Overview
On July 31, 2025, HM Treasury’s Office of Financial Sanctions Implementation (“OFSI”) announced the imposition of a £300,000 monetary penalty to Markom Management Limited (“MML”), a UK-registered company, for breaching financial sanctions related to Russia’s annexation of Crimea. The penalty is the third largest OFSI civil monetary penalty to date and was imposed for a pre-Brexit sanctions breach under the 2014 Ukraine (European Union Financial Sanctions) (No. 2) Regulations (the “Ukraine Regulations”) involving a payment of £416,590.92 that MML instructed to be made to a UK designated person.
The MML penalty represents the twelfth use of OFSI’s civil monetary penalty powers since they were introduced under Part 8 of the Policing and Crime Act 2017 (“PACA”). The enforcement action is notable because it focuses on a business that facilitated a transaction to which it was not a principal party, and also because of the time taken to resolve the case, which relates to conduct occurring over seven years ago and under investigation by OFSI since June 2021. Several useful hints as to OFSI’s enforcement approach and compliance expectations for businesses required to comply with UK sanctions can be discerned from the MML case, which affected businesses should factor in to their UK sanctions compliance efforts. This enforcement action also serves as a reminder that even a single transaction in breach of UK financial sanctions can result in significant regulatory consequences.
The Breach
MML is a UK company that provides fiduciary, management, and accounting services to companies across various jurisdictions. At the time of the breach, MML was part of the Markom Group, which included Markom Management Cyprus (“MMC”), which provided comparable services to companies registered and operating in Cyprus.
In February 2018, an individual designated under the Ukraine Regulations made a payment to a Cypriot client of MMC (“Company A”) pursuant to a sale and purchase agreement. The funds were transferred between two accounts at Gazprombank, a non-EU bank in Moscow. MML was not involved in the transaction. The payment transaction was not prohibited under applicable sanctions.
However, MML’s senior management was informed the next day that the payment had included an overpayment of 33,000,000 Russian Rubles (equivalent to £416,590.02). While Company A was not a client of MML at that time, MML was notified of the overpayment because Company A was a former client and MML personnel remained in contact with persons on day-to-day matters for Company A due to their ability to communicate in Russian with Company A’s representative.
Acting on this information, MML instructed Gazprombank to transfer the overpaid amount from Company A’s account to the account of the designated person. When the transfer was executed, the overpayment repayment made funds directly available to the designated person in breach of the Ukraine Regulations. In its desire to make the payment quickly, MML did not appreciate the sanctions risk associated with the transaction.
The breach occurred prior to the imposition of strict civil liability for breaches of financial sanctions in June 2022, therefore, OFSI was required to satisfy on the balance of probabilities that MML knew or had reasonable cause to suspect that the payment would make funds available to a UK designated person, in contravention of the Ukraine Regulations.
OFSI’s Investigation and Penalty Decision
The breach was self-reported to OFSI in October 2018 after MML discovered it during an internal review prompted by third-party activity. OFSI did not commence a civil investigation until June 2021. In OFSI’s assessment, it found that MML had not voluntarily disclosed the breach in a way that would merit a voluntary disclosure discount.
Based on the value of the breach, the statutory maximum penalty available to OFSI for MML’s breach was £1,000,000. OFSI issued a Notice of Intention to impose a £400,000 civil monetary penalty to MML in August 2024. After considering MML’s written representations, OFSI reduced the final civil monetary penalty amount to £300,000. MML exercised its right to a ministerial review of the penalty decision, with the review upholding the penalty decision and its amount in June 2025.
OFSI’s Assessment of the Case
In assessing MML’s breach of UK financial sanctions, OFSI characterised the breach as “serious” as opposed to “most serious.” In assessing the case, OFSI considered the case factors set out in the May 2, 2024, version of its Enforcement and Monetary Penalties Guidance in assessing the severity of the case and conduct of MML.
OFSI identified a number of aggravating features to the case, as follows:
- High value breach - The funds of £416,590.02 returned to the designated were deemed high value;
- Harm or risk of harm to the sanction regime’s objectives - The designated person benefited financially from those responsible for the annexation of Crimea and destabilisation of Eastern Ukraine and so making funds available to that person undermined the effectiveness of the sanctions regime;
- Severity - Sanctions against Russia were a strategic UK foreign policy priority at the time of the breach;
- Intent, knowledge, reasonable cause to suspect - MML played an active role in the breach, instructing the payment with clear knowledge of the recipient’s identity. MML also demonstrated a disregard for sanctions compliance by failing to seek legal advice or verify its understanding of the application of sanctions to the transaction; and
- Knowledge of sanctions and compliance systems - Although MML had some sanctions policies in place, they were found to be inadequate as they did not cover the sanctions risks involved in the informal cross-border working practices that existed between MML and MMC that gave rise to the breach. MML also decided to prioritise speed over compliance.
These factors were weighed against several mitigating factors. OFSI considered the breach to be a one-off because MML took steps to improve its sanctions compliance after discovering the breach to avoid repeated failures. MML also submitted a materially complete initial disclosure and cooperated fully throughout OFSI’s investigation.
Key Takeaways
The MML enforcement action serves as a timely reminder of three important compliance lessons applicable to businesses that are required to comply with UK sanctions:
- Understanding exposure to sanctions risks and taking steps to address identified risks is essential. OFSI expects businesses of all sizes to assess their exposure to financial sanctions risk and educate themselves as to the impact of sanctions on their business activities, including by engaging with OFSI’s published guidance and seeking legal advice on their sanctions obligations when necessary.
- Sanctions policies and procedures need to be fit for purpose. Having sanctions policies and procedures in place will not necessarily be considered a mitigative factor by OFSI when assessing a breach if they do not appropriately address the sanctions risks that a business faces. In MML’s case, its sanctions compliance controls did not address the risks posed by its informal, transnational working practices.
- Sanctions compliance programmes should incorporate systems to promptly identify and report suspected sanctions breaches. Putting these systems in place increases the likelihood of businesses being able to take advantage of the potential civil monetary penalty discounts of up to 50% offered by OFSI for the voluntary disclosure of financial sanctions breaches.
The extended timelines involved in the investigation and resolution of the MML case also pick up on a number of key themes outlined in the consultation on the reform of OFSI’s enforcement policies and processes that was launched in July 2025. The consultation seeks to identify ways in which OFSI’s civil enforcement processes can be adjusted to deliver strong civil enforcement of financial sanctions breaches as swiftly, efficiently, and transparently as possible. If adopted in full, the proposed changes outlined in the consultation could have a potentially significant impact on businesses’ sanctions compliance efforts. The consultation period closes on October 13, 2025.
For more information on these developments and their implications for companies, contact the authors of this post, Alexandra Melia or Elliot Letts, in Steptoe’s Economic Sanctions team in London.
