US DEVELOPMENTS

OFAC Fundamentally Tightens Iran-specific Licensing Under Operation Economic Outcast.

OFAC issued a new Statement of Licensing Policy on Iran-Related Requests establishing a presumption of denial for applications seeking specific licenses for conduct prohibited by the Iranian Transactions and Sanctions Regulations (ITSR) and other Iran-related authorities. The change is effective immediately and is considerably stronger than simply saying that licenses will be reviewed restrictively: OFAC states that Iran-related specific licenses may now be issued only when required by law or in “exceptional and urgent circumstances,” identifying risks to life, limb or environmental safety as examples. Applicants relying on those circumstances are expected to submit a written attestation, and OFAC will review the requests case by case in consultation with the State Department. OFAC also expressly suspended the application of previously issued Statements of Licensing Policy that had created a favorable licensing posture for certain Iran-related activities. OFAC Statement of Licensing Policy on Iran-Related Requests

The policy is another phase of Operation Economic Outcast, launched August 24.

OFAC reinforced the message on the same day with a significant individual enforcement action. A U.S. person agreed to pay $1,427,230 for 39 apparent violations involving management consulting and advisory services to Iranian software companies, receipt of approximately $713,615 in Iranian-origin dividends through banks in Türkiye, the UAE and Singapore into U.S. accounts, and purchases of four properties in Iran. OFAC deemed the conduct egregious and not voluntarily disclosed. Particularly notable for compliance purposes, the individual participated in 19 virtual management meetings addressing corporate strategy, sales, marketing, accounting, HR, governance and other business matters.

Practical implications. As OFAC specific licence is NOT a reasonably predictable route for solving an otherwise prohibited Iran transaction. For commercial matters – investment, payments, services, technology, restructuring, divestment or other transactions that previously might have been presented to OFAC on policy or humanitarian-adjacent grounds – the starting assumption should now be that authorization will not be granted unless the case fits a genuinely exceptional category. Pending applications should therefore be reassessed against the new standard, and reliance on an earlier favorable Statement of Licensing Policy should be specifically revalidated.

The simultaneous enforcement case also makes the definition of a prohibited “service” very relevant. Remote participation in board or management discussions, strategy, marketing, governance or other corporate decision-making can constitute prohibited services even where nothing tangible is exported. OFAC expressly reminds that U.S. citizens and lawful permanent residents are U.S. persons wherever located, making this particularly important for multinational companies employing U.S. persons on non-U.S. management teams.

UK DEVELOPMENTS

Illumina Cambridge Pays £7.44 million for Involvement in an Overseas Russia Supply Chain.

HMRC disclosed that Illumina Cambridge Limited paid a £7,438,840.13 compound settlement for violations of the Russia (Sanctions) (EU Exit) Regulations 2019. The underlying conduct occurred between July 2022 and January 2023 and involved a UK company in the supply of sanctioned goods from one overseas company within its corporate group to another overseas group company, with the goods then destined for Russia and other destinations. HMRC identified the violation as a breach of Regulation 25(1). Importantly, HMRC itself emphasizes that the case demonstrates that UK trade-sanctions violations can occur even when no goods are exported from the UK and even when the goods are not restricted under the law of the country from which they physically originate or are exported. HMRC agreed compound settlements

This follows directly from the jurisdictional structure of UK sanctions. UK sanctions apply to UK-incorporated entities undertaking activities anywhere in the world, as well as UK nationals wherever located. The Russia rules also expressly regulate indirect third-country supply chains – for example, making sanctioned goods available for use in Russia or supplying/delivering controlled goods between third countries where the statutory conditions are met.

Illumina voluntarily disclosed the matter, cooperated fully with HMRC and undertook remediation, including ending Russia-related business. That was important because HMRC states that a compound settlement – an alternative to criminal prosecution – will ordinarily be considered where the breach was inadvertent or resulted from internal-control weaknesses and the exporter voluntarily reported it. HMRC says it would not normally use a compound settlement where the exporter intended to violate the controls.

Practical implications. A multinational cannot construct its UK sanctions analysis solely around where the goods ship from. A UK entity’s involvement in procurement approvals, purchasing, contracting, order management, logistics, supply-chain direction, technical support or other activity concerning a shipment between two non-UK affiliates may be sufficient to create UK sanctions exposure.

This makes corporate governance particularly important. Global groups should determine which legal entity and which personnel are actually performing each part of an international transaction rather than assuming that a sale belongs exclusively to the subsidiary appearing on the commercial invoice. A Russia-restricted transaction carried out by, for example, an Asian subsidiary may still require UK analysis if a UK entity or UK national participates in the transaction.

There is also a forward-looking connection to the UK’s Sanctions End-Use Controls (SEUC) introduced in May 2026. HMRC expressly flags those controls in the Illumina announcement: the government can now impose a licensing requirement for an export to a non-sanctioned third country where the exporter is notified of a diversion risk to a sanctioned destination.

Citibank and Illumina  Enforcement Cases Together Show a Shift from “Screening Compliance” Toward Operational and Group-wide Sanctions Enforcement.

The £4,732,830.58 OFSI penalty against Citibank’s London branch, published September 2, is unusually valuable because OFSI published a detailed explanation of what actually went wrong. The bank processed 970 payments totaling approximately £19.72 million that OFSI determined breached the Russia and Global Anti-Corruption sanctions regimes. OFSI did not describe the case as deliberate evasion; rather, the failures involved sanctions-screening systems, ownership/control analysis, alert backlogs, account restrictions, correspondent banking, internal charges, reporting and staff errors. OFSI Citibank London Public Penalty Notice

Several details are particularly instructive. After a Russian individual’s designation, an alert backlog left some potentially exposed accounts unresolved for weeks. Citibank temporarily altered guidance so that an account under investigation did not have to be restricted unless staff already had evidence of 50% or greater designated-person ownership; OFSI concluded that this increased the risk and duration of accounts remaining unrestricted.

