When your team finds a potential sanctions match in a customer file, the first question isn't "Is this a violation?" It's "Which regime applies?" This distinction affects everything: your liability, disclosure obligations, recordkeeping, and enforcement risk.
The June 23, 2026 joint guidance from OFAC and OFSI makes it clear: assuming these regimes work the same way will cost you. They share compliance goals but differ in jurisdiction, enforcement, and liability, impacting every cross-border transaction you handle.
The Decision You're Facing
You need to determine whether a transaction, relationship, or activity falls under US sanctions (administered by OFAC), UK sanctions (administered by OFSI), both, or neither. This isn't just theoretical. The wrong call means you're either over-controlling legitimate business or missing a reportable violation.
This decision arises when:
- A new customer has addresses in multiple jurisdictions.
- Your payment routing involves correspondent banks in the US or UK.
- Your entity structure includes US-incorporated subsidiaries or UK branches.
- A third party you're evaluating appears on one sanctions list but not another.
Key Factors That Affect Your Choice
Factor 1: Where the transaction occurs
OFAC jurisdiction extends to US persons (citizens, permanent residents, US entities, and their foreign branches) regardless of location, plus anyone in the US, and transactions through US financial systems. OFAC also prohibits non-US persons from causing US persons to violate sanctions or evade them.
OFSI jurisdiction covers UK persons regardless of location, individuals and entities within the UK, UK-incorporated entities and their foreign branches, and activities in UK waters. OFSI may reach non-UK persons if they have a UK nexus.
If your transaction involves a US-incorporated entity's foreign branch, you're in OFAC territory even if no money crosses US borders. If it involves a UK-incorporated entity's foreign branch, OFSI rules apply.
Factor 2: The type of sanction triggered
OFAC administers list-based blocking sanctions (the SDN List), non-blocking sanctions, sector-based sanctions, government blocking, jurisdiction-based sanctions, and secondary sanctions. OFSI administers list-based financial sanctions (the UK Sanctions List), sectoral sanctions, and directions. OFSI does not impose comprehensive country-based sanctions.
If you're dealing with a blocked person on the SDN List and you're a US person, you must freeze assets. If you're dealing with a designated person on the UK Sanctions List and you're a UK person, you must freeze funds and economic resources. OFSI's "economic resources" includes tangible and intangible assets that can obtain funds, goods, or services.
Factor 3: Your liability exposure
Both OFAC and OFSI apply strict liability to violations occurring after June 15, 2022. You can be held liable without knowledge. But their enforcement approaches differ.
OFAC offers a 50 percent penalty reduction for voluntary disclosure. OFSI offers 30 percent. OFAC has a 10-year statute of limitations. OFSI generally has none. OFAC requires you to keep records for at least 10 years. OFSI defers to general UK recordkeeping law unless a license specifies otherwise.
Path A: When OFAC Rules Control Your Decision
Choose this path if:
- You are a US person (citizen, permanent resident, or US entity) regardless of where you operate.
- The transaction involves US dollars clearing through a US correspondent bank.
- Your company is incorporated in the US, even if the transaction happens through a foreign branch.
- You're a non-US person but the activity would cause a US person to violate OFAC sanctions.
What this means for your compliance program:
You must screen against the SDN List and applicable non-SDN sanctions lists. You must file an Annual Report of Blocked Property by September 30 if you held blocked property as of June 30. You have 10-day reporting requirements for holding, unblocking, or transferring blocked property.
Your recordkeeping obligation is at least 10 years, and specific licenses may extend that. If you discover a potential violation, voluntary disclosure to OFAC may reduce your penalty by half, but you're working within a 10-year enforcement window.
Train your team on OFAC's enforcement factors: willfulness, awareness of conduct, harm to sanctions objectives, compliance program strength, remedial response, and cooperation. OFAC may issue a Cautionary Letter, a Finding of Violation, impose a penalty, or refer you to the Department of Justice for criminal prosecution.
Path B: When OFSI Rules Control Your Decision
Choose this path if:
- You are a UK person regardless of location.
- Your entity is incorporated or constituted under UK law.
- The activity occurs within the UK or its territorial sea.
- You're a non-UK person but have a UK nexus (a fact-specific determination).
What this means for your compliance program:
You must screen against the UK Sanctions List maintained by the Foreign, Commonwealth and Development Office under the Sanctions and Anti-Money Laundering Act 2018. You must file an Annual Frozen Asset Review by November 30 if you held designated person assets as of September 30.
Unlike OFAC, OFSI has no reporting requirement when you reject a prohibited transaction. Your recordkeeping follows general UK law unless your license specifies otherwise.
If you discover a breach, voluntary disclosure to OFSI may reduce your penalty by 30 percent. OFSI may issue a warning letter, refer you to a professional regulator, publish information about the breach even without imposing a penalty, or impose a civil monetary penalty. Criminal referral is also possible.
OFSI assesses circumvention, value of breach, strategic priority, harm to objectives, your knowledge, your risk awareness, ownership and control, and whether breaches were repeated or extended. With generally no statute of limitations, your exposure window is indefinite.
Path C: When Both Regimes Apply
Choose this path if:
- Your entity has both US and UK components (for example, a US parent with a UK subsidiary, or vice versa).
- The transaction involves parties or payment routing in both jurisdictions.
- You're dealing with a person who appears on both the SDN List and UK Sanctions List.
What this means for your compliance program:
You must comply with the stricter standard at every decision point. Screen against both lists. Meet both reporting deadlines (OFAC's September 30 and OFSI's November 30). Keep records for 10 years minimum. File voluntary disclosures to both authorities if you discover a violation.
Your training must cover both liability frameworks. Your team needs to understand that OFAC's extraterritorial reach and OFSI's UK nexus test can both pull you in, and that "comprehensive" sanctions don't exist under OFSI but do under OFAC.
Consider whether you need separate compliance workflows for US and UK operations, or a unified system that applies the higher standard across the board. The latter is simpler but may impose unnecessary restrictions on purely UK or purely US activities.
Summary Matrix
| Decision Factor | OFAC Path | OFSI Path | Both Regimes |
|---|---|---|---|
| Jurisdiction trigger | US person, US entity, US transit | UK person, UK entity, UK nexus | Both apply |
| Screening list | SDN List + non-SDN lists | UK Sanctions List | Both lists |
| Annual reporting deadline | September 30 (ARBP) | November 30 (AFAR) | Both deadlines |
| Recordkeeping minimum | 10 years | General UK law | 10 years |
| Voluntary disclosure benefit | 50% penalty reduction | 30% penalty reduction | File with both |
| Statute of limitations | 10 years | Generally none | Indefinite exposure |
| Rejected transaction reporting | 10-day requirement (if blocked property involved) | No requirement | Follow OFAC rule |
The choice isn't always binary. Many transactions sit in the overlap. When that happens, your compliance program must accommodate the stricter requirement at every turn. That's not redundancy; it's the cost of operating across jurisdictions that coordinate goals but maintain distinct enforcement regimes.
