Sanction compliance is a critical part of risk management for regulated businesses, particularly for those operating in the finance, legal and property sectors.
Non-compliance not only significantly increases the risk that the business becomes a victim of fraud, money laundering or other financial crime – meaning it also becomes an enabler of serious organised crime – but can also result in severe penalties, reputational damage, and increased scrutiny from regulatory bodies.
It is therefore vital that regulated firms take sanction compliance seriously by having a robust compliance solution - including screening for sanctions - in order to mitigate risks and meet regulatory requirements effectively.
Sanctions are restrictive measures that serve various purposes, but primarily financial restrictions put in place to prevent individuals, groups and sometimes entire countries from conducting business, or receiving or transferring funds. In the UK, they support foreign policy and national security, maintain global peace and security, prevent terrorist financing and ensure compliance with UN and international obligations.
The UK enforces a range of sanctions regimes through regulations established under the Sanctions and Anti-Money Laundering Act 2018 - the primary legal framework for imposing, updating, and lifting sanctions.
Businesses are obligated to ensure that they are not engaging in transactions with sanctioned entities or individuals.
However, Global sanctions lists, such as those maintained by the Office of Foreign Assets Control (OFAC), the United Nations, and the European Union, are continually being updated and therefore, require constant monitoring, making sanction compliance a complex, ever-evolving landscape for regulated firms.
The key challenges for regulated businesses that are required to run sanctions checks as part of their overall risk management and due diligence processes are the fact that new entities can be added or removed daily and that different countries may impose their own unique sanctions, making it difficult if to comply if the business operates in multiple regions. Furthermore, if the business is using a manual screening process, there is a risk of human error, leading to costly errors in compliance.
A risk assessment for sanctions is an essential component of a business's compliance strategy. Generally conducted as part of a wider customer due diligence check, the process aims to evaluate the likelihood of engaging with sanctioned individuals or entities in line with the overall risk appetite of the business. The risk assessment will be based on factors such as the clients’ own personal geographical and financial background, their public profile or status, the business sectors that they work in, the types of transactions they undertake – and with whom.
The easiest way to run a risk assessment for sanctions is to use a third-party digital compliance check. This will involve three key stages:
All good digital compliance solutions will incorporate sanctions screening into the verification process and use information from Global sanctions lists to infirm the results. Global sanctions lists – such as the Dow Jones Global Watchlist, which has access to more than 1,100 PEPs and Sanctions lists - are updated daily, and therefore, if your sanctions checks is using these lists, will be able to immediately identify if any individuals that are subject to sanctions.
AML compliance is more than just screening for sanctions - it requires a thorough assessment of the risk associated with any potential customer – individuals or businesses – in relation to the likelihood that they are, were, or could be involved in financial crime, including money laundering and fraud. This is known as ‘Know Your Customer’ or KYC. Under UK law, regulated firms must take a risk-based approach to money laundering, which means having a good KYC programme in place that meets the businesses’ own risk level i.e. some businesses are at more risk than others, so their AML process must be more stringent. However, whatever the risk profile, all AML compliance and KYC programs must determine these three things:
To successfully run the KYC process, regulated business needs to:
The first stage is to obtain personal information about the potential customer, including their name, photograph, address and date of birth. This is usually done by using personal identification documents such as a passport or driver’s license and documents that confirm the address, like bank statements and utility bills, and then cross referencing this information with publicly available information, credit reference agencies etc.
Once you are happy that the individual is who they say they are, the next part of the onboarding process is the sanctions search and PEP screening. As discussed earlier, this stage checks the individual against global sanctions and PEP lists in order to establish if they pose a risk to the business, and if so, the level of that risk. If this check reveals that there are sanctions against the person, you may simply be prohibited from entering into a business relationship with them, in which case no further investigation is needed; the relationship cannot be established.
However, if the screening process reveals that the client is a PEP, RCA (Relatives and Close Associates, of PEPs) SIP (Special Interest Person - someone who has or has had links to financial crime), a High-Net-Worth person, or someone who has a lot of negative coverage in the press, they are seen as ‘high-risk’.
