The obligation to check sanctions lists poses major challenges for entrepreneurs: Global anti-money-laundering regulations criminalise business contacts with persons and organizations who have links to a criminal organisation or are affected by an embargo measure. Likewise, trading with goods that are included in goods-related sanctions lists must be refrained from. If a company violates this and does not carry out a regular sanction and embargo list check, it can be sanctioned and is liable to prosecution.

In the context of anti-money laundering regulations, companies are prohibited from having business contacts with organisations or persons that are included in a sanctions list. Sanction lists are official lists in which persons, groups, organisations or economic goods are noted from which criminal threats emanate. A distinction is made between:

• Person- and organisation-related sanctions lists
• Goods-related sanctions lists

Goods-related sanctions lists contain goods and products that are affected by special import duties or export restrictions, for example. Export restrictions apply, among other things, to dual-use goods that can be used for both private and military purposes.

If a company violates international anti-terror regulations – e.g., by supplying terrorist organisations or disregarding export restrictions – it risks criminal sanctions. Possible sanctions are fines from €500,000 upwards, imprisonment for up to 15 years,

damage to reputation and subsequent impact on business relationships.

For a penalty, it is sufficient if the company acts negligently. In order to exclude such misconduct from the outset, it is advisable to regularly compare employee and customer data as well as your products or trade goods with the relevant sanctions and embargo lists.

The duty to check sanctions and embargo lists does not lie exclusively with the management of a company but is to be enforced equally by every department. Particularly noteworthy are, for example, the accounting department, the sales department, the customer service department and the human resources department.

For example, the accounting department is required to check whether payments are made to persons or organisations that do not stand up to a sanctions list check. Similarly, Sales must reassure itself for each transaction that there is no match to a sanctions list. The service must check that persons and companies on a sanctions list do not benefit from warranty rights, maintenance claims or similar. The HR department should also regularly subject existing employees and all applicants to a GDPR-compliant employee check.

The duty to check sanctions and embargo lists does not lie exclusively with the management of a company but is to be enforced equally by every department. Particularly noteworthy are, for example, the accounting department, the sales department, the customer service department and the human resources department.

For example, the accounting department is required to check whether payments are made to persons or organisations that do not stand up to a sanctions list check. Similarly, Sales must reassure itself for each transaction that there is no match to a sanctions list. The service must check that persons and companies on a sanctions list do not benefit from warranty rights, maintenance claims or similar. The HR department should also regularly subject existing employees and all applicants to a GDPR-compliant employee check.

Since sanctions lists are updated regularly, it is not sufficient to check the existing data only once. On the contrary, regular checking and ideally monitoring is required.

In principle, the intervals can be freely determined by the company. Since the sanctions lists are often updated at very short notice and irregularly, a complete and, above all, automatic check is recommended (monitoring). This is easier to achieve with the help of digital and automated solutions than with a manual procedure – which would require an immense amount of work and time due to the large number of sanctions lists.

In the context of international anti-money-laundering, all European companies are subject to the EU Anti-Money-Laundering Measures. This regulation stipulates that no business relations may be entered into or maintained with individuals who have attracted attention during an Anti-Money-Laundering or sanctions and embargo check. A business relationship is defined as any economic contact as well as any provision of goods, services or financial resources. This so-called ban on the provision of goods and services is intended to deprive global terrorism, criminal organisations or criminals of any financial basis or economic advantage. Companies are legally obliged to cooperate and must subject their employees, customers and contractual partners to regular controls. This ensures that cooperation with persons deemed to be high-risk neither damages the company’s good reputation nor puts it in trouble under criminal law. Sanctions must also be observed in the context of money laundering prevention. For companies, it is problematic to classify themselves in the legal areas of application of the individual sanctions lists, because there are a wide variety of sanctions lists worldwide, which on the one hand can be obligatory and on the other hand can be ignored.

UN sanctions list

For an adequate check of all business contacts, a routine comparison with the sanctions lists issued by government agencies is necessary. These are official catalogues listing all persons, groups and organisations against whom an economic ban has been imposed. The basis for sanctions lists issued at European and national level is the UN Sanctions List drawn up by the UN Security Council. All UN member states are obliged to avoid the listed persons for reasons of international law. At the EU level, there are also European sanctions lists. Entries from the UN sanctions list are included in these. In addition, some states keep their own registers based on international sanctions lists. For example, there are comprehensive sanctions lists of the UK, the USA, Japan and Switzerland. In order to plan and design the regular sanctions list review, the first step is to find out which sanctions lists are relevant to whom.

