What Every Multinational Should Know About … Conducting an Economic Sanctions Self-Check

As detailed in Part I of this risk-assessment self-check series, we are publishing a series of self-check assessment guides covering the key regulatory and contractual risk areas for multinational companies. This article provides Part VII, which is a self-check assessment for conducting a supply chain contracts review. Previous self-check risks assessments are found Part I (general compliance), Part II (buy-side contracts review), Part III (sell-side contracts review), Part IV (supply chain integrity compliance self-check), and Part V (antiboycott self-check), and Part VI (customs compliance and tariff-risk review).

Economic sanctions compliance presents a persistent and often fast-moving risk for multinational companies, including companies that do not manufacture, export, or distribute controlled goods. Unlike export controls, which often turn on the nature of the goods, software, or technology involved, sanctions laws can apply more broadly to ordinary business dealings, including customer onboarding, vendor relationships, payments, software access, professional services, logistics arrangements, cloud-based offerings, and transactions routed through third parties or affiliates. A company can face sanctions exposure even where the underlying products or services are not themselves controlled.

For companies outside the traditional export-controls space, sanctions risk often arises when a transaction that appears commercially routine involves a blocked or restricted party, a comprehensively sanctioned country or region, a prohibited government nexus, an indirect dealing through intermediaries, or conduct that suggests evasion, diversion, or concealment. Risks may also arise from facilitation by U.S. persons, use of the U.S. financial system, foreign subsidiaries interacting with U.S. personnel or systems, or the provision of services or access from sanctioned jurisdictions. Enforcement authorities increasingly focus not only on whether companies maintain written sanctions policies but also on whether they have implemented practical, risk-based controls that function effectively in day-to-day business.

This self-check is designed to help multinational companies assess whether they have a functioning, risk-aligned economic sanctions compliance framework. It is particularly intended for companies whose risk arises through commercial operations rather than sales of controlled goods. The questions below focus on governance, screening, escalation, third-party controls, finance and payment risks, technology and access controls, and response mechanisms. A “no” answer does not necessarily indicate a violation, but it may signal a compliance gap that warrants further review or enhancement.

I. Risk Assessment & Program Design

• Has your company conducted a documented economic sanctions risk assessment tailored to its products, services, business model, customers, vendors, affiliates, markets, and geographic footprint?
• Does the assessment recognize that sanctions risk can arise even where the company does not sell controlled goods, including through: (1) provision of services; (2) software, SaaS, platform, or cloud access; (3) payments or receivables; (4) dealings through third parties or channel partners; (5) procurement and vendor relationships; and (6) employee, affiliate, or customer activity involving sanctioned jurisdictions or blocked parties?
• Does the assessment consider relevant sanctions risk factors, including: (1) sales into or involving higher-risk jurisdictions; (2) customers, vendors, or counterparties with opaque ownership structures; (3) use of distributors, resellers, referral partners, freight forwarders, customs brokers, banks, payment processors, or other intermediaries; (4) remote access to systems, software, data, or services from sanctioned locations; (5) transactions involving government entities, state-owned enterprises, or state-affiliated counterparties; and (6) transaction patterns that may indicate diversion, transshipment, routing concerns, or evasion?
• Are sanctions risks reassessed when the business changes, including: (1) mergers, acquisitions, or joint ventures; (2) entry into new markets or channels; (3) new products, services, platforms, or delivery models; (4) centralization of finance, IT, or procurement functions; or (5) material sanctions developments or enforcement actions?
• Has your company identified which sanctions regimes may apply to its operations, including U.S. sanctions, and where relevant, UK, EU, or other local sanctions laws applicable to affiliates, personnel, transactions, or counterparties?

II. Governance, Ownership, & Accountability

• Is responsibility for sanctions compliance clearly assigned to appropriate personnel or functions, such as legal, compliance, finance, trade compliance, or enterprise risk?
• Does your company have an identified process for escalating sanctions questions to personnel with sufficient expertise and authority to stop, review, or reject transactions?
• Are sanctions compliance responsibilities appropriately allocated across business functions, including sales, onboarding, procurement, accounts payable, accounts receivable, treasury, logistics, IT, HR, and customer support?
• Does senior management receive appropriate visibility into sanctions risks, material incidents, higher-risk markets, and compliance resourcing needs?
• Are sanctions controls designed so that commercial personnel are not left to make legal judgments without compliance or legal support?

