UK OFSI imposes £160,000 penalty on Bank of Scotland Plc for Russia sanctions breach — transliteration name-matching screening failure

Mechanism

The penalty enforces the Russia (Sanctions) (EU Exit) Regulations 2019 against Bank of Scotland Plc, specifically:

• Regulation 11 (dealing with funds owned, held, or controlled by a

designated person): breached by the 20 payments credited to Ovsyannikov's account at Halifax.

• Regulation 12 (making funds available to a designated person): breached

by the 4 payments debited from the account to Ovsyannikov.

How the screening failed. Dmitrii Ovsyannikov (Дмитрий Овсянников) — former Russian-installed "governor" of Sevastopol in occupied Crimea, sanctioned under the Russia Regulations — opened the account at Halifax using a UK passport that rendered his name with transliteration variants of certain characters typical of Russian-to-English rendering (e.g., "i" for "ii", "n" vs "nn"). Halifax's sanctions screen was configured for exact-string matching against the OFSI Consolidated List. The variant spelling did not trigger a match, so the account was opened and remained operational for the February 2023 payment activity.

Penalty calculation: 1. Base penalty: £320,000 (OFSI's case-categorisation calculation). 2. 50% voluntary-disclosure discount applied after Lloyds Banking Group self-reported the breach (initial notification made within two weeks of identifying the potential breach — described by OFSI as prompt). 3. Final penalty: £160,000.

Publication timeline:

• Breach conduct: February 2023.
• Penalty imposed: 10 November 2025 (effective date used in slug).
• Penalty notice published: 26 January 2026 (announced date).
• OFSI compliance-lessons blog post: 23 February 2026.

Compliance-precedent significance

This is the first transliteration-variant name-matching enforcement action in the OFSI canon. OFSI's February 2026 blog post explicitly frames the lesson as a signal that fuzzy / phonetic / character-substitution-tolerant screening is now an expected compliance baseline for UK FIs handling Russian- and CIS-origin customers. The following screening approaches are implied as minimum-expected:

• Phonetic matching (Soundex, Metaphone, or equivalent).
• Character-substitution variants (Cyrillic-to-Latin transliteration tables).
• Name-normalisation pre-processing (diacritics, double-letters, patronymic

omission patterns).

UK FIs relying solely on exact-string matching against the OFSI Consolidated List face a structural compliance exposure this penalty now prices.

Why severity 2

• Absolute penalty size is small. £160,000 (pre-discount base: £320,000)

against a major UK retail bank. Not in the range of Binance ($3.4bn) or OFAC's larger enforcement actions.

• Russia regime perimeter unchanged. This enforces existing Regulation 11/12

prohibitions — no new designations, no new sector restrictions, no new prohibitions.

• Precedent is real but narrow. The transliteration lesson is structurally

important for UK FI compliance architecture (and will feature prominently in 2026 training materials), but the legal consequence of non-compliance was already priced in by prior OFSI guidance.

• Severity 3 would overstate the regime impact. Severity 2 balances the

non-trivial compliance-precedent value with the modest penalty quantum and absence of new perimeter creation.

Register context: UK OFSI Russia-sanctions enforcement cadence

This penalty adds a third data-point to the emerging 2025-2026 OFSI Russia- sanctions enforcement series in the IPTM register:

The 50% discount here is the highest in the series, consistent with OFSI's stated intent to reward prompt, complete voluntary disclosure. The Lloyds initial notification within two weeks of identifying the breach is notably faster than typical corporate disclosure timelines.

Downstream implications

• **Exact-string sanctions screening is now a documented compliance failure

mode.** Any UK FI audit programme that hasn't reviewed its screen configuration for transliteration coverage has an actionable gap.

• Voluntary disclosure economics remain strongly positive. Three consecutive

cases with 30-50% discounts reinforce the expected-value calculus for early self-reporting.

• OFSI's incoming doubled penalty cap (proposed £2m / 100%-of-breach under

forthcoming primary legislation) will make the same transliteration-variant scenario materially more expensive in future cases — raising the stakes for screening-architecture investment.

• UK bank-level enforcement precedent. HSF was a law firm; ADI was an

Irish consumer-tech subsidiary. Bank of Scotland is the first major UK retail bank in the OFSI enforcement series — a structurally more visible subject category for other UK bank compliance functions.

Open questions

• Whether Lloyds Banking Group has updated its sanctions-screen configuration

across all divisions (Halifax, Bank of Scotland, Lloyds Bank, Scottish Widows) following the penalty.

• Whether OFSI publishes further transliteration-variant cases; if the pattern

recurs, OFSI may issue formal guidance or a Dear CEO letter on screening minimum standards.

• Whether OFSI's proposed doubled penalty cap passes in the 2026-27 legislative

session and how enforcement case selection shifts in response.