Sanctions Disclosure Now Has a Price List

The Office of Financial Sanctions Implementation updated its enforcement and monetary penalties guidance on 9 February 2026, eleven days after publishing the response to its consultation on civil enforcement. The part worth reading is not the ceiling. It is that the reduction available for talking to OFSI is now broken into three named components, each carrying its own percentage and its own clock.

The three components

Voluntary Disclosure and Co-operation, up to 30 per cent. The guidance removes the characterisation of a disclosure as voluntary in three situations: where OFSI has required or requested information about the breach; where the subject was prompted to disclose because OFSI is already aware of the case; and where the subject was prompted or required in law to disclose because of a separate law enforcement or regulatory investigation. Promptness runs from discovery — OFSI expects a breach to be disclosed as soon as reasonably practicable after it is discovered.

Read those exclusions together and the discount is not paid for candour. It is paid for sequence. Thirty per cent turns on arriving ahead of the regulator's own knowledge rather than ahead of another party. The guidance says in terms that the mere fact another party disclosed first will not necessarily make a later disclosure less valuable, and that OFSI expects disclosure from each party to a breach. What forfeits the discount is disclosing once OFSI is already aware of the case, and which side of that line a firm sits on is settled long before anyone reads the regulation.

The Early Account Scheme, up to 20 per cent. New in this guidance, and open to legal persons only; individuals cannot use it. OFSI will not offer it — the subject must request it. Where OFSI notifies a subject that it is under investigation, the notice invites the subject to say within fifteen business days whether it wishes to provide an early account, and that account must be comprehensive, factual and supported by all relevant materials and evidence.

Settlement, 20 per cent. The negotiation is time-limited, usually thirty business days. What is surrendered in exchange are the right to seek a review by a minister and the right to appeal to the Upper Tribunal. Representations are not surrendered: the settlement period runs for thirty business days in parallel with the statutory representations period under section 147 of the Policing and Crime Act 2017. OFSI has said it will not settle on the basis of anonymising the subject's identity.

Where two or more discounts apply, the guidance adds them together before applying them to the baseline. Their stated maxima sum to seventy per cent. OFSI does not itself publish an aggregate maximum, and the only worked example in the guidance combines two of the three, for fifty.

What is actually being priced

Not intent. Not remediation, which is not a case factor at all: the factors run from circumvention, value, strategic priority and harm through intention, awareness and management of risk, ownership and control, and repetition. Remediation feeds the co-operation half of the thirty per cent instead. Each of the three is a property of a firm's own information rather than of its conduct.

The first prices the gap between the moment a breach becomes discoverable inside an organisation and the moment it reaches the regulator. The second prices the ability to declare, within fifteen business days of being notified, that a complete evidenced account can be produced at all — and then to produce it inside a scope and a delivery date agreed with the regulator, usually no longer than six months from the date those terms are agreed. The third prices a willingness to stop contesting.

The first two are monitoring questions before they are legal ones, answered by whether transaction and ownership records were kept in a state that permits reconstruction — a decision taken years earlier, when nothing appeared to turn on it.

The base against which they apply

The guidance also replaces the old two-way split between serious and most serious with four levels. Level 1 is likely to be dealt with by a private warning letter absent significant aggravating factors; Level 2 by publication without a monetary penalty. Level 3 carries a baseline of up to 75 per cent of the statutory maximum. Level 4 baselines are likely to be set between 75 and 100 per cent, and Level 4 cases may be referred for criminal investigation in the first instance.

That last clause is where the ladder stops. The discounts are the price of a civil resolution, and at the top of the matrix a civil resolution is not necessarily on offer.

The statutory maximum is unchanged: the greater of £1,000,000 and 50 per cent of the estimated value of the funds or economic resources concerned. OFSI announced on 29 January 2026 that it intends to double it. That change requires legislation and had not been made when this was written.

