Daily Compliance Brief — OFSI Penalizes Citibank London for Sanctions Control Failures

September 2, 2026

Signal

The UK Office of Financial Sanctions Implementation (OFSI) published a monetary penalty notice on September 2, 2026, detailing a £4,732,830.58 penalty imposed on Citibank, N.A., London Branch. According to the OFSI enforcement notice published by HM Treasury, the penalty relates to breaches of the Russia (Sanctions) (EU Exit) Regulations 2019 and the Global Anti-Corruption Sanctions Regulations 2021.

OFSI identified 970 payments with a cumulative value of approximately £19.7 million that it considered breaches, spanning payment processing, correspondent banking and account restrictions. The notice identified delays in sanctions-alert review, screening weaknesses, manual processing failures and errors in identifying ownership and control.

The case was assessed at Level 4, the highest rating under OFSI's seriousness framework. OFSI also found that some payment chains and correspondent-bank information were not re-screened after changes were introduced, allowing designated Russian financial institutions to remain undetected.

Why it matters

Firms should test whether sanctions screening covers the full payment chain, including correspondent banks, BICs, return payments and entities added after initial screening.

Control environments should also ensure that account restrictions, ownership assessments and sanctions alerts are escalated consistently, particularly where high-volume activity creates operational pressure.

The enforcement notice reinforces the need to assess sanctions controls across connected systems and business functions rather than treating screening as a single point-in-time control.