Sanctions Screening: In-House or Third-Party?

The £569,157 penalty paid by Petrofac Facilities Management Limited for Russian sanctions breaches in 2022 and 2023 marks the first time the U.K. customs authority has publicly named a company for such violations. As a compliance officer, you're likely asking: should we build sanctions screening capabilities internally or outsource to a specialist provider?

This is no longer a theoretical question. The U.K.'s willingness to name violators signals a shift in enforcement priorities from warnings to public accountability. Your screening infrastructure needs to match that reality.

The Decision You're Facing

You need to determine whether your organization should:

• Build and maintain in-house sanctions screening systems
• Contract with a third-party sanctions screening provider
• Adopt a hybrid model combining internal controls with external validation

The wrong choice doesn't just risk fines. It creates operational friction, false positives that stall legitimate transactions, or false negatives that expose you to enforcement action.

Key Factors That Affect Your Choice

Transaction volume and complexity. If you process fewer than 100 international transactions monthly with straightforward counterparty relationships, your needs differ fundamentally from an organization managing thousands of daily cross-border payments or supply chain touchpoints.

Jurisdictional footprint. Operating solely in the U.K. under Office of Financial Sanctions Implementation (OFSI) rules is simpler than coordinating compliance across EU sanctions, U.S. Office of Foreign Assets Control (OFAC) requirements, and UN Security Council measures simultaneously.

Internal technical capability. Do you have developers who can integrate sanctions list APIs, maintain database updates, and build matching algorithms? Can your team distinguish between a true match and a phonetic false positive when "Mohammed Ali" appears in your system?

Risk appetite and regulatory scrutiny. Financial services firms face different expectations than manufacturing companies. If you're in banking, energy, defense, or technology sectors with heightened sanctions risk, regulators expect more sophisticated controls.

Budget reality. In-house systems require upfront investment in software, ongoing list maintenance subscriptions, staff training, and technology refresh cycles. Third-party services convert this to predictable operating expenses but reduce your control over the screening logic.

Path A: Build In-House Screening

Choose this path if:

You have high transaction volumes with unique screening requirements. When you're processing thousands of transactions daily and need custom rules for specific product lines, geographies, or entity types, commercial solutions often can't flex enough. You need screening logic that reflects your actual risk exposure, not generic industry templates.

Your technical team can maintain real-time list updates. OFSI, OFAC, and EU sanctions lists change constantly, sometimes multiple times per week during active conflicts. If your developers can automate list ingestion from official sources and push updates to production systems within hours, you avoid the lag inherent in some third-party services.

You require deep integration with existing systems. If sanctions screening needs to happen within your ERP, procurement platform, payment systems, and CRM simultaneously, building once and deploying everywhere often proves more efficient than managing multiple vendor integrations.

You can resource ongoing maintenance. This means dedicated staff for list management, algorithm tuning, false positive investigation, and audit trail maintenance. Not just building it, but running it year after year.

Specific measures for in-house systems:

• Implement automated daily downloads from official sanctions list sources (OFSI Consolidated List, OFAC SDN List, EU Consolidated List)
• Build fuzzy matching algorithms that account for name variations, transliterations, and common aliases
• Create tiered alert systems: automatic blocks for exact matches, manual review queues for potential matches above your risk threshold
• Maintain complete audit logs showing who screened what, when, and what action they took
• Establish escalation protocols when matches occur, including legal review triggers and transaction hold procedures

The risk: you own every failure. If your system misses a sanctioned entity because your matching algorithm didn't catch a name variant, that's your liability.

Path B: Contract With Third-Party Providers

Choose this path if:

You have moderate transaction volumes without specialized requirements. If you're screening suppliers, customers, and payment counterparties using standard name-matching logic, commercial providers offer mature solutions that work immediately.

You lack in-house technical resources for sanctions compliance. Most compliance officers aren't software developers. Third-party platforms provide interfaces your team can actually use without writing code.

You need multi-jurisdictional coverage with guaranteed update speeds. Reputable providers monitor dozens of sanctions regimes simultaneously and push updates to all clients within hours of official publication. You're paying for their monitoring infrastructure and legal interpretation.

You want to transfer some liability through service level agreements. While you can't outsource accountability, you can contractually require specific performance standards, update frequencies, and matching accuracy thresholds.

Specific measures when outsourcing:

• Require contractual commitments for list update timing (within 4 hours of official publication is reasonable for major lists)
• Verify the provider's matching methodology handles your entity types (individuals, companies, vessels, aircraft)
• Test their false positive rates with your actual data before signing
• Ensure they maintain audit trails you can produce during regulatory examinations
• Establish clear ownership for investigating and resolving alerts (don't assume the vendor handles disposition decisions)
• Confirm their system can screen against your required jurisdictions, not just the most common ones

The risk: you're dependent on their technology and responsiveness. If their system goes down during a critical transaction window, you need a backup plan.

Path C: Hybrid Model

Choose this path if:

You have complex needs but limited technical resources. Use third-party screening for routine transactions while building custom controls for high-risk activities. For example, screen all vendor payments through a commercial service but maintain specialized in-house screening for joint venture partners or technology transfers.

You operate in high-scrutiny sectors. Energy, defense, and financial services firms often use vendor screening as a first line of defense, then apply additional internal checks before approving sensitive transactions. The Petrofac case demonstrates that energy sector sanctions compliance now faces the same scrutiny as financial services.

You need validation and redundancy. Run critical transactions through both your internal system and a third-party service. Investigate any discrepancies. This catches both vendor gaps and internal system failures.

Specific measures for hybrid approaches:

• Define clear decision rules for which path handles which transaction types
• Avoid gaps where both systems assume the other is screening a particular flow
• Maintain unified audit trails showing which system screened each transaction
• Test both systems regularly with known sanctioned entities to verify coverage
• Document your rationale for the hybrid approach (regulators will ask why you need both)

Summary Matrix

Factor	In-House	Third-Party	Hybrid
Best for transaction volume	High (1000+/day)	Low to moderate (<500/day)	Variable by transaction type
Technical resource requirement	High (dedicated dev team)	Low (compliance team only)	Moderate (limited dev support)
Upfront cost	High (£100K+ for enterprise systems)	Low (subscription-based)	Moderate
Ongoing maintenance burden	High (daily list updates, algorithm tuning)	Low (vendor manages)	Split responsibility
Customization capability	Maximum	Limited to vendor features	Selective customization
Multi-jurisdiction coverage	You build it	Included	Vendor provides base, you add specific needs
Liability distribution	All internal	Partial (via SLA)	Shared
Update speed control	You control timing	Vendor-dependent	Redundant coverage
Audit trail ownership	Complete control	Vendor-hosted	Dual systems

The U.K.'s decision to publicly name Petrofac signals that sanctions enforcement has moved from reactive to proactive. Your screening infrastructure needs to reflect that shift. Whether you build, buy, or blend, the critical question isn't which technology you choose but whether you can demonstrate to OFSI that your controls actually work when tested against real sanctions lists and real transaction flows.