In its first-ever threat assessment of the UK legal sector, the UK’s Office of Financial Sanctions Implementation (OFSI) has raised red flags with regards to suspected sanctions breaches involving UK legal services providers since February 2022 (the Assessment).
Why Did OFSI Focus on Legal Services Providers?
Legal services providers play a crucial role in ensuring UK and international clients (including UK Designated Persons (DPs)) comply with UK financial sanctions. All legal services providers must ensure compliance not only with the Russian sanctions regime but also other threats to compliance relevant to the United Kingdom, including the UK’s sanctions regimes applicable to Libya, Belarus, Iran and South Sudan, amongst others.
OFSI’s Key Findings
The Assessment sets out four key findings relevant to UK legal services providers from February 2022 to present.
Underreporting of Breaches
OFSI found it was highly likely that UK trust and company services providers (TCSPs) may not fully disclose suspected breaches due to inconsistent detection policies and the failure to monitor clients’ sanctions status.
Since the reporting time frame of February 2022 until the publishing of this Assessment, OFSI identified that 16% of the total number of suspected breach reports received have come from the legal services sector (compared with 65% submitted by the financial services sector). 98% of these were submitted by law firms and barristers, while TCSPs and other types of legal services providers submitted only 2%. OFSI considered this as strongly suggestive that TCSPs were under-reporting.
Compliance Failures
OFSI stated that it was almost certain that most non-compliance by UK legal services providers has occurred due to the following:
Improper Maintenance of Frozen Assets
All DPs accounts, funds and resources, including those held by entities owned or controlled by DPs, must be operated in accordance with asset freeze prohibitions and OFSI licence permissions. OFSI observed legal services providers failing to adhere to asset freeze prohibitions, including delays in freezing funds belonging to DP clients and transferring frozen funds into accounts other than those specified in OFSI licences.
Breaches of Specific and General OFSI Licence Conditions
Receiving payment for legal services rendered to DPs, including services provided on credit, requires an OFSI licence. Specific compliance issues included billing sanctioned DPs more than the value limits set in the relevant licence or receiving payments after the relevant licence has expired.
Reporting
OFSI encourages legal services providers to review licence reporting requirements, including making a report within 14 days of receiving payment under a general licence and providing relevant documentation that sets out the obligation under which the payment has been made.
Wind-down of Russia Related Operations
Many UK legal services providers, including law firms, wound down their operations in Russia following its invasion of Ukraine and advised clients regarding the same. OFSI identified that legal services providers must ensure these activities were conducted in line with general and specific licence permissions and to report any suspected breaches which may have occurred as a result. The recent financial penalty imposed on HSF by OFSI in relation to the activities of HSF Moscow highlights these risks.
Complex Ownership and Control Structures
OFSI considered it was almost certain that complex corporate structures, including trusts, linked to Russian DPs and that their family members have concealed the ownership and control of assets which should have been frozen under UK financial sanctions. The Assessment encourages legal service providers to identify and report any suspected breaches, including those arising from non-designated individuals or entities dealing with frozen assets held through these complex structures.
Post-designation Ownership and Control Transfers
OFSI considered it likely that Russian DPs have sought to recoup frozen assets and even dissipate them beyond the reach of UK financial sanctions to non-designated individuals and entities. This generally requires the involved of other parties enabling these activities, including:
- Professional enablers which provide professional services that enable criminality.
- Non-professional enablers, such as family members, ex-spouses or associates.
Legal service providers need to ensure that they are not, directly or indirectly, enabling such activity by DPs or by non-professional enablers acting in support of DPs.
Intermediary Countries
Approximately 23% of the suspected breach reports identified by OFSI as involving UK legal services providers are connected to intermediary jurisdictions. The Assessment highlights a series of red flags for lawyers to look out for when dealing with jurisdictions such as: the British Virgin Islands, Guernsey, Cyprus, Switzerland, Austria, Luxembourg, United Arab Emirates and Turkey, as well as the Isle of Man, Jersey and the Cayman Islands.
Practical Steps
Legal services providers are obliged to make Suspicious Activity Reports to the National Crime Agency (NCA) under Part 7 of the Proceeds of Crime Act 2002 and the Terrorism Act 2000 if money laundering or terrorist financing activities are known or suspected. Further information about reporting to the NCA and OFSI can be found here and here.
Legal service providers should take the following steps, amongst others, to ensure compliance with the UK sanctions regime:
- Monitor and identify any red flags;
- Update client due diligence beyond basic ID checks to check beneficial owners and connected parties;
- Screen every transaction against OFSI’s consolidated list (see here);
- Complete a tailored risk assessment, incorporating the above findings, and undertake any remedial activities; and
- Identify and comply with any applicable licence requirements.
Conclusion
OFSI’s Assessment builds on previous and related publications issued by OFSI and UK government partners, including the Financial Services Threat Assessment published by OFSI in February 2025 (see our corresponding alert here). OFSI encourages legal services providers to both report now and retrospectively, where appropriate and proportionate, if they suspect a breach linked to the content of this Assessment.
