What Cyprus Firms Can Learn from the Citibank Sanctions Penalty
A sanctions policy is only as useful as the processes that carry it out. A recent UK enforcement decision shows how routine weaknesses can allow payments to continue after restrictions should have been applied.
On 2 September 2026, the UK Office of Financial Sanctions Implementation, or OFSI, published a £4,732,830.58 penalty against Citibank N.A., London Branch. The notice identifies 970 payments worth about £19.72 million that OFSI considered breaches of UK Russia and Global Anti-Corruption sanctions. The bank received a 20% discount for voluntary disclosure and cooperation. [1]
UK rules do not become Cyprus law because a UK regulator applies them. However, the operational questions raised by the notice are useful for Cyprus banks, payment businesses, crypto-asset service providers and other firms handling large numbers of transactions.
Can the team deal with a sudden increase in alerts?
The notice identifies sanctions-alert backlogs and delays in restricting accounts. [1] Firms should test how they would deal with a large number of new designations at once. Who can increase staffing, prioritise urgent cases or apply temporary controls while an alert is investigated?
A dashboard that shows only the total number of open alerts may hide the real problem. Management also needs to understand their age, likely significance and whether transactions can continue during review.
Does name matching work in real conditions?
OFSI’s findings include a failure to match “PAO Sovcomflot” with “Sovcomflot”. [1] Testing should use realistic variations, including corporate prefixes, spelling differences and aliases. A system that matches a clean test name may behave differently when the payment message contains additional words.
The aim is not to remove all screening thresholds. It is to understand how they behave and whether the firm can justify the balance it has chosen.
Does a designation trigger a wider ownership review?
The notice also addresses incorrect ownership and control decisions and failures involving subsidiaries of designated majority owners. [1] A new designation should prompt the firm to consider related entities, rather than waiting for each subsidiary’s name to appear on a list.
That process needs a clear owner. Where information is incomplete, the file should record what remains unresolved and what restrictions apply while the review continues.
Do restrictions cover automatic account activity?
OFSI identified internal charges deducted from restricted accounts. [1] Firms should therefore examine their own automated processes as well as customer payments. Fees, standing instructions and other account movements may continue in the background unless the restriction reaches the relevant system.
An end-to-end test should check what actually happens to the account after a freeze is applied.
Is permission checked before the transaction?
Where a licence or exception is relevant, the review should establish whether it covers the precise transaction before processing. A general understanding that a type of payment may be permitted is not enough. Amounts, parties, purpose and conditions can matter.
The person authorising the payment should be able to see the basis for doing so and any limits that apply.
Can management see whether fixes have worked?
A revised procedure is only the first step. Firms should test a sample of real outcomes and record whether changes have reduced the identified problem. Training attendance and software installation do not, by themselves, demonstrate that a control works.
For Cyprus firms, the useful response to this case is a focused review of their own payment and account processes. The legal analysis must use the sanctions regimes applicable to the firm and transaction; the operational testing should follow the money through the systems that actually move it.
AGPLAW advises on AML and sanctions compliance and regulatory legal support.
Source [1]: OFSI public penalty notice concerning Citibank N.A., London Branch.
Disclaimer: This article provides general information and is not legal advice on a specific matter.
