Citibank Fined £4.7 Million Over UK Sanctions Control Failures

Citibank's London branch has been fined £4.73 million by the UK's Office of Financial Sanctions Implementation (OFSI) after a regulatory investigation identified widespread failures that allowed hundreds of transactions involving sanctioned Russian entities and individuals to pass through the bank.

The penalty relates to 970 payments with a combined value of approximately £19.7 million. Most of the breaches occurred between February and November 2022, following the introduction of extensive UK financial sanctions against Russia after the invasion of Ukraine. However, the regulatory findings also cover failures that continued into 2025, demonstrating that the deficiencies were not confined to the initial period of sanctions implementation.

OFSI concluded that there was no evidence that Citibank intentionally sought to circumvent UK sanctions. Instead, the breaches resulted from a combination of system weaknesses, operational errors, inadequate escalation and shortcomings in the handling of sanctions alerts across different parts of the organisation.

The regulator nevertheless determined that the collective failures were sufficiently serious to warrant a substantial financial penalty.

Citibank's London operation had significant exposure to Russian-related activity when the sanctions regime expanded dramatically in 2022. The branch maintained relationships with Russian clients, provided correspondent banking services involving Russian financial institutions and processed transactions associated with the bank's Russian affiliate.

That exposure created a particularly challenging environment when sanctions were introduced and repeatedly expanded at speed. OFSI recognised the operational pressure placed on firms with substantial Russian exposure, but stressed that the circumstances did not remove the requirement to maintain effective sanctions controls.

The investigation identified transactions involving several designated Russian entities, including state-owned shipping company PJSC Sovcomflot and sanctioned financial institutions such as Alfa-Bank, PJSC Gazprombank and Credit Bank of Moscow.

One of the most significant failures involved Citibank's inability to correctly identify Sovcomflot because of differences in how the company's name appeared in the bank's systems compared with the information contained on the sanctions list.

That issue resulted in 328 payments worth approximately £5.4 million being processed when they should have been blocked or otherwise subjected to appropriate sanctions controls.

The case illustrates a fundamental challenge in sanctions screening: effective controls cannot depend solely on exact name matching.

Sanctioned entities may appear in internal banking systems under different naming conventions, abbreviations, corporate prefixes, transliterations or other variations. A screening system that fails to recognise those differences can generate false negatives, allowing prohibited transactions to proceed without an alert.

The Sovcomflot issue therefore raises broader questions about the quality of sanctions-screening technology, the configuration of matching rules and the extent to which financial institutions test their systems against real-world variations in customer and counterparty data.

The investigation also identified failures involving accounts held by companies owned or controlled by a designated Russian individual.

Citibank failed to promptly restrict 24 accounts belonging to 11 such companies. During the period in which the accounts should have been subject to restrictions, the bank processed 242 payments worth approximately £5.9 million from those accounts and two additional payments exceeding £600,000 to a company owned by the designated individual.

This demonstrates that sanctions compliance extends beyond screening individual payments.

Once a person is designated, institutions must consider the entities and assets that fall within the relevant ownership and control provisions. Identifying a sanctioned individual is therefore only one part of the process; firms must also establish whether companies or other structures are owned or controlled by that person and whether associated accounts require restrictions.

Ownership and control analysis can be particularly challenging where corporate structures span multiple jurisdictions or involve indirect ownership arrangements.

The Citibank case also highlights the importance of maintaining accurate information about customers and counterparties after onboarding. Even where a customer was legitimately onboarded before becoming sanctioned, the institution must be able to identify subsequent changes in status and apply the appropriate restrictions without delay.

Another significant weakness concerned the reporting of frozen assets to OFSI.

Citibank failed to submit frozen-asset reports promptly in 53 cases. The average delay between the bank having reasonable cause to suspect that it held frozen funds belonging to a designated person and submitting the corresponding report was 274 days. In every one of those cases, the reporting delay exceeded six weeks.

This aspect of the enforcement action is particularly important because sanctions compliance does not end when an institution prevents a prohibited payment.

Where UK sanctions legislation requires frozen assets to be reported, firms must also have processes capable of ensuring that those reports are made within the applicable timeframe.

A bank can therefore have multiple sanctions-control obligations operating simultaneously: detecting the designated party, freezing the relevant assets, preventing further dealings, maintaining appropriate records and notifying the regulator where required.

Weakness in any one of those stages can create regulatory exposure.

The investigation further identified problems with the handling of sanctions alerts. Separate alert-management failures resulted in nine payments worth approximately £500,000 being processed between March 2022 and February 2025.

The errors included applying guidance intended for a different type of restriction, issuing contradictory instructions, misunderstanding the scope of a licence and incorrectly identifying the role of a designated institution.

These findings demonstrate that sanctions compliance is not simply a technology problem.

Even where a screening system successfully generates an alert, the subsequent investigation must be handled correctly. Compliance personnel need sufficient knowledge of the relevant sanctions regime, clear procedures, appropriate escalation channels and access to accurate information.

An alert that is correctly generated but incorrectly resolved can ultimately create the same regulatory risk as an alert that was never generated.

This is particularly important in complex financial transactions involving correspondent banking, payment agents, intermediaries or multiple financial institutions.

The more parties involved in a transaction, the more difficult it can become to establish exactly who is sending funds, who is receiving them, who ultimately benefits and whether a sanctions restriction applies to any participant.

Citibank's London branch was operating in precisely this type of environment, with significant Russian-related correspondent and cross-border activity.

The case also demonstrates the consequences of operational pressure.

The majority of the breaches occurred shortly after Russia's invasion of Ukraine, when financial institutions had to implement extensive new sanctions measures within a very short period. OFSI acknowledged that the speed and scale of the regulatory changes placed substantial pressure on firms.

