Screening starts with names. Effective sanctions compliance starts with exposure.
In last week’s article, we explored Rule #2: Know Your Customer and discussed why sanctions due diligence often requires subject persons to look beyond the customer sitting directly in front of them.
Once that exercise is complete, a new challenge emerges.
Knowing who is connected to a relationship is one thing. Determining who should actually be screened is another.
At first glance, sanctions screening appears straightforward. Obtain a name, run it through a screening tool and determine whether a match exists. In practice, however, the harder question is often not how to screen, but who to screen.
This challenge sits at the heart of the Sanctions Monitoring Board’s guidance on Article 32.
The guidance makes it clear that sanctions screening is not merely a customer-name search exercise. Its purpose is to ensure that funds or economic resources are not made available, directly or indirectly, to designated persons.
That is important because sanctions exposure does not always originate from the customer. It may arise from a beneficial owner, a person exercising control, an intermediary, a counterparty or another party connected to the relationship.
The challenge for subject persons is determining where the screening universe ends.
Start with the obvious
The SMB’s guidance provides a relatively clear starting point.
As a minimum, subject persons should ordinarily screen:
- The customer;
- Beneficial owners; and
- Persons exercising control over the client.
For most subject persons, these categories will already feel familiar.
They are often identified as part of the KYC process and will typically form the foundation of any sanctions screening programme.
In many cases, screening these parties may be sufficient.
However, sanctions compliance can quickly become more complex once additional parties become involved.
Consider a relatively ordinary transaction.
A customer may act through an authorised representative.
A payment may be made to a supplier.
An agent may facilitate the transaction.
A broker may receive commission.
A shareholder may ultimately receive distributions.
Suddenly, the number of potentially relevant parties begins to increase.
The natural question becomes:
Which of these parties actually need to be screened?
A practical test
One of the most useful concepts emerging from the SMB guidance is a simple question:
If this party were designated, could our activities result in funds or economic resources being made available to them, directly or indirectly?
If the answer is yes, that party is likely relevant from a sanctions perspective.
This shifts the focus away from organisational charts and towards sanctions exposure.
The objective is not to identify every person connected with a relationship.
The objective is to identify those parties whose involvement could create a sanctions risk.
Viewed through this lens, sanctions screening becomes a risk-management exercise rather than a purely administrative process.
Three ways sanctions risk can arise
It may be helpful to view the screening universe through three lenses.
- Ownership risk: Could a designated person own, directly or indirectly, the customer or another relevant entity? This is often where beneficial ownership analysis becomes important.
- Control risk: Could a designated person exercise control over the customer or transaction, even without formal ownership? Sanctions exposure does not always follow ownership. Influence or decision-making authority may be equally relevant.
- Funds-flow risk: Could funds or economic resources be made available to a designated person as a result of the transaction? This is often the broadest category and explains why counterparties, intermediaries, beneficiaries and other transaction participants may require consideration.
While not every situation fits neatly into these categories, they provide a practical framework for determining whether a party belongs within the screening universe.
The temptation to screen everyone
For subject persons building a sanctions framework, there is often a temptation to screen as broadly as possible. In practice, however, large ownership structures, corporate groups and complex transactions can quickly make screening disproportionate.
The SMB recognises this reality and repeatedly emphasises proportionality, a risk-based approach and the need for professional judgement.
The difficult question: when do you stop?
One of the realities of sanctions compliance is that there is rarely a perfect answer. Stop too early and genuine sanctions exposure may remain hidden within ownership chains, control structures or transactional relationships. Continue indefinitely and the compliance burden can quickly become disproportionate.
In our view, one of the most challenging practical questions arising from Rule #3 is not determining where screening starts, but where it ends.
Every additional layer of ownership can reveal further shareholders.
Every transaction can reveal additional counterparties.
Every intermediary can introduce new parties into the analysis.
Left unchecked, the universe of potentially relevant parties can appear almost limitless. Subject persons must therefore strike a balance between identifying genuine sanctions risks and maintaining a proportionate, workable screening programme.
