Sanctions screening that covers what automated checks miss.

The volume of sanctions designations has increased dramatically since 2022. OFAC, OFSI and the EU have issued thousands of new listings targeting Russian, Belarusian and associated individuals and entities — and the enforcement appetite of sanctions authorities has grown proportionally. Breach can mean criminal liability for senior officers, freezing of assets and reputational damage that is not recoverable on appeal.

Yet most firms screen only against names. The core vulnerability is structural: sophisticated actors do not hold assets in their own names. They use nominees, trust arrangements, multi-layer offshore structures and family members to place economic interests at a distance from the designated individual. Automated list-matching finds the name it is given. It does not find the entity controlled by a person whose name does not appear on the presented paperwork.

The major sanctions regimes

OFAC (US) — the Office of Foreign Assets Control administers more than thirty sanctions programmes, the most significant of which are the SDN list (individually designated) and OFAC's sectoral designations (restrictions on debt and equity for certain Russian state entities). OFAC has extraterritorial reach: any transaction involving US dollars, US persons or US infrastructure is subject to OFAC jurisdiction regardless of where the parties are located. The 50% rule means any entity 50% or more owned by an SDN is itself treated as blocked, even if not named.

OFSI (UK) — the Office of Financial Sanctions Implementation administers UK sanctions, which since Brexit operate independently from the EU. UK designations under the Russia (Sanctions) (EU Exit) Regulations 2019 and others frequently mirror but do not always match EU or OFAC lists. UK financial sanctions prohibit dealing with frozen assets or making funds available to a designated person, directly or indirectly.

EU Consolidated Sanctions List — aggregates designations under all EU Council sanctions regulations. EU persons and entities are prohibited from making funds or economic resources available to listed parties. Post-Brexit, UK and EU lists are maintained separately; differences between them create compliance risk for businesses operating across both jurisdictions.

UN Security Council Consolidated List — the multilateral baseline, binding on all UN member states. National regimes typically add designations beyond the UN list; the UN list is a floor rather than a ceiling.

Indirect and derivative exposure

The most significant sanctions risk for businesses today is not a customer whose name appears on a list — automated screening catches that. It is the customer whose beneficial owner is designated, or whose ultimate economic beneficiary is a person subject to restrictions, or who is transacting on behalf of a sanctioned principal.

OFAC's 50% rule is the most explicit articulation of this: if a designated person owns 50% or more of an entity, that entity is itself treated as blocked even without a separate listing. The UK OFSI position is similar. In practice, sophisticated structures are designed to stay fractionally below these thresholds while preserving economic control — requiring an analyst to assess control, not just ownership percentage.

Identifying indirect exposure requires tracing the full beneficial ownership chain: through corporate registries, cross-referencing nominee directors against known networks, identifying trust arrangements and their principals, and applying OSINT to test whether the presented structure is consistent with what the open record shows.

Who faces the highest sanctions risk

Any firm with significant counterparty exposure should screen. Those with the highest regulatory and legal exposure include:

• Financial services — banks, payment processors, money service businesses, crypto exchanges. Subject to FCA/PRA oversight, with personal liability for MLROs and senior managers.
• Professional services — law firms handling transactions, accountants and real estate agents operating under the MLR 2017 in regulated activities.
• Trade finance and commodities — particularly in sectors with CIS, Middle East or East Asian counterparty exposure. Vessel, cargo and financing chain screening all required.
• Private equity and investment — investor-level screening at fund onboarding, LP due diligence, and portfolio company counterparty screening.
• Any business transacting in US dollars — OFAC jurisdiction follows the dollar, not the geography of the parties.

Ongoing monitoring

Sanctions designations happen continuously. The volume of new listings since February 2022 means that a customer screened at onboarding twelve months ago may have been designated — or their beneficial owner may have been designated — since then. Ongoing monitoring is not a nice-to-have; for regulated firms it is a regulatory expectation, and for unregulated businesses it is the only way to avoid unwitting exposure.

Effective ongoing screening requires: regular rescreening of the customer base against updated lists, event-driven review triggered by adverse media or ownership changes, and a process for handling matches that goes beyond flagging — someone has to make a judgment call, document it and escalate where required.

How Umbragarde screens

For high-risk counterparties and complex structures, automated screening is a starting point, not an answer. Umbragarde's sanctions due diligence traces the beneficial ownership chain through multiple national corporate registries, identifies nominees and offshore structures that may obscure sanctioned principals, applies OSINT to identify indirect exposure not captured by list-matching, and cross-references against OFAC, OFSI, EU, UN and sector-specific designations. We deliver a written report with the ownership map, findings and a clear conclusion.

For firms building or reviewing their internal sanctions programme, we also advise on the gap between current procedures and what regulators expect to find — and on where OSINT-grade screening should replace or supplement automated processes.