OFSI Penalty Apple Distribution International Russia Sanctions Breach

Imposition of Monetary Penalty – Apple Distribution International Limited (“ADI”) SUMMARY

1. On 19 March 2026, the Office of Financial Sanctions Implementation (“OFSI”), part
   of HM Treasury, imposed a penalty of £390,000 on Apple Distribution International Limited (“ADI”), an entity incorporated in the Republic of Ireland and a subsidiary of the US technology company Apple Inc, in accordance with section 146 of the Policing and Crime Act (“PACA”) 2017.

2. OFSI imposed the penalty for breaches of the Russia (Sanctions) (EU Exit)
   Regulations 2019 (“the Russia Regulations”), namely regulation 12 which prohibits (among other conduct) making funds available to a person owned or controlled by a designated person.

3. ADI, a non-UK person, instructed a UK based bank to make two payments (one in
   June 2022 and another in July 2022) totalling £635,618.75 to Okko LLC (“Okko”), a company wholly owned at the time of the payments (and in the case of the July payment also at the time of payment instruction) by the designated person JSC New Opportunities (UKSL ref RUS1489). ADI did not cancel these instructions, leading to the subsequent release of funds to Okko. This conduct, in particular the failure to cancel (an omission), amounted to conduct in the UK by ADI.

4. OFSI imposed a monetary penalty on ADI because it was satisfied, in relation to
   these payments, that on the balance of probabilities, ADI had breached prohibitions imposed by financial sanctions legislation. No penalty was imposed on, nor findings of a breach made against, Apple Inc.

5. ADI voluntarily disclosed the payments in this case to OFSI, together with other
   similar payments occurring in different timeframes, on 4 October 2022.

6. Following exchanges in 2023 and 2024 in which ADI responded to information
   requests from OFSI, OFSI issued ADI a Notice of Intention to impose a monetary penalty on 11 November 2025. ADI submitted formal representations to OFSI on 5 January 2026. On 9 February 2026 OFSI introduced a new enforcement framework enabling the settlement of penalty cases. OFSI and ADI agreed to enter formal settlement discussions on 16 February 2026 under transitional arrangements. Settlement was agreed on 19 March 2026 and OFSI imposed a monetary penalty of £390,000. BACKGROUND 1

7. ADI is incorporated in the Republic of Ireland and, among other activities, is
   responsible for instructing payment transactions for revenues earned by software developers who have placed their software applications on an online marketplace, the ‘App Store’, operated by ADI and its corporate affiliates. Such payments are made using ADI funds held in a UK-based bank account that is controlled by ADI. The Russian app developer in this case, Okko, operates a Russian online media streaming platform.

8. ADI relied on their corporate affiliates to functionally implement relevant payment
   processes and the sanctions screening and due diligence measures discussed in this case. OFSI determined that ADI is the legal entity responsible for the breaches in this case, as it is the legal entity that instructed made the payments that were in breach of the Russia Regulations. OFSI considers that the responsibility of ensuring compliance with sanctions legislation rests with the entity directly responsible for the breach. Therefore, whilst entities may delegate compliance functions to third parties, including corporate affiliates in a larger group structure, both mitigating or aggravating conduct demonstrated by those relevant compliance functions will be assessed as the conduct of the breacher.

9. On 9 August 2018, Russia’s largest bank, PJSC Sberbank (UKSL Ref: RUS0256),
   acquired majority control and full ownership of Okko and remained the sole shareholder of Okko until 17 May 2022, when it sold Okko and its assets entirely to the Russian entity JSC New Opportunities. That sale and purchase occurred after Sberbank was designated by the UK on 6 April 2022, as Sberbank was assessed to be involved in obtaining a benefit from or supporting the Government of Russia. JSC New Opportunities was not designated under UK sanctions at the time they acquired Okko from Sberbank.

10. The designation of JSC New Opportunities was published by the Foreign,
    Commonwealth and Development Office on 29 June 2022 at 11:00 BST, with the statement of reasons noting that, in May 2022, companies offering digital services previously owned by PJSC Sberbank had been sold to JSC New Opportunities. As soon as JSC New Opportunities was designated, Okko again became subject to asset-freeze prohibitions in the Russia Regulations by virtue of being owned or controlled by a designated person (within the meaning of regulation 7 of the Russia Regulations).

11. In assessing this case, OFSI applied the guidance in place at the time of the decision
    to issue notice of a penalty, which was the November 2024 “Financial sanctions enforcement and monetary penalties guidance” (the “Enforcement Guidance”). 2

12. The breaches subject to the penalty in this case occurred after the strict liability
    amendments to PACA came into effect on 15 June 2022. THE BREACHES

13. Payment A was instructed by ADI on 6 June 2022 to the equivalent value of
    £356,429.27. Its value date (when funds were released) was 30 June 2022. Payment B was instructed on 30 June 2022 to the equivalent value of £279,189.48. Its value date was 28 July 2022. These payments released funds to Okko, which was wholly owned by the designated person JSC New Opportunities.

