UK OFSI Sanctions vs OFAC: Which Law Applies to You?

OFSI and OFAC are not interchangeable. They run under separate statutes, maintain separate lists, and enforce through separate agencies — yet both can apply to the same person at the same time. When funds get frozen or a payment is rejected, the question isn’t just “what do I do” — it’s which regime acted, on what authority, and what options exist under that specific framework.

Free legal consultation —Contact Us

OFAC sits inside the U.S. Department of the Treasury. It runs more than 35 sanctions programs — countries, individuals, entities, entire economic sectors. The main statute is IEEPA (50 U.S.C. § 1701 et seq.), with CAATSA layered on top for Russia, Iran, and North Korea. No court order is needed to block assets or impose civil penalties. OFAC acts administratively.

The enforcement record is not abstract. BNP Paribas paid a $963 million OFAC component in 2014. Standard Chartered, Société Générale, Commerzbank — all non-U.S. banks, all hit through dollar correspondent accounts. The mechanism is the same each time: a transaction touches U.S. financial infrastructure, a designated party is involved, the penalty follows.

Primary sanctions cover “U.S. persons” — citizens, green card holders, U.S.-incorporated entities, and their foreign branches. A UK company running dollar payments through a New York correspondent bank is inside that perimeter the moment an SDN-listed counterparty appears in the transaction.

Secondary sanctions go further. No U.S. person required. No dollar required. The conduct itself — trading Iranian crude, facilitating a Russian defense procurement — triggers designation risk for any company anywhere. That’s the extraterritorial reach people underestimate.

When a financial institution identifies a match, it must block the transaction immediately and report to OFAC within 10 business days. The funds don’t disappear — they sit in a segregated blocked account, inaccessible until either the designation is removed or OFAC issues a Specific License. Neither happens quickly.

Full details on how individual OFAC sanctions programs work — country by country, sector by sector — are covered separately.

CAATSA Section 228 and Executive Order 13662 are the instruments most relevant to European and British businesses. A UK company with zero U.S. operations can still be designated if it knowingly facilitates a significant transaction with a Russian defense or intelligence entity. The consequence: SDN listing, loss of dollar correspondent relationships, effective exclusion from international trade finance. For companies dependent on cross-border payments, that outcome is not recoverable without legal intervention.

OFSI was set up in 2016 inside HM Treasury. Before Brexit, UK sanctions ran through EU regulations directly. After exit, a domestic framework became necessary — that’s OFSI’s function. It maintains the UK Consolidated List, processes licenses, investigates breaches, and imposes civil penalties. Criminal prosecutions go to the NCA or CPS; OFSI refers cases and supplies evidence.

In 2024, OFSI and OFAC signed a Memorandum of Understanding on information sharing, focused primarily on Russia. Not joint enforcement — but coordination has measurably increased since then.

UK SAMLA 2018 is the foundation. It authorizes HM Treasury and the Secretary of State to create sanctions regimes through statutory instruments. Each SI specifies prohibited conduct, designated persons, and licensing grounds. The active regimes include the Russia (Sanctions) (EU Exit) Regulations 2019 (amended repeatedly through 2024), Global Human Rights Sanctions Regulations 2020, and Iran (Sanctions) Regulations 2023.

The Economic Crime (Transparency and Enforcement) Act 2022 changed two things materially: it introduced strict civil liability — no need to prove intent — and expanded OFSI’s penalty powers. Before 2022, OFSI was considered toothless by many practitioners. After 2022, that changed.

Around 4,000 entries as of early 2025. Unlike the SDN list, the Consolidated List doesn’t segment by program — applicable restrictions are set out in the relevant SI, not the list itself. Same person, different mechanics.

Since February 2022, most individuals sanctioned under UK Russia regulations have also been designated by OFAC. The lists track each other closely — but challenging one designation does nothing for the other.

Civil penalties: up to £1 million or 50% of the breach value, whichever is higher. Strict liability since 2022 — breach is breach, intent is irrelevant for civil purposes. OFSI can also publish breach details without imposing a monetary penalty (“named disclosure”). Reputational damage from a public naming sometimes exceeds the financial hit.

Criminal liability sits at up to seven years’ imprisonment. Cases requiring proof of intent go to the CPS or NCA. OFSI refers; it doesn’t prosecute. Asset freezes cover all funds in the UK in which a designated person has an interest — and UK financial institutions have no discretion once a match is confirmed.

OFAC’s primary sanctions attach to U.S. persons and dollar transactions clearing through U.S. correspondent banks. OFSI’s jurisdiction covers the UK. A UK company running dollar payments through New York, involving an SDN-listed party, is in both regimes at once. No conflict of laws resolves that — both agencies act independently.

The OFAC vs OFSI jurisdiction question rarely produces a clean single answer. Dual exposure is the norm, not the exception, for any internationally active business after 2022.

OFAC has collected billions in civil penalties over the past decade. OFSI’s first significant monetary penalty — £7.8 million against Wise Payments Ltd — came in 2023. Seven years of operation before a headline-level fine. The gap has narrowed since the 2022 amendments, but OFAC’s total annual enforcement output still exceeds OFSI’s by a substantial margin. That’s changing, slowly.

OFAC’s base civil penalty under IEEPA: $356,579 per violation, or twice the transaction value if higher. That “per violation” structure is what drives large aggregate penalties — a pattern of smaller payments to a designated entity multiplies fast. Egregious violations, meaning willful conduct or obstruction, attract penalties near the statutory ceiling.

