What OFSI’s Apple Fine Reveals About UK Sanctions Enforcement in 2026

Summary

On 19th March 2026, OFSI imposed a £390,000 penalty on Apple Distribution International Limited ("Apple International"), an Irish-incorporated subsidiary of Apple Inc, for making two payments totalling £635,618.75 to a Russian app developer wholly owned by a UK-designated entity. The penalty is the first resolved under OFSI's updated enforcement framework and uses its new settlement scheme, introduced on 9th February 2026. Three compliance questions arise from the case: whether OFSI can reach a non-UK company at all; whether name-based screening is enough; and how the revised penalty discount structure operates in practice. This forms part of our wider guide to UK financial sanctions compliance.

• OFSI imposed a £390,000 penalty on Apple International on 19th March 2026 for two payments to a Russian entity owned by a UK-designated person, in breach of regulation 12 of the Russia (Sanctions) (EU Exit) Regulations 2019.
• OFSI asserted jurisdiction over Apple International, a non-UK, Irish-incorporated entity, on the basis that instructing and failing to cancel payments via a UK-held bank account constitutes conduct in the United Kingdom.
• Apple International’s screening programme focused on name-matching and third-party vendor data; Apple International did not affirmatively request ownership and control information from Russian counterparties, which OFSI treated as an aggravating factor.
• The case was the first resolved under OFSI's February 2026 settlement scheme; a combined 35% discount was applied to the £600,000 baseline, reducing the penalty to £390,000.
• Businesses that use UK bank accounts, regardless of where they are incorporated, must treat compliance with UK financial sanctions as a legal obligation, not a matter for UK affiliates to manage in isolation.

Introduction

On 30th March 2026, OFSI published its penalty notice in full, making the Apple International case the most detailed account OFSI has produced of how its enforcement framework operates end to end. The underlying breach was straightforward: Apple International instructed its UK bank account to pay Okko LLC, a Russian streaming platform, on two occasions in June and July 2022. Okko had been wholly owned by JSC New Opportunities since 17th May 2022, which was designated by the UK on 29th June 2022. Payment A was released on 30th June 2022, the same day as the designation; Payment B was released on 28th July 2022, almost a month later. The Russia (Sanctions) (EU Exit) Regulations 2019 prohibit making funds available to an entity owned or controlled by a designated person under regulation 12, and civil monetary penalties apply on a strict liability basis under section 146 of the Policing and Crime Act 2017, as amended by the Economic Crime (Transparency and Enforcement) Act 2022.

Apple International operates the App Store and processes developer revenues through a UK bank account that Apple International controls directly from Ireland. OFSI identified that as the critical fact. The case sits within OFSI’s enforcement push since 2022, which has increasingly tested the outer limits of its territorial reach and expectations for compliance frameworks across large multinational corporate groups. The compliance lessons set out in the penalty notice carry the status of official OFSI guidance and should be read accordingly.

Can OFSI penalise a company that is not incorporated in the UK?

OFSI can impose a civil monetary penalty on a non-UK entity if its conduct occurs in the United Kingdom. Apple International is incorporated in the Republic of Ireland and operates under US parent control, yet OFSI had no difficulty asserting jurisdiction. The basis is the instruction and non-cancellation of payments processed through a UK bank account controlled by Apple International. OFSI treated the failure to cancel as an omission constituting conduct in the UK for the purposes of the Russia (Sanctions) (EU Exit) Regulations 2019.

The statutory position is set out in the penalty notice itself: OFSI confirmed that “UK financial sanctions apply to any conduct in the UK and to all UK persons (including legal entities established under UK law) anywhere in the world. That includes non-UK firms using UK financial institutions to conduct payments, even if the non-UK firm directly manages the account from outside the UK.” This formulation adds a second, distinct limb to the usual statement that UK persons must comply: conduct in the UK also catches foreign entities, and operating a UK bank account, however remotely, constitutes conduct in the UK.

