Compliance officers, vendor onboarding teams, and GRC leaders face tough questions about sanctions screening. As the U.S., U.K., and EU often disagree on sanctions lists, your team must ensure your process catches risks others miss. Penalties for non-compliance are rising, and your screening needs to be thorough.
Q1: We screen against OFAC's SDN list. Isn't that enough?
No, it's not. If you're operating in the U.K. or EU, or have customers or suppliers there, you must also screen against the U.K. Consolidated List and the EU Consolidated List. These lists don't always match. A supplier might be sanctioned in the EU but not on OFAC's list, or vice versa. Screening only against OFAC exposes you to violations in other jurisdictions.
Your screening tool should pull from all three sources and update daily. Sanctions lists change constantly. If you're downloading a monthly PDF and checking names manually, you're already behind. Set up automated screening that runs against all relevant lists at the point of transaction or onboarding.
Q2: How do we handle beneficial ownership when screening third parties?
Identify the natural persons who ultimately own or control your vendor or partner, typically anyone with 25% or more ownership. Screen these individuals, not just the corporate entity. Sanctions regimes focus on beneficial owners because sanctioned individuals often hide behind shell companies.
Request ownership documentation during vendor onboarding. If a supplier can't or won't disclose beneficial owners, that's a red flag. Your contract should require them to notify you immediately if ownership changes or if any owner becomes subject to sanctions. For higher-risk relationships, re-screen beneficial owners at least annually.
Q3: Our vendor says they don't do business with sanctioned countries, so we're covered, right?
You're not covered by their assurance. You need to verify. Ask for their sanctions compliance policy and evidence of their own screening processes. If they're supplying components or raw materials, ask where those originate. A vendor might not ship directly to a sanctioned jurisdiction but could be sourcing materials from one or selling to an intermediary who does.
Include a sanctions compliance clause in your contracts requiring the vendor to warrant they're not on any sanctions list and won't engage in prohibited transactions. Add a right to audit their compliance controls if the relationship is material. For critical suppliers, consider requiring them to use the same screening tools or standards you do.
Q4: What's the actual risk if we miss a sanctions hit during onboarding?
Civil and criminal liability for both the organization and individual compliance officers. Penalties are substantial and increasing across all jurisdictions. Beyond fines, there's reputational damage, loss of banking relationships, and potential debarment from government contracts.
Regulators focus on whether your controls were reasonable and whether you acted on red flags. If you onboard a vendor later revealed as a front for a sanctioned entity, you must show you did proper due diligence. Document your screening process, your decision-making when encountering a potential match, and any risk assessments you conducted.
Q5: We keep getting false positives. How do we tune our screening without missing real hits?
Don't raise your match threshold across the board. Instead, build a structured false positive review process. When you get a potential match, document why you're clearing it: different date of birth, jurisdiction, middle name, or other distinguishing information.
Invest in screening technology that uses fuzzy logic and considers multiple data points beyond name matching. Tools that check addresses, dates of birth, national IDs, and known aliases reduce false positives. Create a cleared-parties list for entities you've already investigated and determined aren't matches, but re-screen that list quarterly.
Q6: How far down our supply chain do we need to screen?
At minimum, your direct suppliers and any sub-tier suppliers you know about. You need visibility into your supply chain deep enough to identify where sanctioned jurisdictions or entities might enter. In regulated industries like defense, financial services, or technology, regulators expect you to map your supply chain beyond tier one.
Ask your direct suppliers to warrant that their suppliers aren't sourcing from sanctioned countries or entities. For high-risk categories, require them to disclose their sub-tier suppliers so you can screen them directly. If a supplier refuses to provide supply chain transparency, assess whether that relationship is worth the risk.
Q7: Our screening tool flagged a potential match. What's our process from here?
Stop the transaction or onboarding process immediately. Assign someone with sanctions expertise to review the match. Compare all available identifying information: full name, aliases, date of birth, place of birth, nationality, passport number, address, and any other data you have against what's listed in the sanctions entry.
Document everything. If it's a false positive, record why. If it's a true match, you cannot do business with that party. Depending on the jurisdiction and circumstances, you may need to file a report with OFAC, the U.K. Office of Financial Sanctions Implementation, or the relevant EU authority. If you're uncertain, get legal counsel involved before proceeding.
Q8: How often should we update our sanctions compliance program?
Your screening lists need to update daily. Review your policies and procedures at least annually, but monitor regulatory changes continuously. Subscribe to OFAC's email updates, the U.K. sanctions list updates, and EU sanctions announcements. When a new sanctions program launches or an existing one expands, assess the impact on your business within days.
Train your team quarterly on sanctions red flags and your escalation process. Run tabletop exercises to ensure everyone knows their role before dealing with a real hit.
Where to go for more
OFAC publishes its SDN list and sanctions programs on the U.S. Department of the Treasury website. The U.K. Office of Financial Sanctions Implementation maintains the U.K. Consolidated List. The EU publishes its consolidated sanctions list through the European Commission. Set up automated feeds rather than manual checks. For complex sanctions questions involving beneficial ownership or dual-use goods, consult legal counsel with sanctions expertise before proceeding.
