Screening a company for sanctions exposure

Sanctions screening requires checking counterparty names against official lists maintained by the United States, United Kingdom, European Union and United Nations. The process combines name matching with assessment of indirect ownership and control to determine whether designated persons own or direct an entity's activities.

Sanctions regimes operate independently across jurisdictions, each with distinct lists, update schedules and enforcement mechanisms. A company compliant under one regime may breach another, so screening must cover all applicable regimes rather than a single list.

Core lists to screen against

The US Office of Foreign Assets Control maintains the Specially Designated Nationals and Blocked Persons list (SDN list) and a separate Consolidated Non-SDN list covering sectoral and geographic sanctions. The SDN list identifies persons and entities whose assets the US blocks. The Non-SDN list applies sectoral restrictions based on industry or nationality. Both lists are searchable via the OFAC Sanctions List Search Tool.

The UK publishes a consolidated sanctions list covering all individuals and entities subject to UK financial sanctions, with updates reflecting designated persons and entities subject to asset freeze measures. The list includes designations under UN and UK regimes as well as other international sanctions measures.

The European Commission maintains a consolidated sanctions list covering all individuals and entities subject to EU financial sanctions. The list is available in downloadable format and updated whenever official adoptions are published in the Official Journal of the European Union. Entities can access this list directly or submit due diligence queries to the EU Sanctions Helpdesk, which provides personalised assistance to operators verifying whether counterparties are designated.

The UN Security Council Consolidated List aggregates individuals and entities designated under the various Security Council sanctions committees. The consolidated format facilitates implementation, though designation criteria vary across underlying Security Council regimes, encompassing counter-terrorism designations, counter-proliferation designations and others with different operational consequences.

Name matching versus identity confirmation

Screening against these lists produces two distinct outcomes. A name match occurs when a query retrieves textual entries on the list but does not confirm identity. An identity match occurs when investigation confirms the counterparty is the designated person or entity. This distinction is operationally material: name matches require further investigation, whilst confirmed identity matches require immediate asset freeze and transaction blocking.

The OFAC tool performs name-based searching to identify potential matches. However, name matching alone increases false positives, particularly for common names. UK guidance on financial sanctions advises that if a name match is retrieved but identity remains unclear after initial consultation, counterparties may contact OFSI directly for assistance in confirming or excluding the match.

The quality of identifier information in sanctions lists determines screening burden. Lists with complete identifier data reduce both false positives and the time required to detect breaches. Lists with weak identifier data create implementation inefficiencies.

Ownership and control assessment

Designation of a parent company does not automatically extend to all subsidiaries or affiliated entities. However, UK sanctions guidance requires assessment of whether designated persons own or control entities indirectly through shareholding arrangements, board appointments or other influence. This assessment extends beyond name matching to examine corporate structure and beneficial ownership.

Export finance and trade credit operations where the ultimate buyer or obligor is located in a designated jurisdiction present regulatory complexity. Even if the immediate counterparty is not on a sanctions list, indirect ownership by a designated person, or the entity's status as a subsidiary of a designated parent, triggers compliance obligations. Documentation of ownership and control assessment forms part of the screening process.

Regulatory consequences

Non-compliance with sanctions carries criminal and civil penalties. Financial institutions and their personnel face both institutional and personal liability through enforcement action, monetary penalties and other regulatory consequences. Recent enforcement actions demonstrate that oversights in screening, particularly in detecting subsidiaries or indirect ownership links, result in substantial penalties.

Screening scope and methodology

Screening all four major regimes means a systematic search of counterparty name and known aliases, trading names or prior names against the OFAC SDN list, OFAC Non-SDN list, UK Consolidated Sanctions List, EU Consolidated Sanctions List and UN Security Council Consolidated List.

For any name match returned, the distinction between textual match and confirmed identity must be established. Where a match is returned but identity remains unclear, escalation for specialist review is required. Assessment of the counterparty's ownership structure involves identifying substantial shareholders and beneficial owners, then screening those persons against the same lists. Documented assessment of indirect ownership mitigates risk and demonstrates compliance effort.

Update frequency varies: OFAC maintains continuous updates to the SDN list, national regimes vary in their publication cycles, and the UN Consolidated List updates as Security Council committees amend their designations. For high-volume or continuous trading relationships, automation of the screening process is standard practice. Off-the-shelf compliance solutions integrate feeds from all major lists and flag matches for investigation. Manual screening remains appropriate for lower-frequency transactions but must cover all applicable lists rather than a single regime.

Documentation and escalation protocols

Screening results form part of transaction due diligence and should be documented accordingly. Evidence that searches were performed, including list version or update date, names queried and results returned, comprises part of the compliance record. Escalation procedures for name matches, unclear identities or findings of ownership linkages to designated persons should be established in institutional policy in advance.

Where a name match is confirmed as a true identity match, or where beneficial ownership traces to a designated person, the transaction must be blocked and the matter reported to the relevant regulator. The UK requires reporting of suspected designations or breaches to OFSI. The US requires filings to OFAC. The EU provides guidance through the Sanctions Helpdesk for matters requiring clarification.

Sanctions screening is a non-discretionary part of know your customer (KYC) and counterparty due diligence. The operational complexity lies in interpreting name matches accurately rather than in the mechanics of searching. Institutions without specialist sanctions screening capacity benefit from external providers or advisory services. Where screening is conducted in-house, the distinction between name match and identity confirmation, and the assessment of indirect ownership through corporate structure, represent the critical control points.