You can find full guidance on what to do if you suspect a breach of financial sanctions in the aptly named OFSI faq. However in summary the sooner you let OFSI know the better. "Regulations require individuals, entities and bodies to supply OFSI as soon as practicable with any information that would ‘facilitate compliance’ with the regulations. Any information provided will only be used for the purposes for which it was provided or received. This requirement applies to natural and legal persons, entities and bodies in the UK or under UK jurisdiction."
You can report using their compliance reporting form and you can then email it directly to ofsi@hmtreasury.gov.uk.