UK Sanctions for Accountants: OFSI Reporting and Strict Liability

Financial sanctions are a separate legal regime from anti-money laundering (AML), but they land on the same desk. If you act for clients, hold their money or prepare their accounts, UK sanctions law can apply to you, and in some cases it requires you to tell the Office of Financial Sanctions Implementation (OFSI) what you know. This guide explains who has to report, what a breach can cost under the strict liability regime, what changed in OFSI's enforcement approach in 2026, and what a practical sanctions check looks like for an accountancy firm. It draws on OFSI's published guidance on reporting and on law firm summaries of 2026 enforcement developments. Sanctions rules change often and the detail depends on the regime, so check OFSI's current guidance and take specialist advice on specific cases. This is general information, not legal advice.

Who must report to OFSI?

OFSI explains that "relevant firms" must report to it in certain situations, and it names accountancy service providers, auditors and tax advisers among them. A relevant firm must report if it knows, or has reasonable cause to suspect, that:

• a person is a designated person, and that person is a client whose frozen assets the firm holds; or
• a person has committed a financial sanctions offence.

The duty applies to information that comes to the firm while carrying on its business, and failing to report is an offence. OFSI's guidance says a report should include the information that led to the knowledge or suspicion, details that identify the person (such as name, address, date of birth, ID details or company registration), the nature and amount of any funds or economic resources held, and details of the suspected offence. The definitions of each category depend on the regime concerned, so check the relevant statutory instrument. OFSI's own blog on reporting dates from August 2022, so confirm the current process and form on GOV.UK before you report.

Reporting to OFSI is not the same as submitting a suspicious activity report (SAR) to the National Crime Agency. A single concern may need both, so speak to your money laundering reporting officer (MLRO) early. Our guide to suspicious activity reports covers the SAR side.

Strict liability: intent is not required

The civil penalty regime for sanctions breaches has been strict liability since 15 June 2022, according to a June 2026 summary by the law firm WilmerHale. Before that date OFSI had to prove that a person knew, or had reasonable cause to suspect, that they were breaching sanctions. Now it can impose a penalty without showing intent. In both of the 2026 cases the summary describes, OFSI found no evidence of intent, knowledge or actual suspicion, but still imposed a penalty. Absence of fault can mitigate a penalty, but it does not prevent one.

What changed in 2026

The same summary sets out these developments:

• Two penalties. OFSI penalised a technology company in March 2026 and a bank in May 2026, in each case for making funds available to an entity owned or controlled by a designated person. In the bank case, the screening tool produced no alert because the third-party vendor's data omitted the entity's ownership information.
• A settlement scheme. OFSI introduced a new settlement scheme on 9 February 2026, including an early account scheme with up to a 20 per cent discount and a revised voluntary disclosure and co-operation discount of up to 30 per cent.
• A new strategy. OFSI published its 2026 to 2029 strategy on 15 April 2026, which moves it towards proactive, intelligence-led enforcement.
• An FCA review. On 28 May 2026 the Financial Conduct Authority published findings from its review of firms' sanctions systems and controls, identifying weaknesses in due diligence and screening among the most common root causes of reported breaches.

These cases involved a technology company and a bank, not accountants. The lesson that carries across is that gaps in ownership data and screening lead to breaches, and that fault is not a defence.

What this means for an accountancy firm

Three practical points follow.

1. Know who you are acting for, including who owns them. A sanctions risk often sits behind a company, not in the name on the engagement letter, because an entity owned or controlled by a designated person can be caught. Tracing ownership is therefore a sanctions control as well as an AML one. See our guide to ultimate beneficial ownership for accountants.
2. Screen at onboarding and again when things change. The sanctions lists are updated, so a client who was clear last year may not be today. Our guide to sanctions screening for accountants covers how to do it.
3. Understand your screening tool's data. The bank case turned on missing ownership information in a vendor's data. Ask your provider what it covers and what it does not, and do not assume that no alert means no risk.

If you find a match

If you think a client or a counterparty may be a designated person, or that a payment may breach sanctions, stop and escalate to the MLRO before you do anything else. Do not move, return or release funds without advice, because doing so could itself be a breach. Record what you found, when, and what you did, and consider the OFSI report and any SAR. Take specialist legal advice where money has already moved.

For more guides on this topic, start with our AML and KYC guides hub, and see our CPD courses for training for your team.

Frequently asked questions

Are accountants required to report sanctions concerns?

OFSI names accountancy service providers, auditors and tax advisers as relevant firms, which must report in the situations described above. Check the current guidance for the regime concerned.

Do I need to intend to breach sanctions to be penalised?

No. The civil regime has been strict liability since 15 June 2022, so intent is not required.

Is an OFSI report the same as a SAR?

No. They go to different bodies and have different triggers. A case may need both.

Does screening only the client's name work?

Not reliably. A 2026 bank penalty involved ownership data missing from a vendor's screening data, so check owners and controllers too.

What should I do if a screening alert looks genuine?

Pause, escalate to your MLRO and do not release or return funds without advice.