On January 27, 2026, the UK’s Office of Financial Sanctions Implementation fined the Bank of Scotland £160,000 after its Halifax subsidiary opened an account in February 2023 for Dmitrii Ovsiannikov, a sanctioned former Russian politician and Putin ally, and processed 24 payments totaling £77,383. Ovsiannikov had been sanctioned in 2020 over the Russia-Ukraine War and sentenced to over three years in prison for sanctions violations.
The account escaped detection because Ovsiannikov’s UK passport contained spelling variations of his name – including changed and additional characters in the first name, a missing middle name, and an altered surname character – that differed from his listing on the UK Sanctions List as “Dmitrii Vladimirovich Ovsyannikov.” These variations, common in Russian-to-English translations, prevented the bank’s automated sanctions screening system from triggering alerts during account opening or subsequent transactions, serving as a reminder that when automated systems fail, the penalty falls on the institution, not the software.
Fuzzy Matching
This case underscores the importance of “fuzzy matching” algorithms that can identify similar but not identical names. Effective fuzzy matching balances sensitivity, catching genuine matches despite spelling variations, with specificity and results in few irrelevant alerts, making it critical for both regulatory compliance and operational efficiency.
The importance of fuzzy matching is mirrored in government policy. On January 28, 2026, UK authorities finalized a unified UK sanctions list featuring fuzzy logic search, enabling comprehensive searches via a single government portal. [1]
However, Russian names pose a challenge as many can be transliterated into English in more than one way. While fuzzy matching can assist in the process of identifying people with similar names, it cannot do the entire job. Additional identification steps are critical, especially when it comes to a relatively common name, such as the one in this case, as it is likely that numerous Russians with this name spell it in different ways.
Self-Disclosure
In adjudicating the case – specifically, when deciding it could be deemed “serious” as opposed to “most serious” and the bank was eligible for a reduced penalty – the Office of Financial Sanctions Implementation noted that Bank of Scotland voluntarily disclosed the potential breach soon after recognizing it. [2]
There are real advantages to self-disclosure, especially when it is prompt. The disclosing party may face lesser criminal charges or avoid prosecution altogether and may reduce the reputational impact of declaring a sanctions breach. However, self-reporting comes with an increased responsibility to prevent sanctions breaches going forward. It calls for prudent risk assessment and regular enhanced due diligence of relevant counterparties. Introducing additional identity verification is also a critical step in preventing sanctioned parties from operating under the radar.
What to Do to Ensure Compliance
To ensure compliance, organizations should:
- Adopt a risk-based approach to due diligence, one that ensures an understanding of how UK sanctions prohibitions impact the financial sector
- Use compliance lessons to improve awareness of sanctions evasion.
- Conduct regular enhanced due diligence on clients and transactions in high-risk jurisdictions, particularly when there are changes in transactional patterns.
- Understand the specific UK obligations within multinational corporate structures, particularly where requests and transactions originate from the wider corporate group.
- Develop and maintain internal screening procedures necessary to identify transactions that may be in breach of UK trade sanctions regulations.
- Implement safeguards that enable payments to be declined or stopped before they are made.
- Ensure an understanding of the mandatory reporting requirements for regulated sectors and the benefits of voluntary disclosure.
- Where necessary, use Office of Financial Sanctions Implementation’s online reporting tool to promptly report potential breaches. [3]
Conclusion
Although this enforcement action arose under the UK’s sanctions regime, its lessons apply globally. The first is well-known: under the right circumstances, quick and complete cooperation with authorities can prevent a bad situation from getting worse, soften the penalties, and help preserve a company’s reputation. The second is that robust sanctions compliance requires more than rule-based automation: it demands human judgment and effective cooperation across affiliates and borders. The failure here was local, but the compliance imperative is unmistakably global.
