Sanctions screening is an established part of assessing third-party risk. A counterparty and other relevant parties are checked against applicable sanctions lists, potential matches are investigated, and the findings help inform decisions about whether and how to proceed. However, what should be done when the screening outcome is straightforward, yet the broader relationship remains ambiguous? Sanctions risk extends beyond the screening result. It is the risk that a relationship, transaction or activity could involve a sanctioned party, restricted activity or sanctions circumvention. The practical challenge is therefore understanding the underlying aspects of the immediate counterparty, which includes its ownership structure, intermediaries, jurisdictions, transaction patterns, and possible connections to restricted activities.
Recent UK and EU action against Russia’s so-called “shadow fleet” provides a useful example. In June 2026, UK forces boarded the SMYRTOS, a sanctioned oil tanker travelling through the English Channel, in the first UK-led operation of its kind. The following month, the EU’s 21st sanctions package added a further 41 vessels to its shadow-fleet measures, taking the number listed by the EU to more than 670. The package also extended measures to the wider ecosystem supporting the fleet, including vessels providing bunkering and other services, and designated entities involved in supporting shadow-fleet activity. The significance for businesses goes beyond the vessels themselves.
The shadow fleet illustrates a broader challenge in sanctions compliance: risk may not always be apparent from the name of the immediate counterparty.
Recent enforcement action by the Office of Financial Sanctions Implementation (“OFSI”) against Citibank provides a different illustration of the same principle: effective sanctions compliance depends not only on identifying sanctioned parties, but also on having systems and processes capable of identifying and managing sanctions risk within transactions.
Sanctions circumvention: from designated parties to wider networks
Sanctions screening performs an essential function: identifying whether the parties being screened are subject to relevant sanctions. Circumvention presents a different challenge because it can create a gap between restricted activity and those seeking to benefit from it. The UK Government guidance on Russian sanctions circumvention identifies practices including indirect shipping routes, misleading information about the end use of goods and professional evasion networks. It encourages businesses to understand their customers’ identity, beneficial ownership, background and business operations, particularly where goods or technologies are at heightened risk of diversion to Russia.
Why a “No Match” screening result does not mean no sanctions risk
The shadow fleet demonstrates why this wider context matters. A transaction may involve owners, operators, corporate entities, traders, intermediaries and service providers across several jurisdictions. The immediate counterparty may return no obvious sanctions match while other aspects of the relationship warrant further scrutiny.
A “no match” is therefore valuable information, but it should be understood for what it is: a screening result rather than, by itself, a complete assessment of sanctions risk.
The challenge is compounded for businesses operating across multiple jurisdictions, where sanctions regimes may differ in scope, targets and implementation. Recent measures illustrate this divergence: New Zealand has expanded its Russia sanctions regime to include additional shadow-fleet vessels and new prohibitions related to sanctions evasion, Canada has continued to expand its designation of shadow-fleet vessels, and the United States has targeted third-country entities involved in sanctions evasion and the supply of goods supporting Russia’s military-industrial base. A transaction that does not raise an issue under one relevant sanctions regime may therefore still require consideration of other regimes or legal requirements that apply to the parties, transaction, goods or jurisdictions involved.
Why screening alone is insufficient to detect sanctions red flags?
Consider a business entering into a relationship with a new overseas counterparty. Screening identifies no sanctions matches against the company or the relevant individuals identified at the outset. That provides a degree of assurance. It does not necessarily establish who ultimately owns or controls the business, why an intermediary is involved, whether the transaction is consistent with the counterparty’s normal activities, or who the ultimate end user or beneficiary is.
The UK Government’s March 2026 circumvention guidance identifies potential warning signs including significant changes in company structure or ownership, customers whose business activities do not appear consistent with the goods being purchased, unusual shipping routes and the use of intermediaries or complex corporate structures. None of these factors necessarily establishes sanctions circumvention risk. Intermediaries, complex corporate structures and third-country transactions can all have legitimate commercial explanations.
The significance lies in context and combination. An intermediary with a clear commercial purpose may raise little concern. An unexplained intermediary combined with unclear ownership, activity inconsistent with the counterparty’s stated business and uncertainty over the final destination of goods presents a different risk picture.
Assessing Diversion Risk Across Higher-Risk Jurisdictions
For exports of certain goods considered at heightened risk of diversion to Russia, UK guidance identifies a number of third-country jurisdictions where businesses should consider enhanced due diligence on customers. The guidance makes clear that the list is not exhaustive and that the risk associated with each jurisdiction and individual trade can differ. These currently include:
- Armenia
- China, including Hong Kong and Macau
- India
- Israel
- Kazakhstan
- Kyrgyzstan
- Malaysia
- Serbia
- Thailand
- Türkiye
- UAE
- Uzbekistan
- Vietnam
The list is intended to assist businesses in assessing diversion risk. The UK Government states that the risk associated with each jurisdiction and individual trade can differ. It also expressly supports legitimate trade with these countries where the end destination is not Russia or another sanctioned destination and makes clear that inclusion on the list does not attribute responsibility for circumvention risk to the jurisdictions themselves. A geographic connection should therefore be understood as a risk factor requiring context, rather than evidence of wrongdoing. A well-established customer in one of these markets may present a very different risk profile from a newly introduced intermediary whose ownership is difficult to establish, whose activities appear inconsistent with the proposed transaction and where there is limited clarity around the ultimate end user.
