When a sanctions framework meets reality
Over the past four weeks, we have explored how subject persons assess sanctions risk, understand who they are dealing with, screen relevant parties and maintain ongoing monitoring. Together, these controls are designed to answer one critical question:
Could a designated person be involved in this relationship or transaction?
However, identifying a sanctions concern is only part of the equation.
At some point, every sanctions framework is tested by a more practical question:
What happens when you actually find a match?
This is where Rule 5 becomes relevant.
The SMB’s guidance on freezing and reporting controls moves beyond risk identification and focuses on execution. Once a sanctions match is confirmed and freezing obligations apply, subject persons are expected to take immediate action to prevent funds or economic resources from being made available to a designated person.
For many businesses, this is the moment sanctions compliance shifts from a compliance exercise into an operational challenge.
The difference between finding a match and managing one
Most subject persons have invested significant effort in onboarding, screening and monitoring.
However, the effectiveness of the sanctions framework is often determined by what happens immediately after a confirmed match is identified.
A sanctions designation is published overnight. The next morning, an employee identifies that an existing customer appears affected.
Several questions immediately arise:
- Who reviews and validates the match?
- Who is authorised to take the freeze decision?
- What activities must stop immediately?
- Which business units need to be informed?
- How is tipping-off avoided?
- What reporting obligations are triggered?
The speed with which these questions are answered may have a direct impact on the effectiveness of the freeze.
The risk of the exposure window
One practical risk that deserves greater attention is what might be called the exposure window.
This is the period between:
- The moment a sanctions measure becomes applicable, and
- The moment the freeze is fully implemented across the subject person’s operations.
In theory, freezing obligations sound immediate. In practice, there can be several moving parts.
Screening alerts may need validation. Internal escalations may need to occur. Operational teams may need to take action. Technology platforms may require updates.
During this period, businesses face a difficult challenge. What happens if funds are withdrawn, transferred or otherwise moved before all controls are fully applied?
The answer will depend on the specific circumstances, but the scenario highlights why sanctions frameworks should be designed around speed, clear authority and predefined escalation routes.
Subject persons may therefore wish to assess not only whether they can identify sanctions matches, but also how quickly they can move from identification to execution.
A sanctions framework is often measured in minutes rather than days.
Freezing assets is not always as simple as freezing a bank account
Public discussions about sanctions frequently focus on money held in bank accounts. For many sectors, however, the reality is considerably more complex.
Different businesses may hold different forms of funds and economic resources, including cash balances, investment portfolios, SICAV units, life assurance policies, client money arrangements, gaming wallet balances, assets held under custody, shares in private companies and real estate.
While the legal obligation to freeze may be the same, the operational steps required to implement and maintain that freeze can vary significantly depending on the nature of the asset involved.
Consider the following examples:
Gaming operators
- Freeze player balances
- Stop withdrawals
- Restrict bonus redemptions
- Consider the treatment of pending winnings and unsettled transactions
CSPs, trustees and fiduciaries
- Restrict instructions involving underlying entities
- Assess pending or proposed share transfers
- Review powers of attorney and authorised signatories
- Consider how ownership and control arrangements may be impacted
Investment businesses
- Prevent the redemption of units or shares
- Restrict transfers of securities
- Consider the treatment of dividends and distributions
- Suspend instructions to transfer holdings between portfolios, nominees or custodians
Insurance Businesses
- Restrict policy surrender requests
- Prevent policy loans or withdrawals
- Consider how future premium payments should be handled
- Monitor events that impact the policy’s cash value
These examples illustrate why freezing obligations cannot always be approached using a single process. Freezing a payment account may be technically straightforward, whereas restricting the transfer of private company shares, controlling assets held in custody or implementing restrictions across multiple investment platforms may require very different procedures.
For many subject persons, one of the most valuable exercises is to map the types of funds and economic resources they may encounter and determine in advance how each category would be identified, restricted and monitored if a freeze became necessary.
The objective is not merely to know that a freeze must occur. The objective is to know exactly how it would occur.
What exactly is an “economic resource”?
When sanctions discussions take place, the focus often centres on funds. Economic resources, however, can be less straightforward.
Broadly speaking, an economic resource is not necessarily money itself. Rather, it is an asset that may be used to obtain funds, goods or services.