The direction is legible. Under the guidance in force before 9 February 2026, prompt and complete voluntary disclosure attracted up to 50 per cent in a case assessed as serious and up to 30 per cent in a case assessed as most serious; those figures are recited in the penalty notices themselves. The headline disclosure discount has fallen from fifty to thirty, and the twenty points removed have been repriced and sold back in two instalments, each conditional on a deadline.

What the first settled cases record

Three monetary penalties were imposed by way of settlement between March and May 2026.

On 19 March 2026 OFSI imposed a penalty of £390,000 on Apple Distribution International Limited for breaches of regulation 12 of the Russia (Sanctions) (EU Exit) Regulations 2019. The total breach value was £635,618.75, the permitted statutory maximum £1,000,000, the baseline penalty £600,000 and the discount 35 per cent. The notice records it as the first OFSI case resolved by settlement.

On 30 April 2026 OFSI imposed a penalty of £165,000.00 on Deutsche Bank AG London Branch, also under regulation 12, on the same breach value of £635,618.75. The baseline was £300,000 and the discount 45 per cent. The procedural sequence is the instructive part: notice of intention on 12 September 2025, representations on 22 October, OFSI upholding its decision on 2 December, a request for a ministerial review on 23 January 2026, the new framework arriving on 9 February, formal settlement discussions from 4 March, agreement on 30 April.

On 26 May 2026 OFSI imposed a penalty of £1,000,920.59 on Sabre Global Technologies Limited for breaches of regulations 13, 14 and 19. The total breach value was assessed at £2,634,001.54, which set the permitted statutory maximum at £1,317,000.77. The baseline was £1,251,150.73, a little under 95 per cent of that maximum; the case was assessed as most serious; the discount was 20 per cent.

One qualification most summaries leave out. None of the three was assessed under the new four-level matrix; all three notices say so expressly, recording that OFSI applied the guidance in place when the decision to issue notice was taken, which was the November 2024 version. All three entered settlement under transitional arrangements. The price list published on 9 February 2026 has not yet priced a case from beginning to end.

Two adjacent records belong in the frame. On 29 June 2026 HM Revenue and Customs published Notice to Exporters 2026/15, recording a compound settlement of £569,157.07 with Petrofac Facilities Management Limited for breaches of regulations 46Y(2)(c) and 46Z(1)(b) of the same Russia Regulations, following a voluntary disclosure. Different body, different regime, different instrument — and the same governing variable.

On 28 May 2026 the Financial Conduct Authority published findings from assessments of more than 150 supervised firms. Assets reported frozen in the United Kingdom rose from £24.4bn in 2023-24 to £37bn in 2024-25. The most common root causes of reported breaches were weaknesses in due diligence, alert management, transaction and name screening, and the management of frozen assets and of licences. The average interval between identifying a breach and reporting it was 116 days in 2025, against 120 days in 2024.

Set that average against the standard the framework applies — disclosure as soon as reasonably practicable after discovery — and the distance between the two is the exposure. The discount is up to thirty per cent, with partial credit expressly available, so what a long interval buys is not forfeiture but a smaller number.

What the framework does not contain

There is no corporate failure-to-prevent-sanctions offence. The offence created by section 199 of the Economic Crime and Corporate Transparency Act 2023 is confined to the fraud offences listed in Schedule 13 to that Act. The two are not the same instrument and should not be read as one.

And nothing here prices the decision not to disclose. The framework prices speed, completeness and acquiescence. It is silent, as an enforcement guidance document has to be, on the anterior question of whether a reportable breach has occurred — a legal question, answered against particular facts, which no monitoring system answers.

The framework is a calendar and a tariff. It does not tell a reader whether an obligation to report has arisen, what to disclose, or whether to surrender a review. Those are questions for counsel in each relevant territory, and an institution or a principal weighing them should take advice from an adviser unrelated to Privy Consul. Nothing here is legal advice.

Establishing ownership and control before a relationship opens sits under KYC & Enhanced Due Diligence; reconstructing what passed through afterwards under Corporate Intelligence & Investigations Group; the decision structure around a live matter under Crisis Advisory & Stabilisation.