OFSI Report on Vanquis Bank Limited Financial Sanctions Breach

Report Concerning Breach of Financial Sanctions Regulations Publication of a Report – Vanquis Bank Limited Summary 1. On 08 Septemb er 2025 the Offic e of Financial Sanctions I mplementation (“ OFSI ”), part of HM Treasury, issue d this report in accor dance with s149(3) of th e Policing an d Crime Act 2017 (“ PACA ”) ag ainst Vanquis Bank Limited (“ VBL ”) fo r breaching regul ations 11 and 12 of the Counter- Te rrorism (Sanctions) (EU Exit) R egulations 20 19 (“ the Regulations ”). OFSI refers to the use of this power as Disclosure. 2. VBL is a UK- regist ered compan y, regulated by the Finan cial Conduct Au thority (“ FCA ”), providing financial services to consu mers. 3. This Disclosure relates to breache s of the Regul ations which prohibit mak ing funds availab le to a designated person or dealing with funds owned, held or con trolled by a designat ed person. The br eaches occ urred due to a delay in res tricting access to an acco unt for eight days following designatio n, during which ti me a pe rson designat ed under th e Regulations (“ the DP ”) w as able to have ful l access to the ir fund s. The DP was able to with draw cash, and a transaction was processed on the accou nt. In permitting the cash withdrawal and transaction, VBL m ade funds di rectly available to a designat ed person. 4. OFSI categorise s breach cases as being of l esser severi ty, moderat e severity or serious enough to justif y a civil m onetary penalt y. On the facts as kno wn, OFSI does no t assess the breach as sufficientl y serio us to impose a monetary penalty. Ho wever, the nature and circumstances of this breach w ere assess ed as mode rately severe and in OFSI’s ju dgement publishing a Disclosur e is the a ppropriate and proportionate en forcement response.

1. OFSI considers that thi s breach satisfies th e test at section 149(3) of PACA 2017 which states: “The Treasury m ay also pub lish report s at such inter vals as it considers appro priate in cases where — (a) a monetary penalty has not been i mposed un der section 1 46 or 148, but (b) the Treasury i s satisfied, on the balance of probabilities, that a per son has br eached a prohibitio n, or failed to comply wit h an obligation, that is impo sed by or un der financial sanctio ns legislatio n”. Detail 6. The day befor e the DP wa s designated un der the R egulations, OFSI wrote to VBL to advise it that a suspected customer of the bank would be designated for the purpo ses of an asset- freeze the followin g day. OFSI did not provi de any personal d etails of this customer to VBL, the notification solely outl ined that a desi gnation w as due to happ en and tha t the DP might have been a custo mer of VBL. Pre-notification was given in this instance by OFSI as the designating bod y for this regime, given the terror fin ancing risks in this case and the r egime purpose of prot ecting nat ional security. 7. On the day of de signation, OFSI upda ted the Consol idated List with details of the DP and sent an e-Alert to subscribers publ icising the d esignation. 8. The day after th e designat ion, at approxi mately 083 0 VBL’s screenin g system generated a potential match alert for t he DP and plac ed it into a queu e for priori tisation. 9. The day after th e designat ion, at 0943, the DP withdrew £200 in cash from t heir account with VBL. 10. Five days after th e design ation, the DP made a purchase of £8. 99 from thei r VBL accou nt. 11. Eight days after the designatio n, VBL confir med the alert g enerated by its screening s ystem was a positive match to the DP and restrict e d access to th e DP’s account. 12. Thirteen days a f ter the designation, VBL r eported t he breaches to OFSI.