This distinction is important because sanctions obligations are not limited to cash or bank accounts. Depending on the circumstances, subject persons may also need to consider assets such as:
- Luxury vehicles
- Yachts and other high-value vessels
- Real estate
- Valuable items held in safe custody or storage
- Shares in private companies
- Intellectual property rights
- Collectables, artwork and precious metals
These assets can present different operational challenges. While a bank account can often be restricted through a system control, preventing the transfer or disposal of other economic resources may require additional controls, stakeholders or external parties.
For this reason, subject persons may benefit from looking beyond account balances when assessing sanctions exposure and asking a simple question:
If a designated person were connected to one of our customers today, what funds and economic resources could we actually identify, control and restrict?
The answer will often vary significantly between sectors, business models and customer profiles, making it an important consideration when designing a sanctions framework.
The practical difficulty of ownership structures
In our previous articles, we explored customer due diligence, beneficial ownership and screening. Rule 5 highlights why those controls matter in practice.
Assets are not always held directly by the designated person. They may be held through companies, trusts or other structures involving multiple parties.
Consider a scenario where a designated individual is connected to a corporate customer through several layers of ownership. The immediate challenge becomes determining:
- Who ultimately owns or controls the asset?
- Which funds and economic resources may be affected?
- Whether freezing obligations extend beyond the individual identified during screening.
These assessments often need to be performed quickly and based on reliable ownership information.
For this reason, Rule 5 should not be viewed in isolation. The effectiveness of freezing measures is often closely linked to the quality of the due diligence, ownership transparency and screening measures that preceded them.
The challenge of maintaining the freeze
Implementing a freeze is one challenge. Maintaining it is often another.
As businesses grow, restrictions may need to remain effective across multiple departments, systems and teams. Under these circumstances, the risk of human error can increase.
Examples could include:
- An employee processing a transaction without realising a restriction is in place.
- A system migration failing to carry forward sanctions restrictions.
- A customer account being reviewed by a team that lacks visibility of the freeze.
For this reason, subject persons may benefit from viewing a freeze not as a single event, but as an ongoing control requiring continuous oversight.
The question is not simply:
“Have we frozen the assets?”
It is also:
“How do we ensure the freeze remains effective tomorrow, next month and next year?”
Governance and operational readiness
When discussing freezing obligations, attention often focuses on screening tools, alerts and technology. In practice, however, governance is often what determines whether controls function effectively when a sanctions event occurs.
A confirmed sanctions match can trigger a series of decisions and actions across multiple teams. Subject persons may therefore wish to consider:
- Who validates the sanctions match?
- Who authorises operational restrictions?
- Is legal input required?
- How is senior management informed?
- What happens if key decision-makers are unavailable?
- Are responsibilities clearly documented and understood?
Businesses should also ensure that decisions, actions taken and supporting rationale are appropriately documented.
Effective sanctions frameworks rely on more than policies. They require clear responsibilities, established escalation routes and practical implementation arrangements that can operate when a real sanctions event occurs.
If the freeze happened today…
A useful way to assess sanctions readiness is to consider a simple scenario.
If a sanctions designation affecting one of your customers was published this afternoon, could your business:
- Identify every affected asset?
- Restrict access immediately?
- Escalate internally?
- Report where required?
- Demonstrate the actions taken to a regulator?
Unlike policies and procedures, these questions test whether the framework can operate effectively in practice.
The answer is often a stronger measure of sanctions readiness than any policy document.
A well-designed sanctions framework is ultimately demonstrated not by what is written on paper, but by how effectively subject persons can respond when action is required.
Final thought
At its core, Rule 5 is about execution.
Identifying a sanctions concern is only the starting point. The real test is whether a business can translate that identification into effective action when freezing obligations arise.
The SMB’s guidance reminds subject persons that sanctions compliance is not solely about identifying risk. It is also about being capable of responding effectively when that risk materialises.
Sanctions freezes often require rapid decisions, coordinated execution and ongoing management. The businesses that navigate these situations most effectively are not necessarily those with the longest policies or the most complex procedures. They are usually the businesses that have already considered the operational realities before the need to act arises.
It is also worth remembering that freezing assets is not always the end of the story. Depending on the applicable sanctions regime and the circumstances involved, businesses may need to consider whether licensing, authorisation or exemption processes are relevant alongside their ongoing freezing and reporting obligations.
Next week
Part 6 of 13 – Reporting to the SMB
In next week’s article, we turn our attention to another critical component of the framework: reporting obligations and engagement with the Sanctions Monitoring Board.
Contact us to discuss what these requirements mean for your business and how Komply can help you meet your compliance obligations with confidence.