Guidance published by the Office of Financial Sanctions Implementation (OFSI) in February 2026 draws lessons from its £160,000 monetary penalty imposed on Bank of Scotland Plc, a subsidiary of Lloyds Banking Group. The penalty was imposed for breaching Russia financial sanctions regime.
Although the penalty was directed at a financial institution, the lessons OFSI sets out are directly relevant to law firms and regulated entities across the UK, including those regulated by the Law Society of Scotland.
How Effective Are Your Sanctions Controls? Asks OFSI
Scottish law firms operate in an environment where sanctions compliance sits alongside AML obligations, client due diligence requirements, and increasingly complex geopolitical considerations.
OFSI’s published guidance is clear. The question is not simply whether a firm has sanctions controls in place, but is directed at how effectively those controls operate in practice. This includes the way screening data is configured, how concerns are escalated, how often training is refreshed, and how quickly potential breaches are reported. This is a distinction that every compliance officer and practice manager in Scottish law firms should note of.
Below, our compliance team looks at each of the lessons shared by the OFSI:
Lesson 1: Screening Systems Require Active Management
In the published case study, it was shown that the Lloyds Banking Group’s automated sanctions systems failed to detect a spelling variation of a designated individual’s name. For law firms, this is a reminder that screening tools must be configured carefully and reviewed regularly. Relying on a system without understanding its limitations is not a defensible position. Firms handling international matters, transactions involving politically exposed persons, or clients with connections to higher-risk jurisdictions should give particular thought to whether their current arrangements would catch variations in names or transliterations.
Lesson 2: Automation Does Not Remove Responsibility
Internal policies should provide robust, explicit guidance to staff regarding the escalation of political sanctions concerns, particularly for areas of business that are more exposed to sanctions risk. Front-line fee earners need to know not just that they should escalate a concern, but who to contact, how, and when. Vague policy wording is not sufficient.
Lesson 3: Training Must Reflect the Current Landscape
OFSI highlights how “the sanctions landscape has evolved significantly since the Russian invasion of Ukraine in February 2022 and continues to develop with ever-shirting geopolitical events.” Training materials that have not been updated since 2022 are unlikely to reflect the position as it stands today. Regular review of your training materials is not optional to ensure continued compliance.
Lesson 4: Voluntary Disclosure Matters
One key takeaway includes the importance of prompt, voluntary disclosure of a potential breach. Lloyds Banking Group, on behalf of Bank of Scotland, made an initial notification within two weeks of identifying a breach. OFSI says it “seeks to reward prompt and complete voluntary disclosures through penalty discounts, which alongside co-operation can result in a discount of up to 30% under new guidance.”
Firms that identify a potential breach and delay reporting in the hope that the matter will resolve itself are taking a significant risk. Acting promptly, even with partial information, is the appropriate course of action.
Source: Sanctions compliance in practice: lessons from OFSI’s £160,000 Bank of Scotland penalty
What This Means for Your Law Firm
UK financial sanctions apply to any conduct in the UK and to all UK persons (including UK legal entities) anywhere in the world. Compliance with these obligations is not a box-ticking exercise, and OFSI’s guidance reinforces that enforcement activity looks at the whole picture. Firms must be able to display how they run sanctions controls in practice, with robust systems, ongoing training, escalation procedures, and conduct following a breach.
Scottish law firms with any exposure to international clients, cross-border transactions or matters touching on designated persons or entities should review their arrangements against each of these areas now, rather than wait for a concern to arise.
How RACO Supports Scottish Law Firms
At the Regulation and Compliance Office (RACO), we work with Scottish law firms to strengthen their AML frameworks in a way that is practical, proportionate, and aligned with how firms actually operate.
We can support your firm with:
- Business-Wide Risk Assessments
Ensuring your risk assessment reflects your current services, clients, and exposure. - AML Policy and Procedure Reviews
Aligning your documentation with regulatory expectations and best practice. - Independent AML Audits
Providing an objective review of your compliance framework. - AML Training
Supporting your team in understanding their responsibilities and recognising risk in practice. - Ongoing Compliance Support
Giving your firm access to experienced compliance professionals as your needs evolve.
Our approach is designed to support firms at all stages, whether you are reviewing your framework for the first time or looking to strengthen existing controls.
Outsourced Compliance Solutions
Our goal is to ensure the firms we work with have and maintain a compliant structure, enabling them, their managers, and owners to focus on serving their clients.
Our packaged risk and compliance solutions provide guidance and support to firms on a range of topics, including:
- Our Regulation and Compliance Service, including Risk Management and AML Risk, provides firms with the necessary Policies, Controls and Procedures (PCPs) alongside training, supervision structure, an annual independent assessment and reporting. This solution ensures that firms and their staff are compliant and remain so. It also clarifies what to do in the event of a breach.
- Our extended service, Regulation & Compliance Outsource Guidance & Support, provides an outsource solution for firms where RACO not only manages and maintains the risk registers and provides guidance to all staff, including partners, but also produces monthly risk and compliance reports.
The combination of these two solutions provides a law firm with a robust, cost-effective risk and compliance strategy that ensures staff have access to expert guidance when needed.
Join The RACO Membership
The Regulation and Compliance Office membership offers Law Firms the opportunity to experience a range of benefits and discounts unavailable to non-members.
These benefits include:
- Members Area—access the online Members Area to interact with RACO, access vital information, and provide or update information about your Firm.
- Members Helpline– a dedicated helpline for the use of our members to gain support and guidance on Practice Management, Risk and Regulatory matters.
- Online Health check– an annual review which includes: Competitor analysis, Search Engine Ranking analysis, Technical website overview
- News and updates– informative news, white papers and blogs all written for or by the Regulation & Compliance Office for our members.
- Regulatory Updates– regulatory information about the legal market and knowledge sharing
- Client Referral Scheme– a work exchange scheme enabling Firms to send and receive work in return for a fee share.
- Mergers and Acquisitions– a discrete service that enables our member firms to advertise themselves for sale or merger, or to notify others that they are looking to acquire another firm.
- Recruitment– a vacancy section where you can post your vacancies and we will advertise these for our members across our social media, including LinkedIn Jobs.
- Discounts– members are entitled to exclusive discounts on products and services (not available to non-members).
Membership is priced at £495 per annum, payable monthly at £42.00 per month plus VAT.
The Regulation and Compliance Office
We work with law firms and professional indemnity insurers, advising and guiding on compliance and risk management techniques to assist and reduce instances of claims or regulatory breaches.
We offer a range of services and consultancy tailored to the legal sector, with specialist knowledge of Scottish regulatory requirements. We have gained a wealth of knowledge and experience in the overall management of law firms across multiple jurisdictions, and work with them to achieve profitability, stability, and efficiency. Our goal is to consistently provide high-quality services and solutions.
For more information about The Regulation & Compliance Office, you can call us on 0203 985 8550 or email us at: info@regulationandcomplianceoffice.co.uk
