The UK Sanctions List explained for small businesses

The UK Sanctions List is the UK government's list of every person, entity and ship designated under UK sanctions. Entities under the Russia financial and investment restrictions sit on a separate list, covered below. The Foreign, Commonwealth & Development Office (FCDO) publishes it. If a supplier or customer is on it with an asset freeze, a business bound by UK law cannot pay them or make anything of value available to them.

For the basics of how sanctions lists work, start with what a sanctions list is.

What is the UK Sanctions List?

The UK Sanctions List shows which people, entities and ships are "designated or specified under regulations made under the Sanctions and Anti-Money Laundering Act 2018". Each sanctions regime, such as Russia, Iran or counter-terrorism, has its own set of regulations under it.

Each entry says which regime it falls under and which sanctions apply. An asset freeze is the one that matters most to a business paying bills and raising invoices. Other entries carry travel bans, director disqualification or, for ships, measures such as a ban on port entry.

The CSV dated 15 October 2026 held 6,408 entries under 31 regimes: 4,058 individuals, 1,667 entities and 683 ships. Most entries take up several rows in the file, one per name variant or address, so the raw row count is much higher.

Who maintains the list and who enforces it?

Two parts of government share the work. OFSI's general guidance sets out the split in section 1.2:

• The FCDO is "responsible for the UK's international sanctions policy, including all international sanctions regimes and designations". It decides who goes on the list and publishes it.
• The Office of Financial Sanctions Implementation (OFSI) is "the authority responsible for implementing the UK's financial sanctions on behalf of HM Treasury". It issues licences, takes reports and imposes civil penalties.
• The National Crime Agency investigates and enforces criminal breaches.

So the FCDO writes the list. OFSI is who you talk to when a name on it turns up in your accounts.

What changed on 28 January 2026?

Until January 2026 the UK ran two lists. The FCDO published the UK Sanctions List. OFSI, part of HM Treasury, published its own Consolidated List of Asset Freeze Targets, with a separate search tool.

That ended on 28 January 2026. The GOV.UK notice on the move to a single list says that from 9am UK time that day, the UK Sanctions List became the only list of UK sanctions designations.

The notice says the UK list's existing files did not change format. They keep the same fields in the same order.

One list stays separate. The Russia list of persons named in relation to financial and investment restrictions is not part of the UK Sanctions List. GOV.UK says its 11 entities remain subject to sectoral financial and investment restrictions under the Russia regulations.

Who has to follow UK sanctions?

Section 21 of the Sanctions and Anti-Money Laundering Act 2018 sets the reach. UK sanctions regulations can cover:

• conduct in the United Kingdom or in the territorial sea, by any person
• conduct anywhere else, but only by a United Kingdom person

The Act defines a United Kingdom person as a UK national, or a body incorporated or constituted under the law of any part of the UK.

OFSI's guidance puts it in plain terms in section 1.4. Financial sanctions apply to "all persons within the territory and territorial sea of the UK and to all UK persons, wherever they are in the world." That includes UK companies and their branches.

For a small business, this means:

• A UK limited company is bound wherever it trades.
• A sole trader who is a UK national is bound, even while working abroad.
• A foreign business is bound for anything it does in the UK.
• A foreign business with no UK link is not bound, but its UK suppliers, customers and banks are.

What an asset freeze stops you doing

Section 3 of OFSI's guidance lists the main asset freeze prohibitions. You must not:

• "deal with the frozen funds or economic resources" of a designated person, or of an entity they own or control
• "make funds or economic resources available, directly or indirectly, to, or for the benefit of, a designated person"
• "engage in actions that, directly or indirectly, circumvent the financial sanctions prohibitions"

"Funds" means "financial assets and benefits of every kind". "Economic resources" covers assets of every kind that are not funds, tangible or intangible. OFSI's examples include vehicles, property, precious metals and antiques. OFSI says it "interprets prohibitions widely."

In a bookkeeping system, that means: do not pay a bill from a designated supplier, even for work already delivered. Do not ship goods to a designated customer. If money arrives from a designated party, do not move it.

How does the ownership and control rule work?

A company can be caught by a UK asset freeze without appearing on the list. Section 4 of OFSI's guidance says entities owned or controlled by a designated person "may not be designated in their own right", so "their names may not appear on the sanctions list". It adds that "those entities are similarly subject to financial sanctions."

The guidance treats an entity as owned or controlled by a person when any of these is true:

• the person holds, directly or indirectly, more than 50% of the shares or voting rights
• the person has the right, directly or indirectly, to appoint or remove a majority of the board
• it is reasonable to expect the person could ensure the entity's affairs are run the way they want

The UK threshold is more than 50%. A 50% stake on its own does not meet the shares test. The EU and US use 50% or more, which our EU sanctions list guide compares in a table.

OFSI also does not simply add up separate holdings. Its guidance says it "would not simply aggregate different designated persons' holdings in a company", unless, for example, the shares are held under a joint arrangement between the designated parties. Two designated people with 30% each, acting independently, do not make the company owned by a designated person on that basis alone. The control test can still apply.

In practice, a name check alone can miss a sanctioned company. For any supplier or customer you pay large amounts to, find out who owns it.

Where do you download or search the UK Sanctions List?

The UK Sanctions List page on GOV.UK links to two things.

