Sanctions screening for small UK firms: the UK Sanctions List, what to check and what to do with a match

Which list to screen against since 28 January 2026

Screen against the UK Sanctions List, published by the Foreign, Commonwealth & Development Office (FCDO). From 9am on 28 January 2026 it became the only UK sanctions list. The OFSI Consolidated List and its search tool are frozen and kept for reference only, so a check against them misses every designation made since.

The UK Sanctions List search tool now offers fuzzy search, ranked results and highlighted matches. The FCDO aims to add new UN and UK listings within one working day and other amendments within 3 working days. People designated since 28 January 2026 have only a Unique ID; older OFSI Group IDs stay valid in reports and licence applications.

One exception: the list of 11 entities subject to the Russia regulations’ Schedule 2 financial and investment restrictions is not part of the UK Sanctions List. It sits on a separate GOV.UK page. For the definitions of sanctions, PEPs and adverse media, see our guide to PEPs, sanctions and adverse media and the glossary entries on sanctions checks and sanctions lists.

Who must comply and who must report to OFSI

Everyone in the UK, and every UK national or UK-incorporated company anywhere, must comply with financial sanctions. On top of that, “relevant firms” must report to the Office of Financial Sanctions Implementation (OFSI). Most small regulated firms are relevant firms, including accountants, tax advisers, estate agents and, since 14 May 2025, letting agents.

The reporting duty is in the sanctions regulations themselves, not in the Money Laundering Regulations 2017 (MLRs). Under the Russia regulations (reg 70), a relevant firm must inform the Treasury “as soon as practicable” if it knows or has reasonable cause to suspect that a person is a designated person or has committed a breach, and the information came to it “in the course of carrying on its business”. If the designated person is a customer, the report must also give the nature and amount of the funds held. Failing to report is an offence. Each sanctions regime has an equivalent provision.

Letting agents: the OFSI duty applies “irrespective of the value of any rental agreement”, so it reaches lets far below the £10,000 a month MLR threshold. It starts when the landlord instructs you and, for a tenant, when the landlord accepts their offer. (OFSI’s letting guidance still says “10,000 euros”; MLR reg 13 has said £10,000 since 30 June 2026.) HMRC’s AMLG3300 says “you must not deal with those specifically listed”. More on the letting agents hub.

No regulation says “you must screen”. In practice, screening is how a firm avoids a strict-liability breach and meets its reporting duty.

Ownership and control: the 50% rule

A company is caught by sanctions “in its entirety” if a designated person owns or controls it, even when the company itself is not listed. OFSI’s test is a holding of more than 50% of shares or voting rights, the power to appoint or remove most of the board, or a reasonable expectation that the company’s affairs follow the designated person’s wishes.

Points to watch, from OFSI’s general guidance (section 4.1):

• No adding up by default. OFSI “would not simply aggregate” different designated persons’ holdings, unless they have a joint arrangement or one controls the other’s rights.
• Stakes change. A holding can rise above 50% after you onboard the client.
• Control without a majority. A minority stake can still amount to control.

When your client is a company, identify its beneficial owners and controllers and screen them too. OFSI judges it “almost certain” that complex structures and trusts linked to Russian designated persons have obscured ownership and control.

Name match or target match: handling a hit

A name match does not prove your client is the designated person. OFSI says that if all the details match, it is likely a target match. If you are satisfied the person is someone else, “you do not need to take further action”. If you cannot tell, contact OFSI. Either way, record how you decided.

UK Sanctions List entries can include aliases, date of birth, place of birth, nationality, passport and ID numbers, addresses and position. Compare each one with what you hold.

Sanctions screening usually runs alongside PEP screening, but the outcomes differ. A PEP can be a client with enhanced due diligence; a designated person cannot be dealt with without a licence.

What to do with a confirmed match

If you know or have reasonable cause to suspect that you hold or deal with a designated person’s funds or economic resources, freeze them. Do not deal with them or make funds available, unless an exception or licence applies. Report to OFSI as soon as practicable. “Reasonable cause to suspect” is an objective test.