The objective is not to screen the maximum number of parties possible. It is to focus resources where they are most likely to mitigate real sanctions exposure.
A practical question to ask is:
What realistic sanctions exposure would exist if we did not screen this party?
If that question cannot be answered persuasively, there may be limited value in expanding the screening universe further.
Rather than applying a rigid formula, subject persons should be able to explain why certain parties were considered relevant and others were not. Regulators are likely to place greater value on a well-documented rationale than on a screening population that cannot be meaningfully justified.
Risk-based screening in practice
The nature of the customer and the activity being undertaken will often determine how far a subject person needs to look.
Regardless of the industry involved, the objective remains the same: understand where sanctions exposure could realistically arise. This requires understanding the customer, the transaction and the parties involved before determining who should be screened.
What this may look like in practice
The same customer can create very different sanctions risk dynamics depending on the service being provided.
Consider a shipping company.
A bank providing banking facilities will typically focus on the activity flowing through the accounts it operates. This may require understanding the company’s counterparties, payment flows, sanctions controls, ports of call and broader shipping activity. However, where banking relationships are split across multiple institutions, the bank’s visibility is limited to the activity passing through its own accounts.
An auditor will often have broader visibility because it reviews the company’s overall financial position across multiple banking relationships. However, audit procedures are driven by audit standards and materiality considerations, meaning the focus will generally be on transactions and balances considered material to the audit engagement.
A CSP acting as a director, particularly where that role carries legal or judicial authority, may have significantly wider visibility. Unlike a bank or auditor, the director may have access to the company’s activities irrespective of banking arrangements, materiality thresholds or individual transactions.
By contrast, a notary assisting the same shipping company with the acquisition of office premises may have a much narrower field of vision. Where the transaction is primarily financed through bank financing, the notary’s visibility into the company’s counterparties, shipping operations, sanctions controls, ports of call and cargo activities may be limited.
These examples illustrate an important principle. The extent of sanctions exposure, and therefore the scope of potentially relevant parties, is often shaped by the service being provided. Different subject persons may therefore reach different, yet equally reasonable, conclusions regarding who should be screened because they are exposed to different aspects of the same customer’s activities.
KYC Relevance versus Sanctions Relevance
The shipping company example highlights another important point.
Knowing who is relevant from a KYC perspective is not always the same as knowing who is relevant from a sanctions perspective.
KYC helps subject persons understand the customer and identify parties connected to the relationship. Sanctions screening builds on that understanding but asks a different question:
Could this person create sanctions exposure?
Consider the shipping company again.
The parties identified during KYC will not necessarily be the same for every subject person. The parties identified during KYC will not necessarily be the same for every subject person.
Even where the same parties are identified, their sanctions relevance may differ. A party may help explain how the customer operates without necessarily creating sanctions exposure. Equally, a party that receives funds, economic resources or exercises influence may become highly relevant from a sanctions perspective.
KYC therefore helps establish the universe of potentially relevant parties. Sanctions screening helps determine which of those parties belong within the screening universe.
Ultimately, the question is not whether a party was identified during KYC.
It is whether that party is relevant to the sanctions exposure created by the specific service being provided.
Documentation matters
Decisions relating to the screening universe should be capable of being demonstrated. Whether a subject person decides to screen a category of parties or exclude it, the rationale should be documented and defensible. In complex scenarios, different businesses may legitimately reach different conclusions based on their own exposure and business model.
Final thought
Technology plays an important role. However, before any screening system can identify a designated person, somebody must first determine who belongs in the screening universe.
Ultimately, Rule #3 is not about screening names.
It is about understanding sanctions exposure and being able to explain why certain parties were screened and others were not.
Next Week
Part 4 of 13 – Ongoing Monitoring
A clean screening result at onboarding does not mean sanctions risk disappears.
Next week we look at why sanctions compliance is an ongoing process, and how subject persons can identify sanctions risks that emerge long after a customer has been onboarded.
Contact us to discuss what these requirements mean for your business and how Komply can help you meet your compliance obligations with confidence.