For companies operating in the UK or expanding into the market, sanctions screening helps answer a critical question: Are we about to do business with someone we legally cannot deal with? <\/strong>This guide explains the key UK sanctions screening requirements and what businesses need to do to stay compliant.<\/p>\n\n\n\n Under the Sanctions and Anti-Money Laundering Act 2018<\/a> (SAMLA), UK financial sanctions apply to all persons and entities within the UK’s territory, as well as to UK persons, including UK-registered legal entities, wherever they operate in the world.<\/p>\n\n\n\n Practically speaking, that means compliance obligations extend far beyond financial services. Relevant firms required to report to OFSI include<\/a>:<\/p>\n\n\n\n So, if your business handles client money, facilitates transactions, or provides professional services to UK businesses or individuals, you need a sanctions screening program.<\/p>\n\n\n\n UK sanctions screening rules is a set of controls designed to prevent a business from making funds, economic resources, or services available to sanctioned individuals, entities, ships, or organizations.<\/p>\n\n\n\n OFSI states that financial sanctions can restrict access to financial markets, funds, economic resources, and certain financial services. For more details, please refer to the UK financial sanctions general guidance<\/a>.<\/p>\n\n\n\n Even though the legislation requires compliance, how you achieve it is largely up to you. The only practical expectation, shaped by OFSI guidance, comes down to four core activities: customer screening, business screening, transaction screening, and ongoing monitoring. Let\u2019s dig deeper into them.<\/p>\n\n\n\n Before you onboard a customer or a business party, you must screen them by checking their identity against the UK Sanctions List<\/a> to establish whether they are a \u00abdesignated person\u00bb \u2013 someone subject to an asset freeze or other sanctions measures.<\/p>\n\n\n\n Sanction screening<\/a> procedures should happen:<\/p>\n\n\n\n For individuals<\/strong>, screening usually involves verifying full name, date of birth, nationality, address, aliases, and identification documents. For companies<\/strong>, it should include registered name, trading names, registration number, jurisdiction, directors, beneficial owners, parent companies, and controlling parties.<\/p>\n\n\n\n EXAMPLE:<\/strong> A UK-based accounting firm is approached by a new corporate client wishing to restructure its assets. Before signing an engagement letter, the firm must screen the company name, its directors, and its ultimate beneficial owners against the UK Sanctions List. If the firm’s founder appears on the list under an alias, that match needs to be investigated and not dismissed as a <\/em>false positive<\/em><\/a> without proper review.<\/em><\/p>\n\n\n\n Every payment or transfer of money, goods, services, or other economic resources must be screened at the point of execution, including checking the sender, receiver, and any intermediate parties involved in the transaction routing.<\/p>\n\n\n\n It helps identify whether a payment, counterparty, bank, vessel, destination, or intermediary may be connected to sanctions. So, if a transaction has links to a sanctioned individual (even indirectly), processing it is a breach.<\/p>\n\n\n\n All this means that in the UK transaction screening cannot be an afterthought, but rather be embedded into payment workflows before funds move.<\/p>\n\n\n\n Transaction screening<\/a> is important because sanctions risk can appear after onboarding. A customer may not be sanctioned, but a transaction could involve a sanctioned bank, vessel, region, intermediary, or beneficial owner.<\/p>\n\n\n\n EXAMPLE:<\/strong> A payment services firm is processing a batch of international transfers. One payment is destined for a company in a third country. Before the funds are released, the firm’s systems flag the beneficiary’s name as a close match to a sanctioned entity. As a result, the transaction is paused pending manual review.<\/em><\/p>\n\n\n\n Sanctions lists often change as new designations are added regularly, mostly in response to evolving geopolitical events. The risk remains that your customer who cleared screening at onboarding may become a designated person tomorrow. That’s why one-time screening is never enough.