Sanctions Alert Resolution: OFSI and OFAC Reporting Explained

A sanctions screening tool does not resolve anything on its own. It produces alerts, and people then decide whether each alert is a true match, a false positive or something that needs escalating. This guide looks at what primary sources say about that second stage: what OFSI said after a 2026 penalty on a screening failure, and what US rules require once a transaction is blocked or rejected. It supports our Sanctions Screening and Alert Resolution course overview.

What the Bank of Scotland case shows

In January 2026 the UK's Office of Financial Sanctions Implementation (OFSI) published a £160,000 monetary penalty on Bank of Scotland Plc, a subsidiary of Lloyds Banking Group, under the Russia regime. In a blog post dated 23 February 2026, OFSI explained that the group had screening in place, but its automated systems failed to detect a spelling variation of a designated individual's name. OFSI's blog did not give the dates or transaction details in the text we read.

The same post lists lessons for other firms. Firms should ask whether screening copes with spelling and transliteration variants, and consider enriched screening data or commercial list providers where risk justifies it. Automation is not a safety net, so firms need contingency procedures and clear escalation guidance, including for politically exposed persons, and front-line staff should know who to contact. Training material should be reviewed as sanctions change. OFSI also stressed reporting suspected breaches as soon as practicable, and said an early partial disclosure can be followed by a full one.

Voluntary disclosure and the discount

According to OFSI's blog, Lloyds made an initial notification within two weeks of identifying the potential breach on behalf of Bank of Scotland. OFSI said its newer guidance allows a penalty discount of up to 30% for prompt and complete voluntary disclosure combined with cooperation. The practical point for alert handling is speed: a reviewer who spots a possible miss needs a route to compliance staff the same day.

What UK firms must report

OFSI's guidance on reporting says a relevant firm must inform OFSI as soon as practicable if it knows or reasonably suspects that a person is a designated person, or that a prohibition has been breached. Relevant firms include holders of an FSMA 2000 Part 4A permission, accountancy, legal and tax advisers, cryptoasset exchange and custodian wallet providers and others listed in each regime's regulations. Where a designated person is a customer, the firm must state the nature and amount of funds or economic resources it holds for them.

For frozen assets, OFSI's guidance says that from 2025 persons holding such assets as of 30 September must report by 30 November of that year. Outside that review cycle, firms freezing assets should contact OFSI as soon as practicable using the Frozen Asset online form. For a fuller UK summary, see our guide to UK financial sanctions and OFSI reporting.

US blocked and rejected transaction reports

Under 31 CFR 501.603 on the eCFR, US persons holding blocked property must file an initial report within 10 business days after the property becomes blocked. The report must include details such as the holder, the sanctions target, a description and value of the property, the date blocked and the legal authority. A separate annual report covers blocked property held as of 30 June and is due by 30 September.

Under 31 CFR 501.604, a US person that rejects a transaction which is not blocked but would violate the sanctions rules if processed must report it within 10 business days. Both initial and annual blocked-property reports and rejected-transaction reports are filed through the OFAC Reporting System. Under 31 CFR 501.601, records must be kept for at least 10 years after the transaction, and blocked property records for as long as it is blocked and at least 10 years after it is unblocked.

Ownership questions often drive these decisions. Our guide to the OFAC 50 percent rule explains how entities owned by blocked persons are treated.

Turning the sources into an alert process: our suggestions

These steps are our suggestions, not requirements in the sources above.

• Record why each alert was closed, including which identifiers (date of birth, country, address) were compared, so a later reviewer can reproduce the decision.
• Test the screening tool with deliberate name variants and transliterations, as OFSI's lessons imply.
• Give reviewers a clear, short escalation route and a named backup.
• Diarise the reporting deadlines that apply to your jurisdiction so a true match triggers the right filing.
• Sample closed false positives periodically to check that reviewers are applying the same standard.

For structured learning, browse our CPD courses.

What we could not confirm

We did not read OFAC's guidance on how to evaluate a potential match, so this post does not set out a match-scoring method. We read only the first part of the eCFR page for Part 501, so other reporting provisions may apply. The OFSI blog did not state the breach dates, and we did not read the penalty notice itself. We did not confirm the EU or Irish reporting position in detail; our Ireland sanctions guide is the better starting point. Rules change, so check current guidance before relying on this summary. This post is general information, not legal advice.