The search service. The FCDO runs a free search at search-uk-sanctions-list.service.gov.uk. It is the replacement for the old OFSI search tool. Use it for one-off checks on a single name.

The full list as files. The page links to seven formats: CSV, ODS, ODT, XML, HTML, TXT and PDF. Since January 2026 each file sits at a fixed URL, so a script or spreadsheet can fetch the same link every time. The format guide says "The data provided in each format is identical." It also explains every field.

Fields you will use when checking a contact:

• names, name variations and aliases, including names in non-Latin script
• date of birth, nationality, passport and national ID numbers
• up to six address lines, postcode and country
• the regime, the sanctions imposed and the date designated
• a Unique ID for each entry, and for ships an IMO number

For a contact list exported from Xero or QuickBooks, the CSV is the easiest file to open next to it. Our guide on how to check Xero contacts against sanctions lists walks through the export and the search step by step.

How often does the UK Sanctions List change?

There is no fixed schedule. The FCDO updates the list whenever designations change, and the GOV.UK page keeps a dated log of each update. The log shows several updates in most months. The latest when we checked was 15 October 2026, a variation under the Russia regime.

OFSI's general guidance gives the FCDO's targets. The FCDO aims to update the list "within one working day for all new UN and UK listings coming into force in the UK". For all other amendments, the target is "within 3 working days".

To hear about changes, sign up for the UK sanctions email alerts linked from the list page. A check you ran last month says nothing about names added since.

What do you do on a possible match?

A matching name is not a match on its own. Section 2 of OFSI's guidance says a name match "does not necessarily mean" you are dealing with the person on the list. Work through it like this:

1. Compare the details. Check the entry's date of birth, nationality, address and ID numbers against what you know about the contact. If everything matches, OFSI says "this is likely to be a target match."
2. Rule out false positives. If you are satisfied it is a different person or company, OFSI says you "do not need to take further action." Write down why you decided that.
3. Escalate close calls. For a close name match with some details that differ, OFSI's guidance says "You should contact OFSI immediately." If you are still unsure after checking the list, you can contact OFSI for help.
4. Stop and freeze. If the match looks real, do not pay, ship or release anything. If you hold money or assets for the person, they are frozen in your hands.
5. Report to OFSI. OFSI's reporting page links to online forms for a suspected designated person, frozen assets and a suspected breach.

Some businesses have a legal duty to report. OFSI calls them relevant firms. The list includes accountants, firms with FSMA Part 4A permission, cryptoasset exchanges and estate agents. They must tell OFSI "as soon as practicable" if they know or reasonably suspect a person is designated or a breach has happened. Our guide to sanctions compliance for accountants covers that duty in more detail.

Anyone who holds frozen funds or assets must report them to OFSI, whether or not they are a relevant firm. OFSI's guidance also warns that "reporting to your regulator or submitting a SAR does not meet your reporting obligations under financial sanctions."

What are the penalties for breaching UK financial sanctions?

OFSI can impose a civil monetary penalty under section 146 of the Policing and Crime Act 2017. The maximum is the greater of:

• £1,000,000, or
• 50% of the estimated value of the funds or economic resources involved, where that value can be estimated

Where the value cannot be estimated, the maximum is £1,000,000.

Strict liability since 15 June 2022

Before June 2022, OFSI had to show that a person knew, or had reasonable cause to suspect, that they were breaching sanctions. The Economic Crime (Transparency and Enforcement) Act 2022 removed that test. Section 146(1A), in force from 15 June 2022, says any requirement for the person to have "known, suspected or believed any matter" is to be ignored.

OFSI's enforcement guidance puts it this way about proving knowledge: "For breaches occurring on or after 15 June 2022, this is no longer a requirement."

The Director of OFSI explained the change in an OFSI blog post on 8 June 2022.

OFSI still has to prove a breach happened. "I didn't know" is no longer a defence to a civil penalty. Screening records and a written note of each check matter for that reason. They show what you looked at and when.

How OFSI decides on a case

The enforcement guidance sorts cases into four levels of severity:

• Level 1, low: usually a private warning letter
• Level 2, moderate: usually a published disclosure of the breach, without a penalty
• Level 3, high: usually a civil monetary penalty
• Level 4, very high: may be referred for criminal investigation first

OFSI says it "will normally publish details of all monetary penalties it imposes". It applies "a discount of up to 30% for Voluntary Disclosure and Co-operation", so telling OFSI promptly about a breach you find counts in your favour.

Criminal breaches are a separate track. OFSI's general guidance gives a maximum of 7 years' imprisonment on conviction on indictment.

How to check a name against the UK Sanctions List

1. Export your suppliers and customers from Xero or QuickBooks.
2. Search each name on the FCDO search service, or download the CSV and search it next to your export. Try spelling variants and check aliases.
3. For your larger suppliers and customers, look up their owners and directors and check those names too.
4. Compare any hit with the entry's date of birth, address and ID numbers before calling it a match.
5. Record the date, the list version, what you searched and the result.
6. Recheck when the list changes and when you add a new contact.

For a likely match, hold the payment and contact OFSI before you release anything. Our guide to sanctions compliance for small businesses covers how often to recheck and what records to keep.

Sanctions Verified, opening to QuickBooks Online and Xero users, will screen your contacts against the UK Sanctions List alongside OFAC, EU and UN lists, and keep a dated record of each check. Until it launches, the manual steps above do the job.

This guide is general information, not legal advice.