News
FCA report on sanctions systems and controls
11 June 2026
Over the past four years, the UK's sanctions regimes have grown in scope and complexity. The Financial Conduct Authority (FCA) has been reviewing financial services firms' systems and controls for financial and trade sanctions. It has now published a report on its findings.
Although this is focussed on the financial sector, it contains useful and relevant information for law firms. This includes examples of good and poor practice, which all solicitors' firms might find useful, including:
- While the Russian sanctions regime remains the biggest source of reports, there are an increasing number relating to Iran and North Korea.
- Reports of sanctions breaches are not always timely: 35 per cent of reports in 2025 related to breaches in the year or more earlier. The average time between a breach and a report was 116 days. This is an important point as OFSI's enforcement guidance notes: 'In relation to whether a report is prompt, we expect a breach to be disclosed as soon as reasonably practicable after discovery of the breach.'
- The FCA found weaknesses among firms which relied on third parties to conduct sanctions screening. Several firms were unable to demonstrate that they understood the outputs of these providers, or who had responsibility to monitor the risk level on an ongoing basis.
- The importance of fuzzy logic in searches is highlighted, with some firms failing to identify sanctioned individuals if their names were not in the Latin alphabet or contained variant spellings.
- In one case study, a bank's compliance analysts bypassed mandatory sanctions escalation procedures due to pressure to meet internal targets. Key sanctions indictors were also missed and connections to designated persons were not identified.
- Good control measures remain robust and informative sanctions training, and stress-testing existing systems after changes to the sanctions regime.
Larger firms, with systems, controls and resources comparable to financial institutions, are likely to find the whole report useful in considering threats against their firms.