When “Winding-Down” Goes Wrong: Lessons from the OFSI Colorcon Notice

On 30 September 2025, the UK's Office of Financial Sanctions Implementation (OFSI) published a monetary penalty of £152,750 imposed on Colorcon Limited, a pharmaceuticals provider. The penalty was for making funds available to designated persons (DPs) in breach of the UK's sanctions on Russia.

The Colorcon case is the sixth enforcement action by OFSI in 2025. This is a notable increase on the single penalty issued in 2024, and further evidence that cases concerning breaches of sanctions imposed on Russia since 2022 are increasingly making their way through the OFSI enforcement process.

The penalty offers a useful reminder to businesses on the importance of timely disclosing breaches to OFSI and of proactive, comprehensive sanctions compliance for companies operating in high-risk jurisdictions.

Background

The Breaches

Colorcon is the UK subsidiary of a US-headquartered pharmaceuticals group. Colorcon operated a representative office in Moscow that made 123 payments (totalling £191,290.57) in 2022 to employees and service providers holding accounts at Russian banks. The employees and service providers were not designated targets of UK sanctions, but the Russian banks were. OFSI assessed that:

• 44 of the payments (totalling £63,012.85) were permitted under an OFSI General Licence (GL) relating to companies winding down operations in Russia.
• Colorcon continued to make payments after the expiry of the GL and OFSI identified 79 payments (totalling £128,277.72) that were made in breach of sanctions.

The payments were predominantly made to pay the salaries of employees of Colorcon's Moscow office, with a small number for payroll and other services.

In June 2022, the UK introduced a strict civil liability financial sanctions regime. That means that for breaches after that date OFSI does not have to prove that a person knew, or had reasonable cause to suspect, that they were breaching sanctions. OFSI assessed that, for payments that fell prior to the introduction of strict civil liability, Colorcon had knowledge or reasonable cause to suspect that their actions would breach sanctions.

Financial Penalty

OFSI’s Enforcement and Monetary Penalties guidance states that a discount of up to 50% may be granted if a person gives a prompt and complete voluntary disclosure of the breach in "serious" (as opposed to "most serious" cases).¹

• OFSI assessed that the case was "serious" and applied a 35% discount to the financial penalty to take into account Colorcon's full cooperation with its investigation.
• While Colorcon made initial and full disclosures to OFSI, there was a 4 month delay between Colorcon becoming aware of the breaches and making an initial notification to OFSI, so OFSI did not consider that Colorcon's disclosure could be reasonably considered prompt.
• Furthermore, Colorcon's initial disclosure (after the 4 month delay) was only a pre-notification. OFSI considered that a subsequent fuller disclosure (provided after a further two months) was detailed and complete.

GLs often include reporting and record keeping requirements. These may require parties who rely on the GL to do something that would otherwise be unlawful to provide details of their activities to OFSI. OFSI assessed that Colorcon did not comply with the reporting requirements under the GL, which is an offence in its own right. While OFSI did not impose a separate penalty for this breach, it considered it to be an aggravating feature in assessing the monetary penalty against Colorcon.

Key Takeaways

4 Months is Too Long: The Importance of Timely Voluntary Disclosure

• Businesses considering voluntarily disclosing breaches to OFSI – particularly those such as Colorcon which do not have mandatory reporting requirements as regulated entities – should take note of OFSI's findings regarding the timeliness of Colorcon's disclosure.
• OFSI did not consider Colorcon's initial voluntary disclosure, which took place four months after becoming aware of the breach, to be prompt, and reduced its discount to 35%.
• OFSI's position is that it is reasonable to "take some time to assess the nature and extent of the breach, or seek legal advice", but that this "should not delay an effective response to the breach". Businesses should ensure that they investigate or seek legal advice on potential breaches of UK sanctions, and consider voluntary disclosure, on a timely basis.

Payments to Non-Designated Accounts at Designated Banks Breach UK Sanctions

• This is not a new development. OFSI decision notices have made this point clear since 2021. However, it appears to be an area which frequently catches businesses out. The position is clear that, even if the beneficiary of a payment is not designated, a payment to their account at a designated bank will be considered making available funds to the designated bank.
• Businesses should ensure screening of both counterparties and receiving banks to avoid falling foul of UK sanctions.

General Licence Reporting is Mandatory, not 'Best Practice'

• Businesses should be alive to their reporting obligations if seeking to use an OFSI GL which contains a reporting requirement. Colorcon’s failure to report certain lawful payments under the relevant GL became an aggravating factor in the penalty calculation.

Policies Dated 2018 Will Not Survive 2025 Scrutiny

• Businesses should ensure that they regularly refresh their sanctions policies and risk assessments.
• OFSI criticised Colorcon for failing to fully refresh its sanctions procedures after 2018, notwithstanding significant geopolitical changes.
• This expectation will be particularly relevant to businesses operating in high-risk jurisdictions such as Russia. OFSI expects companies operating in such jurisdictions to have a more developed understanding and awareness of financial sanctions.
• Businesses should also ensure that their policies and processes cover both financial and trade sanctions, even if one of these appears more immediately relevant to a company's day to day activities.

Screening Must Cover All Relevant Counterparties

• Businesses should ensure that their screening processes cover all applicable third parties. Colorcon's procedures were focused on its direct customers, shareholders and remitting banks, rather than its employees and service providers.

Reliance on Third Parties for Screening is Not a Defence

• Businesses should be alive to the fact that it is insufficient to rely on third parties to undertake financial sanctions checks. Colorcon's understanding was that its bank would apply UK sanctions across the bank's business, however OSFI is clear that companies will still be liable for such breaches and should properly understand their third parties' activities.

We anticipate that a number of the areas covered in the Colorcon case will continue to be recurring themes in future OFSI cases.

To keep track of all the latest Russian sanctions developments, access our Russia Sanctions Tracker here.

Other Authors: Ruth Pillay, Trainee