III. Policies & Practical Guidance

• Does your company maintain clear, accessible economic sanctions policies tailored to its business model and operating environment?
• Do policies explain that sanctions restrictions may apply even when the company does not deal in controlled goods and that routine transactions can still create sanctions exposure?
• Do policies provide practical guidance on: (1) screening counterparties; (2) identifying sanctioned countries, regions, parties, vessels, and ownership issues; (3) escalation procedures for possible matches or red flags; (4) restrictions on providing services, software access, support, or payments involving sanctioned parties or territories; and (5) when legal or compliance review is required?
• Do policies address prohibited indirect dealings, including transactions routed through distributors, resellers, service providers, affiliates, or other intermediaries?
• Are policies reviewed and updated periodically to reflect changes in applicable sanctions laws, enforcement trends, and business operations?

IV. Counterparty Screening & Onboarding

• Does your company screen relevant parties on a risk-based basis, including customers, vendors, distributors, service providers, referral partners, agents, consultants, counterparties, and other third parties?
• Does screening extend, where appropriate, to beneficial owners, parent companies, affiliates, directors, authorized signatories, consignees, end users, vessels, financial institutions, and other transaction participants?
• Does your company have a process to identify whether a counterparty is owned 50% or more, directly or indirectly, by one or more blocked persons, or is otherwise subject to applicable restrictions?
• Are onboarding and vendor-setup processes designed to capture sufficient information for sanctions review, including legal name, address, country, ownership information where appropriate, and banking details?
• Are potential screening matches reviewed and resolved by trained personnel before onboarding or payment?
• Are counterparties re-screened periodically or upon relevant changes, such as ownership changes, address changes, new payment instructions, or expansion into new jurisdictions?

V. Geographic, Service, & Technology Access Controls

• Does your company assess whether it provides products, services, support, software, SaaS access, cloud access, updates, downloads, or other benefits into sanctioned countries or regions?
• Are there controls to identify and address access to systems, platforms, portals, or applications from sanctioned jurisdictions, including through IP address review, geolocation tools, account registration data, or other technical means where appropriate?
• Does your company evaluate whether employees, contractors, customers, or third parties located in sanctioned jurisdictions may be accessing services, support, or systems in a manner that creates sanctions risk?
• If the company provides professional, technical, financial, digital, or other non-goods services, are there controls to assess whether those services could involve blocked parties, sanctioned territories, or prohibited government-related dealings?
• Are there controls to prevent sanctioned-country workarounds, such as use of alternate billing locations, non-local subsidiaries, VPNs, transshipment points, substitute banks, or mischaracterized end-user locations?

VI. Transaction Review, Red Flags, & Escalation

• Are transactions reviewed for sanctions-related red flags, including: (1) inconsistent customer or vendor information; (2) unusual routing, shipping, or payment patterns; (3) reluctance to disclose ownership or end use; (4) requests to remove identifying information from documents; (5) use of multiple intermediaries without clear commercial purpose; (6) last-minute changes to destination, counterparty, or bank details; or (7) references to sanctioned countries, regions, or parties?
• Are customer service, finance, procurement, logistics, and sales personnel trained to identify sanctions red flags and to pause activity pending review?
• Are there documented procedures for holding shipments, blocking onboarding, suspending services, stopping payments, or pausing transactions when sanctions concerns arise?
• Are decisions on escalated issues documented, including the facts reviewed, disposition, and any conditions for proceeding?
• Does your company have a process for handling false positives efficiently while ensuring potentially significant matches receive appropriate review?

VII. Finance, Treasury, & Payment Controls

• Do accounts payable, accounts receivable, treasury, and finance teams have sanctions-related review procedures appropriate to their roles?
• Are payment counterparties, remitting banks, beneficiary banks, and other financial institutions screened or reviewed on a risk-based basis where appropriate?
• Are there controls to identify red flags in payment activity, such as requests for payment to third parties, frequent changes to banking instructions, payments involving high-risk jurisdictions, split payments, unusual currencies, or unexplained intermediary banks?
• Does your company assess whether use of the U.S. financial system, U.S.-dollar payments, or involvement of U.S. persons could create additional sanctions implications?
• Are blocked or rejected transactions handled in accordance with applicable legal requirements and internal procedures, including documentation and escalation?

