The penalty is for GBP4,732,830.58 in respect of breaches of the Russia (Sanctions) (EU Exit) Regulations 2019 and the Global Anti-Corruption Sanctions Regulations 2021.

The case involved 970 transactions worth approximately GBP19.7 million processed between 2022 and 2025. The majority of the breaches occurred between February and November 2022 following Russia's illegal invasion of Ukraine and arose across the bank's operations, including payment processing, correspondent banking and account restrictions.

Citbank London voluntarily disclosed the majority of the breaches, co-operated with OFSI's investigation and undertook remediation. OFSI applied a 20% voluntary disclosure and co-operation discount and a 20% settlement discount, resulting in a final penalty of £4,732,830.58.

It's surprising because, basically, it averages out at one failure per day over three years. This is not a minor breach: it is a persistent systemic failure.

The full penalty notice is here: https://assets.publishing.service.gov.uk/media/6a97e3ba5a0c25165ae46760…