The question every Subject Person should ask
When people think about sanctions risk, they often picture banks processing international payments or multinational trading companies dealing with restricted jurisdictions.
However, the SMB’s Article 32 guidance makes it clear that sanctions compliance is not limited to high-profile sectors.
Any Subject Person can unknowingly become involved with a designated person, frozen assets, a sanctioned jurisdiction, or a structure established to conceal sanctions exposure.
This is why the first building block of the sanctions framework introduced under Article 32 is the Sanctions Risk Assessment (“SRA”).
As Subject Persons continue to design and embed their sanctions frameworks following the introduction of these requirements, understanding sanctions exposure is the logical starting point. Before screening, monitoring, reporting or freezing assets, businesses must first understand where sanctions risk exists within their operations.
An SRA is not just another regulatory document
Given that SRAs are a relatively new requirement, there is a risk that some businesses may view them primarily as a compliance deliverable. That would miss their true purpose.
An SRA is ultimately a business exercise designed to identify where sanctions exposure exists and how it should be managed.
The purpose is to identify:
- Where sanctions exposure can arise.
- How that exposure could materialise.
- Which controls are needed to manage it.
Without this understanding, Subject Persons risk implementing generic controls rather than controls that are tailored to their specific sanctions risk exposure.
The same principle applies in any effective risk management framework. A business would not purchase insurance before identifying the risks it is seeking to mitigate. Similarly, a sanctions framework should be designed around a clear understanding of the Subject Person’s sanctions exposure.
Why sanctions risk is different from AML risk
As businesses develop their SRAs, many may instinctively view sanctions risk through the same lens as AML/CFT risk. However, the two assessments are designed to answer different questions.
A Business Risk Assessment (“BRA”), which analyses AML/CFT risk, focuses on the likelihood that a customer, transaction or activity could facilitate ML/FT. An SRA, by contrast, focuses on whether the business could become exposed to designated persons, sanctioned jurisdictions, frozen assets or sanctions circumvention activity.
As a result, a customer that presents relatively low ML/FT risk may still create significant sanctions exposure, making it essential to assess sanctions risk as a distinct and standalone discipline.
Consider a long-established corporate customer with a transparent ownership structure, audited financial statements and a legitimate source of funds. From an AML/CFT perspective, such a customer may appear relatively low risk.
However, the sanctions picture could be very different.
The company may trade with jurisdictions considered to be circumvention hubs, or operate within sectors that are particularly exposed to international sanctions. None of these factors necessarily indicate ML/FT concerns, yet they may significantly increase the business’s sanctions exposure.
This distinction is important. As Subject Persons build and refine their sanctions frameworks, it will become increasingly important to recognise that the BRA and the SRA serve different purposes, focus on different risk drivers and require different analysis.
Foundation questions every business should ask
While every business’s sanctions exposure will be different, an effective SRA should be built around a series of fundamental questions designed to help the Subject Person understand where sanctions risk may arise.
The questions below represent some of the core building blocks of that analysis. They are not intended to be an exhaustive checklist, nor are they the only questions a business should consider. As Subject Persons mature their sanctions frameworks, many will identify additional risk factors driven by their customer base, services, delivery channels and operating model.
- Who are our customers?
- Where are they located and where do they operate?
- How complex are their ownership and control structures?
- Which products and services create sanctions exposure?
- How might a sanctioned person interact with our business indirectly?
Ultimately, a good SRA should enable the business to clearly articulate where sanctions exposure exists, how those risks have been assessed, and how its sanctions framework has been designed to address them.
Furthermore, an SRA should not be built solely around today’s business model, but also around how the business expects its customers, services and geographic exposure to evolve.
Looking beyond the named customer
One of the most common risks when designing an SRA is focusing exclusively on the customer being onboarded. In reality, sanctions exposure often arises through beneficial owners, controllers, intermediaries, counterparties and other connected parties.
An effective SRA should therefore look beyond the customer’s name and consider who stands behind the relationship and who the customer interacts with. In many cases, sanctions risks only become apparent when ownership, control and transactional relationships are examined more closely.
Potential pitfalls as businesses implement SRAs
As the requirement to conduct an SRA is still relatively new, many businesses are developing their approach for the first time. As they do so, there are several pitfalls worth avoiding.
The first is treating the SRA as a standalone compliance document rather than the foundation of the wider sanctions framework. Similarly, businesses should be cautious about relying on generic templates or treating sanctions risk as merely a subsection of the AML/CFT risk assessment. The SRA should be tailored to the Subject Person’s own customers, services, geographic exposure and operating model.
Another common challenge is failing to translate the assessment into practice. An effective SRA should drive the design of screening, monitoring, escalation, governance and due diligence controls. The business should be able to explain how its identified risks have influenced its sanctions framework.
The relationship should also work in reverse. Screening matches, escalations, sanctions-related incidents and other compliance findings can provide valuable insight into emerging risks. A well-designed framework therefore operates as a continuous feedback loop, with the SRA informing controls and the operation of those controls continually refining the SRA.
For this reason, the SRA should be viewed as a living document rather than a one-time exercise. As supervisory expectations continue to evolve, businesses that can demonstrate a clear link between their risks, controls and ongoing refinement are likely to be better positioned than those that view the assessment as a static compliance document.
The same risk can look different depending on the nature of business
One of the challenges when conducting an SRA is recognising that the same sanctions risk can manifest itself differently depending on the nature of the services being provided.
Consider a corporate customer involved in the manufacture, trade or distribution of goods that may ultimately be supplied to higher-risk jurisdictions or end-users. The customer itself may not be subject to sanctions, yet questions may arise regarding the origin, destination or ultimate use of the goods.
A CSP may identify the risk through its understanding of the customer’s ownership structure, business activities and international footprint.
An accountant or auditor may encounter it through revenue streams, trading patterns, counterparties or disclosures in the financial records.
A lawyer or notary may encounter it when supporting commercial transactions, contractual arrangements or asset transfers.
A bank or payment institution may identify it through payment flows, trade-related transactions or counterparties located in higher-risk jurisdictions.
The underlying sanctions risk is the same, but the way it becomes visible, and the controls needed to manage it, can differ significantly.
This is why there is no universal SRA. As businesses continue developing their sanctions frameworks, assessments should be tailored to the specific activities through which sanctions exposure could arise within the business. Put simply, businesses should assess sanctions risk through the lens of the services they provide, not through the lens of another Subject Person’s business model.
The foundation stone of the framework
The introduction of the SRA requirement reflects a broader shift towards a more structured and risk-based approach to sanctions compliance.
Every other element of the sanctions framework ultimately depends on understanding risk. Businesses cannot properly design screening, monitoring, escalation, reporting, governance or training arrangements if they have not first identified where their sanctions exposure exists.
For that reason, an SRA should not be viewed as the end product of a compliance exercise. It should be viewed as the foundation upon which the wider sanctions framework is built and continuously refined.
Most Subject Persons are currently focused on producing and implementing their first SRA. Over the coming years, however, the greater challenge is likely to be demonstrating that the assessment genuinely drives the sanctions framework and evolves in response to changing risks, business activities and operational experience.
An effective SRA should therefore not only identify risk, but also provide a clear rationale for the controls implemented to manage that risk.
As supervisory expectations continue to mature, businesses that can demonstrate this connection between identified risks, implemented controls and ongoing refinement of their framework are likely to be better positioned than those that view the SRA as a static compliance document.
Next week, we move from understanding the risk to understanding the people behind it.
Part 2: Know Your Client.
If you would like to discuss how these requirements apply to your business, or explore how Komply can support your compliance objectives, feel free to contact our team.