Between 23 February and 16 December 2022 the EU adopted ten sets of sanctions against Russia, five of them in the first three weeks, as the European Commission's package record shows. A sanctions risk assessment signed in January 2022 had rated Russian exposure against rules that changed five times by 15 March. Listings go on. A 21st package came on 23 July 2026 and a listing package on 12 October 2026, and each one changes whom your client screening and ongoing monitoring has to find.
What is a sanctions risk assessment, and how does it differ from an AML risk assessment?
A sanctions risk assessment is a firm's own analysis of where its customers, counterparties, products and countries could bring it into contact with a sanctioned party, and how far its controls close that gap. OFAC's Framework for OFAC Compliance Commitments, published 2 May 2019, lists it among the five essential components of a sanctions compliance program (p. 1). OFAC wants it "routine, and if appropriate, ongoing", covering customers, supply chain, intermediaries and counterparties, products and services, and geographic locations (p. 3).
It overlaps most with the enterprise wide AML risk assessment. The Wolfsberg Group's FAQs on risk assessments note that firms often run the two together, but the sanctions side needs its own data feeds, and payment screening can work differently from core AML controls (2015, p. 6). Both rest on the same risk based approach.
The trigger is different. A sanctions hit turns on status, so a company whose listed owners hold enough of it is blocked although it did nothing suspicious. In the UK, for breaches on or after 15 June 2022, OFSI no longer has to show that a firm knew or had reasonable cause to suspect before it imposes a civil penalty (OFSI enforcement guidance).
Which risk factors does a sanctions risk assessment score?
Score seven factors. For each one, Table 1 gives the question to ask, the evidence to keep on file, and what pushes the score to high.
Table 1. The seven factors of a sanctions risk assessment (scale 1 low to 3 high)
| Factor | Question to ask | Evidence to keep | Scores 3 when |
|---|---|---|---|
| Customers and counterparties | Who are they, what do they trade, whom do they pay? | Customer counts by type, industry and residence | Many trade across borders or in sanctioned sectors |
| Ownership and control | Who owns or controls each business customer, directly or through others? | Ownership records with every owner's stake | Owners sit outside your home market or the chain cannot be traced |
| Geography | Where are customers and payment destinations, and where do correspondents reach? | Payment value by country and by correspondent | Flows reach a sanctioned country, a neighbor of one or an unseen market |
| Products and services | Do you offer trade finance, correspondent accounts, crypto or cross border payouts? | Product list with volumes | Trade finance, correspondent accounts or crypto transfers |
| Delivery channels | How are customers onboarded and served? | Share of remote onboarding and of introduced business | Fully remote onboarding through introducers |
| Transactions and data | Which fields reach the screening filter, and how complete are they? | Field map per payment type, data quality samples | Messages lack beneficiary address, BIC or ownership data |
| Third parties | Which suppliers, agents and intermediaries act for you? | Due diligence files, contract terms | Unscreened agents in high risk markets |
Geography reaches past the sanctioned countries themselves: the Wolfsberg FAQs add countries bordering or close to them and places that offer a chance to divert funds around the rules (p. 9). A correspondent banking relationship carries this risk, because the correspondent's own customers are out of your sight. For direct exposure, the free AML Country Risk Index gives each country a 0 to 100 score that blends sanctions intensity with FATF status and the Basel AML Index.
For products, the US higher risk factors that the Wolfsberg FAQs list include international funds transfers, cross border ACH, trade finance, foreign correspondent accounts and international private banking (p. 6).
How do you score inherent risk, controls and residual risk?
Score in three passes, as the Wolfsberg FAQs set out: inherent risk, then the controls, then the residual risk that remains (p. 7). Rate each factor 1 low, 2 medium or 3 high before any control. Rate each control 1 strong, 2 adequate or 3 weak on how it was designed and how it ran, with alert data and test results as the evidence.
Then combine the two on a grid you write into the method. In the grid used here, inherent 3 behind a strong control gives 2; behind an adequate or weak one it stays 3. Inherent 2 drops to 1 behind a strong control, stays 2 behind an adequate one and rises to 3 behind a weak one. Two of the FAQs' example rules, written for money laundering risk, carry over. A high inherent rating never ends as low residual (p. 13), and an action still under way lowers nothing (p. 11). An "unknown" answer may bring an automatic high rating (p. 8).
OFAC's Framework also has firms develop a sanctions risk rating for customers at onboarding (p. 4), and that rating belongs in the customer risk assessment. complead, formerly Sanction Scanner, holds it in the customer risk assessment and KYC product as one score per customer, built from factors and weights the compliance team sets, and each rating shows its factors. Onboarding, screening and monitoring feed that same score, and the analyst still decides each case.
What should the assessment ask about each sanctions control?
OFAC's appendix on the root causes of past enforcement cases (from p. 9) gives a ready test set. Ask of each control:
- How fast does a new designation reach the filter? OFAC names firms whose screening software missed SDN List updates.
- Does the filter hold identifiers and other spellings? OFAC's examples are missing BICs of sanctioned banks and filters blind to Habana for Havana, Kuba for Cuba and Soudan for Sudan.