The parallel with US practice is instructive. The US Office of Foreign Assets Control (OFAC) has long asserted jurisdiction over non-US persons who cause a US financial institution to process a prohibited transaction – so called secondary sanctions. OFSI’s Apple International reasoning mirrors that approach. Any business, wherever incorporated, that settles transactions through a UK-clearing bank or holds a UK-based account is subject to UK financial sanctions law in England and Wales. Businesses in Ireland, continental Europe, and further afield that use UK correspondent banking relationships should treat those relationships as engaging UK sanctions compliance obligations in the same way they would treat direct relationships with UK regulators.

A structural argument is available in cases where, unlike Apple International, the non-UK entity can show that the UK bank acted entirely on standing instructions maintained and controlled outside the UK. OFSI has not excluded that argument, but the penalty notice gives it no comfort: Apple International held and controlled the account, and the instruction to pay came from Apple International. The chain of UK-facing conduct was unbroken.

Does screening counterparty names satisfy the ownership-and-control obligation?

Name-based screening of sanctioned parties does not satisfy the ownership-and-control obligation in higher-risk situations. The Russia (Sanctions) (EU Exit) Regulations 2019 prohibit making funds available not only to a designated person directly but to any entity owned or controlled by a designated person. Okko was not itself on any sanctions list. The breach arose because Okko’s parent, JSC New Opportunities, was designated, and Apple International’s screening processes did not identify that ownership link in time.

OFSI was explicit that Apple International’s reliance on a self-certification model and third-party due diligence vendors was insufficient in the circumstances prevailing from February 2022 onwards. The penalty notice identified two specific failures. First, Apple International did not affirmatively request ownership and control information from Russian paid developers at onboarding or on an ongoing basis. Second, the third-party providers Apple International engaged did not flag publicly available press reporting, available at the time of the breach payments, indicating that Sberbank’s digital assets, including Okko, had been transferred to JSC New Opportunities. OFSI treated both failures as aggravating factors under case factor E (inadequately calibrated sanctions framework) and case factor F (failure to augment the diligence process given enhanced risk).

The implication for compliance teams is direct. Regulation 7 of the Russia (Sanctions) (EU Exit) Regulations 2019 extends asset-freeze obligations to entities owned or controlled by a designated person, where it is reasonable to expect the designated person to be able to conduct the entity’s affairs in accordance with their wishes. A counterparty that passes an automated name-screen may still be in scope if the counterparty’s owner or controller is designated. OFSI’s compliance notes state that onboarding procedures should require clients to provide clear, accurate, and up-to-date information on their ownership structure and ultimate beneficial owners, and that ongoing monitoring should be calibrated to identify changes in ownership and control. The obligation to augment standard screening with affirmative ownership requests is a stated regulatory expectation, not merely good practice.

The Apple International case is not the only penalty in which name-screening failures have been central. Still, the penalty notice is the clearest statement of what OFSI expects. Third-party tools remain a legitimate and valuable part of a compliance programme. As OFSI confirmed in the Apple International penalty notice: “ADI remains ultimately responsible for ensuring that it complies with financial sanctions.” Outsourcing the function does not transfer the liability. Where third-party data is incomplete, and particularly where a counterparty operates in a higher-risk jurisdiction such as Russia post-February 2022, firms must take steps to fill the gap directly.

How does the co-operation discount work under the February 2026 framework?

Under OFSI’s updated enforcement guidance, published on 9th February 2026, three concurrent discounts can reduce a baseline penalty by up to 70%. The Apple International case was assessed under transitional arrangements using the November 2024 guidance, but the settlement element was applied under the new scheme, making it the first illustration of how the two discount streams interact in practice.

