Sanctions compliance is often reduced to a name check against a list. That framing is the source of most failures. Restrictions extend to parties that never appear on any list, exposure arises through intermediaries several steps removed, and liability commonly attaches without any requirement to show intent.
Multiple Regimes, Applied Simultaneously
An international business is rarely subject to only one sanctions regime. Several major frameworks apply concurrently, and they do not align — a party restricted under one may be unrestricted under another, and the scope of prohibited activity differs.
Jurisdictional reach compounds this. Some regimes apply extraterritorially based on the currency of a transaction, the nationality of personnel, the origin of goods or technology, or the involvement of financial infrastructure. A transaction between two non-domiciled parties can fall within a regime's reach through the currency used to settle it.
The practical consequence is that the applicable regimes must be determined from the facts of the transaction — parties, goods, currency, routing, personnel — and not from where the organisation happens to be incorporated.
Ownership and Control: What Lists Do Not Show
The most consequential principle in sanctions compliance is that restrictions typically extend to entities owned or controlled by designated persons, whether or not those entities are themselves listed.
Several regimes apply an ownership threshold at which an entity is treated as restricted, and aggregate holdings across multiple designated parties in reaching it. An entity owned in several tranches, none individually meeting the threshold but together exceeding it, is caught. Control tests operate separately from ownership and can catch entities where the designated party holds little or no equity but exercises decisive influence.
This is why name screening alone is insufficient. The entity that must be identified frequently does not appear on any list, and identifying it requires:
- Tracing ownership through intermediate layers to natural persons
- Aggregating indirect and split holdings
- Assessing control exercised through board rights, voting arrangements, or contract
- Recognising nominee and trustee arrangements that obscure the beneficial position
Where Supply Chains Create Exposure
Direct counterparty screening addresses the first tier. Exposure frequently sits further out:
- Sub-suppliers and sub-contractors not visible in the contracting relationship
- Logistics and routing — transhipment through jurisdictions used to obscure origin or destination
- Vessels and aircraft, which can themselves be designated, and where practices such as disabling tracking systems or ship-to-ship transfers are recognised evasion indicators
- Payment intermediaries and correspondent banking relationships
- End use — dual-use goods lawfully supplied for a civilian purpose but diverted afterwards
- Technology and data, where controls attach to the origin of technology regardless of where it is transferred from
Circumvention Indicators
Deliberate evasion has recognisable characteristics. Patterns that warrant investigation include a sudden increase in orders of controlled goods from a jurisdiction with no relevant end-market; newly incorporated counterparties with minimal operating history; ownership restructured shortly after a designation; reluctance to identify end users or provide end-use documentation; routing that makes no commercial sense; requests for unusual payment arrangements or currencies; and addresses shared with previously designated entities.
None is conclusive alone. Several together generally warrant escalation before proceeding.
Screening That Works
Effective screening addresses several problems that naive implementations miss:
- Transliteration. Names rendered from non-Latin scripts admit multiple valid spellings. Exact matching fails; fuzzy matching calibrated for the relevant scripts is required.
- Threshold calibration. Set too tight, genuine matches are missed. Set too loose, alert volume overwhelms review capacity and everything is cleared cursorily — which is functionally the same as not screening.
- Coverage. All applicable lists for the regimes actually engaged, plus ownership data, refreshed promptly after designations.
- Timing. At onboarding, before transactions, and continuously against list updates. Designations take effect immediately and frequently without warning.
- Alert handling. A documented process with defined escalation, and evidence that alerts were genuinely reviewed rather than bulk-cleared.
When a Potential Breach Surfaces
Speed matters, and so does sequence. Suspend the relevant activity rather than continuing while investigating; establish the facts, including whether the position was different at the time of the transaction; determine which regimes are engaged and what each requires by way of reporting; take legal advice before external communication; and preserve records.
Several regimes provide for materially reduced penalties on voluntary self-disclosure. That mitigation is generally unavailable once an authority has independently identified the matter, which makes the decision on disclosure time-sensitive rather than something to be deferred.
The broader counterparty framework within which screening sits is set out in our guide to third-party and supplier due diligence.
Is a breach only committed knowingly?
Frequently not. Many sanctions provisions impose strict liability, meaning a breach occurs regardless of knowledge or intent. Knowledge may affect penalty severity but is often irrelevant to whether a violation occurred.
Can a business deal with an unlisted subsidiary of a designated entity?
Usually not. Restrictions commonly extend to entities owned or controlled by designated persons, whether or not the subsidiary appears on a list. Ownership must be traced and aggregated rather than assessed from list membership alone.
Do non-domestic regimes apply to a business with no local presence?
They can. Several regimes reach transactions based on currency, the origin of goods or technology, the nationality of personnel involved, or the use of particular financial infrastructure, independently of where the parties are established.