- Where does screening run? At onboarding, on every payment, and again when a list or a customer record changes.
- Which lists run on exact matching and which on fuzzy, and why? The Wolfsberg sanctions screening guidance asks for that decision (2019, p. 11) with the rationale for threshold settings on file (p. 5). Candex, which screens its vendors on complead, sets fuzzy matching at 80 percent on sanctions lists, where it rates the risk of a true match highest, and at 95 percent on watchlists (how Candex screens its vendors).
- Who clears an alert, who escalates it, and does a second reviewer sample closed alerts, automated closures included?
- What do alerts by list and the share of false positives show after a threshold change?
- Is every search kept with its result and the reviewer's reason, no match results included?
- Does training reach staff at least once a year, tailored to high risk roles, and is testing independent of the activities it tests? OFAC asks for both (p. 7).
What does a scored sanctions risk assessment look like for a payments firm?
Picture an illustrative payments firm with 40,000 consumer and 1,500 business customers in the EU and the UK, payouts to 30 countries and one correspondent bank in the Gulf. Each line gives the inherent, control and residual scores.
- Customers: 2, 1, 1. One business customer in ten trades outside Europe; onboarding screening and daily rescreening rate strong.
- Ownership: 2, 3, 3. Owners are recorded only from 25 percent up, so in a company held 30 percent by one listed person and 24 percent by another, the second stake goes unseen.
- Geography: 3, 2, 3. Six percent of payout value leaves through the Gulf correspondent to markets the firm never sees; its questionnaire is on file, its onward flows untested.
- Products: 2, 1, 1. Cross border payouts, no trade finance, no crypto; payment screening rates strong.
- Channels: 2, 2, 2. Onboarding is fully remote.
- Transactions and data: 3, 2, 3. One message in seven from the correspondent names the ultimate beneficiary without an address.
Three factors end at 3. Management signs two dated actions: record owners from 10 percent, and screen the beneficiary fields of every correspondent message. Until both are done, the ownership and data scores stay at 3.
How do you turn the assessment into a screening plan?
Start with the ownership gap. Under the EU Best Practices of 3 July 2024, a company owned 30 percent by one designated person and 25 percent by another should in principle count as owned by designated persons (paragraph 63). OFAC adds holdings up the same way, at 50 percent or more (guidance of 13 August 2014).
OFSI counts more than 50 percent held by one designated person and does not simply add holdings together unless, for example, they sit under a joint arrangement or one party controls the other's rights (general guidance, 4.1.4). So one company can be blocked under EU and US rules and not under UK rules, and the plan has to say which ownership test applies to which customers and how deep the ownership data goes.
The plan then answers Wolfsberg's four questions: "what data attributes to screen, when to screen, what lists to use and how exact or 'fuzzy' to set the screening filter" (2019, p. 3). A smaller firm in one country may limit itself to that country's sanctions laws, while a global one may screen the US, UN, EU and home lists (p. 4). A UK plan names the UK Sanctions List, the single source of UK designations since OFSI closed its consolidated list on 28 January 2026 (OFSI's guidance page). Screening then runs at onboarding, on each payment and through ongoing monitoring.
The free sanctions risk calculator drafts a first plan from your own profile. Its 15 questions on your industry, jurisdiction and controls take about 3 minutes and return a 0 to 100 score; with your contact details, the full report adds the watchlists you must screen, a screening plan and your control gaps. The tool's own FAQ calls the result a structured starting point for the assessment a supervisor expects.
How do you document a sanctions risk assessment for the regulator?
Every score should trace to its evidence. A dated, signed assessment is how a firm shows a supervisor why it screens what it screens. OFSI's enforcement guidance, updated 9 February 2026, weighs whether a firm's sanctions risk controls were "proportionate and reasonable" to its risks and, on ownership and control checks, would usually expect decisions made "by reference to an internal framework or policy".
OFAC expects senior management to have "reviewed and approved" the program (p. 2) and the assessment to be updated for the root causes of any apparent violation (p. 4). Its regulations do not require a formal program (p. 9), yet an effective one can mitigate a penalty when OFAC decides one (p. 1).
The record names the events that reopen it: a new product or market, a merger, an audit finding, the root cause of a breach, a designation wave like 2022's. Its results feed the AML policy.
What goes in a sanctions risk assessment template?
Copy these headings in order:
- Scope and owner
- Version, date and the period the data covers
- Method: the 1 to 3 scale, any weights and the residual grid
- Data sources
- Inherent risk by factor, as in Table 1
- Control ratings with the test evidence
- Residual risk
- Actions with owners and due dates
- Screening plan: lists, fields, exact or fuzzy per list, frequency and ownership depth
- Refresh triggers and the next review date
- Senior management sign off
Before the next review, pull 12 months of payout value by country and by correspondent. Check how deep your ownership records go against the EU's 30 plus 25 percent example. Then ask when each list last reached the filter, and date every answer.
Method. The payments firm is invented. Its scores only show how the grid works. Sinan Tekin opened each OFAC, OFSI, Wolfsberg, Council and Commission text quoted here on 1 November 2026, and Ufuk Gürdaş, Compliance Specialist, reviews the page before it goes live.
