The greatest sanctions risk often isn’t the customer sitting in front of you
When most subject persons hear the phrase “Know Your Customer”, their first thought is to collect an identification document, obtain proof of address and identify beneficial owners.
For many AML/CFT purposes, those steps form an important part of the customer due diligence process.
Sanctions compliance, however, requires businesses to ask a different question.
Who is really behind this relationship?
A business may complete its onboarding process perfectly, verify every document presented and identify the customer with complete accuracy, yet still fail to identify a significant sanctions risk.
The reason is simple. In sanctions compliance, understanding the customer means understanding the wider ecosystem surrounding that customer.
Ownership structures, controllers, beneficiaries, commercial relationships, supply chains, intermediaries, end-users and counterparties may all influence the sanctions risk associated with a relationship.
This is one of the key themes emerging from the Implementing Article 32 Sanctions Compliance Requirements. Understanding sanctions exposure requires subject persons to look beyond the onboarding file and develop a broader understanding of how the customer operates and who may ultimately be connected to the relationship.
As we discussed in the Rule 1 article on sanctions risk assessment, the first step is understanding where sanctions risk may exist within your business. The next step is understanding the customer and the wider ecosystem that may create that risk.
Why Sanctions KYC is different from AML KYC
One of the most common mistakes businesses make is assuming that sanctions due diligence and AML due diligence are effectively the same exercise.
Most subject persons are already familiar with the concepts of ownership and control through their AML/CFT obligations. They understand the need to identify beneficial owners and consider control exercised through means other than shareholding.
The key difference between AML and sanctions compliance lies elsewhere.
Under AML/CFT rules, organisations typically focus on identifying and verifying individuals who own or control 25% or more of the customer. Sanctions compliance requires a different mindset. The question is not simply who exceeds a particular threshold. The question is whether any person, whether natural or legal, within the ownership or control structure is a designated person.
The first question: Could a designated person benefit?
The primary sanctions consideration is whether a designated person could benefit, directly or indirectly, from the relationship, transaction or activity.
This analysis is wider than beneficial ownership.
A designated person with a relatively small ownership interest may still receive dividends, economic resources, services, assets or other benefits arising from the relationship. The sanctions risk therefore does not disappear simply because the designated person falls below a particular ownership threshold.
The objective is to determine whether funds, goods, services or economic resources could ultimately be made available, directly or indirectly, to a designated person.
The second question: Does the 50% rule apply?
A separate analysis must then be performed.
Once designated persons have been identified, subject persons should determine whether the customer itself should be treated as owned or controlled by designated persons.
This assessment requires consideration of the 50% aggregation rule.
A single designated person may hold less than 50% of the ownership interests. However, where multiple designated persons together hold 50% or more, the customer may itself be regarded as owned by designated persons.
Accordingly, sanctions due diligence is not simply about identifying beneficial owners. It is about identifying designated persons throughout the structure, assessing whether they may benefit from the relationship and determining whether the ownership and control structure triggers sanctions consequences for the customer itself.
Looking beyond the customer
Effective sanctions due diligence requires subject persons to look beyond the customer itself and develop a broader understanding of the relationships, activities and circumstances surrounding that customer.
The customer is often the starting point of the assessment, but rarely the end point.
The six questions every subject person should ask
The SMB’s guidance can ultimately be distilled into a simple six-question checklist:
- Who is my customer?
- Who owns the customer?
- Who controls the customer?
- Who ultimately benefits from the relationship?
- How does the customer conduct its business?
- With whom does the customer do business?
Many sanctions compliance failures occur because businesses focus exclusively on the customer itself and stop asking questions too early.
The subject persons that achieve better outcomes are often those that continue asking questions until they understand the wider ownership structure, commercial ecosystem and potential sanctions exposure associated with the relationship.
The hidden risk of intermediaries and nominees
Experience shows that sanctions circumvention rarely occurs openly.
Individuals seeking to avoid detection often place distance between themselves and the transaction. That distance may be created through intermediaries, representatives, introducers, nominees, agents, relatives or corporate structures.
This does not mean that the presence of an intermediary should automatically trigger suspicion.
Intermediaries often serve entirely legitimate commercial purposes. However, their involvement should encourage subject persons to understand the context of the arrangement more fully.
- Who is instructing whom?
- Who is funding the transaction?
- Who is receiving the benefit?
- Why is an intermediary involved?