This is because they may be more susceptible to bribery because of their position or wealth (PEP, RCA or high net worth) or have a history of being linked to financial crime or other suspect activity (SIPs, anyone with adverse media coverage) or a combination of those things.
It is not illegal to enter a business relationship with a PEP, RCA, SIP or High-Net-Worth person, but you will need to undertake enhanced due diligence - where you investigate the person even further - to determine if entering into a business relationship with them would be harmful to the business.
Once the risks have been assessed, the results must be recorded and monitored on an ongoing basis for any changes to the customers’ risk level. This means that every single customer check needs to be recorded somewhere and regularly ‘re-checked’ to ensure the risk they pose has not changed.
Changes could include – but are not limited to - becoming subject to sanctions (as many Russian individuals when Putin invaded Ukraine), moving or starting to transact in a high-risk jurisdiction, or becoming a PEP. It could also go the other way – a customer may become lower risk if they are no longer a PEP, have sanctions removed, or they move to a low-risk country.
As touched on briefly earlier, AML and sanctions compliance involves several key components:
By incorporating these elements into a compliance strategy, businesses can ensure they meet regulatory requirements and reduce their exposure to financial crime.
Sanction screening involves checking individuals, companies, or entities against global sanctions lists to ensure they are not subject to sanctions or restrictions imposed by government bodies. This helps ensure compliance, prevent involvement with illicit financial activities – such as terrorism, human rights abuses, or arms trafficking - and manage reputational risk.
Sanctions compliance covers several key areas:
Sanctions compliance is a complicated process and there are a number of issues that can complicate complying with sanctions. These include:
Failure to comply with sanctions can have serious consequences for regulated firms. These include:
In the past, the entire AML process – including sanctions checks - were done manually, with customers asked to fill out forms and provide identification documents - such as a passport, driver’s license, or social security card - to prove they were who they were claiming to be.
This information was then cross-referenced with sanctions lists, but undertaking this process manually is not only hugely time consuming but is also open to error, with huge numbers of sanctioned individuals missed, while time is continually being wasted investigation false positives.
The best way to run sanctions checks is via a digital compliance platform. This type of solution can run the initial check, screen for sanctions and PEPs and then automatically run enhanced due diligence when it’s required. Not only is this quicker, easier and more secure, but it also greatly reduces false positives by only alerting the regulated business if there is a true match.
SmartSearch is an award-winning digital compliance solution that runs identification, verification, PEP and sanction screening, enhanced due diligence and monitoring, all from one place.
SmartSearch uses global data from three partners Experian, Equifax and TransUnion – the three largest credit reference bureaus in the world – and the Dow Jones Global Watchlist, which has access to more than 1,100 PEPs and sanctions lists and is updated daily.
Using the data provided by the customer and cross-referencing with these global data partners, SmartSearch is able to identify, verify and screen an individual or business in a matter of seconds.
If SmartSearch finds a match, enhanced due diligence is triggered automatically. This will comprise of running extensive checks, including building up a comprehensive adverse media profile, on any SIPs (Special Interest Persons with links to financial crimes), anyone named on sanctions lists, as well as any PEPs or RCAs (Relatives and Close Associates of PEPs).
Anyone identified as any of the above are seen as higher risk, because either they already have known links to financial crime, or because they are more vulnerable to bribery and corruption. This information is then passed on so you are able to assess the risk to your business.
As well as completing all the required checks, doing a SmartSearch rather than a standard AML check also means that your record keeping will always be up to date.
That is because when you run a SmartSearch, the check is automatically saved into the system to ensure watertight record-keeping. The entire system is monitored every night meaning that any changes to any customers’ status or public position will be identified, and you will be alerted if this affects the potential risk to the business.
There are many digital compliance solutions on the market that perform identification and verification checks, there are also a number of platforms that are able to screen for sanctions and PEPs, while other firms have programs set up to monitor customer databases. However, SmartSearch is the only one to offer all three, as well as a number of other benefits, including:
For regulated firms looking for a reliable service that can both ensure sanction compliance and streamline their operations, SmartSearch's award-winning platform offers the solution.