OFSI Imposes Monetary Penalty Against Former Moscow Office of International Law Firm for Sanctions Breaches

Key Takeaways

• The OFSI issued a monetary penalty of £465,000 against HSF Moscow for six payments made in breach of the U.K. sanctions against Russia.
• OFSI stresses that companies must understand their exposure to sanctions risks and take appropriate action to address them. The mere existence of a dedicated compliance function is not sufficient and will not result in a lower penalty if the measures are not actually implemented by those responsible for carrying out the transactions.
• Where a breach has been identified, a voluntary and complete disclosure should be submitted to OFSI without delay. Such cooperation and disclosure may significantly mitigate any final monetary penalty imposed.

Background

On March 20, 2025, the U.K.’s Office of Financial Sanctions Implementation (OFSI) announced that, in accordance with section 146 of the Policing and Crime Act 2017 (PACA), a monetary penalty of £465,000 had been imposed against U.K. registered Herbert Smith Freehills CIS LLP Moscow (HSF Moscow) for six payments made in breach of the U.K.’s Russia (Sanctions) (EU Exit) Regulations 2019 (the Russia Regulations).

According to its ‘Penalty Notice’, OFSI maintained that no findings have been made against Herbert Smith Freehills LLP (HSF London), the parent firm of HSF Moscow. OFSI noted that since HSF London, on behalf of HSF Moscow, provided prompt and detailed disclosure relating to all breaches, a 50% reduction was made to the final penalty amount. Absent such disclosure, OFSI would have imposed a penalty of £930,000.

Between May 25 to 31, 2022, HSF Moscow made six payments to three designated persons (DPs), including Alfa Bank JSC (Group ID: 15017), PJSC Sovcombank (Group ID: 14200) and PJSC Sberbank (Group ID: 15076), in breach of the Russia Regulations. The collective value of these payments was £3,932,392.10, which related to annual audit fees, life insurance policies, employee redundancy and the transfer of an existing lease agreement between HSF Moscow and a local firm in Russia.

On June 1, 2022, HSF London submitted a voluntary notification to OFSI, explaining that HSF Moscow had made a lease payment to the DP Alfa Bank JSC, in breach of the Russia Regulations. Following this disclosure, HSF London voluntarily submitted a further breach report on July 15, 2022, relating to five earlier payments. These payments were made to two other DPs, namely PJSC Sovcombank and PJSC Sberbank, which HSF Moscow and HSF London identified after conducting an internal investigation, following the initial lease payment breach report.

During its investigation, OFSI assessed HSF Moscow’s actions with reference to the May 2, 2024 version of its Financial sanctions enforcement and monetary penalties guidance (the Enforcement Guidance), and identified that the breaches committed by HSF Moscow occurred due to:

1. Employees conducting inadequate due diligence and sanctions screening in respect of outbound payments.
2. Errors caused by the expeditious closure of HSF Moscow’s Russian offices, which resulted in the failure to sufficiently account for K. sanctions requirements.

Furthermore, with reference to its Enforcement Guidance, OFSI’s identified the following aggravating factors:

• HSF Moscow made funds available directly to DPs or their wholly owned subsidiaries. While most of the payments were of lower value, the cumulative total and their repeated nature was serious, and the total value significant. Six payments were made to various DPs over successive days (factors B and I of the Enforcement Guidance).
• The harm or risk of harm to the regime’s objective. All payments, including a very high payment, were made directly to DPs at a time when attempts to elicit behavioral change from Russian DPs were a critical priority for the K. government (factor C of the Enforcement Guidance).
• OFSI does not consider there to have been any intent or actual knowledge when making the payments that HSF Moscow’s actions would be in breach of the Russia Regulations. However, while HSF Moscow had significant awareness of the sanctions risk, it failed to take reasonable care. For all payments, HSF Moscow had reasonable cause to suspect their actions would result in a breach of the Russia Regulations (factor D of the Enforcement Guidance).
• Despite HSF Moscow having systems and policies in place to prevent sanctions breaches, and possessing widespread awareness of sanctions risk, these proved ineffective and were not properly followed in relation to these specific payments (factor E of the Enforcement Guidance).
• A clear failure by HSF Moscow’s most senior finance staff to conduct proper due diligence or understand the application of ownership and control in the Russia Regulations. HSF Moscow relied on an informal response from HSF London as their sole basis for concluding that sanctions did not apply to Sovcombank Life, far below what would be expected from the office of a law firm operating in Russia during the first half of 2022 (factor F of the Enforcement Guidance).

OFSI’s Penalty Notice states the following actions were identified as mitigating factors:

• HSF London’s initial disclosure to OFSI was made almost immediately after the lease payment breach was discovered by HSF Moscow and was followed by further voluntary reporting five days later. OFSI notes that all reporting by HSF London was voluntary, prompt, and contained significant detail. In addition, HSF London conducted its own investigations and cooperated fully. OFSI states that HSF London’s proactive actions were considered mitigating factors in the case against HSF Moscow given that HSF London was acting on its behalf (factors J and K of the Guidance).
• The breaches were committed by HSF Moscow while in the process of closing down its operations within Russia. This was in support of K. policy objectives (factor C of the Guidance).