The objective is not to assume wrongdoing but to ensure that the subject person genuinely understands the relationship it is entering into.
The nature of business tells you where to look
An often overlooked aspect of sanctions due diligence is the customer’s actual business activity.
Understanding ownership and control is important, but understanding what the customer actually does is often what determines where sanctions risk is most likely to arise.
Different sectors, goods, services and technologies create very different sanctions exposures.
For example, a local retail business operating exclusively within Malta will generally create a very different sanctions risk profile from a company involved in international trade, logistics, defence-related manufacturing, advanced technology, aviation, shipping or energy.
The nature of business often provides the first indication of where sanctions exposure may arise and which aspects of the customer’s activities require closer scrutiny.
Consider the example of a company manufacturing drones. A business producing short-range commercial drones for photography may present a different level of sanctions exposure from a manufacturer producing long-range drones capable of being adapted for military or surveillance purposes. The moment a subject person identifies potential exposure to dual-use goods, technologies or components, the focus should shift from simply identifying the customer to understanding the activities, products and commercial relationships that create that exposure.
Questions may arise such as:
- Who are the end-users of the product?
- Which jurisdictions receive the goods?
- Are distributors, agents or intermediaries involved?
- Who ultimately controls the technology?
- Could the goods be incorporated into products supplied to sanctioned jurisdictions or restricted end-users?
The same principle applies across many sectors.
- A payroll or bookkeeping company may primarily require an understanding of the customer, its owners, controllers and the recipients of funds.
- A software developer creating internal business applications may require a relatively limited sanctions assessment focused on ownership, control and key counterparties.
- A developer of advanced technologies, encryption tools, artificial intelligence applications or cyber-security solutions may require a deeper understanding of licensing arrangements, deployment models, end-users and jurisdictions.
- A trader or manufacturer of dual-use goods may require particular attention to sourcing arrangements, distribution channels and end-use considerations.
- A shipping, aviation or energy business may require a deeper understanding of routes, operations, counterparties and geographic exposure.
However, understanding sanctions exposure is not simply a matter of understanding who the customer is and what the customer deals in.
Subject persons should also seek to understand how the customer conducts its business.
Two companies may sell exactly the same product yet create completely different sanctions risks depending on how that product reaches the market, where it is used and who ultimately benefits from it.
Questions that may become relevant include:
- Where do the goods, services or technologies originate?
- How do they reach the market?
- What jurisdictions are involved?
- What is the intended end-use of the product, service or technology?
- Are there features which could create military, strategic, surveillance or other restricted applications?
A product that appears low-risk when viewed in isolation may create a very different risk profile once its destination, end-use or deployment model is understood. Similarly, technology developed for legitimate commercial purposes may create heightened sanctions concerns if it can be incorporated into military, strategic, surveillance or other restricted activities.
Ultimately, business activity often determines where sanctions exposure arises. The products, services, technologies, customers, jurisdictions and commercial arrangements associated with a business will frequently reveal far more about sanctions risk than the ownership structure alone. Understanding what a customer does is therefore not a simple onboarding exercise. It is often the foundation upon which an effective sanctions assessment is built.
Practical red flags
Ask more questions when:
- Ownership structures appear unusually complex.
- Different documents provide inconsistent information.
- Decision-makers are difficult to identify.
- Intermediaries are involved without a clear commercial rationale.
- The person funding the relationship differs from the customer.
- The customer struggles to explain who ultimately benefits from the arrangement.
- Control appears concentrated in individuals who do not hold ownership interests.
- The relationship involves several layers of entities across multiple jurisdictions.
The presence of a red flag does not automatically indicate a sanctions issue. It simply means additional understanding may be required.
Final thought
The greater challenge is understanding whether any designated person exists within the relationship and whether that person could benefit, directly or indirectly, from the activities being undertaken.
Once identified, subject persons must consider two questions:
- Could funds, economic resources, goods or services be made available to that designated person?
- Does the 50% aggregation rule result in the customer being treated as owned or controlled by designated persons?
Effective sanctions due diligence therefore goes beyond the onboarding file. It requires organisations to understand how the customer operates and where sanctions exposure may arise.
Next week
Part 3 of 13 – Screen Relevant Parties
Once you know who is involved in a relationship, the next challenge becomes identifying who actually needs to be screened.
Because sanctions compliance is only effective if you are screening the right people.
Contact us to discuss what these requirements mean for your business and how Komply can help you meet your compliance obligations with confidence.