanctions. In 2025 the Office of Financial Sanctions Implementation (OFSI) imposed a £300,000 monetary penalty, and the notice was published in July 2025. The case matters for accountants, bookkeepers and company service providers because it concerns the ordinary work they do for clients: administration, bookkeeping and payments. To build your own sanctions knowledge, see our CPD courses.

This guide is based on OFSI's public penalty publication notice. We read it through a summarising tool, so check every figure against the notice before you quote it.

What happened

In 2018 MML, part of the Markom Group, provided fiduciary, management, administration, bookkeeping and accounting services to companies in several jurisdictions. A related entity, Markom Management Cyprus, had a client called Company A in the notice. On 19 February 2018 a designated person made a payment to Company A between two accounts at the same Russian bank. It was an overpayment. The next day MML's senior management were told, and MML instructed a transfer of RUB 33,000,000 (about £416,590.92) from Company A's account back to the designated person.

MML was not involved in the original transfer. Its staff were a point of contact for Company A, including for payments, partly because they spoke Russian. MML notified OFSI through its legal representatives on 19 October 2018, and OFSI opened a civil investigation in June 2021.

The legal basis

The notice applies section 146 of the Policing and Crime Act 2017 to a breach of the Ukraine (European Union Financial Sanctions) (No.2) Regulations 2014, which gave effect to Council Regulation (EU) No 269/2014. The breach happened before strict liability for civil penalties was introduced in 2022, so OFSI applied its enforcement guidance of 2 May 2024 to the earlier conduct. Our guide to UK financial sanctions, OFSI and strict liability explains the later change.

Penalty and timeline

The breach value was £416,590.92 (the notice also contains a typographical variant of the last digits) and the statutory maximum was £1,000,000. OFSI issued a notice of intention on 1 August 2024 proposing £400,000, received representations between October and December 2024, and imposed a penalty of £300,000 on 10 January 2025. MML asked for a ministerial review on 18 February 2025; the review concluded on 4 June 2025 and the penalty was upheld. The text we read does not itemise the reasons for the £100,000 difference between the notice of intention and the final penalty, and no voluntary disclosure discount applied.

Why OFSI rated it serious

OFSI assessed the case as "serious", not "most serious". The aggravating factors it identified were:

• a high-value breach;
• a benefit to a designated person linked to the annexation of Crimea and destabilisation of eastern Ukraine, which undermined the purpose of the regime;
• the fact that Ukraine sanctions were a UK strategic priority in 2018;
• that MML knowingly instructed the payment to the designated person, prioritising speed over compliance;
• inadequate policies, with no controls for informal working across the group's UK and Cyprus entities; and
• MML's active role in the breach.

The mitigating factors were the steps taken after discovery to improve compliance, which led OFSI to treat the breach as a one-off, a materially complete initial disclosure (although it did not meet the criteria for a discount), and full cooperation during the investigation.

The compliance failings

• Misunderstanding the prohibition. The firm treated returning the overpayment as acceptable, when making funds available to a designated person is prohibited whatever the reason.
• No advice sought. No legal advice was taken before the payment was instructed.
• No fit-for-purpose controls. There were no suitable sanctions processes, and nothing governed informal cross-border working between group entities.
• Late detection. The breach was identified only through an internal review prompted by third-party activity.

What this means for accountants and corporate service providers

Many professionals handle money on a client's behalf, make or instruct payments, or sit between a client and its bank. The Markom case shows that an instruction to return funds is a payment like any other, and that if the recipient is a designated person, or owned or controlled by one, the prohibition applies. It also shows that being a small team does not reduce the standard: OFSI's lesson is that firms must understand their sanctions exposure and act on it regardless of size. Our guide to the ownership and control test shows how a payee can be caught even when it is not itself named on a list.

Lessons OFSI draws

• Understand your sanctions exposure and act on it, whatever your size.
• Make sure staff understand the prohibitions, including for refunds and returns of overpayments, and take professional advice when unsure.
• Make sanctions policies fit for purpose and cover cross-border working practices between group companies.
• Have systems to identify and report suspected breaches promptly. Current OFSI policy allows up to a 50% discount in serious cases for prompt, complete voluntary disclosure.

For how screening and alert handling should work in practice, read our guide to sanctions screening and alert resolution.

Frequently asked questions

Can I return an overpayment to a sanctioned person?

Not without checking the rules. Paying funds to a designated person is prohibited, and a refund is still a payment. Take advice and consider whether a licence from OFSI is needed.

Why did a 2018 breach lead to a 2025 penalty?

The firm reported it to OFSI in 2018, but OFSI's civil investigation began in June 2021 and the penalty process ran from 2024 to 2025. Old breaches can still be penalised.

How much was the penalty?

£300,000, against a breach value of £416,590.92.

What we could not confirm

We read OFSI's publication notice through a summarising tool. The identity of the designated person is not given, the baseline penalty is not stated in the text we read, and the notice contains a small discrepancy in the breach value. Please check all figures against the notice.