OFSI, OFAC and EU Sanctions: A Side-by-Side Enforcement Map
OFSI, OFAC and the EU: Three Sanctions Regimes, Three Operating Models
Of the three major Western sanctions regimes, only one — the United States' Office of Foreign Assets Control — has a multi-decade enforcement history producing consistent eight- and nine-figure penalties. The UK's Office of Financial Sanctions Implementation rebuilt its enforcement toolkit dramatically after 2022 and has, as of May 2026, an active penalty pipeline that includes major financial institutions and global technology firms. The EU's sanctions enforcement remains the most architecturally fragmented of the three, with policy-setting at the Council level but enforcement at member-state level. For firms with cross-border exposure, the asymmetries between these three regimes matter for both compliance design and incident response.
The Three Regimes at a Glance
| Feature | OFAC (US) | OFSI (UK) | EU |
|---|---|---|---|
| ------- | --------- | --------- | -- |
| Established | 1950 (Treasury Dept) | 2016 (HM Treasury) | Council Regulations + 27 national authorities |
| Annual enforcement volume | ~$1bn+ in typical year | Growing rapidly post-2022 | Fragmented, member-state-led |
| Highest profile recent action | TD Bank Group $1.3bn (Oct 2024) | Deutsche Bank AG London Branch (May 2026); Apple Distribution International (Mar 2026) | EU 20th sanctions package on Russia (Apr 2026) |
| Strategic direction | Continued aggressive enforcement | OFSI Strategy 2026-2029 (Apr 2026) | 20+ Russia sanctions packages since 2022; sanctions evasion focus |
| Penalty type | Civil monetary penalty (settlement or admin) | Civil monetary penalty (s.146 Policing and Crime Act 2017) | Member-state enforcement varies (criminal or admin) |
| Penalty ceiling | No fixed cap; multiples of transaction value | Maximum of £1m or 50% of value of breach, whichever is higher | Varies by member state |
OFAC: The Established Enforcer
OFAC has the deepest enforcement record of the three. Its civil-penalty programme has produced consistent nine-figure settlements across the banking, technology, and shipping sectors for over two decades. The TD Bank Group settlement of approximately $1.3bn in October 2024 — for AML and sanctions-related failings — is the largest single sanctions-related action of the recent period and illustrates the OFAC pattern: comprehensive settlements that combine sanctions, AML, and BSA components, typically negotiated with the Department of Justice as a coordinated outcome.
Three features of the OFAC approach matter for compliance teams. First, the agency's settlement guidelines reward voluntary self-disclosure heavily — discounts of 50% or more are typical for cooperative disclosures, which makes pre-emptive engagement strategically important. Second, OFAC publishes detailed Settlement Agreements that name specific facts and circumstances, creating a body of precedent that shapes industry practice. Third, the agency operates a 50-year statute of limitations on civil penalties for sanctions violations — a recent change extended from 5 years to 10 years for most matters, giving OFAC unusually long latitude on stale conduct.
OFSI: Rebuilding Post-2022
OFSI was established in 2016 and operated as a relatively low-profile enforcement function until Russia's invasion of Ukraine in February 2022 made UK financial sanctions enforcement geopolitically central. Since then, OFSI's enforcement toolkit, public profile, and operational capacity have all expanded materially.
The OFSI Strategy 2026-2029 (published 15 April 2026) sets out the regulator's direction for the next three years. Key signals include continued investment in monetary-penalty enforcement capacity, expansion of sector-specific guidance (the 12 May 2026 publications on Art Market Participants and High Value Goods are recent examples), and a clear statement that OFSI intends to use its full toolkit including civil monetary penalties, disclosure notices, and licensing decisions.
Two recent OFSI monetary penalties illustrate the current direction:
- Deutsche Bank AG London Branch — Notice of imposition of monetary penalty published 19 May 2026. The Deutsche Bank case is significant because it brings a global tier-1 financial institution into OFSI's enforcement record at a recognisable scale, signalling that the regulator is willing to act against firms of substantial size.
- Apple Distribution International Limited — Notice of imposition of monetary penalty published 30 March 2026. The Apple case extends OFSI's enforcement reach beyond financial services to global technology distributors, reflecting the breadth of sanctions exposure for any firm handling international payments or product flows.
The EU: Fragmented Enforcement, Coordinated Policy
The European Union's sanctions regime operates with a sharper policy-enforcement split than either OFAC or OFSI. Council Regulations set sanctions designations and trade restrictions at the EU level — most visibly the twenty-plus packages of sanctions imposed on Russia since February 2022, with the 20th package adopted in April 2026 — but enforcement of these regulations is a matter for each member state's competent authorities.