<\/p>\n\n\n\n Ongoing monitoring<\/a> means re-screening existing customers and counterparties whenever the UK Sanctions List is updated, and reviewing the status of any customer flagged for the Enhanced Due Diligence<\/a> (EDD) at regular intervals.\u00a0<\/p>\n\n\n\n Ongoing monitoring should include:<\/p>\n\n\n\n The UK\u2019s OFSI came up with a convenient way that helps businesses to stay up to date with the sanctions list: it offers an e-alert service, which had reached over 56,000 subscribers in April 2025<\/a>. This way, businesses can receive direct notifications when sanctions designations change.<\/p>\n\n\n\n EXAMPLE:<\/strong> A law firm onboarded a client in 2023, after sanctions check turned out clean. In early 2025, however, that client’s business partner and a major shareholder in one of the client’s subsidiary companies was designated under the Russia and Belarus sanctions regime. Without ongoing monitoring, the firm would have no way of knowing it may now be facilitating the business of a sanctioned party indirectly.<\/em><\/p>\n\n\n\n Published by the Foreign, Commonwealth and Development Office (FCDO), the UK Sanctions List <\/strong>is the official source for people, entities, and ships designated or specified under the Sanctions and Anti-Money Laundering Act 2018.<\/p>\n\n\n\n Until January 2026, UK sanctions were published across two separate lists \u2013 the UK Sanctions List and the OFSI Consolidated List. But from January 18, 2026<\/a>, the UK Sanctions List became the sole official source for all UK sanctions designations.<\/p>\n\n\n\n The OFSI Consolidated List has been closed and is no longer updated. So, businesses that still reference the old list (or use third-party providers that haven’t made the switch) risk screening against incomplete data.<\/p>\n\n\n\n The UK Sanctions List is available in multiple formats (Excel, XML, HTML, and others), and businesses should ensure their screening systems, whether in-house or third-party, are pulling from the current, live version of that list on a continuous basis.<\/p>\n\n\n\n Businesses should use the UK Sanctions List to screen:<\/p>\n\n\n\n One of the most complex areas of UK sanctions compliance is the ownership and control test. OFSI guidance explains that financial sanctions do not only apply to individuals and entities named on the UK Sanctions List, but also to any entity that a designated person owns or controls, even indirectly.<\/p>\n\n\n\n Under UK financial sanctions regulations<\/a>, a designated person is considered to \u00abown or control\u00bb an entity if they:<\/p>\n\n\n\n All this means that a company does not need to appear on the UK Sanctions List for obligations to apply. If a sanctioned individual holds 60% of its shares through a chain of holding companies in multiple jurisdictions, that company is effectively sanctioned, and you are prohibited from dealing with it.<\/p>\n\n\n\n It’s also worth noting that the UK’s ownership threshold differs from the\u00a0Anti-Money Laundering<\/a> (AML) regime’s 25% beneficial ownership test. For sanctions, the threshold is more than 50% \u2013 a distinction that catches many businesses off guard, particularly those who assume that their existing AML due diligence<\/a> covers the full sanctions picture.<\/p>\n\n\n\n So, what happens next after your sanctions screening<\/a> has produced a confirmed match, meaning a customer, counterparty, or beneficial owner appeared to be a designated person?<\/p>\n\n\n\n After the issue is identified, you must act quickly. From that moment on your obligation is to freeze any funds or economic resources you hold for that person, refuse to make any further funds available to them, and report the situation to OFSI.<\/p>\n\n\n\n So, here is a list of actions a business must do after a sanctions issue is identified:<\/p>\n\n\n\n When it comes to reporting, relevant firms are required to inform OFSI \u00abas soon as practicable\u00bb if they know or have reasonable cause to suspect that a person is a designated person, or that a sanctions breach has occurred.<\/p>\n\n\n\n If the person is a customer and the firm holds funds or economic resources for them, the firm must also report the nature and amount or quantity of those funds or resources. Failure to report is considered a criminal offense, punishable by up to five years imprisonment or a fine<\/strong>. <\/p>\n\n\n\n OFSI strongly encourages self-reporting in cases where a breach has already occurred. OFSI treats voluntary disclosure<\/a> as a significant mitigating factor when deciding on enforcement action and penalty levels.