Matt Winlaw Law Journal Newsletters

When Sanctions Fail: The Ovsiannikov Case and Why Enhanced Due Diligence Must Become a Compliance Standard

This article was originally published in Law Journal Newsletters on August 1st. 

By Matt Winlaw, CEO & Managing Director, EDD Group

In April 2025, the United Kingdom secured its first-ever criminal conviction for a breach of Russian sanctions—a milestone in the global enforcement landscape. But beneath the headline lies a far more pressing narrative: how a sanctioned Politically Exposed Person (PEP) was able to enter the UK, open a bank account, and launder funds through mainstream financial and non-financial institutions without detection.

The conviction of Dmitrii Ovsiannikov—a former Russian Deputy Minister and ex-Governor of Sevastopol—should be a sobering moment for every legal, compliance, and risk leader. This wasn’t a complex crypto scheme or an advanced cyber intrusion. It was an almost banal series of oversights and procedural failures, with one common denominator: the absence of rigorous Enhanced Due Diligence (EDD).

As geopolitical tensions escalate and global sanctions regimes become more aggressive, the Ovsiannikov case serves as a stark warning: checkbox compliance is no longer sufficient. EDD must become the operational standard—not just in banking, but across every sector involved in high-risk transactions.

A Step-by-Step Breakdown of a Preventable Breach

Despite being sanctioned by the UK and EU since 2017 for his role in Russia’s annexation of Crimea, Ovsiannikov entered the UK in early 2023. He leveraged his British father’s nationality to obtain a UK passport—exposing flaws in cross-agency data sharing between immigration, law enforcement, and sanctions enforcement bodies.

With documentation in hand, he opened a personal bank account at Halifax. What followed was a textbook case of sanctions evasion:

  • Over £75,000 was transferred into the account by his wife, Ekaterina.
  • He attempted to purchase a Mercedes-Benz GLC 300 with the laundered funds.
  • After the account was frozen, his brother, Alexei, stepped in—buying the car, paying £40,000+ in private school tuition, and issuing a debit card for daily use.

Every one of these actions represented a breach of UK sanctions law. Every one passed through institutional controls designed to detect and prevent precisely this type of behavior.

Where Systems and Culture Broke Down

The case offers a grim checklist of what happens when compliance systems are outdated, siloed, or poorly enforced.

  1. Know Your Client (KYC) Failures

Ovsiannikov’s onboarding application omitted critical information—marital status, beneficial ownership ties, and his status as a sanctioned individual. Despite being listed on the UK’s consolidated sanctions list, the bank accepted him as a client, underscoring how easily falsified or incomplete applications can bypass rudimentary KYC checks if not properly verified.

  1. Ineffective Sanctions Screening

Basic screening tools—if configured correctly—should have instantly flagged his name against the UK’s Office of Financial Sanctions Implementation (OFSI) list. That this didn’t happen raises two possibilities: either the tools were misconfigured, or there was overreliance on automated systems with no manual review protocols in place.

  1. Poor AML and Transaction Monitoring

Several red flags should have triggered immediate escalation:

  • A significant spousal deposit with no documented source of funds.
  • A high-value purchase of a luxury vehicle.
  • Tuition payments made on behalf of a third party.
  • Proxy debit card use—indicating attempts to obfuscate true ownership and spending patterns.

Individually, any one of these could be defensible. Taken together, they form a clear pattern of laundering and sanctions evasion.

  1. No Enhanced Due Diligence (EDD)

Ovsiannikov’s PEP status alone should have triggered mandatory EDD under the UK’s Money Laundering Regulations. Instead, there was no documented effort to verify source of funds, investigate beneficial ownership structures, or conduct adverse media screening. This was a systemic failure to treat a high-risk profile with the scrutiny it demanded.

  1. Cultural and Training Shortfalls

Even if technology fails, a robust compliance culture can act as a safety net. But culture only functions when frontline staff are trained, empowered, and incentivized to act. In this case, human intervention was absent or ineffective, likely due to lack of awareness, confidence, or organizational emphasis on proactive escalation.

Beyond Banking: An Ecosystem at Risk

It would be easy to dismiss this as a banking problem. It isn’t.

  • The private school that accepted tuition payments from a sanctioned individual is now exposed to reputational and regulatory risk.
  • The immigration system that issued a UK passport failed to consult its own sanctions databases.
  • The auto dealer, real estate agent, and service providers who transact without performing EDD are now increasingly in the crosshairs of regulators.

In today’s interconnected regulatory landscape, every institution—financial or otherwise—that touches high-value or cross-border transactions has a role to play in preventing sanctions breaches.

What Robust EDD Actually Requires

True Enhanced Due Diligence goes well beyond ticking boxes or applying generic risk scores. It must include:

  • Real-Time Sanctions Screening integrated across onboarding, ongoing monitoring, and account servicing.
  • PEP-Specific Risk Models that flag potential obfuscation strategies, shell company ties, and layered ownership structures.
  • Source of Funds Validation using documented, verifiable income and asset histories—not self-attestation.
  • Behavioral Transaction Monitoring that identifies suspicious patterns over time, not just isolated transactions.
  • Escalation Protocols that trigger manual review and intervention—supported by training and accountability frameworks.

These aren’t theoretical ideals—they are achievable with the right systems, workflows, and culture. And increasingly, they are being written into regulation.

The Legal Stakes Are Rising

The legal implications of this case are significant—and extend to counsel advising firms across finance, education, real estate, and more. Regulatory bodies are making clear that ignorance is not a defense, and due diligence lapses will be treated as compliance violations. Moreover, reputational damage can carry consequences long after fines are paid. The institutions named in the Ovsiannikov case may find themselves under enhanced scrutiny for years to come.

Final Thoughts: From Compliance to Resilience

The Ovsiannikov case is not just a regulatory milestone. It’s a wake-up call. Sanctions regimes are no longer dormant policy tools—they are dynamic enforcement priorities, backed by real prosecutions and real consequences.

The institutions that thrive in this environment will be those that stop treating compliance as a box-ticking exercise—and start treating it as a core business function. Enhanced Due Diligence is no longer an add-on for high-risk clients. It’s the new standard of care. Because the next time systems fail, it won’t just be a news story. It may be a courtroom.