Knowing that a rule has changed is only the beginning. Someone must translate it into action, verify that the change works and take responsibility when an exception remains unresolved.
Citibank’s London branch has received a £4.7 million financial sanctions penalty. For compliance and operations teams, the case raises a practical question: how do you establish that a regulatory change has reached every process that needs to act on it?
What happened
On 2 September 2026, the Office of Financial Sanctions Implementation (OFSI) published a notice concerning Citibank, N.A., London Branch. The £4,732,830.58 penalty was imposed on 11 August 2026. The publication date and the enforcement decision date are therefore different. OFSI publication
Reuters reported 970 payments worth approximately £19.7 million, with most breaches occurring between February and November 2022. The bank voluntarily disclosed the majority. Citi said it had co-operated with the investigation and continued to invest in its sanctions compliance framework. Reuters, 2 September 2026
The official notice covers both Russia sanctions and the Global Anti-Corruption sanctions regime. OFSI found no intent to breach sanctions, but regarded the combined failures as serious. It acknowledged the operational pressure created by the 2022 sanctions packages. OFSI penalty notice, paragraphs 2, 46 and 50
Where the controls broke down
The notice describes alert backlogs delaying account restrictions, a name-matching problem involving Sovcomflot, and payment screening performed before correspondent banks were added. Some account restrictions blocked customer debits while allowing internal charges. OFSI also considered certain weaknesses reasonably foreseeable through further analysis or stress testing. OFSI penalty notice, paragraphs 16–22 and 37
Our operational reading is that organisations need to test the whole journey from a new requirement to a completed action. A control can exist at one stage while leaving another stage exposed.
For example, a team reviewing a changed process should ask what happens after the initial check. Can another system add information? Can a manual intervention change the outcome? Does a restriction apply consistently across routine activity and exceptions?
These questions help move a review beyond whether a procedure has been updated to whether the revised process works in practice.
Making implementation visible
For teams reviewing their own arrangements, a useful starting point is a recent regulatory change. Choose one affected workflow and follow it from the original assessment through implementation, testing and subsequent use.
At each handover, establish who owns the next action and what evidence confirms completion. A policy owner may explain the requirement. An operational owner must translate it into a procedure. A technical owner may need to change system behaviour. A reviewer then needs enough evidence to assess the result.
Those responsibilities should connect. A task marked complete by one team may leave a dependency unresolved elsewhere.
It is also useful to define completion before work begins. Does completion mean that wording has been approved, a configuration has changed, a test has passed, or the revised process is operating? Each describes a different milestone. Recording them separately makes outstanding work easier to identify.
Exceptions need an owner and an outcome
Routine processing is only part of the picture. Teams should also examine what happens when information is incomplete, a decision requires specialist review or the normal route cannot be followed.
An exception record should make the next action clear. Who is responsible? What remains uncertain? What can happen while the issue is unresolved? When must it be escalated, and who confirms that it is closed?
For internal assurance, an organisation can take a small sample of completed exceptions and ask an independent colleague to reconstruct each decision. If that requires searching several inboxes or relying on someone’s memory, the record may need strengthening.
This is an operational review exercise, rather than a statement of additional requirements imposed by the Citibank notice.
The connection to customer communications
The enforcement case concerns sanctions controls. The communication examples below are our wider application of the governance lesson; they are not findings about Citibank’s customer correspondence.
Consider a regulated business changing an account notice or a service restriction explanation. The relevant specialists determine what may be communicated, to whom and when. The communication workflow then needs to carry that decision through drafting, review, approval and use.
Approving revised wording is one milestone. Establishing which template version a connected system actually uses is another. A team investigating a later query needs to distinguish the version that was drafted, the version that was approved and the version used to generate the output.
Generation records also need to remain distinct from evidence of sending or delivery. Where another system performs those steps, its records are needed to establish what happened after generation.
Where CommsPliant fits
CommsPliant is a working platform for controlled customer communications. It connects template editing, review and approval with version control, API generation and the CommsPliant Evidence Vault, a protected record store where retained entries cannot be altered.
This gives teams a structured way to trace communication changes and approval decisions. Evidence of the complete generated content depends on the retention configuration; a hash-only record does not store the communication itself.
CommsPliant supports this communication workflow. Sanctions screening, payment restrictions and legal decisions remain with the organisation’s relevant systems and specialists. The platform does not guarantee compliance or establish that these sanctions breaches would have been prevented.
For communication teams, the practical question is straightforward: can you follow an approved change through to the version used, and show the records that support it?