A practical guide to OFSI sanctions enforcement for law firms: client money, third-party payments and legal fees

OFSI has overhauled its enforcement framework, and the Government intends to double the maximum civil penalty. This guide sets out what has changed, how the regime differs from AML, what recent cases show, and the steps COLPs and COFAs can take to test their controls.

This article reflects the position at 11 October 2026. Two developments could change parts of it: the legal services general licence discussed below expires on 28 October 2026, and the proposed increase in OFSI’s maximum penalty requires legislation that has not yet been passed. Firms should check GOV.UK for the current position before relying on any licence or figure quoted here.

The Office of Financial Sanctions Implementation (OFSI) is tightening how it enforces financial sanctions, and the Government intends to double the maximum civil penalty. For law firms, the practical question is whether their sanctions controls work when a difficult payment arrives, not whether a policy exists. This article sets out the background to the recent changes and the practical steps firms can take, and it can be used as a checklist when reviewing existing controls.

The exposure is not limited to firms with overseas clients or high-profile instructions. Receipts into client account, payments from third parties, requests to return funds elsewhere and the collection of legal fees can all put a firm at risk. COLPs, COFAs and managing partners need to be confident that the firm would spot the problem, escalate it and stop the transaction before it happens.

What OFSI has changed, and what it hasn’t yet

On 29 January 2026, OFSI published its response to a consultation on its civil enforcement processes. Updated enforcement and monetary penalties guidance followed on 9 February.

Several changes are already in effect:

• A four-level case assessment matrix, combining the seriousness of the breach with the conduct of the party involved.
• A settlement scheme offering a 20% discount on the baseline penalty. It runs to a short fixed window and requires the firm to give up its rights to ministerial review and appeal.
• An Early Account Scheme, offering a discount of up to 20% where an organisation gives OFSI a comprehensive early account of a breach, supported by evidence.
• A discount of up to 30% for voluntary disclosure and cooperation. The discounts can be combined, to a maximum reduction of 70%.
• Fixed penalties for certain information, reporting and licensing offences.

The proposed increase in the maximum penalty has not yet taken effect. The current maximum is the greater of £1 million or 50% of the value of the breach. OFSI intends to raise it to the greater of £2 million or 100%, but the Government’s strategic approach to sanctions enforcement confirms this needs legislation, which will be taken forward when parliamentary time allows.

Two further points matter for firms. First, OFSI assesses breaches on a strict liability basis. Outside circumvention offences, which require intent, it does not have to show that the firm knew or had reasonable cause to suspect a breach, so an inadvertent breach can still lead to a penalty. Knowledge, or a failure to mitigate an obvious risk, is treated as an aggravating factor. Second, a breach is also a criminal offence, carrying up to seven years’ imprisonment on indictment for financial sanctions breaches. Most cases are dealt with civilly, but the criminal exposure is part of why these controls matter.

Why this is not simply an AML issue

Many firms manage sanctions within their anti-money laundering framework. The overlap is real, but the regimes differ in ways that matter.

AML controls address the risk that funds are the proceeds of crime or linked to terrorist financing. Financial sanctions can prohibit dealing with a person or asset regardless of whether the money is suspected to be criminal. A transaction with a perfectly legitimate source of funds can still be a breach.

The SRA’s guidance on complying with the UK sanctions regime, first published in 2022 and most recently updated in June 2026, makes clear that every SRA-regulated firm is subject to the regime, whether or not its work falls within the Money Laundering Regulations. It also sets out differences that affect day-to-day controls:

• Ownership and control. The AML beneficial ownership test is triggered at more than 25%. The sanctions test is commonly more than 50% of shares or voting rights, but it also captures other forms of control, including where it is reasonable to expect a designated person could ensure the entity’s affairs are conducted in line with their wishes.
  
  
• Scope. Sanctions apply to payments for legal services as well as to client assets. AML generally does not catch fees paid as adequate consideration for legal services.
  
  
• Reporting. A suspicious activity report to the NCA does not discharge a sanctions reporting duty to OFSI, and the reverse is also true.
  
  
• Reliance. A firm cannot outsource its sanctions liability, for example by relying on an e-verification provider’s report.
  
  

A firm with comprehensive AML procedures can therefore still lack proper arrangements for identifying sanctioned parties, testing ownership and control, or dealing with frozen funds.