2. VBL indicated that they rely on t wo suppliers for t heir sanct ions screening. One suppli e r provides the sanction s list, whilst the oth e r supplies the automated screening syst em that screens those lis tings again st VBL’s custo m er data, flagging an y potential matches. Any potential match es are the n escalated for a first and se cond line r e view the foll owing day by VBL staff and wh ere a match is identified, th e DP’s account is restricted. The VBL service level agreement (“ SLA ”) timeframe for th e se revie ws is one day. VBL noted that they assessed that th e ir produc ts carry lo w sanctions risk, as credit ca r ds are onl y available to U K residents. As such they assessed that the a bove mo del was appropriate for thei r business needs. 14. VBL reported that in 2024 a separate risk event w as identi f ied in the a utomat ed screening system. This ev e nt resulte d in a number of alerts being falsely clos e d as dupli cates. As part of their rem ediation activity, VBL generated a large number of alerts for man ual screening. VBL reallocated r esources from its first line referral team to under t ake this re mediation activity. 15. VBL’s screenin g system’s potentia l match alert for the DP the day afte r the designation failed to meet th e SLA due to the lack of resource in the first line refe rral team cause d by the reallocation of staff to the r emediation activity. As a re sult, the ale rt was not reviewe d by VBL’s first lin e referral t e am until ei ght days afte r the designation. This was de spite OFSI having forewa rned VBL th at a suspected custo mer of the bank was du e to be d esignated the following da y. Following the f irst line r eview, the alert was es calated to th e second line team and access to the account was restrict ed on the sa me day. 16. In light of the a bove, OFSI c onsiders V BL to be in breach of regulations 1 1 and 12 o f the Regulations by making fun ds available to, an d dealing with funds owne d, held or con tr olled by, the DP. 17. OFSI considered th e following aggravatin g factors whe n reaching its decision to publish this Disclosure:

a. OFSI fo rewarned VBL tha t a suspected custom e r of the bank was due to be designated the following day, whi ch should have made VBL especially vigilant to the designation; b. VBL made funds di r ectly availabl e to a designa ted person and a purchase was processed on the DP’s account; c. A delay of eight days bet wee n designatio n and res tricting the accou nt mean t the DP had full access to their credit card and could have m ade additional withd rawals or purchases; and d. VBL is an FCA-regulat e d firm and theref ore is expected to have signifi cant awaren ess and understanding of sanctions r isks, in addition t o suffi cient financial crime systems and cont rols in place to ensure that i t does not make funds available to a designated person. 18. OFSI considered th e following potentiall y mitigatin g factors when r eaching it s decision to publish this Disclosu re: a. VBL volun tar ily provi ded complet e reporting of th ese breaches and was coop e rative in assisting OFSI’s inv estigation; b. The cash withdra wa l occu r red within 2 4 hours of th e DP’s des ignation; c. There is no evid e nce of d eliberate circumvention by VB L; and d. The breaches ar e of comparativ e ly low va lue and present as isolate d, as opposed t o forming part of a pattern. 19. OFSI considered tha t the length of time it took VBL to restrict access to the ac count was inappropriate. OF SI noted that the risk e vent which le d to VBL’ s decision to redeploy staff was not within its control, however the failure to en sure business continuity was, and led to a period wh en the DP had f ull access to th e account and cr edit card. Compliance Lessons fo r Industry 20. Companies and individuals mus t ensure th ey do not make f unds availabl e t o de signated persons und er the Regulation s. The delay in V BL’s response to the designa tion led to funds being made dir e ctly available to th e DP

1. Companies should exercise particular vigilance if they rec eive a notification from OFSI that a suspected custom e r may be des ignated in th e near f uture. Whe re OFSI is the desi gnating body, OFSI will ta ke a case- by -cas e approach when issuing such notifications, and companies mus t still ensu re their syste ms and contro ls are appropri ate and that they can a ct quickly to implem e nt sanc tions e ven whe re OFSI does not provide p rior noti fication. 22. This case de monstrates th at companies should care fully consid er whether th ey have adequate operat ional resil ience in their s anctions screening processes and sho uld look to develop and imp lement robust con tingency plans t o ensure business continu ity and prevent delays in respons e to sanction s designations. 23. For persons d esignated u nder the do mestic counter t e rrorism r egime allowin g access to funds – even lo w value – post-d e signation no t only presents a risk of ci rcumvention, but also of direct t errorist fina ncing. 24. If you know or b e lieve yo u have committe d a breach of financial sanct ions, you s hould inform OFSI as soo n as practicabl e. OFSI value s voluntary dis closure and this may be considered a miti gati ng factor whe n OFSI ass e sses t he case. 25. If you are in poss essi on o r control o f, or are othe rwise dealing with, the funds or economic resources of a d esignated pe rson you m ust: a. Freez e them b. Not deal with them o r make them available to, or for the benefit of, th e designated person, unless: i. there is an exce ption in the legi slation that you can rely on; or ii. you have a lic ence from O FSI; and c. Report them to OFSI. 26. Further inform ation and gu ida nce on UK fin ancial sanctions can be found on OFSI’s website: https:/ /www.gov.uk/gov ernment/organisation s/ office- of - financialsanctions implementation