OFSI applied a single 35% discount to the £600,000 baseline, which combined two elements: the voluntary disclosure discount available under the 2024 guidance (up to 50% for a serious case) and the new 20% settlement discount introduced in February 2026. The penalty notice records that Apple International voluntarily disclosed the payments to OFSI on 4th October 2022 and that a settlement was agreed on 19th March 2026 following formal settlement discussions entered into on 16th February 2026 under transitional arrangements.

The mechanics of the updated framework are set out in OFSI’s February 2026 guidance as follows. The Voluntary Disclosure and Co-operation discount is reduced from a maximum of 50% to a maximum of 30% for cases decided under the new framework. The Early Account Scheme (“EAS”) offers a further discount of up to 20% in exchange for a comprehensive factual account provided at an early stage of the investigation. The Settlement Scheme offers a further 20% discount, conditional on the subject agreeing to pay the penalty as imposed and waiving the right to ministerial review and appeal to the Upper Tribunal. All three discounts apply concurrently to the same baseline, resulting in a maximum reduction of 70%. As Giles Thomson, Director of OFSI, stated in OFSI’s January 2026 blog post on the new enforcement framework: “Resolving cases through settlement reduces the resource burden on OFSI and subjects that would otherwise be spent through the contested monetary penalty process.”

The reduction from 50% to 30% for voluntary disclosure has attracted comment in the compliance community. OFSI acknowledged in its consultation response that reducing the voluntary disclosure discount could diminish the incentive to self-report, but concluded that a 50% ceiling risked undermining the deterrent effect of the penalty regime. The practical response for firms is to pursue all available routes: disclose promptly and comprehensively, engage early with OFSI through the EAS, and consider the settlement scheme where the facts of the case are not genuinely contested. A firm that does all three can still achieve a 70% reduction. A firm that discloses late, declines the EAS, and contests the penalty to the Upper Tribunal will start from the baseline with no discount at all.

Settlement carries one further consequence that compliance and legal teams should factor in. A subject who settles waives the right to ministerial review and to appeal. In Apple International’s case, that was a rational commercial decision given OFSI’s strong position. In cases where the jurisdictional question or the ownership-and-control analysis is genuinely arguable, settlement forecloses the opportunity to test those arguments. The new framework rewards early engagement; a late conversion to co-operation produces a materially worse outcome.

Frequently asked questions

Can OFSI fine my company if it is incorporated outside the UK?

Yes, OFSI can impose a civil monetary penalty on a non-UK entity if its conduct occurs in the United Kingdom. The Apple International penalty notice confirmed that using a UK bank account to instruct, or failing to cancel, a payment, constitutes conduct in the UK for the purposes of UK financial sanctions legislation, regardless of where the instructing entity is incorporated or based.

Is it enough to screen counterparty names against the UK Sanctions List?

No, name-screening alone is not sufficient in higher-risk situations. UK financial sanctions prohibit making funds available to entities owned or controlled by a designated person, even if the entity itself is not on any sanctions list. OFSI expects firms to conduct affirmative ownership and control due diligence, particularly where counterparties operate in higher-risk sectors or jurisdictions such as Russia, and to keep that information current rather than relying solely on automated name-matching tools or third-party vendor data.

What discount can I get if I voluntarily report a sanctions breach to OFSI?

Under OFSI’s February 2026 enforcement framework, voluntary disclosure and co-operation can qualify for a 30% discount on the baseline penalty. An additional Early Account Scheme discount of up to 20% is available for providing a comprehensive early account of the breach. A further 20% settlement discount applies if a case is resolved through the settlement scheme within the 30-business-day settlement window. The three discounts run concurrently, so the maximum aggregate reduction available to a firm that qualifies for all three is 70%.

Talk to Eldwick Law

Eldwick Law advises businesses and financial institutions on all aspects of UK financial sanctions compliance, including voluntary disclosures to OFSI, penalty representations, and the development of ownership-and-control screening programmes that meet OFSI’s current expectations. If your business uses a UK bank account or deals with counterparties in higher-risk jurisdictions, please get in touch with our sanctions team for a confidential discussion.