Sanctions & PEP screening for UK businesses: a practical primer

The Office of Financial Sanctions Implementation (OFSI) publishes its enforcement figures every year, and the direction of travel is unambiguous: more designations, more monetary penalties, and less patience for "we didn't check". In 2024–25 OFSI issued its largest single financial penalty to date and named a wider set of non-financial firms in its enforcement reports than in any previous year.

UK financial sanctions are strict liability. You do not need to intend to deal with a designated person to commit an offence — you just need to do it. That is the point of this guide.

Who has to screen

Everyone in the UK — individual or business — is bound by financial sanctions. The screening obligation, though, differs by sector:

• Regulated firms under the Money Laundering Regulations 2017 (banks, e-money, crypto, accountants, law firms, TCSPs, estate agents, high-value dealers over €10,000) must screen at onboarding and on an ongoing basis.
• Unregulated businesses have no explicit screening obligation, but the sanctions themselves still apply. A private-sector supplier that ships to a designated Russian owner is committing an offence regardless of whether they knew.
• Charities and non-profits operating in high-risk jurisdictions have separate Charity Commission expectations layered on top.

If you extend credit, hold client money, sell above about £8,000 in a single deal, or trade with any counterparty outside the UK — screen.

The lists that actually matter

List	Publisher	Update cadence	Why you check it
UK Sanctions List	OFSI (HM Treasury)	Weekly, sometimes daily	Legally binding in the UK
UN Consolidated List	United Nations	Continuous	Enforced through UK regulations
OFAC SDN	US Treasury	Continuous	Relevant for USD payments or US nexus
EU Consolidated List	European Commission	Continuous	Relevant if you sell into or bank in the EU
NCA / SFO notices	UK enforcement bodies	Ad hoc	Wider adverse-media signal
PEP lists	Commercial data providers	Continuous	Trigger for enhanced due diligence, not a ban

The UK list is the one you must screen against by law. The others matter for risk, for banking, and for cross-border trade — but screening only the UK list and ignoring OFAC is a good way to lose a US correspondent-banking relationship.

PEPs — the misunderstood one

A Politically Exposed Person is someone entrusted with prominent public functions — heads of state, ministers, senior civil servants, senior judges, senior military officers, central bank governors, ambassadors, senior figures at state-owned enterprises — plus their immediate family and known close associates.

PEP status is not a bar to doing business. It is a signal that you need Enhanced Due Diligence (EDD): senior-management sign-off, source-of-funds evidence, and ongoing monitoring. The FCA's 2024 guidance was explicit that UK-domestic PEPs should generally be treated as lower risk than foreign PEPs — a point banks were criticised for ignoring.

A PEP stays a PEP for at least 12 months after they leave office (longer if the risk warrants it). Family members remain in scope until the primary PEP is de-classified.

What to screen — the whole picture, not just the entity

Screening the company name against OFSI's list is table stakes. It also catches almost nothing. Serious screening covers:

• The legal entity name and all trading names.
• Every director (current and recently departed).
• Every Person of Significant Control, including corporate PSCs traced upward to the ultimate beneficial owner.
• The registered office, especially when it is a serviced address shared with many entities.
• Passport / date-of-birth data on individuals — names alone generate huge false-positive volumes.

For context on why beneficial-ownership screening matters, see the AML compliance guide for UK SMEs.

How often to re-screen

OFSI's guidance is unambiguous: designations change constantly, so a one-off screen at onboarding is not compliance. Sensible cadence for most firms:

• Every business relationship, every month — batch-screen the entire customer book against the latest OFSI list.
• Trigger events — re-screen when a customer's beneficial owner changes, when they move to a higher-risk jurisdiction, or on a large transaction.
• Real time — for regulated financial firms, screen at payment initiation, not just at onboarding.

The false-positive problem

"John Smith" appears on adverse-media lists more than a thousand times. That is the false-positive problem in one sentence. Practical mitigations:

1. Use secondary identifiers — date of birth, nationality, and address alongside the name. OFSI's list publishes DOB and aliases for exactly this reason.
2. Set fuzzy-match thresholds carefully — 100% match misses obvious aliases; 70% drowns you in noise. Most vendors default to 85% for a reason.
3. Document your dispositions — for every hit, record who reviewed it, what evidence discounted or confirmed it, and the outcome. This is the file OFSI or the FCA will ask for.
4. Do not silently unblock repeat false positives — build a whitelist with a reason and a review date.

What OFSI actually enforces

OFSI's enforcement powers include:

• Public censure — a "monetary penalty" notice naming the firm and the breach.
• Civil penalties of up to £1 million or 50% of the value of the breach, whichever is higher.
• Criminal referral to the National Crime Agency for wilful breaches.
• Individual sanctions on directors and MLROs where personal knowledge is proven.

The lowered burden of proof introduced in 2022 — from "knowledge or reasonable cause to suspect" to strict liability — is why enforcement volume has climbed since. It also means the standard defence of "our screening was reasonable" only survives if you can show the file.

A minimum-viable screening programme

1. Document a written screening policy — lists in scope, frequency, escalation.
2. Screen every new customer at onboarding, before any money moves.
3. Re-screen the full book monthly against the UK sanctions list at minimum.
4. Screen beneficial owners, not just the entity.
5. Log every alert, every disposition, every whitelist decision.
6. Escalate any true positive to your MLRO within 24 hours; report to OFSI without delay.
7. Review the policy at least annually and after every major enforcement case.

Frequently asked questions

Do I need a paid screening tool?

Not for the UK list — OFSI publishes it in CSV and XML for free. You do need tooling once you screen against multiple lists, run fuzzy matches, and want an audit trail. Small firms often start with the OFSI list plus a monthly commercial-database sweep for PEPs.

What is the difference between sanctions and PEP screening?

Sanctions screening asks "is this person legally off-limits?" — a yes means you cannot do business without a licence. PEP screening asks "is this person high-risk?" — a yes triggers enhanced due diligence, not a block.

How does this interact with adverse media?

Adverse media (news reports, litigation databases, regulator enforcement notices) is a separate risk signal. It is not a legal list, but it feeds risk scoring and can trigger EDD in the same way a PEP status does.

What happens if I miss a designation?

The clock starts from designation, not from your next screening run. If a customer becomes designated on Tuesday and you screen monthly on the first, you have a technical breach on Wednesday. The mitigation is documentation — evidence that your policy is reasonable, that you screened on your stated cadence, and that you froze funds promptly once notified.

Do I have to freeze funds unilaterally?

Yes. If a customer is designated, their funds must be frozen immediately and reported to OFSI. Any dealing with those funds — including refunding them — requires an OFSI licence.

Are UK PEPs treated the same as foreign PEPs?

No. Following the 2023 review, the FCA now expects firms to treat UK-domestic PEPs as inherently lower risk than foreign PEPs, absent specific adverse indicators. Blanket account-closure of UK PEPs is not compliant behaviour.

Bring the screen inside the check

CompanyCheckr runs UK sanctions, UN and OFAC lists, and PEP indicators against every director and PSC returned in a company report — one search, one audit trail, no CSV downloads at 11pm on a Sunday. Cross-reference with the AML compliance guide before you set your firm's screening policy.

Run a free UK company check to see the screening panel in action, or upgrade for continuous monitoring so a new designation on a customer you already onboarded lands in your inbox the same day.