Doing business with a sanctioned entity or individual is an excellent way to risk fines and reputation damage. But figuring out whether a potential third party or customer is sanctioned is easier said than done. Chris Sindik of Blue Umbrella, a compliance and risk software provider, talks about some of the complexities.
Answering whether a prospective third party or customer is sanctioned may seem like a straightforward proposition. And many times the results are obvious and unmistakable. But not every sanctions report is so easy to parse.
For one, sanctions are being added or modified every week, and the very basis of sanctions can change altogether, such as with a foreign aid bill signed into law in late April 2024, which creates and alters existing sanctions.
Even in times of stability, keeping up with sanctions is a challenge. But it’s one companies must meet if they want to sidestep the risks of fines, litigation and lost productivity — not to mention the risk of inadvertently funding terrorist organizations, tyrannical regimes or human rights atrocities. But something as simple as an individual with a common name can inject uncertainty into a due diligence report.
Standards for sanctions screening
Most of the time, the first step is doing a screening and possibly an enhanced due diligence report (assuming you have basic data on name, country, etc.). Doing these types of checks for sanctions has become a baseline standard. As many government agencies have said over the years, a risk-based approach should be used across the compliance program.
That local company catering a lunch is likely a low-risk entity, and an in-depth investigation is overkill. However, running the names of the company and its owners through a sanctions screen is still a good idea if you have the time and resources. Many companies choose to do at least basic sanctions checks on every company and individual they do business with. These checks are typically only a few cents per search when bought in bulk — or even free of cost if a company has the time to search multiple government databases.
These screenings are typically done by putting the name of an entity or person into a searchable database, and while the basic premise of a search is simple, the results can be difficult to interpret.
The results can be inconclusive for a number of reasons, including:
- A common name (George Smith, Amir Mohammed, Zhang Wei)
- A lack of clear secondary identifiers (country, address, date of birth, registration number)
- Hit on a parent company, subsidiary, joint venture or owner but not on the actual entity itself
- Part of a state-owned entity
- Sanctions from years ago that have since been removed
- Unclear details on the nature of sanctions
Even when there is a valid hit on a company or individual, it can be up to interpretation on how to handle that finding and what it means for your company. To counteract this risk, many companies conduct dedicated research on entities with potential hits.
For example, if a key owner was sanctioned at one point in time but has since been removed from that designation, does their previous status prohibit you from working with them? Perhaps there is no legal prohibition, but upon review of company policy, it may be a clear stop sign for moving forward with the potential relationship. The short answer is that employing a risk-based approach is critical to being able to guide decisions like this one and help your organization steer clear of any compliance or regulatory troubles.
As Sanctions Lists Grow, So Do Avoidance Schemes
‘Blocked’ entities increasingly using corporate bond measures to gain access to financial markets
Read moreCommon names: Is this the person I’m dealing with?
Get secondary identifiers. This can be a date of birth, ID number, country of birth/residence, business address, photo, middle name and similar types of data. Consider geographic and cultural differences here. For example, in China, a person’s surname typically comes first. And in some Arabic cultures, names can have five distinct parts: title, given name, bin or ibn, father’s given name and a family name. Failing to understand nuances of naming conventions can make matching a person to their name especially difficult.
What if the entity we want to work with is not directly sanctioned, but part of another entity that is?
Ownership structures are not a part of every sanctions database. These sanctions databases can often be a collection of names and identifiers along with the nature (and sometimes cause) of the sanctions. Entities may be on the list due to their high-profile connections to sanctioned entities, but more complex or minority ownerships can be difficult to interpret.
For example, if your company wants to work with Global Inc. and Global Inc. is 50% owned by BU Holdings and BU Holdings is 20% owned by Christopher Sindik, does it matter if Christopher Sindik is on OFAC’s specially designated nationals (SDN) list? Would this change if he was on the list 10 years ago but was removed in 2017?
(The short answer to both of these questions is yes.)
What if a potential customer or third party was on a sanctions list at one point but has since been removed?
While it doesn’t feel great to know that you could be partnering with a formerly sanctioned entity, a genuine removal does mean the sanction is no longer in effect. However, the absence of a current sanction does not mean absence of risk entirely.
A binary approach to sanctions, as either a red or green light to do business with a partner or customer, can prove fatal to an organization’s risk approach. As with the example above, while exonerated, a relationship with a previously sanctioned entity can still present large, real and fast-moving concerns of other operational and reputational risks.
What would the board, the public, media outlets and shareholders think of working with a formerly sanctioned individual or company? The court of public opinion moves faster than the court of law, so from a pragmatic perspective, it is important to understand why the entity in question was put on the sanctions list initially, as well as why they were removed.
Additionally, when an entity is sanctioned, it is often not sanctioned by a single country but by a collection of various agencies around the world with varying degrees of scrutiny and definition. They may be off some of the sanctions lists but linger on others.
The person or company operates in a country that has sweeping sanctions; is this a problem?
On the OFAC list of active sanctions programs, there are 38 active listings under “Sanctions Programs and Country Information.” Many of these are related to blanket sanctions on specific activities or industries in dozens of countries. Does this mean that you can’t work with any companies in Somalia, Venezuela, Yemen or Ethiopia?
Knowing the nuances of the sanctions and the work your company and your third parties will do in countries can help your organization make decisions around dealing with these types of sanctions and entities. Often, these blanket sanctions can be sector-based sanctions, focused on whole industries within a geographic area in the world. While not a deal-breaker, your company should be fully aware of the nature of services and products (and those of your third parties) to see if they fall under these sanctions, and how a relationship with these identified entities would affect your organization.
Chris Sindik is director of third-party risk and due diligence at Blue Umbrella. During his career, he has advised hundreds of companies from 30-plus industries by providing solutions for onboarding and risk rating third parties, due diligence research, compliance program building and bespoke compliance-driven efforts. He is an expert in policies and codes of conduct having written hundreds of policies and workflows related to conflicts of interest, gifts/entertainment, money laundering, ESG and anti-bribery. In his role at Blue Umbrella, he oversees a global team of subject matter experts that lead research and due diligence projects. He has authored several articles, whitepapers and webinars on topics related to third party risk management and due diligence best practices. He is an expert in third party management, workflows, and risk mitigation tactics as well as being a certified fraud examiner and ISO37001 auditor.