VIII. Third-Party, Distributor, & Vendor Risk Management

• Does your company apply risk-based due diligence to distributors, resellers, agents, consultants, freight forwarders, customs brokers, logistics providers, payment processors, outsourcing providers, and other third parties that may create sanctions risk?
• Are third parties subject to appropriate contractual controls, including sanctions compliance representations, commitments not to engage in prohibited transactions, restrictions on prohibited resale or onward dealings, cooperation obligations, audit rights, and termination rights where appropriate?
• Does your company assess whether third parties may expose it to sanctions risk by servicing sanctioned territories, dealing with blocked parties, obscuring end users, or rerouting transactions?
• Are procurement and vendor-management functions trained to identify sanctions risks in supplier and service-provider relationships, not just customer relationships?
• Is there a process for escalating and resolving third-party sanctions concerns before onboarding, renewal, or continued performance?

IX. Affiliates, Shared Services, & Internal Operations

• Has your company assessed sanctions risks arising through affiliates, shared service centers, and centralized functions, such as finance, IT, procurement, legal, HR, and customer support?
• Where U.S. persons are involved, are there controls to identify and address potential facilitation risks relating to foreign affiliate activities?
• Are there procedures governing referrals, approvals, technical support, invoicing, procurement assistance, customer support, or other internal actions that may involve sanctioned jurisdictions or blocked parties?
• Are internal systems, workflows, and approval processes designed so sanctions concerns can be elevated before commitments are made externally?
• If your company has acquired businesses or operates through decentralized entities, have sanctions controls been integrated consistently across the organization?

X. Training, Communications, & Testing

• Is economic sanctions training provided on a risk-based basis, with enhanced focus for sales, customer onboarding, finance, treasury, procurement, logistics, legal, IT, customer support, HR, and senior leadership?
• Does the training explain sanctions concepts in practical terms relevant to a non-controlled-goods business, including risks involving services, software access, vendors, affiliates, and payments?
• Does training include realistic scenarios relevant to your company’s operations, such as blocked-party screening hits, vendor onboarding concerns, requests involving sanctioned regions, suspicious payment routing, software access from embargoed locations, or distributor/reseller diversion?
• Is training tracked and documented?
• Does your company periodically test or audit whether sanctions screening, geolocation controls, escalation procedures, onboarding reviews, payment controls, and transaction holds are working in practice?

XI. Recordkeeping, Investigations, & Incident Response

• Do employees know how to identify and escalate potential sanctions issues to compliance personnel, senior management, or legal counsel?
• Is there a defined process for pausing transactions, preserving records, investigating potential sanctions concerns, and documenting decisions?
• Are relevant records retained concerning screening results, escalations, approvals, blocked or rejected transactions, onboarding reviews, ownership analyses, and remediation steps?
• Are suspected violations reviewed promptly, with appropriate remediation, corrective action, and consideration of voluntary disclosure, reporting, or blocking obligations where required?
• Are investigations coordinated across relevant functions, including legal, compliance, finance, IT, and business leadership?

XII. Continuous Improvement

• Are lessons learned from incidents, audits, screening failures, business changes, customer complaints, payment disruptions, or enforcement developments fed back into risk assessments, policies, training, and controls?
• Does your company periodically evaluate whether its sanctions compliance controls remain proportionate to its current risk profile and business model?
• Are material sanctions developments monitored so the company can respond promptly to changes affecting customers, vendors, affiliates, business lines, or geographies?
• Does your company periodically assess whether manual controls should be supplemented by automated tools, or whether automated tools require additional human oversight?

If you would like help analyzing the results of your compliance self-check, please reach out to the authors or your Foley relationship attorney.

Would you like more practical compliance tips like these? The Foley International Trade & National Security Team is monitoring all international trade, enforcement, and compliance developments, which we post as they occur on our Tariff & International Trade Resources blog. Click Here To Register for our email list to receive future emails and practical international regulatory compliance tips, including our weekly Tariff-ied! This Week in International Trade and What Every Multinational Should Know articles.

Our white paper on Managing Import and Tariff Risks During a Trade War outlines a 12-step plan to provide practical steps to help importers navigate the tariff and international trade risks in the current tariff and trade environment, while the companion white paper on Managing Supply Chain Integrity Risks provides practical advice to deal with heightened supply chain risks pertaining to goods imported into the United States, including the increasing use of detentions by Customs.