The SRA has published a substantially revised edition of its guidance on Complying with the UK Sanctions Regime.

The refresh – timed to coincide with the transition to a single sanctions list – introduces several important additions that firms should review carefully. The revised guidance reflects the SRA’s supervisory experience accumulated since the regime came into force, and signals clearly that sanctions compliance is now treated as a business-as-usual obligation for all regulated firms, not just those with an international practice.

A new case study illustrates how the Bank of Scotland, a firm with no prior exposure to sanctions found itself involved in a matter with sanctions implications through a complex cross-border transaction. This highlights that risk is not confined to Russia or Iran-linked matters: any transaction with international elements warrants vigilance.  The case study is particularly significant because it demonstrates how sanctions exposure can arise indirectly through a counter-party, an intermediary, or a funding structure rather than through a direct relationship with a designated person. Firms that have previously considered themselves low-risk on the basis of their client base alone should treat this as a prompt to revisit that assumption.

What is the new sanctions guidance?

The guidance also expands the list of red flags, now explicitly including the use of multiple intermediaries and requests designed to obscure ownership structures. Other additions to the red flags list include clients who are reluctant to provide identification or explanation for the structure of a transaction, and unusual payment routes that do not reflect the commercial reality of the matter. Firms should ensure that fee earners are familiar with the updated list and that it is embedded into matter intake and risk assessment procedures

Critically, the guidance now confirms that firms should carry out sanctions screening of staff as part of onboarding – not just of clients. Reporting obligations have been clarified with a dedicated new section on when to report to the SRA (separate from obligations to OFSI), and there is expanded guidance on what ‘control’ means for entities where ownership structures are opaque or layered. We talk about this in greater detail here [link to Anne’s article] On the question of control, the guidance makes clear that a firm cannot simply rely on formal share registers or company filings: where there are indicators that a person exercises effective control over an entity through informal means, that must be investigated and documented. The SRA has drawn on its inspection findings in this area and notes that this is one of the most common points of failure in sanctions due diligence.

Actions for you:

• Review the updated guidance in full. The SRA’s guidance is available here and was updated on both 28 January and 13 February 2026 to reflect the transition to a single sanctions list; ensure you are reading the current version.
  
  
• Ensure HR onboarding procedures include staff screening against the UK Sanctions List. The SRA suggests this can be conducted alongside existing checks such as DBS checks, professional references, and right to work verification.
  
  
• Establish clear internal escalation procedures and confirm all relevant staff know how to report to both OFSI and the SRA when necessary. The updated guidance includes a new section setting out when a report to the SRA is required separately from – and in addition to – any report to OFSI; these are distinct obligations and should be treated as such.