Client account: where the two regimes meet

Rule 3.3 of the SRA Accounts Rules prohibits using a client account to provide banking facilities. Payments into and out of client account must be in respect of the delivery of regulated services. Sanctions add a second test. A payment connected to genuine legal work can still be prohibited if it involves funds owned or controlled by a designated person, or makes funds or economic resources available to one, directly or indirectly, without a licence or exception.

COFA oversight therefore cannot stop at reconciliation and compliance with the Accounts Rules. The SRA’s guidance is also clear on how the two sets of obligations interact. The sanctions regime takes precedence over the Accounts Rules, and holding funds that are frozen under it is a proper reason for retention under rule 2.5. In practice, the firm must hold those funds, not release them.

Situations that warrant extra enquiry include:

• payments received from someone other than the client;
• requests to return funds to a different account or a third party;
• complex corporate ownership structures;
• links to jurisdictions or sectors subject to sanctions restrictions;
• unexpected changes to payment instructions; and
• requests to receive or transfer funds where the connection to the firm’s legal services is unclear.

None of these establishes a breach on its own. Each may justify further enquiries, escalation or a decision not to proceed.

What two recent cases show

Herbert Smith Freehills CIS LLP (OFSI, March 2025).

OFSI imposed a £465,000 penalty on the Moscow subsidiary of Herbert Smith Freehills over six payments, totalling about £3.9 million, made between 25 and 31 May 2022 to designated banks and a subsidiary of a designated bank. The payments were made during the office’s closure and did not involve client money. The Law Gazette reported it as the first OFSI action against a law firm for breaching Russia sanctions since the invasion. The penalty was reduced by half in recognition of self-reporting and cooperation. The lessons for any firm are practical: payments into accounts held at designated banks can amount to making funds available to a designated person, and inadequate screening and due diligence, particularly under time pressure, were among the root causes.

Scott-Moncrieff and Associates Limited (SRA, 2025).

This was not a sanctions case, and the firm was not found by OFSI to have breached sanctions. It is relevant because of what it shows about client account scrutiny. According to the SRA’s published decision, a consultant at the firm acted for a client in the Russian Federation buying an asset for $22.5 million from a Canadian company. The firm agreed to provide escrow services and general advice but did not act in the sale and purchase agreement, and there was no need for it to receive or make payments relating to that transaction. In 2021, however, it received more than $23.28 million from the client into client account and paid out sums to the supplier and to other third parties, including an agent in Germany and a company in Estonia.

The SRA found a breach of rule 3.3, because client account had been used to provide banking facilities, and failures in the firm’s firm-wide risk assessment and its policies, controls and procedures under the Money Laundering Regulations. It imposed a £68,000 penalty, set at 2% of annual domestic turnover, and £1,350 costs. The decision was made in August 2025 and published in February 2026. The Solicitors Disciplinary Tribunal dismissed the firm’s appeal.

For COLPs and COFAs, the lesson is that advising on part of a transaction does not justify processing every associated payment through client account. Where a matter also carries sanctions risk, that scrutiny matters more.

Source of funds and third-party payments

Source of funds enquiries are familiar from AML work. Sanctions compliance requires firms to look further, at who ultimately owns or controls the funds and who will benefit.

A UK bank account is not free of sanctions risk simply because the bank is regulated. A company that does not appear on the UK Sanctions List may still be caught because a designated person owns or controls it. OFSI’s general guidance explains how ownership and control are assessed.

Firms should be able to answer five questions about any significant payment:

• Who is paying? The client, a connected entity or an unrelated third party.
  
  
• Who owns or controls the parties involved? Has anyone considered whether a designated person is behind an entity in the transaction?
  
  
• Who will ultimately receive the funds? Could a designated person benefit?
  
  
• Does the payment make commercial sense? Is there a clear explanation for it, and for its connection to the legal services provided?
  
  
• Has anything changed since onboarding? New parties, revised payment instructions or ownership changes can create risks that were not present at the start.
  
  

Checks should be proportionate, and the reasoning behind decisions recorded. Screening is also not a one-off exercise. A client or counterparty can be designated mid-matter, and the firm will then need to reassess what it can hold, transfer or otherwise deal with.

Legal fees: licences, caps and reasonableness

Designation does not stop a solicitor from advising or representing a client, but receiving payment for that work is restricted. A firm must be able to point to an exception, a general licence or a specific licence.

