OFSI has published a report on a breach of the Counter-Terrorism sanctions by Vanquis Bank. Delays in the bank’s processes for restricting account access meant that a Designated Person had full access to funds in an account for 8 days following designation. OFSI does not regard the breach as serious enough to warrant a fine and has published a Disclosure Notice as the most appropriate and proportionate response.
OFSI had written to the bank the day before designating the individual to advise it that a suspected customer was to be designated the following day, although the notification did not contain any personal details of the individual. It duly made the designation and sent out an e-alert to subscribers.
The following day the bank’s systems generated a match and put it in a queue for prioritisation. The designated person withdrew £200 on that day, and then, 5 days after the designation made a small purchase from their account. The bank confirmed the alert and restricted access 8 days after designation and informed OFSI of the breach 5 days after that.
The bank had used two suppliers for screening – one provided the list and the other the screening system – after which matches would be escalated for review by bank staff the following day. The bank thought that was proportionate as it makes cards available solely to UK residents. The bank had been carrying out a remediation exercise following an issue in 2024 which was generating a lot of alerts which it had reallocated resources from its first line referral team to deal with – and this is what caused the delay in review of this particular match.