Who this covers

Anyone we deal with, anywhere, can be sanctioned. That includes people and companies in the UK.

A country connection matters where the rules restrict services, technology, or payments to that country. The countries most likely to affect our work are Russia, Belarus, Iran, and North Korea. Other regimes, including Syria, Myanmar, and worldwide regimes covering cyber activity, terrorism, corruption, and human rights, mainly bite when a person or company is designated, or owns or controls the customer.

"Connected with Russia" means a company incorporated or based in Russia, or a person located in Russia or ordinarily resident there. A UK employee with a Russian passport, living and working here, is not that person.

A designated person includes any company they own or control. Screening the customer name only is not enough.

What we can do

Normal MSP work for a verified client, if all of the following are true:

• The user is not in Russia, Belarus, Iran, or North Korea, and is not ordinarily resident there.
• The user, the customer, and its owners are not on the UK Sanctions List.
• The work and the benefit stay with that client. They do not go to a restricted company, subsidiary, or site.
• We are paid by that client, through a bank that is not itself restricted.

What we cannot do

The user is not in Russia, Belarus, Iran, or North Korea, and is not ordinarily resident there.

The user, the customer, and its owners are not on the UK Sanctions List.

The work and the benefit stay with that client. They do not go to a restricted company, subsidiary, or site.

We are paid by that client, through a bank that is not itself restricted.

Stop the ticket and do not start the work if any of these are true:

• The user, the site, the contracting party, or the company that benefits is in Russia, or is a Russian company, including a Russian subsidiary of a UK or foreign group.
• We are asked for paid IT consultancy, design, managed services, or technical assistance for a person connected with Russia. Do not decide on the desk that a job is "only support" and therefore outside the ban.
• The person or company is designated under any UK regime, or owned or controlled by someone who is. No services and no payment without a licence.
• The job involves hardware, software, technology, or technical assistance going to Belarus, Iran, North Korea, or another restricted destination, or being used for a prohibited end use.
• The same work would reach a restricted person or place through a partner, another country, or another group company. Routing around a ban is itself prohibited.
• Payment would come from a designated person or a restricted bank.
• Belarus, Iran, and North Korea are not identical to Russia. Do not apply the Russia wording blindly, and do not treat them as lighter. If the connection is real or unclear, stop.

US or EU rules, and the terms of our software and cloud suppliers, can also block a job even where UK rules do not. That is a compliance question, not a desk decision.

Penalties

These apply to the company, and to a director or manager who consented, connived, or neglected the breach.

Financial sanctions, including dealing with a designated person or taking their money: a criminal offence, up to 7 years' imprisonment and/or an unlimited fine. The Office of Financial Sanctions Implementation can also impose a civil fine of the greater of £1 million or 50% of the value involved. The government has said it intends to double that civil maximum. That increase is not yet in force.

Trade sanctions, including restricted software, technology, and related services: a civil fine of the greater of £1 million or 50% of the breach, and possible criminal prosecution. For the civil fine, it is not a defence that nobody realised the rules applied.

Circumvention is an offence on its own.

A penalty is published. That means reputational damage, and it can affect contracts and insurance.

On every ticket

Record who the work is for, where they are, which legal entity benefits, and who pays.

Screen the person and the entity on the UK Sanctions List.

If the answer is a restricted country, a designated person, restricted technology, or unclear, stop and send it to the compliance lead. Do not proceed while you wait.

Only compliance can confirm an exception or licence, in writing, before any work starts.

A clean name search does not clear a service banned under trade or Russia services rules. Review this article when the regime changes.