Overview
- The UK Treasury’s Office of Financial Sanctions Implementation fined Citibank’s London branch £4.7 million on Wednesday after finding it processed 970 payments worth about £19.7 million that should have been restricted.
- OFSI said most breaches took place in the months after Russia’s 2022 invasion but noted some transactions that Citi flagged occurred as late as 2025, showing the failures spanned an extended period.
- Investigators identified concrete control failures including a May 2022 change to escalation guidance that narrowed account restrictions, name‑screening software that did not recognise the Russian corporate prefix “PAO,” and an automated processor that added unscreened correspondent banks to transactions.
- Citi voluntarily self‑reported the majority of the breaches, cooperated with OFSI, agreed a settlement that reduced the penalty, and said it is investing in its global sanctions‑compliance framework.
- OFSI rated the case as “high” severity because the breaches let designated persons access funds, a finding that raises the bar for banks to fix screening software, staffing and processes and could mean tougher enforcement and higher compliance costs across the sector.