<\/p>\n\n\n\n EXAMPLE:<\/strong> A payment firm identifies that a customer whose account holds \u00a385,000 has just been added to the UK Sanctions List following a new Russia regime designation. The firm must immediately freeze the funds, cease any activity on the account, and report the situation to OFSI. And all this without delay and without waiting to seek legal advice first.<\/em><\/p>\n\n\n\n But even well-intentioned compliance programs struggle with several recurring issues. Let’s review the most common sanctions screening challenges:<\/p>\n\n\n\n False positives and false negatives. <\/strong>Sanctions lists contain common names, and screening tools frequently generate alerts for individuals who share a name with a designated person but have no connection to them. Unmanaged, this creates alert fatigue, which can lead to legitimate hits being dismissed. On the flip side, poor matching logic, outdated lists, missing aliases, or weak data quality can cause a real match to be missed.<\/p>\n\n\n\n Complex ownership structures.<\/strong> Sanctioned individuals routinely use layered corporate structures, such as shell companies<\/a>, nominee directors, relatives, layered entities, or trusts. This is done to obscure their ownership interests.\u00a0<\/p>\n\n\n\n The use of shell companies and client proxies as one of the primary methods used by professional enablers to help sanctioned individuals circumvent restrictions. <\/em>Source<\/em><\/a><\/p>\n<\/blockquote>\n\n\n\n Cross-border operations.<\/strong> The UK financial sanctions are legally distinct from the EU and US sanctions. Since Brexit, a person may be designated under UK sanctions but not EU sanctions, or vice versa. Businesses operating across both jurisdictions need separate compliance frameworks: one UK program is not sufficient for EU operations, and vice versa.<\/p>\n\n\n\n List updates and operational pressure.<\/strong> New designations can turn an existing customer or supplier into a restricted relationship overnight. Also, businesses want fast onboarding and smooth payments. To achieve that compliance teams need tools that support speed without sacrificing screening accuracy.<\/p>\n\n\n\n EXAMPLE:<\/strong> A UK import business is dealing with a European supplier whose parent company appears to be majority-owned by a Russian holding group. The supplier itself is not on any list, but the parent company may be controlled by a designated person. The UK business must investigate the full ownership chain before proceeding \u2013 not simply rely on the fact that no individual or entity in the immediate transaction is named on the list.<\/em><\/p>\n\n\n\n Manual screening can work for very small volumes, but it becomes difficult to scale. <\/p>\n\n\n\n For example, a mid-sized payments firm needs to onboard dozens of new customers a week, process hundreds of transactions a day, and try to keep pace with a sanctions list that can change overnight.<\/p>\n\n\n\n Doing all of that by hand is painfully slow, and, frankly, a compliance liability waiting to happen. Automated sanctions screening takes that pressure off by connecting directly to the UK Sanctions List (and other global lists where relevant) and running checks in real time, at every stage that matters \u2013 onboarding, transaction execution, and ongoing monitoring<\/a>.<\/p>\n\n\n\n A well-implemented automated sanctions screening system will:<\/p>\n\n\n\n Automation is especially valuable for growing companies because sanctions risk increases with scale. More customers, more transactions, more markets, and more counterparties \u2013 all create more opportunities for missed matches. <\/p>\n\n\n\n It\u2019s important to stress that automation does not remove the need for human judgment<\/strong>. Confirmed matches still require trained staff to assess, escalate, and report. But automation ensures that the volume of transactions never becomes an excuse for missed checks, and it provides the documented evidence of due diligence that OFSI looks for when assessing enforcement cases.<\/p>\n\n\n\n Sanctions breaches in the UK can lead to serious consequences, including regulatory action, monetary penalties, criminal prosecution, reputational damage, frozen transactions, and loss of banking or partner relationships.