Method · Sanctions
Sanctions screening: the six-control method
A useful screening framework is not judged by how many lists it queries, but by three things: when it runs, what happens to the alerts, and the record it leaves.
Most companies we audit have a screening tool. Very few have a framework. The difference is simple: the tool compares names to lists; the framework decides what happens next, and proves it.
Here is the structure we install. It is deliberately reduced to six controls, because a framework with twenty control points is never applied in full, and an unapplied control is worse than a missing one: it creates unwarranted confidence.
Control 1 — At onboarding
Before any order, the counterparty is screened against the lists relevant to your exposure: EU lists, Swiss lists where you are established or your flows transit, US lists where your products, financing or banks create a nexus, and UK or other lists as applicable.
This first control covers the counterparty and its beneficial owners. It is the only moment when you have the commercial standing to ask for a capital structure without creating friction.
- Exact name, former names, transliterations.
- Address, including secondary and delivery addresses.
- Known directors and shareholders, through to beneficial owners.
- Evidence retention: a dated capture of the result, including negative results.
Control 2 — The ownership chain
This is the control no tool performs alone, and the one that produces most real incidents. An entity that is not designated is nonetheless treated as designated when owned, directly or indirectly, more than 50% by one or more designated persons — holdings aggregating. A separate criterion, control, can produce the same effect below the threshold.
The analysis requires walking the chain to a level where the information becomes reliable, dating that information, and documenting what you could not establish. Being unable to walk the chain is not neutral: it is itself a signal to record and act on.
Practical rule
Always document what you could not verify. A file stating "ownership chain not established beyond the second level, company registered in a jurisdiction with no public register, decision to proceed taken by management on 14 March" leaves you in a far better position than a silent file.
Control 3 — At order entry
This control is about the object, not the person: is the ordered item covered by a sectoral restriction applicable to the destination country? It runs against the tariff heading and, where relevant, the specific lists of goods sensitive to circumvention. It is the easiest control to automate, provided your product master is reliable.
Control 4 — Coherence of the request
This control is human and cannot be delegated to a rule. It consists of checking that the order makes economic sense given what you know about the customer.
| Signal | What to do |
|---|---|
| Order unrelated to the customer's stated business | Suspend and request a written explanation of end use |
| Quantities disproportionate to the local market | Verify the real final destination before shipping |
| New customer, opaque capital structure, transit country | Full ownership chain analysis before acceptance |
| Payment offered by a third party not party to the contract | Refuse, or have compliance and the bank validate |
| Refusal to sign an end-use declaration | Strong signal: stop the transaction and retain the record |
| Delivery address in a country other than the registered office | Physically verify the recipient and the forwarder |
Control 5 — Before shipment
Lists change between order entry and delivery, sometimes over several months. A pre-shipment re-screen is therefore essential for sensitive flows, and must cover all parties: customer, consignee, forwarder, carrier, receiving bank. It also includes verifying the actual delivery address, which sometimes differs from the contract without anyone noticing.
Control 6 — Continuously
The whole portfolio is re-screened on every significant list update. This control is the easiest to automate and the most often neglected, although it is the best available evidence of diligence: a timestamped log of re-screens triggered by official publications.
Add a periodic review of volume anomalies by market, which is as much commercial analysis as compliance, and which catches situations no name screening will ever see.
Tuning match thresholds
A badly tuned framework fails in two ways. Too strict, it produces an alert volume nobody handles, and the framework collapses within weeks. Too permissive, it lets through the transliteration variants, renamings and typos that are precisely the circumvention playbook.
Tuning is empirical, on your real data, with a test set built from your own counterparties: spelling variants, names transliterated from Cyrillic, homonymous entities, partial addresses. We then measure the alert rate and handling time, and adjust until the volume matches the team's real capacity.
Design criterion
If handling alerts takes more time than the person responsible actually has, the framework will not work — however good it looks on paper. Sizing the tuning to real capacity is not a compromise: it is the condition for the control to exist at all.
What you must be able to produce
- The written procedure describing the six controls and the escalation rule.
- The timestamped screening log, including negative results.
- The file of alerts handled, with the decision taken and its author.
- Evidence of training for exposed functions, with dates and attendees.