Sanctions Compliance for Businesses in the UK: Screening, Re-Export Controls and Best-Efforts Obligations

Businesses operating in the United Kingdom face a layered sanctions compliance environment shaped by the UK's own autonomous regime administered by the Office of Financial Sanctions Implementation (OFSI) and His Majesty's Treasury, supplemented by export controls enforced by the Export Control Joint Unit (ECJU). Since the UK's departure from the European Union, the UK regime and EU sanctions – including the most recent 20th and 21st packages targeting Russia – no longer apply automatically in Britain, yet UK firms with EU subsidiaries, EU counterparties or EU-routed transactions remain subject to both simultaneously. Understanding where these regimes overlap, and where they diverge, is the starting point for any credible compliance programme.

The Legal Landscape: UK Autonomous Regime and EU Parallel Obligations

The primary UK legal basis for financial sanctions is the Sanctions and Anti-Money Laundering Act 2018 (SAMLA), under which Treasury designates individuals and entities and imposes asset freezes and prohibitions. OFSI is the competent authority for financial sanctions licensing, enforcement and civil monetary penalties. The ECJU administers export and trade controls under the Export Control Order 2008, including the critical controls on dual-use goods, military items and, increasingly, common high-priority items identified in the Russia context.

For UK groups that also operate in the European Union, EU sanctions remain directly binding on their EU-established entities and on transactions that touch EU jurisdiction. The EU 20th sanctions package, adopted on 23 April 2026, extended the scope of prohibitions and introduced a ban on transactions involving the digital rouble and the RUBx instrument, effective from 24 May 2026. The EU 21st package, adopted on 23 July 2026 as Council Regulation (EU) 2026/1848, covers energy, financial services and crypto-asset activities. A ban on Russian LNG imports applied from 25 April 2026 for most contracts, with long-term contracts concluded before 17 June 2025 benefiting from a phased transition until 1 January 2027. The EU divestment derogation for Russia exits has been extended to 31 December 2026. UK firms with EU affiliates must ensure these measures are reflected in group-wide policies, not treated as a purely continental concern.

Sanctions Screening: Obligations, Systems and Gaps

UK law does not prescribe a single screening methodology, but OFSI guidance and FCA expectations for regulated firms establish that screening must be risk-based, documented and current. At a minimum, a compliant screening programme should address the following elements:

• Counterparty screening against the UK Consolidated List, the OFSI financial sanctions list and, where relevant, the EU Consolidated List and OFAC SDN list.
• Ownership and control analysis: a 50% or more ownership threshold is applied in the UK regime to determine whether an entity owned by a designated person is itself subject to the asset freeze, without needing separate designation.
• Vessel and cargo screening for trade finance, insurance and commodity transactions – the Russia shadow fleet remains a high-risk area under both UK and EU guidance.
• Ongoing monitoring: screening at onboarding is insufficient. Counterparty status can change; new designations are published without advance notice.
• Companies House checks: UK corporate registrations can surface beneficial ownership information relevant to sanctions exposure, particularly where Russian or Belarusian nationals appear in the chain of control.

A recurring error by foreign clients is treating static, onboarding-only screening as sufficient. OFSI enforcement decisions have consistently highlighted failure to screen at the time of a transaction – not just at client take-on – as a factor in liability findings. Regulated firms additionally face FCA supervisory scrutiny of their sanctions frameworks as part of the broader financial crime controls review.

If your current screening programme has not been reviewed in light of the 2026 package updates, Ferraz & Whitmore can assist with a compliance gap analysis. Reach us at info@ferrazwhitmore.com or through our contacts page.

Re-Export Controls and Common High-Priority Items

Re-export controls represent one of the most operationally complex areas for UK businesses. The UK maintains its own list of controlled goods and technologies under the Export Control Order 2008, and the ECJU issues Standard Individual Export Licences (SIELs), Open Individual Export Licences (OIELs) and Open General Export Licences (OGELs) depending on the nature of the goods and destination.

Since 2022, the UK has progressively expanded controls on goods that could reach Russia or Belarus through third-country intermediaries. Common high-priority items – electronics, machine tools, bearings and components with dual-use potential – are subject to heightened scrutiny regardless of whether the declared end-user is in a sanctioned jurisdiction. The key compliance questions are:

• Is the item listed under Schedule 2 or Schedule 3 of the Export Control Order, or on the UK Strategic Export Control Lists?
• What is the actual end-use and end-user, and does the transaction pattern suggest diversion risk (for example, export to a jurisdiction frequently identified as a transit route)?
• Does the transaction trigger any of the items-of-concern flags published in ECJU and OFSI joint guidance on circumvention?

UK businesses exporting to or through countries that have been publicly associated with sanctions circumvention risk must apply enhanced due diligence, document their analysis and, where doubt remains, seek ECJU pre-licence advice before proceeding.

Where a UK business has a parallel operation in the Netherlands or another EU member state, the applicable EU export control regulation and the interplay with the 21st package measures will also need to be considered. Our Netherlands sanctions and trade practice can assist with that cross-border dimension.

Best-Efforts Obligations: What They Require in Practice

The concept of a "best-efforts obligation" appears in both EU and UK sanctions contexts in relation to the conduct expected of businesses when they cannot obtain full certainty about a counterparty's status or a transaction's ultimate destination. Under UK law, the obligation is not expressed as a statutory term of art in the same way as some EU provisions, but it has a functional equivalent: OFSI and courts expect that businesses take all reasonable steps proportionate to the risk, document those steps, and act promptly when red flags arise.