This produces three operational realities for compliance teams. First, enforcement intensity varies materially by jurisdiction — Germany's BaFin, France's AMF, the Netherlands' DNB, and Ireland's CBI all have different supervisory postures on sanctions compliance, and a breach producing low enforcement risk in one member state may produce significant risk in another. Second, the EU's emphasis on sanctions evasion has intensified since 2024, with the UK and EU collaborating on enforcement against backdoor evasion routes (the UK Government's 26 May 2026 publication on Russian sanctions evasion crackdowns is a recent example of the cooperative framework). Third, the EU's coordination mechanism for criminal sanctions enforcement is still developing — the harmonisation directive adopted in 2024 began to take effect in 2025-2026, but in-practice criminal enforcement of EU sanctions violations remains uneven across the 27 member states.
Where the Three Regimes Overlap — and Where They Don't
For any firm with cross-border activity, the practical question is how exposure under one regime affects exposure under the others.
Overlap zones. Russia-related sanctions are the most consistently coordinated area: OFAC, OFSI, and EU designations significantly overlap, and a breach in one regime is likely to constitute a breach in the others. Iran-related sanctions have substantial overlap but with notable differences in oil-trade and licensing approaches. Counter-narcotics, counter-proliferation, and human-rights-related sanctions are coordinated through G7 mechanisms and tend to align.
Divergence zones. US secondary sanctions on Iran and on certain Russia-related petroleum trades have no direct UK or EU analogue and create exposure for non-US firms that would not exist under domestic-only sanctions analysis. UK humanitarian licensing under OFSI General Licences sometimes permits activity that remains constrained under EU national approaches. EU member-state-specific national security listings (notably Germany's) sometimes diverge from EU-level designations.
Disclosure asymmetry. OFAC's voluntary self-disclosure regime is the most generous of the three. OFSI's voluntary disclosure framework is materially less developed, though the 2026-2029 Strategy signals an intent to expand disclosure recognition. EU member-state approaches vary widely. The practical implication is that a firm discovering a multi-jurisdiction breach must sequence its disclosures carefully — a disclosure to OFAC that triggers a public Settlement Agreement can prejudice the same firm's position with OFSI or member-state authorities.
What This Means for Compliance Teams
For Heads of Compliance and MLROs at firms with cross-border activity: treat your sanctions-screening framework as a multi-regime system, not a single-source-of-truth system. The three regimes use overlapping but not identical designation lists, and the cost of getting the synthesis wrong has risen since 2022. Three operational priorities. (1) Maintain a single internal designation reference that integrates OFAC's SDN List, the UK Consolidated List, and the EU Sanctions Map — with documented daily synchronisation evidence. (2) Have a documented incident-response protocol that specifies the order in which you would engage OFAC, OFSI, and EU member-state authorities if you discovered a breach with multi-jurisdiction exposure. (3) Brief your senior managers on personal exposure under OFSI's UK Senior Managers regime and under analogous EU member-state frameworks.
For boards and NEDs: three questions for the next risk committee. (1) Have we mapped our material counterparty exposure against each of the three major sanctions regimes — and would we know within twenty-four hours if a designated entity entered our payment flows? (2) Do we have current Board-approved sanctions policies, refreshed since the OFSI Strategy 2026-2029 publication? (3) What is our defensible answer to "have we materially exceeded sanctions-related risk appetite in the past twelve months"?
For consultants and law firms: the cross-regime sanctions advisory market is significantly under-served relative to the actual operational risk. Firms have spent 2023-2025 building EU and UK sanctions capacity reactively in response to Russia-related obligations, and many of those frameworks were stood up at speed without integration testing across regimes. Practical engagements that combine cross-regime designation-mapping audits with simulated incident-response exercises are particularly valuable.
What's Coming Next
For OFAC: continued enforcement at scale through 2026 and 2027, with sustained focus on Russia-related secondary sanctions, China-related technology and financial controls, and AML-sanctions hybrid cases of the TD Bank type. Expect continued nine-figure outcomes for tier-1 financial institutions.
For OFSI: the 2026-2029 Strategy signals materially expanded enforcement capacity. The Deutsche Bank and Apple cases suggest the pipeline includes financial services and non-financial multinationals; readers should expect monetary penalty volume to grow steadily through 2026 and 2027, alongside continued sector-specific guidance development.
For the EU: continued sanctions packaging against Russia (each round adding designations and trade restrictions), gradual harmonisation of criminal enforcement under the 2024 directive, and growing focus on circumvention. Expect material member-state-level enforcement activity in Germany, France, and the Netherlands in particular.
For an interactive view of UK sanctions and broader regulatory enforcement, including the underlying record of OFSI monetary penalties and the broader UK enforcement landscape, explore our dashboard.