In another group of violations, the screening system treated “PAO Sovcomflot” and “Sovcomflot” differently because of its calibration around the Russian corporate prefix, contributing to 328 transactions worth approximately £5.4 million involving entities owned or controlled by Sovcomflot. The bank also processed approximately £135,000 of internal fees, tax charges and corrections affecting restricted accounts because some internal systems could continue posting bank-generated transactions even after customer activity was restricted.

OFSI was also critical of delayed frozen-asset reporting: on 53 occasions the delay exceeded six weeks, and in 11 instances reached 518 days; OFSI calculated an average delay of 274 days for the relevant reports. It concluded that several systems weaknesses were reasonably foreseeable and could potentially have been identified through more detailed pre-crisis testing.

The penalty calculation itself is instructive. OFSI set a baseline of approximately £7.89 million, granted only a 20% voluntary-disclosure and cooperation discount – rather than the potential maximum 30% – because not all breaches had been voluntarily identified and some disclosures were delayed or incomplete, and then applied a further 20% settlement discount, producing the £4.73 million final penalty.

OFSI’s explicit compliance message is that firms with material sanctions exposure should assess vulnerabilities before systems are placed under stress.

That case becomes still more significant when read together with Illumina Cambridge six days later (SEE THE ALERT ABOVE). Citibank shows OFSI pursuing defects in the day-to-day operation of a sophisticated financial sanctions system; Illumina shows HMRC imposing a very large trade-sanctions settlement where the physical goods moved between two overseas group companies. The two cases address different enforcement regimes and regulators, but the policy message is strikingly consistent: UK authorities are looking at how sanctions controls function across the organization.

Practical implications. For financial sanctions, the Citibank matter is especially consequential because OFSI’s civil monetary penalty regime operates on a strict-liability basis for breaches occurring on or after June 15, 2022. OFSI does not have to prove knowledge or reasonable cause to suspect in order to establish civil liability, although knowledge, intent and compliance efforts remain relevant when deciding whether enforcement is appropriate and how serious the case is.

The practical compliance standard emerging from the two cases: a defensible program increasingly needs to demonstrate that automated screening recognizes linguistic and corporate-form variations; ownership and control alerts are investigated quickly; alert queues have surge capacity during geopolitical events; unresolved high-risk accounts are appropriately restricted; internal fees and system-generated payments cannot inadvertently move frozen funds; general-licence reliance is documented prospectively; global group transactions involving UK companies or UK personnel receive UK sanctions review; and voluntary disclosures are prompt, complete and internally reconciled before submission.

EU DEVELOPMENTS

CJEU’s Inter Rao Lietuva Judgment Materially Clarifies the EU “Control” Standard.

In Case C-147/25, Inter Rao Lietuva, the Court of Justice addressed a recurring and commercially difficult sanctions question: when can the assets of a non-listed company be frozen because it is allegedly controlled by an EU-designated person? Inter Rao Lietuva, a Lithuanian electricity importer, was not itself an EU-listed person. Lithuanian authorities nevertheless froze its assets on the basis of its ownership chain: it was indirectly owned by the Russian Inter RAO group, whose principal shareholders included Russian state-owned undertakings, and the authorities reasoned from Russian state ownership to control by designated Russian President Vladimir Putin.

The Court rejected the proposition that this inference can be made merely from the nature of the Russian political system. Where an authority relies on “control,” the existence of that control must be proven “on an objective and sufficiently solid basis”, either through direct evidence or through a sufficiently specific, precise and consistent set of indicia. The fact that Russia is an autocratic and oligarchic system in which its president possesses extensive de facto powers is not, standing alone, sufficient evidence that he controls the particular company. CJEU Inter Rao Lietuva press release

At the same time, the Court did not limit control to formal equity ownership or contractual powers. Informal or de facto control remains legally relevant. A national authority and court may consider all circumstances demonstrating that a listed person actually possesses the ability to influence corporate decisions, provided those circumstances are supported by objective and sufficiently solid evidence. State ownership elsewhere in the chain may also be relevant evidence; it simply does not automatically establish personal control by a designated head of state.

The judgment also contains an important procedural component. National authorities implementing the directly applicable EU asset freeze do not necessarily have to hear the company before freezing its assets, because advance notice could undermine the freeze, but the reasons must be communicated promptly thereafter. National courts reviewing the measure must test whether the alleged factual basis is genuinely substantiated rather than merely reviewing the authority’s reasoning at a superficial level.

Practical implications. This judgment should cause EU operators to distinguish more carefully between three different concepts: listing, ownership and control. A company is not automatically sanctioned simply because it has a commercial connection to Russia, is state-associated, or sits within a corporate chain containing Russian state ownership. If the company is not itself listed and the 50%-ownership analysis does not independently resolve the issue, a control conclusion needs an evidentiary record showing the designated person’s actual ability to influence the entity.

That does not mean companies should abandon conservative compliance practices. Banks and suppliers can still decline transactions under their own risk appetite, and informal control remains capable of bringing an entity within an asset freeze.

For compliance teams, the better practice is therefore to document the control analysis: board appointment rights, voting arrangements, governance powers, instructions, management overlap, financing dependency, contractual rights, actual decision-making behavior and other evidence of decisive influence.

The decision may also become important in dealings with national competent authorities. Where an authority asserts that an unlisted counterparty is controlled by a designated person, operators have a stronger basis to request the specific factual indicia supporting that conclusion instead of accepting a generalized political-control theory.