The AML Analyst

May 28th, 2026

On May 19th, 2026, the Office of Financial Sanctions Implementation (OFSI) fined the London office of Deutsche Bank £165,000 for processing two payments totalling £635,618.75 on behalf of a client to their beneficiary Okko, a company owned by Russian-sanctioned entity JSC New

Opportunities. 

What stands out in this case is that Okko itself wasn’t Deutsche’s client, but was rather a downstream customer for Deutsche’s actual customer. Deutsche was aware of its client’s business in Russia, even discussing with them the sanction risks associated with it; however, Deutsche failed to understand how its customer conducted their sanctions screening check. Similar to correspondent banking, it has been made clear that the proper due diligence not only needs to go on customers themselves, but also on their AML policies and procedures, ensuring that respondents don’t utilise correspondent payment systems to enable the transfer of illicit funds. It isn’t common practice to conduct due diligence on downstream customers; however, the risk that arises from them should be properly assessed.

With the knowledge that Deutsche had on its own customers’ payments to Russia, the risk should have changed greatly with the sanctions in place since February 2022. This means that Deutsche should exhibit greater oversight of the processes and seek further information, applying increased scrutiny proportionate to the risk, highlighting the overall responsibility Deutsche has in sanctions compliance. 

Deutsche handled its sanctions screening in two ways. One was through its own systems containing the UK Sanctions List, and the other was through the use of third-party list providers. The OFSI underscored the fact that Deutsche’s third-party vendor, at the time of the transactions, did not have information on Okko or the beneficial owners, which led to no alerts being generated. While the payments were processed in June and July 2022, JSC only became a designated sanctioned entity in June 2022, displaying the difficulty in updating lists to display new designations while adhering to sanctions compliance.  

This reinforces the need for stronger oversight of customers’ processes and systems, as well as those of third-party vendors. In terms of third-party vendors, Deutsche disclosed the incorporation of additional third-party lists. This is a positive step toward more robust sanctions compliance. Relying on one vendor puts all the risk on them to ensure lists are updated instantly, and failures to do so bring the burden of responsibility on Deutsche itself. By working with multiple vendors, it gives Deutsche a greater reach into the sanctions list, minimizing the risk brought upon by them, especially with the lack of transparency in beneficial ownerships in Russia. 

While the OFSI deemed Deutsche Bank guilty, it applied a 45% discount to the fine, resulting in a cost of £165,000. For a global bank such as Deutsche, this can be seen as relatively modest; however, I think it shows a key point in sanctions compliance. The discount was applied due to Deutsche’s voluntary disclosures, which help regulators and firms learn early on the risks associated with systems, and work together to better mitigate them. Collaboration and information sharing are the key to preventing financial crime, and through honesty on gaps, Deutsche and other firms can further prevent such gaps from occurring in their systems. This is the second time OFSI has fined a firm for payments to Okko. In March 2026, Apple’s European subsidiary, Apple Distribution International (ADI), was fined £390,000 for payments in the same period to Okko and immediately disclosed the payments to the OFSI, further strengthening the role that voluntary disclosures play in enhancing more robust compliance protocols. 

Both Deutsche and ADI, with ADI being the first, were resolved under OFSI’s settlement scheme, which was released in February 2026. The settlement scheme offers penalty discounts based on voluntary disclosure, cooperation, and the severity of the breach. This strengthens transparency between firms and regulators, as shown by these two cases; however, the issue arises that if firms know they can reduce penalties through voluntary disclosure, does the scheme inadvertently reduce the deterrent effect of sanctions enforcement?

How does your firm handle the risks associated with third-party vendors?

Sources:

Deutsche Bank OFSI Notice: https://assets.publishing.service.gov.uk/media/6a0c287bfcae986635db916d/DB_Penalty_Notice.pdf

ADI OFSI Notice: https://assets.publishing.service.gov.uk/media/69ca1da04321776215360a1c/ADI_Public_Penalty_Notice.pdf