1. Freeze and stop. No payments to the person or for their benefit, including refunds and routine payments.
2. Report using OFSI’s online form. Include what your suspicion is based on and the identifying information you hold. For a customer, give the nature and amount of funds held. Quote the Unique ID, or the Group ID for older designations.
3. Consider other reports. The OFSI report is “in addition to” a suspicious activity report to the NCA and any report to your supervisor. Your nominated officer should decide.
4. Privilege. The duty does not apply to legally privileged information, but OFSI “may challenge a blanket assertion”.
5. Diary the annual report. Anyone holding a designated person’s funds or resources on 30 September must report them to OFSI by 30 November. If you reported last year and no longer hold the assets, send a nil report. Failing to report without a reasonable excuse is an offence.

Licences: get permission before you act

An OFSI licence is written permission to do something sanctions would otherwise prohibit. It cannot be issued retrospectively, so you must apply and receive it before you act. Each regime sets the grounds, such as basic needs, reasonable legal fees, prior obligations and the routine holding or maintenance of frozen assets.

Where a general licence covers the activity, use it and meet its reporting conditions. Specific licences have no statutory turnaround: OFSI reviews them “as soon as practicable”, puts basic needs and humanitarian cases first and returns incomplete applications without action.

Penalties after 9 February 2026

OFSI civil penalties are strict liability for breaches on or after 15 June 2022, so OFSI does not have to show that you knew. The maximum is the greater of £1m and 50% of the breach’s estimated value. Since 9 February 2026, voluntary disclosure and co-operation earn a discount of up to 30%, down from up to 50%.

Older penalty notices still quote the “up to 50%” discount, which was the policy before 9 February 2026.

What recent penalty cases show

OFSI does fine small firms, and the amounts are not always large. Three published cases show the common risks: carrying on routine work for a client after they are designated, sending a refund to a designated person, and answering an OFSI request for information late. Each one is a process gap a small firm can close.

• £15,000, property management and concierge company (published September 2024). It kept managing a designated person’s UK flat after designation: rent collection, maintenance and fees from the client account, 26 payments worth £15,487.30. Routine maintenance payments made funds available “for the benefit of” the designated person. Its sanctions knowledge was “extremely limited”.
• £300,000, fiduciary, bookkeeping and accounting services firm (published July 2025). It refunded an overpayment of £416,590.92 to a designated person. Refunds are not exempt, and OFSI’s expectations apply “to all firms regardless of their size”.
• £5,000, late answer to a request for information (April 2025). OFSI found no other breach.

Since February 2022, just over 1% of suspected breach reports came from property and related services firms. OFSI judges it “highly likely” that property-related breaches were facilitated by “small-scale property or related services firms or sole practitioners”.

A practical screening process for a small firm

Screen every client, and the owners and controllers of company clients, before you act. Screen again when the relationship changes or before money moves. Resolve each hit on the identifying details, report where needed, and record every outcome. Write it into your policies so anyone in the firm can follow it.

1. Name an owner, usually your nominated officer or MLRO.
2. Screen before you act against the UK Sanctions List. Letting agents: the landlord at instruction, the tenant at offer acceptance.
3. Use full details: name, aliases, date of birth, nationality and address.
4. Check owners and controllers of company clients against the 50% test.
5. Resolve and record each hit as a false positive, potential target match or target match.
6. Act on a target match: freeze, do not deal, report to OFSI, consider a SAR.
7. Re-screen at key events, such as before refunds, client account payments and renewals.
8. Get licences first. None can be backdated.
9. Answer OFSI on time, and diary the 30 November report if it applies.
10. Train staff to recognise a hit and escalate it.

AML Buddy includes sanctions and PEP screening in each client check, alongside ID document and selfie verification, an address match and adverse media, with a timestamped PDF report for the file, at £5.40 a check inc. VAT. Your firm still decides whether a match is genuine and reports to OFSI.

See also our AML deadlines calendar, the HMRC AML fees calculator and the estate agents and accountants hubs.

This guide is general information, not legal advice. Your supervisor’s guidance and OFSI’s own guidance decide what is right for your firm.