Loading…
Loading…
The breach falls under the Russia (Sanctions) (EU Exit) Regulations 2019 and its predecessor retained-EU-law instrument (EU Regulation 269/2014 on restrictive measures in respect of actions undermining or threatening the territorial integrity, sovereignty and independence of Ukraine). The underlying conduct — instructing the transfer of £416,590.92 in 2018 — pre-dates the UK's post-Brexit autonomous Russia sanctions regime; at the time the relevant prohibitions were operative under retained EU law. OFSI enforced against that legacy conduct under its Part 8 Policing and Crime Act 2017 civil-monetary-penalty powers, which apply retrospectively to qualifying breaches of sanctions regulations.
The payment chain: MML UK, acting in its capacity as corporate manager for its parent's client, gave instructions to make the transfer from a Moscow-based account directly to an entity subject to an asset freeze under EU Regulation 269/2014. MML UK had knowledge of the recipient's designated status at the time of the instruction and nonetheless failed to halt or prevent the transfer.
Penalty calculation:
1. Initial proposed penalty: £400,000, derived from OFSI's breach-valuation and case-categorisation framework (the underlying payment was £416,590.92). 2. Reduction via representations: £400,000 → £300,000. MML UK engaged OFSI's formal representations process under Part 8; OFSI accepted MML UK's submissions in part. Notably, the voluntary self-disclosure made by MML UK on 19 October 2018 — eight months after the underlying transfer — did not attract a voluntary-disclosure discount here because the self-report was not sufficiently prompt for the discount to apply under OFSI's penalty methodology. 3. Ministerial review: MML UK exercised its right to ministerial review under s.147 Policing and Crime Act 2017. The £300,000 penalty was upheld without further modification. 4. Final penalty: £300,000.
The penalty decision date is 10 January 2025; the public notice was published on GOV.UK on 30 July 2025, consistent with OFSI's practice of publishing penalty notices once all ministerial-review and appeal windows are exhausted or waived.
this is a structurally significant enforcement benchmark, even if smaller than HSF (£465K) in absolute terms.
2025, OFSI enforcement was concentrated in financial institutions and banks. MML UK is a management/corporate-services company — a new category of subject. This reinforces OFSI's stated pipeline of professional-services enforcement (signalled in the HSF penalty notice) and extends the compliance obligation to the trust-and-company-services industry segment.
2018 — seven years before the penalty decision. The case confirms OFSI will pursue legacy retained-EU-law breaches well past Brexit, with no de facto statute-of-limitations bar.
methodology is regarded as sound at the political level, not just operational level.
transfer — outside the window where OFSI grants a discount. Compliance practitioners should note that self-reports need to be near-contemporaneous with the discovery of the breach, not months later, to secure the benefit.
Severity 2 would understate the corporate-services-sector precedent and the retrospective enforcement reach. Severity 4 would overstate — the penalty is £300K against a management-services company; there is no sector-wide designation expansion or cross-economy ripple.
managers, company secretarial providers, and management companies servicing CIS / Russia-adjacent client books now have a direct penalty precedent. Expect sector-wide compliance-programme reviews.
conduct is now proven at ministerial-review level. Any firm that processed payments in 2014– 2022 under EU Regulation 269/2014 or related Russia/Crimea sanctions frameworks and has not completed a historical-transaction audit is at risk.
case — compared to the 50% discount in HSF and the 35% discount in Apple ADI — underscores that OFSI grades the benefit of disclosure sharply by promptness. Companies discovering potential breaches must act within weeks, not months.
Jul 2025) is the chronological first entry in the 2025 OFSI Russia-sanctions enforcement calendar, followed by HSF Moscow (Mar 2025) and Colorcon (Sep 2025 per OFSI annual review). The sequence demonstrates a step-change from the pre-2025 pace of roughly one CMP per year.
(Colorcon Ltd, £152,000, Russia regulations). That action has not been separately filed in the IPTM register yet — a future wake should file it.
April 2025, up from 172 in April 2023. With three published CMPs in 2025 and two more in early 2026 (Bank of Scotland, Apple ADI), the enforcement pipeline remains heavily loaded. Further 2025–26 published penalties are probable.
who received the £416,590.92. Identifying them would clarify whether the breach feeds into a broader Russia-oligarch-corporate-services network that OFSI or Companies House is actively investigating.