OFSI published Legal Services General Licence INT/2026/9512597 on 24 April 2026, replacing the previous licence. It permits qualifying UK legal firms and counsel to receive payment from designated persons under the regimes listed in its annex, provided the conditions are met. Those include caps on fees (£2 million including VAT per firm or counsel for the life of the licence) and on expenses (the lower of 10% of fees or £200,000), reporting to OFSI within 14 days of receiving payment, and supporting records.

Firms should note three things:

• The licence is time-limited. It takes effect from 29 April 2026 and expires on 28 October 2026. Earlier legal services licences have been replaced at roughly six-month intervals, but there is no guarantee of a successor on the same terms. Any replacement may change the fee and expenses caps, the conditions or the regimes covered, so firms should read the new licence in full and not assume the current terms carry over. Payments received under this licence must still be reported to OFSI within 14 days, including those received shortly before expiry.
  
  
• It is not a blanket authorisation. It does not authorise any act that would otherwise breach the regulations, and non-compliance with its conditions means it does not apply.
  
  
• A specific licence may be needed. Where the general licence does not cover the payment, or the fee cap is exceeded, the firm must apply.
  
  

For specific licence applications, OFSI’s March 2026 guidance on reasonableness now requires an independent Costs Draftsperson’s Report in defined circumstances. For law firms the trigger is legal fees, counsel fees and expenses to be licensed exceeding £2 million including VAT in any six-month period, assessed per designated person and cumulatively across applications. For counsel instructed directly, the figure is £1 million. The report must come from an independent practising Costs Lawyer regulated by the Costs Lawyer Standards Board, and OFSI may still license a lower amount even where the report supports the fees. This £2 million threshold is separate from the £2 million cap in the general licence.

Fee earners should understand that permission to advise a designated person is not permission to be paid.

If you identify a potential breach

A suspected breach calls for prompt, coordinated action. The firm may need to stop a transaction, freeze funds, investigate and report to OFSI. The precise duties depend on the regime and on whether knowledge or suspicion thresholds are met, and legal professional privilege may affect what a report can contain. Where privilege is relied on to limit a report, the SRA expects a detailed record of who decided, when and why.

Reporting duties run separately, and one report does not cover the others:

• a report to OFSI does not discharge duties under the money laundering legislation or the SRA’s regulatory framework;
  
  
• an NCA suspicious activity report does not authorise a transaction that sanctions prohibit; and
  
  
• there is no deemed consent. Silence from OFSI after a report or licence application is not permission to proceed.
  
  

The SRA also expects firms that self-report a sanctions breach to OFSI to tell the SRA as well. OFSI’s revised framework rewards early disclosure and cooperation, so a clear audit trail showing when the concern arose, what was done and who authorised it is valuable.

Six priorities for COLPs and COFAs

1. Review the sanctions risk assessment. It should cover client base, practice areas, geography, payment patterns and structures, and be distinct from the AML risk assessment. The SRA publishes a firm-wide sanctions risk assessment template.
   
   
2. Test onboarding and ongoing screening. Check that screening covers clients, beneficial owners, controllers and relevant counterparties, that changes to the sanctions list trigger rechecks, and that potential matches are escalated and resolved consistently.
   
   
3. Tighten client account controls. Look at how unusual receipts, third-party payments and changed payment instructions are challenged before money moves, and who can release frozen funds.
   
   
4. Document your legal fees licensing process. Cover how general licence terms, caps, reporting deadlines and expiry dates are monitored, and when specific licences are sought.
   
   
5. Make ownership of sanctions clear. COLPs, COFAs, MLROs and senior management may each hold part of it, but one role does not remove the obligations of the others. Staff should know whom to contact and when a transaction must pause.
   
   
6. Train by role. Fee earners, accounts teams and compliance officers need scenario-based training covering client account payments, third-party funding, beneficial ownership and licence conditions.

Sanctions compliance is a governance responsibility

Enforcement expectations are rising, and a higher maximum penalty would raise the stakes further. The risks arise in ordinary operations: onboarding, receiving funds, paying third parties and recovering fees.

Responsibility cannot rest with the individual fee earner. COLPs, COFAs and managing partners need assurance that systems are appropriate, that staff understand their obligations and that identified risks are acted on. The test is whether the firm’s controls hold up when a problematic transaction arrives.

How Enderley Consulting can help

Enderley Consulting works with law firms on regulatory compliance. We review compliance policies and procedures, assess governance and reporting arrangements, and identify where additional training or practical guidance is needed.