Sanctions Enforcement Update: Citibank, N.A., London Branch Fined for UK Sanctions Breaches

The breaches related to 970 payments made between 2022 and 2025 totalling almost £20 million. They included processing payments to / from companies owned by Designated Persons, deducting internal charges and correcting payment errors, processing correspondent banking payments, and returning a rejected interest payment (for distribution to noteholders, from an issuer owned or controlled by a Designated Person) to the correspondent bank.

Although neither the Cayman Islands nor the BVI yet has the same type of strict liability civil enforcement regime that was applied in this case, a similar regime may well be enacted in the British Overseas Territories in future. Accordingly, examples of how OFSI handles such cases are likely to be of relevance to our Cayman Islands and BVI clients.

In this instance, the case was assessed to be Level 4 (the highest rating) on OFSI’s seriousness framework, with a baseline penalty of £7,888,050.97 set from the balance of aggravating and mitigating factors. A 20% voluntary disclosure and co-operation discount was applied, as well as a further 20% discount for having settled the case (under the settlement framework introduced by OFSI in February 2026).

The compliance lessons noted by OFSI are to:

• Appropriately assess sanctions exposure in advance, and in enough detail to understand where vulnerabilities could arise. Where a firm has elevated exposure to specific sanctions risks (particularly where there is rapidly increasing risk of new sanctions being introduced) it should ensure that it maintains evidence of sufficiently detailed prior analysis;
• Take care to comply with all sanctions requirements even where their size, scale, and complexity pose operational challenges and strain systems and processes – whilst this may be a mitigating factor, it does not excuse breaches;
• Promptly report frozen assets to OFSI – delays of more than 6 weeks in 53 cases (and almost 18 months for 11 of those) was considered an aggravating factor;
• Where a general licence issued by OFSI is in effect, take reasonable steps in advance for the firm to assure itself (and maintain records accordingly) that the licence applies to the transaction in question and any relevant clients remain in compliance – especially where accounts are being operated on behalf of Designated Persons; and
• Voluntarily self-report, provide a complete account of the incident, and co-operate fully throughout the process in order to access the voluntary disclosure and co-operation discount. Incomplete or delayed disclosure can materially reduce any discount. Where full disclosure is not initially possible, an early disclosure supplemented by a subsequent fuller report is the appropriate approach. Co-operation in this context is expected to go above and beyond what is required by law and what is explicitly requested, and firms should be proactive in providing information that may assist OFSI’s investigation.

The full penalty notice is available here.

Maples Group has significant experience in advising on Cayman Islands, BVI, and European Union sanctions law, including but not limited to risk assessment, upstream and downstream asset freezing measures, and specific licence applications. Please reach out if we can be of assistance.