The UK’s financial sanctions watchdog has slammed Bank of Scotland with a £160,000 penalty after the lender allowed a sanctioned Russian-British ex-politician to move more than £77,000 through a Halifax account without triggering proper alerts. The case exposes dangerous gaps that still exist in some banks’ screening systems three years into the intensified Russia sanctions regime.
How the Breach Happened
On 6 February 2023, the designated individual walked into a Halifax branch (Halifax operates as Bank of Scotland’s trading name) and opened a personal account using his British passport.
The passport showed slight but common spelling differences from the name on the UK sanctions list: one extra letter in the first name, a missing middle name, and a single changed character in the surname. These are standard transliteration variations when Russian names are rendered in English.
The bank’s automated screening system did not flag the match. A politically exposed person (PEP) alert did fire, but staff mistakenly believed the customer had been removed from both UK and EU lists when he had only been delisted by the EU. The error went unchallenged.
Over the next 16 days the account handled 24 transactions worth a total of £77,351.42. Every payment breached the Russia (Sanctions) (EU Exit) Regulations 2019.
Lloyds Banking Group, the parent company, spotted the problem internally and self-reported to the Office of Financial Sanctions Implementation (OFSI) in March 2023, just two weeks after the last transaction.
Why OFSI Came Down Hard
OFSI originally assessed the breach at £320,000 but cut the fine in half because Lloyds voluntarily disclosed the issue. That 50 per cent reduction was the only mitigating factor.
The watchdog listed several aggravating points:
- The funds went to a personal account of a person designated since 2020 for destabilising Ukraine.
- The transactions “blunted the intended effect” of UK sanctions and helped the individual circumvent restrictions.
- Russia sanctions remain a top UK foreign-policy priority.
- Lloyds’ mandatory sanctions training was out of date and failed to cover current risks.
- There were no clear written procedures telling staff to escalate potential sanctions hits when a PEP alert also appeared.
This is only the second time OFSI has publicly named a major UK high-street bank in an enforcement notice, the first being a £15 million fine against Standard Chartered in 2023 for Russia-related breaches.
The Real-World Weaknesses Exposed
The case is a wake-up call on four specific fronts that many firms still get wrong.
- Transliteration blindness
Most screening tools still choke on common Cyrillic-to-Latin variations (e.g. “iy” vs “y”, “ya” vs “ia”, extra “i” or “y”). If your system only does exact or basic fuzzy matching, it will miss these. - Siloed PEP and sanctions checks
Many banks treat PEP alerts and sanctions alerts as separate workflows. When they overlap, staff often assume one clear status applies to both regimes. That is exactly what happened here. - Out-of-date training
Lloyds admitted its “advanced” sanctions training had not been refreshed to reflect the post-2022 Russia sanctions explosion. Front-line and compliance staff were effectively working with 2021 knowledge in a 2023 risk environment. - No mandatory escalation rule
There was no explicit policy requiring every possible sanctions match – even weak ones – to be sent to the sanctions team. Human judgement filled the gap, and judgement failed.
What Banks Must Fix Now
OFSI made it clear: passive compliance is no longer enough. Firms must actively hunt for ways they could be breached.
Immediate actionable steps:
• Upgrade screening engines to handle known transliteration equivalents for Russian, Arabic, Chinese and other high-risk name sets.
• Force every PEP + potential sanctions overlap to the sanctions team; do not let relationship managers or onboarding staff make the call alone.
• Rewrite escalation procedures in plain English and make them mandatory reading every year.
• Run quarterly training that includes real recent OFSI enforcement examples – this Bank of Scotland case should now be slide 1.
• Test your systems with the exact name variations from this case; if they do not flag, fix them before the next OFSI review visit.
The regulator’s message is blunt: Russia sanctions are not going away, enforcement is only getting tougher, and voluntary disclosure is now the only reliable way to keep fines manageable.
Bank of Scotland paid £160,000 for a mistake that lasted just over two weeks. In the current climate, the next bank might not be so lucky.
What do you think – are UK banks finally getting serious about sanctions screening, or are more big fines coming? Drop your view in the comments and use #OFSI #Sanctions if you share this piece.