14. Payment A was processed on the day of the designation of JSC New Opportunities.
    OFSI concluded that it is a breach by virtue of the operation of the PACA strict liability regime. OFSI assessed there was a narrow window in which the payment could potentially have been cancelled before completion. In deciding to take enforcement action in relation to Payment A, OFSI considered it significant that another breach payment (Payment B) involving a payment to the same party occurred approximately a month after Payment A.

15. OFSI has also taken into account that Okko had previously been owned by Sberbank
    and that two other payments, termed Payments C and D, were processed in April 2022 with an equivalent total value of £1,160,278.39. These were made to Okko and another entity previously owned by Sberbank. OFSI considered them relevant to its assessment of the case but on the particular facts of the payments did not treat them as breaches of the prohibitions in the Russia Regulations as they occurred before the entry into force of the PACA strict liability regime.

16. It is noted that ADI had relied on corporate affiliates to functionally implement
    relevant payment processes and the sanctions screening and due diligence measures discussed herein. OFSI determined that ADI is the legal entity responsible for the breaches in this case, as it is the legal entity that made the payments that were in breach of the Russia Regulations. OFSI considers that the responsibility of ensuring compliance with sanctions legislation rests with the entity directly responsible for the breach. Therefore, whilst entities may delegate compliance functions to third parties, including corporate affiliates in a larger group structure, both mitigating or aggravating conduct demonstrated by those relevant compliance functions will be assessed as the conduct of the breacher. CASE ASSESSMENT 3

17. OFSI takes several factors into account that could be assessed as aggravating or
    mitigating when determining how seriously to view a case (the “case factors”). Within those case factors, OFSI makes an overall assessment of the breach severity and the conduct of the person who has breached. With reference to the factors set out in OFSI’s Enforcement Guidance, OFSI’s assessment is that the aggravating factors in this case were:

18. ADI instructed and failed to cancel two outgoing payments, Payments A and

B, in breach of the regulations, with a collective high value of £635,618.75 (case factor B).

1. Both payments were made directly to an entity wholly owned and controlled
   by a designated person. By breaching prohibitions and providing financial benefit to this entity, ADI undermined the asset freeze and diminished its intended impact on Russia’s behaviour (case factor C).

2. Whilst ADI maintained sanctions screening and broader financial crime
   controls, OFSI considers that an aspect of its sanctions framework at the time of the breaches was not sufficiently calibrated to the increased financial sanctions risk associated with Russia following its full-scale invasion of Ukraine in February 2022 and the ensuing rapid escalation in UK financial sanctions against Russia. At the time of the breach payments, the processes used by ADI to assess sanctioned party ownership-related risks in the onboarding of Russian app developers focused primarily on (1) a self‑certification model, and (2) ownership due diligence provided by third- party due diligence vendors (case factor E).

3. OFSI assesses that, given the enhanced UK sanctions risks in dealings with
   Russian parties following February 2022 - including the withdrawal of information from Russian corporate registries in mid-2022, and public reports of asset transfers intended to circumvent sanctions - not augmenting the diligence process by affirmatively requesting ownership information from Russian paid app developers very likely contributed to the breach payments occurring (case factor F).

4. ADI relied in part on third‑party providers for ownership and control data.
   OFSI acknowledges the value that such services can afford firms like ADI, and recognises that including such providers in a diligence program is good compliance practice. However, ADI remains ultimately responsible for ensuring that it complies with financial sanctions. In this case, third‑party tools did not identify the change in Okko’s ownership in a timely manner. 4

Furthermore, at the time the breach payments were made, multiple open‑source media articles were available which clearly indicated the transfer of Sberbank’s digital assets to JSC New Opportunities. OFSI understands that these articles were not identified or flagged by the third-party providers engaged by ADI. Had ADI affirmatively requested ownership details from Russian app developers, there is an increased possibility that ADI would have been able to determine that Okko was owned by JSC New Opportunities (case factor F).

1. In considering ADI’s conduct, OFSI also took into account two earlier
   payments, Payments C and D, which bore similar characteristics to Payments A and B, and which occurred prior to the entry into force of the PACA strict liability regime (case factor I).

2. In 2022, sanctions imposed by the UK in respect of Russia were a strategic
   priority for the UK and its foreign policy, and remain so today (other relevant case factor under severity).

3. These factors were weighed against the mitigating factors in the case, which were
   assessed by OFSI as follows:

4. Whilst there were publicly available press articles stating that Okko was
   wholly owned by a designated person, there is no evidence that ADI was aware of those press articles at the relevant time or that third-party diligence providers were aware of this information. OFSI considered that ADI had neither intent, knowledge nor cause to actually suspect that these payments would be in breach of financial sanctions (case factor D).