European sanctions lists

If a company has its registered office and focus of activity within the EU, at least the sanctions lists issued by the EU and the respective national competent body must be checked. At the EU level, a distinction is made between the sanctions lists relating to persons and those relating to countries. For example, the “Consolidated list of persons, groups and entities subject to EU financial sanctions” (also known as the CFSP list) contains the names of all persons, companies and organisations threatened with sanctions by the EU – regardless of their nationality.

UK sanctions lists

The “Consolidated list of Financial Sanctions Targets in the UK” serves as the UK’s central sanctions list and contains financial sanctions imposed by the EU on individuals, companies and organisations as well as national supplements. From the UK perspective, it is therefore more comprehensive than the “Consolidated list of persons, groups and entities subject to EU financial sanctions” and must be checked by companies or branches and locations based in the UK.

US sanctions lists

In principle, the examination of US sanctions lists can be considered if a specific line of business affects the EAR (“Export Administration Regulations”). These form the basis of US export control law. US sanctions lists under the EAR apply worldwide to all products and technologies of US origin – even if the product contains only a single component made in the USA (“integrated abroad into foreign-made products”) or was developed solely with the help of US technologies (“foreign-made direct products”) – that are traded internationally. Thus, even European companies that have no economic connection to the USA, but only deal with European or other non-US companies, are affected by the US sanctions lists. An initial overview of the subjects of the EAR is provided by its official table of contents. Put simply, a company falls within the scope of the US sanctions lists if it trades in goods or services that are of US origin – regardless of where in the world the company is based or where its customers are located.

However, the US sanctions lists are negligible if a company does business exclusively with US companies, as in this case US products may not leave the US goods cycle.

Other sanctions lists

In addition to the sanctions lists of the EU, the UK and the USA, embargoes of Switzerland and Japan could also be relevant. It depends on whether the respective areas of interest apply to a company.

If a company maintains business relations with Switzerland or is subject to Swiss law due to its registered office, Switzerland’s “Consolidated List” should be examined. This contains sanctions imposed by the Organisation for Security and Cooperation in Europe as well as important trading partners of Switzerland. In contrast, the Japanese “End User List” is published by the Japanese Ministry of Economy, Trade and Industry (METI) and lists companies and organisations that are suspected of developing weapons of mass destruction or missiles.

If the business partner data has been subjected to a sanctions list check and a match is found, the company must take immediate action. The further course of action is largely determined by the sanctions list checked and the jurisdiction in which a company is located.

If the sanctions list check does not produce any matching results, there is nothing further for management to do. If there is a positive result and a business partner or employee does not pass the sanctions list check, further steps must be taken.

First, the hit must be thoroughly clarified, because: Identical names do not automatically mean that the person on the sanctions list and the business contact in question are the same. Date of birth, place of birth or the organisation’s registered office, for example, provide clarification. This data can usually be found in the detailed entries of the sanctions lists.

If the company does not make any progress in clarifying the matter or if the suspicion is confirmed, the competent authority must be involved. The competent authority is, for example:

Financial Service Centre of the Deutsche Bundesbank

Federal Office of Economics and Export Control (BAFA)

The authority carries out further comparisons and then informs the company of the result. If it confirms the suspicion, current monetary payments must be frozen immediately, and the initiation or establishment of business relations must be terminated immediately.

EU sanctions lists (“Consolidated list of persons, groups and entities subject to EU financial sanctions”):

If business partner data matches entries on this list, the business relationship should not be continued. The prohibition on providing information applies.

United Kingdom (“Consolidated list of Financial Sanctions Targets in the UK”):

No economic goods or funds may be made available in the case of hits on this list. If the entry is a national addition to the “Consolidated list of persons, groups and entities subject to EU financial sanctions”, it is also advisable to notify the British Treasury.

US sanctions lists:

If the sanctions list check yields hit on US sanctions lists, this does not automatically mean a ban on the business relationship – in contrast to European sanctions lists. Rather, in some cases only an authorisation is required, which must be applied for with the US authorities.

“Consolidated List” (Switzerland):

Here, too, no goods or funds may be provided in the event of hits. In the case of national additions to the “Consolidated list of persons, groups and entities subject to EU financial sanctions”, contact should also be sought with the Swiss State Secretariat for Economic Affairs.

“End User List” (Japan):

In the case of matching results on the METI lists, shipments to the listed companies must be approved by the Japanese Ministry of Economy, Trade, and Industry.

If companies underestimate the importance of a regular and thorough sanctions list check and do not check business contacts against it, they are acting with gross negligence. Criminal sanctions, reputational damage and economic losses can be the result.

So that you neither fear sanctions nor must invest a considerable amount of time and effort in the sanctions list check, it is worthwhile to resort to a simple and automated solution.