In practice, a best-efforts framework for a UK business should include:

• Red-flag identification protocols: formal written checklists capturing indicators such as unusual payment routes, requests to omit end-use information, cash-equivalent instruments or routing through non-obvious intermediaries.
• Escalation procedures: clear internal lines from front-office personnel to compliance and legal, with documented sign-off requirements for transactions above defined risk thresholds.
• Record retention: OFSI expects records to be kept that would allow reconstruction of the compliance decision. Standard commercial practice suggests a minimum of five years, aligned with AML record-keeping requirements.
• Voluntary disclosure: where a business discovers a potential breach, prompt voluntary disclosure to OFSI is a material mitigating factor. The timing and content of disclosure affect how OFSI exercises its civil penalty discretion.

UK High Court proceedings in sanctions-related disputes have addressed the standard of conduct expected of sophisticated commercial counterparties, reinforcing that reliance on counterparty representations alone is not sufficient where the circumstances objectively called for further inquiry.

Step-by-Step Compliance Procedure for UK Businesses

The following sequence reflects current UK market practice for establishing or updating a sanctions compliance programme:

• Step 1 – Risk assessment: map the business's exposure by geography, product, counterparty type and transaction channel. Identify which regulatory regimes apply (UK, EU, US) given the business's structure and transaction flows.
• Step 2 – Policy and procedure drafting: prepare or update a sanctions policy aligned with OFSI guidance, FCA expectations (for regulated firms) and, where relevant, EU obligations applicable to group entities.
• Step 3 – System configuration: configure or procure screening tools with appropriate match-rate thresholds; test against known-positive entries on the UK Consolidated List.
• Step 4 – Training: deliver documented training to client-facing, operations and finance staff. Training records should be retained and refreshed at least annually or after major regulatory developments.
• Step 5 – Licensing and derogation review: identify transactions that may require an OFSI licence or ECJU export licence and initiate applications early. Licensing timelines vary; OFSI does not publish binding turnaround commitments for all licence types.
• Step 6 – Ongoing monitoring and testing: conduct periodic testing of screening effectiveness, internal audit reviews and, where the risk profile justifies it, independent external review.
• Step 7 – Incident response: maintain a documented incident response plan that addresses discovery of a potential breach, including voluntary disclosure assessment, legal privilege considerations and interaction with insurers.

Common Errors by Foreign Clients and Cross-Border Pitfalls

Foreign businesses establishing a UK presence or transacting with UK counterparties frequently encounter the following compliance failures:

• Assuming that compliance with their home jurisdiction's sanctions regime (including EU sanctions) is sufficient to discharge UK obligations. The UK and EU lists are broadly aligned on Russia measures but are not identical, and divergence has increased with each package update.
• Overlooking the asset freeze implications of the 50% ownership rule when dealing with corporate groups where a designated person holds a majority interest, even indirectly.
• Treating the EU divestment derogation extended to 31 December 2026 as automatically applicable in a UK context. UK licences must be obtained separately from OFSI where the transaction involves UK-nexus assets or parties.
• Failing to account for the digital rouble and RUBx transaction ban (effective EU-wide from 24 May 2026) when structuring payments involving EU financial intermediaries, while simultaneously assuming UK payment channels are unaffected.
• Inadequate supply chain due diligence for goods with potential dual-use applications, particularly where the distribution chain passes through jurisdictions associated with sanctions circumvention.

Cross-border compliance questions benefit from coordinated advice across jurisdictions. Our UK sanctions and trade practice works alongside our teams in other European jurisdictions to provide an integrated view. Contact us at info@ferrazwhitmore.com or visit our contacts page to arrange an initial discussion.

Realistic Timelines and Cost Drivers

There is no single timeline for sanctions compliance, as the scope of work depends heavily on the size of the business, the complexity of its transaction flows and the maturity of existing controls. As a general indication of what UK businesses and their advisers typically encounter:

• OFSI licence applications: turnaround times are not fixed but processing can take several weeks to several months depending on the licence type and complexity. Planning ahead is essential, particularly for time-sensitive transactions involving the Russia divestment derogation, which runs only until 31 December 2026.
• ECJU export licence applications: standard SIELs typically take longer to process when they involve higher-risk destinations or goods; ECJU publishes processing time data that should be consulted at the outset of the application.
• Programme build or remediation: establishing a new compliance framework from scratch in a mid-sized business typically requires several months of internal and external resource. Remediation of an existing programme following an OFSI review may be required on a shorter timeline.

Key cost drivers include the complexity of screening system procurement or configuration, the volume of counterparties requiring enhanced due diligence, the need for specialist legal advice on licensing, and the cost of any external audit or testing engagement.

Decision Checklist Before Proceeding with a Transaction

Before proceeding with any transaction that carries potential sanctions exposure, a UK business should be able to answer affirmatively to the following questions:

• Has the counterparty been screened against the UK Consolidated List, and is there no match or has any match been resolved?
• Has the ownership and control chain been reviewed to assess whether the 50% rule could bring the counterparty within the scope of an asset freeze?
• For goods transactions: have export control classification and end-user due diligence been completed?
• Has the transaction been assessed for circumvention risk, including routing through third-country intermediaries?
• Where the group has EU-established entities: do the EU 20th or 21st package prohibitions (including the digital rouble ban effective 24 May 2026, or the LNG import prohibition effective 25 April 2026) apply to any element of the transaction?
• Is a licence required, and if so, has the application been submitted with sufficient lead time?
• Has the compliance decision been documented and approved at the appropriate level?

If you are unsure whether a specific transaction or counterparty falls within the scope of UK or EU sanctions, our team can provide a focused assessment. Write to us at info@ferrazwhitmore.com or use our contacts page to describe your situation.

Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.