Challenges in sanctions compliance

Sanction lists are growing both in number and in complexity, making it increasingly difficult for businesses to effectively identify and manage sanctions risk. So, what are the key risks that should be on your radar?

Key risks

1. Indirect risks

When facilitating transactions or providing advice on deals, firms need to be aware of indirect sanctions risks, such as inadvertently enabling the evasion of sanctions through corporate restructuring or financial transactions.

2. Professional services restrictions

Some sanctions regimes specifically target the provision of certain legal services. Firms need to be aware of which services they can and cannot provide to sanctioned entities or in sanctioned jurisdictions.

3. Ever-evolving sanctions lists

As governments increasingly rely on sanctions as a tool for political foreign policy, new entities are added to, and removed, from sanctions lists continuously. Firms need to regularly check against the updated sanctions and high-risk jurisdiction lists.

4. Increasing complexity

While sanctions have long targeted specific entities (such as states, ships, aircraft, organisations and individuals), as well as entire countries, the landscape has evolved significantly. In recent years, there has been a notable shift towards narrative and sectoral sanctions, that target specific economic sectors and prohibit particular activities. These require more research and interpretation than list-based sanctions.

Screening challenges

The real challenge is not just to detect and prevent sanctioned customers from transacting with the business, but also to avoid disrupting the customer journey for legitimate customers and undermining the efficiency of the company’s operations. Key challenges include:

1. Data consolidation and harmonisation

Screening against multiple sanction sources with varying data elements can lead to inconsistent results, missed matches, multiple alerts per entity, and time-consuming efforts in linking data from different sanction sources. Effective screening requires consolidating profiles across selected sanction lists to ensure comprehensive coverage and reduce the risk of overlooking sanctioned entities. Solutions that can consolidate lists of interest to a business will screen more comprehensively and reduce the risk of overlooking sanctioned entities due to data discrepancies.

2. Navigating complex ownership rules

Compliance with rules like the Office of Foreign Assets Control (OFAC) 50% rule (where if a blocked person or entity owns a 50 percent or greater interest in another entity, that second entity is also considered blocked) and identifying associations of sanctioned entities is challenging. Jurisdictions may interpret the same facts differently, requiring meticulous analysis of each sanction regime’s approach.

3. Keeping up with compliance

Changing sanctions regulation requires constant attention to screening systems and policies, regular staff training, and nimble adjustments to compliance processes. Firms must adapt their screening tools and procedures to reflect changes, a task that can be resource-intensive. Screening solutions must be sufficiently configurable to support these ongoing changes and ensure continuous monitoring. The ability to update both policies and screening tools in line with new rules is crucial for maintaining effective sanctions compliance.

4 Under or over screening

If organisations do not screen robustly, there is a danger of ‘false negatives’, where entities subject to sanctions slip through the net. Conversely, over-screening can result in organisations generating high volumes of ‘false positives’, where non-sanctioned entities are flagged as potentially sanctioned. These false positives need time and resource to confirm they are not sanctioned.

A screening engine must be capable of precision tuning to reflect the company’s risk exposure and screening rules, as well as being able to deal with imprecise or inaccurate data. Machine learning technology can be used to automate the routine elimination of false positives.

Top tips for effective screening

1. Maintain good customer data

It’s critical that customer data is up-to-date and it’s worth investing the time upfront to cleanse and prepare data. Incomplete or inaccurate data will result in false positives and when companies are screening millions of customers daily, this can become a real problem.

Where possible, it’s prudent to use data enrichment software to append secondary identifiers and improve process efficiency, such as date of birth, address and nationality for individuals, or business address and registration number for companies.

2. Use proven, reliable technology

It’s important to ensure that the sanctions screening software you use to support your screening is fit for purpose. Key considerations are:

• Does your solution have the capacity to handle high volumes and to scale for business growth?
• Does your technology provider have the resource and infrastructure to ensure your screening and onboarding systems are operationally resilient in the long term?
• Is your technology platform user-friendly with configurable risk-based settings, so that you can avoid over-screening and adjust screening criteria to match your organisation’s risk appetite?
• Does the platform also have workflow tools to manage the remediation of sanctions matches in a logical fashion?
• Does the platform have industry-proven functionality and the ability to automate tasks to ensure the process is effortless and efficient from the initial loading of files, through to the results.

3. Screen against comprehensive sanctions data

To ensure you are identifying sanctions from all relevant bodies, the data you screen your customers against must be comprehensive, up-to-date and, ideally, consolidated all in one place with other watchlist databases such as politically exposed persons, enforcement and adverse media lists.

Some businesses rely on search engines to locate such information, but this is inefficient and could leave your organisation exposed to sanctions breaches and reputational risk. Selected updated sanctions lists can be found in the Law Society Guide to UK sanctions.

For full confidence in your compliance, your data sources should:

• have a full audit trail
• be curated by a global network of experts
• offer a consolidated view of global sanctions lists
• optimise sanctions records, and
• add and update sanctions lists as soon as possible.