<\/p>\n\n\n\n Also, ignorance is not a defense, as you can be penalized even if you didn\u2019t know you were dealing with a sanctioned person or entity. If a breach occurred, OFSI can act, regardless of intent.<\/p>\n\n\n\n Civil penalties<\/strong>, imposed by OFSI, can reach \u00a31 million or 50% of the estimated value of the breach<\/a>, whichever is greater. But that’s not all. Under powers introduced by the Economic Crime (Transparency and Enforcement) Act 2022, OFSI can publicly \u00abname and shame\u00bb a business it believes has breached sanctions, even without issuing a fine. For most organizations, that kind of reputational exposure hits harder than any penalty notice.<\/p>\n\n\n\n Meanwhile, criminal prosecution<\/strong> by the National Crime Agency and the Crown Prosecution Service can result in unlimited fines and up to seven years’ imprisonment<\/a> under SAMLA.<\/p>\n\n\n\n And if you’re wondering whether OFSI actually uses these powers \u2013 it does.<\/p>\n\n\n\n For example, in 2025, OFSI fined Markom Management Limited<\/a> \u00a3300,000 for instructing a payment of \u00a3416,590.92 to a designated individual under Russia sanctions. What made things worse is that the firm knew about the breach and still lacked adequate controls to prevent it.<\/p>\n\n\n\n This only proves that awareness without action is exactly the kind of aggravating factor that turns a compliance lapse into a very public, very costly lesson.<\/p>\n\n\n\n There is no prescriptive OFSI-mandated framework.<\/p>\n\n\n\n A strong sanctions compliance program should be risk-based, documented, and practical, helping the business make faster decisions and reducing the chance of prohibited activity.<\/p>\n\n\n\n Here are a few practices that reflect what OFSI expects to see in enforcement cases, and what consistently distinguishes firms that handle breaches well from those that don’t: <\/p>\n\n\n\n Conduct a sanctions risk assessment<\/strong><\/p>\n\n\n\n Map your business against the key risk factors: the types of customers you serve, the jurisdictions you operate in, the products or services you provide, and your exposure to high-risk sectors. Even though a formal sanctions risk assessment is not compulsory, OFSI and the SRA both recommend it, because it forms the basis for calibrating your screening controls.<\/p>\n\n\n\n Screen at every relevant touchpoint<\/strong><\/p>\n\n\n\n Onboarding is only the starting point. Screen customers at onboarding, re-screen when the sanctions list updates, and build triggers for re-screening when material changes occur in a customer relationship, such as a change of directors, a new ultimate beneficial owner<\/a>, or a significant transaction.<\/p>\n\n\n\n Document everything<\/strong><\/p>\n\n\n\n When a sanctions alert is reviewed and closed as a false positive, the reasoning for that decision must be recorded. And when a potential match is escalated, the steps taken must be auditable. OFSI’s enforcement decisions consistently highlight inadequate record-keeping<\/a> as a compliance failure, even where the underlying screening was performed.<\/p>\n\n\n\nWhich Businesses Must Comply with UK Sanctions Requirements?<\/strong><\/h2>\n\n\n\n
\n
What Are the Main UK Sanctions Screening Requirements?<\/strong><\/h2>\n\n\n\n
![\"Key](\"https:\/\/ondato.com\/wp-content\/uploads\/2026\/06\/v1_2026-06_UK_Sanctions_Screening_Requirements_Featured-1-1024x578.webp\")
<\/figure>\n\n\n\nCustomer and Business Screening<\/strong><\/h3>\n\n\n\n
\n
Transaction Screening<\/strong><\/h3>\n\n\n\n
Ongoing Monitoring<\/strong><\/h3>\n\n\n\n
\n
Screening Against the UK Sanctions List<\/strong><\/h2>\n\n\n\n
\n
Ownership and Control Requirements<\/strong><\/h2>\n\n\n\n
\n
Asset Freeze and Reporting Obligations<\/strong><\/h2>\n\n\n\n
\n
Reporting Requirements<\/strong><\/h3>\n\n\n\n
Common Sanctions Screening Challenges<\/strong><\/h3>\n\n\n\n
\n
How Automated Sanctions Screening Helps Meet Compliance Requirements<\/strong><\/h2>\n\n\n\n
\n
Penalties for Non-Compliance<\/strong><\/h2>\n\n\n\n
<\/h2><\/span><\/h2>\n\n\n\n
<\/h2><\/span><\/h2>\n\n\n\n
![\"Maximum](\"https:\/\/ondato.com\/wp-content\/uploads\/2026\/06\/v1_2026-06_UK_Sanctions_Screening_Requirements_Featured-2-1024x578.webp\")
Best Practices for Building an Effective Sanctions Compliance Program<\/strong><\/h2>\n\n\n\n