A snapshot in time
In the first three parts of this series, we explored sanctions risk assessments, understanding your customer, and identifying which parties should be screened. Together, these components help subject persons establish a picture of the sanctions risks they face and the individuals or entities they should be aware of.
However, there is one important reality that every subject person eventually encounters: that picture does not stay still.
Customers evolve. Businesses grow. Ownership structures change. New jurisdictions are entered. New counterparties emerge. Sanctions lists are updated. Risks that did not exist when a relationship began may arise years later.
This is precisely why Article 32 does not stop at onboarding.
The Sanctions Monitoring Board’s framework expects subject persons to apply ongoing monitoring throughout the business relationship. While sanctions compliance often attracts attention during onboarding, the regulator’s expectations extend far beyond that initial assessment.
The underlying principle is a simple one.
A sanctions risk assessment conducted on day one is only a snapshot in time.
The challenge for businesses is ensuring that the information upon which decisions were originally made remains accurate, relevant and complete as the relationship progresses.
Ongoing monitoring is really about detecting change
When people hear the phrase “ongoing monitoring”, they sometimes immediately think of periodic screening exercises or recurring compliance reviews.
While these activities undoubtedly form part of a monitoring framework, they are ultimately designed to achieve a broader objective.
Detecting change.
A customer whose profile appeared straightforward during onboarding may, over the course of several years:
- Enter new markets;
- Expand operations internationally;
- Introduce new shareholders;
- Undergo a change of control;
- Establish ties to higher-risk jurisdictions;
- Develop business relationships with sanctioned or high-risk parties.
None of these developments necessarily indicate wrongdoing.
In many cases, they are simply the natural consequence of commercial growth.
Yet from a sanctions perspective, each of these developments has the potential to alter the risk profile originally assigned to the relationship.
This is why the SMB places significant emphasis on maintaining an up-to-date understanding of customers and their activities.
The objective is not to predict every future development. Rather, it is to ensure that meaningful changes can be identified when they occur.
The “successful customer” effect
One often overlooked aspect of ongoing monitoring is that increased sanctions exposure is not always the result of problematic behaviour.
Sometimes it is the result of success.
A customer that was considered relatively straightforward at onboarding may, several years later, have expanded into international markets, established overseas subsidiaries, entered into cross-border transactions, attracted new investors or developed relationships with counterparties in unfamiliar jurisdictions.
In other words, the very factors that signal commercial success can also increase sanctions exposure.
This is one of the reasons ongoing monitoring remains so important. The risk assessment performed when the relationship commenced may have been entirely appropriate at that point in time. The question is whether it still accurately reflects the customer’s current reality.
The “familiarity” risk
Ongoing monitoring is often associated with changes in customers. Equally important, however, is recognising how our understanding of those customers can evolve over time as business relationships mature. Alongside changes in ownership, activities and sanctions exposure, long-standing business relationships can introduce another dynamic that is worth bearing in mind: familiarity.
At onboarding, a prospective customer is often viewed with a naturally inquisitive mindset. Information is verified. Ownership structures are analysed. Questions are asked. Documents are reviewed critically.
As relationships mature, that level of scrutiny can gradually soften.
This is not usually the result of poor compliance practices. It is simply human nature.
Businesses work closely with customers for years. Relationships become established and trust develops. Certain assumptions may begin to form, often unconsciously.
As a result, information may sometimes be accepted more readily than it would be during onboarding. In that sense, long-standing customers can occasionally be more challenging to assess than new ones, which typically attract greater scrutiny.
An effective ongoing monitoring framework helps counterbalance this natural tendency by introducing structured review mechanisms that encourage subject persons to periodically reassess what they know about their customers.
In that sense, monitoring is not a reflection of distrust.
It is a safeguard against complacency.
Trigger events and periodic reviews
When discussing ongoing monitoring, many subject persons naturally focus on periodic reviews. These remain important, particularly for ensuring that customer information, risk assessments and screening records remain current.
However, waiting for the next scheduled review is not always sufficient.
Some changes require attention as soon as they occur.
This is where trigger events become relevant.
Examples may include:
- Changes in beneficial ownership;
- Changes in directors or key controllers;
- Expansion into new jurisdictions;
- Material changes in business activities;
- Significant adverse media;
- Sanctions matches or alerts;
- Unusual transaction activity.
Periodic reviews provide structure and discipline. Trigger events provide responsiveness.
Together, they help ensure that monitoring frameworks are both systematic and capable of responding to evolving risks.
What should subject persons be monitoring?
While monitoring arrangements will differ from one business to another, some common areas include:
- Ownership and Control: Changes in shareholders, beneficial owners, control structures or other ownership arrangements.
- Changes in Customer Activities: Changes in business activities, jurisdictions, products, services or geographical footprint.
- Screening Results: New or updated sanctions listings, designations and other screening alerts affecting existing customers or related parties.
- Transaction Activity: Activity that is inconsistent with the customer’s known profile or expected business activities.
How do subject persons become aware of change?
In practice, one of the biggest challenges is not responding to change. It is detecting that change has occurred in the first place.
Different businesses will have different mechanisms available to them, but monitoring often draws upon multiple sources of information.
These may include:
- Periodic CDD refresh exercises;
- Customer declarations and updates;
- Reviews of company registry information;
- Ongoing screening alerts;
- Transaction monitoring activities;
- Information obtained during customer communications;
- Staff observations arising from day-to-day interactions.
No single source will identify every change.
Effective monitoring therefore tends to rely on a combination of processes that collectively help businesses maintain an accurate understanding of their customers.
Questions worth asking
Every subject person’s sanctions framework will differ.
However, there are several useful questions that businesses may periodically ask themselves:
- How would we become aware of a change in beneficial ownership?
- How frequently do we reassess customer sanctions risk?
- Are our screening processes capable of identifying relevant sanctions developments promptly?
- Would we recognise if a customer’s activities expanded into higher-risk jurisdictions?
- What triggers a review of an existing customer file?
- How would we identify potential indicators of sanctions circumvention?
These questions are not intended as a checklist.
Rather, they help demonstrate the practical mindset that ongoing monitoring seeks to achieve.
Final thought
Perhaps the most important takeaway from this part of the series is that sanctions compliance cannot be defined by a single onboarding exercise.
Rule 2 asked an important question: Who is my customer?
Rule 3 expanded the discussion: Who should I be screening?
Rule 4 introduces a new question.
Has anything changed since I answered those questions?
That question sits at the heart of ongoing monitoring.
The SMB’s expectations recognise that sanctions risk is dynamic. Businesses are not expected to freeze their understanding of customers at the moment a relationship begins. They are expected to maintain that understanding throughout the life of the relationship.
A strong monitoring framework therefore serves a practical purpose.
It helps businesses identify change, challenge assumptions and ensure that decisions continue to be based on accurate and current information.
Because in sanctions compliance, understanding a customer once is important.
Continuing to understand them is what ultimately matters.
Next week
Part 5 of 13 – Freezing Assets
Identifying a sanctions match is only one part of the equation.
Next week we explore what happens after a match is confirmed, including the practical realities of freezing funds and economic resources, internal escalation procedures, and whether businesses could act quickly and effectively when a sanctions obligation requires immediate action.
Contact us to discuss what these requirements mean for your business and how Komply can help you meet your compliance obligations with confidence.