OFSI vs OFAC penalties at the top end favor OFAC by a large margin in absolute terms. For smaller transactions, OFSI’s 50% calculation can produce comparable proportional exposure. Named disclosure — public breach reporting without a financial penalty — has no OFAC equivalent. It’s a distinctly British enforcement tool.

Both regimes license otherwise-prohibited transactions. OFAC’s General Licenses cover broad categories — no application needed. Specific Licenses require a formal submission; review timelines run three to nine months for complex cases, often longer. Grounds include humanitarian need, legal expenses, pre-existing contracts.

OFSI’s general and specific licenses operate similarly, with grounds varying by SI. Russia regulations permit licensing for legal fees and basic needs. OFSI targets 30 business days for straightforward applications — complex cases run longer, with no statutory deadline.

The OFAC License application process — required content, viable grounds, and common failure points — is covered separately.

Four variables determine the answer: where the party is located and incorporated, what currency and clearing route the transaction uses, whether the counterparty appears on the SDN list, the UK Consolidated List, or both, and whether secondary sanctions are triggered by the nature of the activity.

UK company, sterling payments, UK bank only. OFSI applies. OFAC doesn’t — unless the counterparty is SDN-listed and a U.S. nexus exists somewhere in the transaction chain.

UK company, dollar transactions via U.S. correspondent account. Both regimes apply. Any SDN-listed counterparty in that chain means U.S. jurisdiction is engaged.

Individual with UK-frozen assets under Russia sanctions. OFSI governs the UK assets. OFAC applies separately if the same person is SDN-listed with U.S.-jurisdiction property or dealings with U.S. persons.

Non-U.S., non-UK company trading with Iranian petroleum. OFAC secondary sanctions apply regardless of nationality — provided the transaction meets the statutory threshold for “significant” dealings. UK sanctions may apply separately depending on the entity’s connection to UK financial infrastructure.

For compliance procedures, reporting obligations, and blocked property handling under U.S. law, see the OFAC compliance overview.

Extradition for sanctions violations happens. Rarely — but it’s not theoretical. The UK-US Extradition Treaty 2003 governs the process. The dual criminality test requires that the alleged conduct constitute a criminal offense in both countries. Courts look at the facts, not the statutory labels.

Criminal OFAC violations are federal offenses under IEEPA. The question for UK courts — specifically Westminster Magistrates’ Court at first instance — is whether the same conduct would be criminal under UK law. Post-2022, where SDN list and UK Consolidated List overlap extensively on Russia-related designations, the answer is increasingly yes. Same transaction, same counterparty, two separate criminal statutes both violated. The dual criminality test clears without difficulty in those cases.

The U.S. requesting extradition purely for an OFSI breach is unlikely absent a U.S. nexus. The realistic risk runs differently: the same conduct violates both OFSI and OFAC, and U.S. prosecutors bring their own indictment under IEEPA without needing extradition. That parallel prosecution model has appeared in Russia oligarch-connected cases where transactions breached both regimes simultaneously.

UK-US OFAC sanctions extradition analysis requires the requesting state to show the alleged conduct would carry at least 12 months’ imprisonment in the UK. Criminal sanctions breaches under SAMLA carry up to seven years — well above the threshold. The substantive question: do the facts alleged, stripped of U.S.-specific legal framing, describe conduct UK law prohibits? Where the SDN-listed entity is also on the UK Consolidated List and the transaction touched UK-connected institutions, the answer is almost always yes.

Designation is an administrative decision. Not a conviction. Both regimes have formal challenge mechanisms — the timelines, disclosure obligations, and realistic prospects differ substantially between them.

The starting point is a Ministerial Review under the relevant SI. HM Treasury must consider the application; no statutory deadline exists for the response. The review tests legality and proportionality. If it fails, judicial review in the Administrative Court is available on grounds of illegality, procedural impropriety, or Wednesbury unreasonableness. UK courts have in several cases required government to disclose the factual basis for designation — without that disclosure, mounting an effective challenge is practically impossible. Access to legal representation is protected: designated persons can apply to OFSI for a specific license covering legal expenses even while other assets remain frozen.

A Petition for Reconsideration goes to OFAC’s Office of Global Targeting. It must set out factual and legal grounds — erroneous designation, changed circumstances, or completed remedial steps. OFAC reviews internally, with no mandatory evidentiary disclosure and no fixed response deadline. Most petitions take one to three years. Federal Court litigation runs in parallel — primarily in the U.S. District Court for D.C. — on due process and APA grounds. Judicial deference to OFAC in national security contexts is high, but not absolute.

Details on the OFAC SDN list removal petition process — content requirements, legal standards, and litigation options — are addressed separately.

OFSI or OFAC blocked funds don’t wait. Banks in compliance-mode blocking don’t advise account holders on legal remedies — that’s not their role. The window for procedural action narrows fast: petition deadlines, licensing grounds, and judicial review timelines all have practical cutoffs that can’t be recovered once missed.

Three questions need answers immediately: which regime blocked the funds, on what legal basis, and whether the designation is challengeable or whether licensing is the faster route. Each path requires different documentation, different timelines, different legal arguments.

Where a sanctions block has affected banking relationships or credit reporting beyond the immediate transaction, additional steps may be needed — covered in detail on the OFAC and credit reports page.

Get legal advice on blocked funds —Contact Us