5. Payment A was completed very shortly after the designation of JSC New
   Opportunities. The window of time available to ADI to cancel Payment A was therefore very limited, and it is only included as part of the penalty case because of the further breach, Payment B, occurring approximately a month later. OFSI does not necessarily expect payments completed very close to the time of designation to be stopped by automated screening systems. OFSI therefore treated the timing of Payment A as mitigating (considered as an “other relevant factor” under severity).

6. Voluntary disclosure was made by ADI to OFSI on 4 October 2022 (case
   factor J).

7. After being made aware by a third party of concerns (unrelated to UK
   financial sanctions) regarding Okko, ADI commissioned an external due diligence report to ascertain the ownership of Okko. Following receipt of that report – which indicated that Okko may be owned by JSC New Opportunities – ADI then proactively notified its third-party due diligence providers of this ownership link. ADI has also committed to making improvements to its sanctions compliance framework since the breach payments, including working to implement a new process to require Russian paid app developers to provide direct and indirect ownership and control information at onboarding and periodically thereafter (case factor M, Other relevant factors).

8. Other factors were considered either not to be relevant, or on balance to be neither
   aggravating nor mitigating. ADI responded to all requests for information made as part of OFSI’s investigation (case factor K).

9. In accordance with the Enforcement Guidance, OFSI assessed this case overall to be “serious” as opposed to “most serious”.

10. OFSI values voluntary disclosure and expects suspected breaches to be disclosed as
    soon as reasonably practicable after discovery. OFSI’s Enforcement Guidance applied in this case stated that a discount of up to 50% would be granted for prompt and complete voluntary disclosure in a case assessed as serious.

11. The total breach value in this case was £635,618.75. The permitted statutory
    maximum penalty was therefore £1,000,000. OFSI considered that a reasonable and proportionate baseline penalty amount was £600,000. OFSI applied a 35% discount to reflect ADI’s voluntary disclosure and settlement of the case under the transitional arrangements, and imposed a penalty of £390,000. NOTES ON COMPLIANCE

12. This case highlights important compliance lessons for a wide range of industry
    stakeholders.

13. First, UK financial sanctions apply to any conduct in the UK and to all UK persons
    (including legal entities established under UK law) anywhere in the world. That includes non-UK firms using UK financial institutions to conduct payments, even if the non-UK firm directly manages the account from outside the UK. Firms must ensure they comply with those UK financial sanctions that are in force. 6

14. Second, firms should ensure that their client and customer due diligence
    frameworks are sufficiently robust to identify and understand ownership and control at the outset of a relationship and on an ongoing basis. Firms should take a risk- based approach, applying enhanced due diligence where ownership structures are complex, opaque, or involve higher risk jurisdictions or sectors. In some cases, this should include onboarding procedures that require clients to provide clear, accurate and up to date information on their ownership structure and ultimate beneficial owners (UBOs). Ongoing monitoring should be calibrated to identify changes in ownership and control that may give rise to heightened sanctions risk.

15. Third, firms retain ultimately responsibility for screening payments and ensuring
    compliance with financial sanctions. Use of third‑party sanctions screening and ownership diligence providers is often invaluable in supporting firms, particularly those with large and complex customer bases. However, there are inherent risks, especially where ownership may change frequently or where input data to be screened is incomplete or out of date.

16. Fourth, this case demonstrates the value that complete, detailed, and prompt
    voluntary disclosure of potential breaches to OFSI can provide. Firms should make timely, comprehensive disclosures aiming to provide OFSI with insight into the culpability of the parties and the underlying reasons for the breaches. The reporting of suspected breaches can result in a discount of up to 30% as part of OFSI’s new Voluntary Disclosure and Co-operation discount. NOTES ON SETTLEMENT

17. This case represents the first OFSI case resolved by means of settlement. OFSI
    regards settlement as a means to achieve timely and efficient enforcement outcomes. Resolving cases through settlement reduces the resource burden on OFSI and subjects that would otherwise be spent through the contested monetary penalty process. It can also result in messages about financial sanctions compliance being published sooner. OFSI therefore considers that it is in the public interest for matters to settle, and settle early, if possible.

18. Settlement is an agreement between OFSI and the subject of an enforcement action
    to resolve a monetary penalty case following a time-limited negotiation. As a condition of settlement, the subject must agree 1) to pay the penalty as imposed, and 2) to waive their rights to a ministerial review and to appeal OFSI’s decision to the Upper Tribunal concerning the matters within the scope of the settlement. In return, the subject will have the opportunity as part of the negotiations to input into the summary of the case that will be published, and under the new scheme will also 7

be entitled to a discount to the baseline monetary penalty (in addition to any other available discount) if they sign a settlement agreement within the applicable timeframe, usually 30 business days.

1. Further information and guidance on UK financial sanctions can be found on OFSI’s website: https://www.gov.uk/government/organisations/office-of-financial- sanctions-implementation