HMRC names Petrofac unit as first company penalised over Russia sanctions breach

An energy services firm has become the first company to be publicly named by HMRC after paying more than half a million pounds to settle breaches of Russia sanctions rules.

The breach and settlement

Petrofac Facilities Management Limited (PFML) has paid a £569,157 compound settlement to HMRC after breaching Russia sanctions regulations. The breaches took place in 2022 and 2023, while the company was in the process of winding down its operations in Russia. During that period, PFML supplied sanctioned industrial goods to individuals connected to Russia and provided technical assistance relating to those goods.

HMRC confirmed that PFML self-reported the breaches and fully cooperated with the subsequent investigation — factors that typically weigh in a company's favour when HMRC decides whether, and on what terms, to offer a settlement rather than pursue prosecution.

A new approach to naming

What sets this case apart is not the size of the penalty but the decision to name the company involved. PFML is the first business to be publicly identified by HMRC after accepting a compound settlement for a sanctions or strategic export offence, marking a deliberate change in departmental practice.

Edwige Hill, Deputy Director in HMRC's Fraud Investigation Service, explained the thinking behind the shift:

"Non-compliance with Russia sanctions is a serious offence and together with our international partners, the UK Government has implemented the most severe package of sanctions ever imposed on a major economy. Naming those involved brings us into line with other enforcement partners whilst sending a clear message on the consequences of breaching sanctions rules."

Going forward, HMRC says that where appropriate, it will include naming as a condition when offering a compound settlement for strategic export and sanctions offences. The department has framed this as bringing its approach into closer alignment with other UK sanctions enforcement bodies, such as the Office of Financial Sanctions Implementation (OFSI), which already publishes details of the penalties it issues.

How compound settlements work

A compound settlement allows a business to pay a sum of money to resolve alleged offences under the Customs and Excise Management Act and the Export Control Order without going through court proceedings, saving time and cost for both sides. HMRC will only offer this route where it believes there is sufficient evidence to prosecute in the first place.

When deciding whether a compound settlement is appropriate, and what level to set it at, HMRC says it takes into account a range of factors: the seriousness of the alleged offence, whether fraudulent intent can be proven, the extent of the efforts made to carry out the offence, the type and value of the goods involved, the offender's previous compliance history, the level of cooperation shown during the investigation, and the level of financial penalties courts have imposed for comparable offences. Details of compound settlements are published via Notices to Exporters, issued by the Export Control Joint Unit.

Implications

For businesses with any residual exposure to Russia-linked supply chains — whether through legacy contracts, subsidiaries or wind-down arrangements — this case is a clear signal that HMRC's approach to sanctions enforcement has hardened. Self-reporting and cooperation clearly still matter, and appear to have kept PFML's penalty at a compound settlement rather than a prosecution. But the reputational consequence of a breach has now changed: a quiet financial settlement is no longer necessarily a private matter between a business and HMRC.

Companies operating in sectors with sanctions exposure — energy, engineering, logistics and anything touching restricted goods or technology — should treat this as a prompt to revisit their export control and sanctions compliance processes, including how quickly potential breaches are identified and reported internally. Given HMRC's stated intent to make naming a standard feature of future settlements, businesses should also factor reputational risk into their calculus alongside the financial penalty when weighing up how to respond to a suspected breach.