The Bank of Scotland OFSI Penalty and Compliance Lessons
On 10 November 2025, the Office of Financial Sanctions Implementation imposed a £160,000 monetary penalty on Bank of Scotland for breaching the United Kingdom’s Russia financial sanctions regime. The penalty was published by OFSI on 26 January 2026 and highlights key sanctions screening and escalation failures within the bank’s controls.
This enforcement action reinforces the importance of robust sanctions compliance systems, effective screening logic, and timely escalation processes. It also illustrates how even seemingly minor errors can lead to prohibited transactions and regulatory action.
What Happened
OFSI found that between 8 February and 24 February 2023, Bank of Scotland processed 24 payments totalling approximately £77,383 to and from a personal current account held by an individual designated under UK Russia sanctions.
The breach arose because the individual opened an account using a UK passport with a spelling variation of their name compared with the UK sanctions list, allowing the bank’s automated sanctions screening system to miss the match. The discrepancies included character changes typical of transliteration differences and a missing middle name, preventing the system from flagging a potential sanctions hit.
The account was eventually recognised as belonging to a designated person through a politically exposed person (PEP) alert and adverse media review, but this identification did not immediately stop the account’s activity until 24 February 2023.
Regulatory Findings and Legal Basis
OFSI concluded that the bank breached the Russia (Sanctions) (EU Exit) Regulations 2019, including prohibitions on “dealing with funds” and “making funds available” to a designated person. The penalty notice detailed that the bank’s sanctions screening capabilities and escalation frameworks did not adequately identify and address the risk presented by the account and related transactions.
Voluntary Disclosure and Penalty Calculation
Bank of Scotland’s parent, Lloyds Banking Group, voluntarily disclosed the breach to OFSI in March 2023, shortly after discovering it. This voluntary disclosure made the bank eligible for a 50% discount on the penalty under OFSI’s guidance. As a result, the final penalty was reduced from an initial £175,000 to £160,000.
Bank of Scotland’s Response
In response to the enforcement action, a spokesperson for Lloyds Banking Group stated that the group “takes its regulatory responsibilities extremely seriously.” The bank emphasised that:
• It acted swiftly and transparently, voluntarily reporting the isolated breach to OFSI.
• It worked closely with the regulator throughout the process.
• It has since strengthened its sanctions screening and compliance controls to reduce the likelihood of similar breaches going undetected.
These comments reflect a broader trend in enforcement where institutions publicly commit to remediation and control enhancements following sanctions breaches.
Compliance Program Lessons
This case reinforces practical sanctions compliance imperatives:
Sanctions Screening Effectiveness
Ensure screening systems can reconcile transliteration and name variation issues, especially for high-risk jurisdictions and individuals.
Escalation Processes
Clear escalation pathways must exist so that alerts generated by PEP or adverse media screening are promptly evaluated for sanctions relevance.
Training and Awareness
Frontline staff and compliance teams need up-to-date training that reflects current geopolitical risks and sanctions landscapes. OFSI noted that some training at the time of the breach was outdated and did not consider contemporary Russia sanctions risk.
Voluntary Self-Reporting
Prompt voluntary disclosure can materially reduce penalties and demonstrates a proactive compliance culture.
