On 3 April 2025, the Office of Financial Sanctions Implementation (OFSI) published its first Legal Services Threat Assessment. While the report focuses specifically on the legal sector, many of the risks and recommendations it outlines are highly relevant to firms across the financial services landscape.
The assessment provides a snapshot of how financial sanctions risks are materialising in practice, and it underscores the importance of a proactive, risk-based approach to compliance.
For payment, and e-money institutions, cryptoasset firms, and other regulated businesses, the report offers timely insights into both the evolving threat environment and OFSI’s expectations.
Key Judgements from OFSI
The report identifies two primary concerns: underreporting of breaches and ongoing risks posed by Russian Designated Persons (DPs) and their enablers.
Underreporting of breaches
OFSI notes that detection and reporting of potential sanctions breaches remain inconsistent, even among regulated legal service providers. In some cases, breaches are not reported due to weak internal processes, a lack of clear responsibilities, or uncertainty over what constitutes a breach.
This has clear parallels in other sectors. Firms that provide regulated services or facilitate cross-border transactions must ensure their detection and escalation procedures are robust. Failure to identify and report breaches not only increases legal risk but may also expose firms to enforcement action.
Risks from Russian DPs and enablers
The report highlights persistent threats from Russian-designated individuals and entities, particularly where they operate through intermediaries or complex corporate structures. OFSI emphasises the need for heightened vigilance, particularly in high-risk sectors or client relationships involving international exposure.
OFSI’s Recommendations
OFSI’s central message is that sanctions compliance must be proactive and risk-based.
The report encourages firms to conduct internal “lookback” exercises, designed to identify any unreported breaches or control gaps that may have been missed at the time.
Other recommended steps include:
- Adopting a documented risk-based approach, tailored to the firm’s business model, client base, and geographical exposure.
- Regularly reviewing screening tools and CDD processes, ensuring they capture relevant ownership and control indicators.
- Improving staff awareness and accountability, particularly in frontline and onboarding roles.
- Making use of published guidance, including OFSI’s enforcement notices and compliance case studies.
These recommendations apply equally to regulated firms, especially those handling complex client arrangements or facilitating asset flows across borders.
Final Thoughts
OFSI’s Legal Services Threat Assessment should not be seen as relevant only to the legal profession. Its findings speak to wider challenges in sanctions compliance across the regulated sector. The evolving sanctions landscape, particularly in relation to Russia, requires firms to move beyond static controls and adopt a dynamic, intelligence-led approach.
Now is a good time for firms to revisit their sanctions frameworks and consider whether existing measures remain fit for purpose. API Compliance Ltd. offers support with risk assessments, internal reviews, and training to ensure firms remain aligned with current expectations.
If you would like to discuss your firm’s sanctions obligations or conduct a gap analysis, please get in touch using our contact form.