In the context of these aggravating and mitigating factors, OFSI assessed this case to be “serious”, as opposed to “most serious”. As the total value of the breaches amounted to £3,932,392.10, the statutory maximum penalty in this case would have been £1,966,196.05 (see section 146(3) PACA). However, when considering all of the aggravating and mitigating factors, OFSI concluded that it was reasonable and proportionate to impose a penalty of £930,000, which was further reduced by 50% due to HSF London, on behalf of HSF Moscow, having provided prompt and detailed disclosure relating to all breaches.

U.K. Nexus?

The risk of being subject to penalty under U.K. sanctions is not one which applies to all persons and entities. Per Section 21 of the Sanctions and Anti-Money Laundering Act 2018 (SAMLA) U.K. sanctions apply (a) to conduct in the U.K. or its territorial sea; (b) to U.K. nationals, wherever located;¹  and (c) to any entity or body incorporated or constituted under the law of any part of the U.K., wherever located.

Accordingly, while companies established in the U.K. are always required to comply with U.K. sanctions, regardless of where their actions take place, a Russia-incorporated subsidiary of a U.K.-established parent will not per se be subject to U.K. sanctions. In the case of HSF Moscow, this company was established in the U.K. and, as a result, this brought HSF Moscow within scope of the U.K. sanctions regime.

The broad territorial scope of U.K. financial sanctions was also highlighted by OFSI’s enforcement action against Tracerco Limited, a U.K.-established company and UAE-based subsidiary of Johnson Matthey, which involved two payments made by Tracerco Limited to a DP in breach of the Syria (European Union Financial Sanctions) Regulations 2012. In accordance with the Penalty Notice, OFSI noted that “[a]ll companies with a UK nexus, not just traditional financial institutions, must make sure they comply with the restrictions in place, and this is especially important when operating internationally” (Paragraph 13). Further, in its recent Financial Services Threat Assessment, OFSI noted that it had observed across different types of transactions failures to identify the involvement of U.K. nationals or entities in transaction chains.

Compliance Lessons

Since January 21, 2019, OFSI has taken twelve enforcement actions in respect of U.K. financial sanctions. Key lessons, in particular from the HSF Moscow enforcement action, include the following:

• First, firms must “understand their exposure to sanctions risks and to take appropriate action to address them. Firms operating in higher risk environments should educate themselves fully on the risks (including by properly engaging with the Enforcement Guidance and seeking professional advice on their sanctions obligations if necessary). In particular, parent companies with subsidiaries in areas that pose a heightened sanctions risk (such as offices overseas) should ensure they are providing suitable advice and assurance.” We note that, in its enforcement action against Wise Payments Limited, OFSI considered Wise’s systems and controls, specifically surrounding debit card payments, to be inappropriate. This factor increased the severity of the breach to moderately severe as it failed to prevent funds from being made available to a company owned or controlled by a DP.
• Second, “the need for adherence to sanctions policies and processes that a firm has in place. Firms are expected to follow all relevant sanctions screening and due diligence measures they have in place. This applies equally to all individuals, regardless of seniority. Whilst OFSI usually considers the existence of appropriate sanctions policies and procedures mitigating, the failure to follow and comply with them may significantly undermine the weight given to this factor and be aggravating overall when considered against OFSI’s expectations of a firm.” The HSF Moscow case highlights that the mere existence of a dedicated compliance function is not sufficient and may not result in a lower penalty if the measures are not actually implemented by those responsible for carrying out the transactions. Accordingly, companies subject to K. sanctions jurisdiction should make sure that all relevant employees, in particular those responsible for approving payments or entering into business relationships with other parties, have obtained sanctions compliance training and are aware of the risks of sanctions breaches.
• Third, “the need to fully consider ownership and control beyond just whether an entity is directly subject to sanctions. Failure to properly consider and identify clear ownership is viewed more poorly by OFSI than an incorrect but good faith assessment of control.”

Regarding self-disclosure and co-operation, we note the following in particular:

• Voluntary, prompt and complete disclosure – Firms that proactively make a voluntary, prompt and complete disclosure relating to sanctions breaches may obtain relief of up to 50% (30% for cases assessed as ‘most serious’) of the final monetary penalty imposed. Case examples include:
• HSF Moscow (received 50% discount)
• Tracerco Limited (received 50% discount)
• Raphaels Bank (received 50% discount)
• Standard Chartered Bank (received 30% discount; since this case was assessed as “most serious” only reductions of up to 30% are possible)
• Clear Junction (received 26.7% discount; while Clear Junction disclosed eight transactions, OFSI identified further transactions which Clear Junction had not notified).
• Co-operation – Where a firm has not made a voluntary disclosure to be eligible for relief, their full co-operation with OFSI during the investigation process will be considered a mitigating factor.

^{1 The term “U.K. national” includes any individual who is a British citizen, a British overseas’ territories citizen, a British National (Overseas) or a British Overseas citizen; a person who under the British Nationality Act 1981 is a British subject; as well as a British protected person within the meaning of that Act. U.K. sanctions can also extend to certain British Overseas Territories.}