Nevertheless, the regulator's decision makes clear that high operational workload cannot justify material control failures.

For compliance departments, this creates an important lesson about capacity planning. When sanctions regimes change rapidly, institutions must be able to increase staffing, review screening configurations, update procedures, test controls and ensure that alerts are investigated promptly.

A sanctions programme that works under normal operating conditions may not remain effective when transaction volumes suddenly increase and new restrictions are introduced.

The Citibank penalty also demonstrates the importance of governance across different business lines.

OFSI found failures across a wide range of business areas and systems rather than identifying a single isolated technical problem. This suggests that sanctions compliance must be managed as an enterprise-wide control rather than being delegated exclusively to a specialist compliance team.

Front-office personnel, operations teams, payments staff, technology specialists, legal departments and compliance professionals may all play a role in preventing sanctions breaches.

Where responsibilities are fragmented, there is a risk that one team assumes another department has addressed a potential sanctions issue.

Clear ownership and escalation procedures are therefore essential.

The case is also relevant to the management of sanctions licences and exceptions. Where a transaction may be permissible under a specific licence or exemption, staff need to understand precisely what the authorisation permits.

Misunderstanding the scope of a licence can result in transactions being processed outside the legal permission granted by the regulator.

This requires institutions to maintain accurate and accessible records of applicable licences, conditions and expiration dates, while ensuring that employees understand how those authorisations should be applied.

The enforcement action comes at a time when UK authorities are increasing pressure on businesses to strengthen sanctions compliance and combat sanctions evasion.

The UK has recently increased the maximum financial penalty for sanctions breaches from 50% of the value of the breach to the full value, reflecting a broader move toward stronger enforcement. Authorities have also intensified efforts to identify networks facilitating sanctions evasion and the movement of funds through third countries.

Against that background, the Citibank case sends a particularly important message to large international financial institutions.

Size and sophistication do not eliminate sanctions risk.

A major global bank may have extensive screening technology, large compliance teams and significant financial resources, yet still be exposed to breaches if systems are not configured correctly, alerts are not handled consistently or information is not escalated effectively.

The case therefore provides a useful illustration of the difference between having sanctions controls and having effective sanctions controls.

A written sanctions policy is not sufficient by itself. Institutions need to demonstrate that the policy is embedded into operational systems and that controls function effectively in practice.

This includes regular testing of sanctions-screening systems, validation of name-matching logic, review of false-negative risks, testing of ownership and control assessments and monitoring of alert-resolution quality.

Independent testing can also play an important role in identifying weaknesses that internal teams may overlook.

The Citibank case highlights the need to test not only whether an alert is generated but also what happens afterwards. Compliance teams should examine whether alerts are investigated within appropriate timeframes, whether decisions are properly documented and whether escalation takes place when the facts are uncertain.

Management information should also allow senior executives and boards to understand the scale and nature of sanctions risk.

Metrics such as alert volumes, investigation times, overdue cases, blocked transactions, reporting delays, system exceptions and unresolved data-quality issues can provide valuable indicators of whether the sanctions programme is operating effectively.

The frozen-asset reporting failures in this case illustrate why such metrics matter.

A reporting obligation can be missed even after an institution has correctly identified a sanctioned party and frozen the relevant assets. Without dedicated monitoring of reporting deadlines, the compliance process can fail at the final stage.

For financial institutions operating across multiple jurisdictions, another challenge is the interaction between different sanctions regimes.

A transaction may be permitted under one jurisdiction's rules but prohibited under another. International banks therefore need to understand which legal regime applies to a particular transaction and how their global policies interact with local requirements.

This becomes especially complex when payments involve Russia-related counterparties, intermediary banks or entities in third countries.

The Citibank penalty demonstrates that sanctions risk can arise from relatively small data or process discrepancies that have significant consequences when repeated across hundreds of transactions.

A single naming mismatch may appear operationally minor. But when the mismatch prevents a sanctions alert from being generated across hundreds of payments, the aggregate exposure becomes material.

The same principle applies to ownership information, payment instructions and customer records.

Small data-quality weaknesses can become significant regulatory problems when they occur repeatedly across high-volume financial systems.

Citibank cooperated with OFSI during the investigation and voluntarily disclosed most of the breaches. The bank has also indicated that it continues to invest in strengthening its global sanctions compliance framework.

Cooperation and voluntary disclosure can be relevant factors in regulatory enforcement, but the case demonstrates that they do not necessarily eliminate the possibility of a substantial penalty where the underlying failures are considered material.

The £4.73 million sanction is one of OFSI's largest penalties and represents a significant escalation in enforcement against a major international bank.

For the wider financial sector, the case reinforces several fundamental principles.

Sanctions lists must be implemented accurately and dynamically. Screening systems must be capable of identifying meaningful variations in names and corporate information. Ownership and control must be assessed rather than relying exclusively on direct name matches. Alerts must be investigated by appropriately trained personnel. Licences and exemptions must be understood and applied correctly. Frozen assets must be reported within the required timeframe.

Most importantly, these controls must operate together as part of a coherent sanctions compliance framework.

The Citibank case ultimately demonstrates that sanctions compliance failures rarely result from a single weakness. They can emerge from the interaction between technology, data, people, procedures and governance.

For banks with significant exposure to high-risk jurisdictions or complex cross-border payment flows, the lesson is clear: sanctions controls need to be continuously tested, challenged and adapted as regulatory requirements and financial risks evolve.

The scale of the Citibank penalty shows that regulators are prepared to hold even the world's largest financial institutions accountable when those controls fail to prevent sanctioned funds from moving through the financial system.

By fLEXI tEAM