The direction of UK sanctions controls also reflects greater attention to what sits behind the immediate transaction. Sanctions end-use controls introduced in 2026 provide a mechanism for the UK Government to restrict certain exports where the government has informed an exporter that there is a risk that the goods or related technology may ultimately be diverted, via that route, to a sanctioned destination or person. Nevertheless, the controls reinforce the importance of understanding the end user, intermediary and potential diversion route when assessing relevant trade-sanctions risk. Depending on the risk, this may require establishing beneficial ownership and control, identifying relevant related entities and intermediaries, corroborating a counterparty’s stated operations, and understanding the intended purpose and end use of a transaction. The objective is not absolute certainty, nor is enhanced due diligence appropriate for every counterparty. The more useful question is whether the information available provides sufficient assurance for the level of risk involved.
When should sanctions screening become enhanced due diligence?
There is no universal point at which sanctions screening should automatically become enhanced due diligence. A risk-based approach instead considers the nature and significance of the indicators identified and how they interact. One unusual feature may simply require clarification. Several risk-indicators, such as unclear ownership, an unexplained intermediary, unusual routing and uncertainty around the end user, may justify deeper investigation. The focus should be on relationships where the counterparty, transaction, product, jurisdiction or combination of warning signs creates a credible reason to look further.
Russia’s shadow fleet is a particularly visible example of sanctions circumvention risk, but the underlying issue is broader than maritime trade. Modern supply chains can involve distributors, resellers, logistics providers, service providers, corporate vehicles and other intermediaries between an original supplier and the ultimate destination of goods or economic benefit. That complexity is not inherently suspicious, but it can make understanding the full relationship more important when credible risk indicators arise. This is where the distinction between screening and due diligence becomes particularly relevant.
Sanctions screening vs sanctions due diligence
Screening asks whether the parties we know about are sanctioned. Due diligence helps establish whether we understand the relationship well enough to know who and what should be screened. As circumvention methods continue to evolve, businesses need neither to treat every unusual feature as suspicious nor to regard a clear screening result as the end of the assessment. Effective third-party risk management sits between those two extremes: identifying relevant indicators, understanding them in context and applying proportionate scrutiny where the circumstances justify it.
Due diligence is not solely about identifying reasons to stop a transaction. In many cases, it provides the evidence and context needed to assess whether a relationship or transaction is legitimate, understood and within an organisation’s risk appetite. That assurance can allow businesses to proceed with greater confidence, while applying appropriate safeguards where risks do exist. In this sense, due diligence is not simply a risk-identification exercise; it is an important part of risk mitigation, helping businesses operate with greater confidence and assurance.
TenIntelligence Thoughts
Sanctions screening is one component of a broader third-party risk assessment. TenIntelligence due diligence experts support organisations with sanctions and PEP screening, beneficial ownership analysis, commercial due diligence and enhanced due diligence, helping clients understand corporate relationships, identify relevant risk indicators and make evidence-based decisions.
Need to assess your sanctions risk?
Speak with a due diligence expert for a tailored risk assessment of your business relationships.
Written by
Salma Abouahmed | Analyst
FAQs
Does a clear sanctions screening result mean there is no sanctions risk?
No. A clear or “no match” screening result only indicates that the parties screened did not produce an identified sanctions match based on the information and lists used. It does not, by itself, establish that the wider relationship is free from sanctions risk. Ownership, intermediaries, jurisdictions, transaction patterns, end users and potential circumvention indicators may require further assessment.
What is the difference between sanctions screening and sanctions risk assessment?
While sanctions screening checks the relevant parties against the applicable sanctions lists, sanctions risk assessment looks at the wider circumstances surrounding a relationship or transaction, such as ownership and control, intermediaries, jurisdictions, end use, and any possible indicators of sanctions circumvention. Screening is therefore just one element of a comprehensive sanctions risk assessment.
How can beneficial ownership affect sanctions risk?
Beneficial ownership can affect sanctions risk because the immediate counterparty may not reveal the individuals or entities that ultimately own or control it. Where ownership is complex, changes frequently, or involves multiple jurisdictions, businesses may need to establish who ultimately owns or controls the entity and assess whether those parties create additional sanctions exposure.
What is the significance of the OFSI enforcement action against Citibank, and what does it signal about transactional sanctions risk?
The OFSI action against Citibank illustrates that sanctions compliance failures does not arise from screening misses but also from inadequate systems and processes for identifying and managing sanctions risk within transactions themselves. A financial institution can have robust list-screening in place and still face enforcement exposure if its transactional controls fail to flag risk that is present in the structure or flow of a payment rather than in the identity of the named counterparty. For non-financial businesses, the lesson is the same: the question regulators are increasingly asking is not only whether you checked the right names, but whether your processes were capable of identifying the risk that existed in the transaction as a whole.