Introduction
Britain has fined Citibank's London unit £4.7 million ($6.35 million) for breaching its Russia sanctions regime, the Office of Financial Sanctions Implementation (OFSI) announced. The regulator found that Citibank's London branch processed 970 payments worth a total of more than £19.7 million for accounts that should have been restricted.
The fine and the breaches
According to OFSI, the majority of the breaches occurred between February and November 2022, shortly after Russia's invasion of Ukraine, which prompted the UK, the US and the EU to impose thousands of sanctions on Russian individuals and entities. Some of the transactions that Citi voluntarily flagged to OFSI took place as late as 2025.
OFSI described the errors as "material and significant," occurring "across a wide range of business areas and systems within the bank." The regulator noted that many breaches arose in the aftermath of sanctions initially being imposed, which had placed "significant strain on the bank's alert handling and investigation processes." However, OFSI stated that it does not consider there to have been any intent by CBNA London to breach sanctions.
Specific failures
In one instance, OFSI found that Citi failed to freeze up to 24 commercial bank accounts belonging to 11 companies controlled by a single designated Russian individual. Of the £5.9 million in funds passed through by that client, around £4.3 million was processed in the first 24 hours of the individual being placed on the sanctions watchlist.
The regulator also said that Citibank delayed reporting frozen assets to OFSI by over six weeks on 53 separate occasions, with delays taking as long as 518 days in extreme cases. Some of the accounts were used by companies linked to PJSC Sovcomflot, the largest shipping company in Russia.
The incident stemmed from Citi's screening software failing to generate alerts for PAO Sovcomflot because it did not recognise the Russian corporate prefix "PAO" attached to the name. An automated payment processor was also found to have selected Russian correspondent banks from an internal list that was never screened against sanctions lists before adding them to transactions.
Additionally, OFSI found that Citi processed payments for designated Russian banks Alfa-Bank JSC, PJSC Gazprombank and Credit Bank of Moscow. To handle the backlog, the bank temporarily altered its compliance guidance in May 2022 to stop restricting accounts unless it had evidence of over 50 per cent ownership by an individual on the sanctions list.
Penalty and response
OFSI rated the severity of the case as 'high' with 'aggravating' factors. The fine was reduced to £4.7 million from a higher amount after Citi received a 20 per cent settlement discount for co-operation. The regulator noted that CBNA London had voluntarily disclosed the majority of the breaches.
A Citi spokesperson said: "We are pleased to conclude this matter with OFSI. Citi takes sanctions compliance extremely seriously and continues to invest significantly in its global sanctions compliance framework." The spokesperson added that the unit "proactively" engaged and cooperated with OFSI through its investigation.
Context
Citigroup had ceased almost all institutional banking services in Russia as of 2025. It obtained approval from Russian President Vladimir Putin in November 2025 to sell its bank inside the country.
The fine is the latest in a series of actions by UK regulators against financial institutions for sanctions breaches. In May, Deutsche Bank was handed a £160,000 fine after it was found to have authorised two payments linked to a sanctioned Russian firm between June and July 2022. A subsidiary of Lloyds Banking Group was also fined at the beginning of the year for sanctions breaches after opening a bank account for an ally of Vladimir Putin.