Sanctions screening basics for online suppliers

Economic sanctions are restrictions a government places on dealings with certain countries, regions, governments, organizations and people. In the United States, the Treasury Department's Office of Foreign Assets Control (OFAC) administers and enforces them. Sanctions screening is the routine of checking who you are dealing with, and where an order is going, against OFAC's public lists and programs before you accept or ship it.

For an online supplier that sells to business and research buyers in more than one country, screening is a basic control. This page explains what sanctions are, what OFAC publishes, how a small team can screen in practice and what OFAC's guidance says about a possible match. It is general information, not legal advice. Speak to a qualified lawyer about how sanctions apply to your business.

What economic sanctions are

OFAC describes its role as administering and enforcing economic and trade sanctions against targeted foreign jurisdictions and regimes, and against people and organizations involved in conduct such as terrorism and narcotics trafficking. Its program index describes the tools as blocking assets and restricting trade to meet foreign policy and national security goals, and notes that sanctions can be comprehensive or selective.

In practice, OFAC's programs fall into two broad groups:

• Country and region programs. These restrict dealings involving a particular country, region or government. Some are broad.
• Activity programs. These target named people and organizations connected with activities such as terrorism, narcotics trafficking, cyber-related conduct or weapons proliferation.

OFAC also points out that sanctioned persons can be located anywhere in the world. A buyer outside a sanctioned country is not automatically outside the scope of sanctions, which is why screening looks at names as well as destinations.

Who has to comply

OFAC says all U.S. persons must comply with OFAC sanctions. It describes U.S. persons as including U.S. citizens and permanent residents wherever they are located, anyone within the United States, and entities incorporated in the United States. OFAC's compliance framework also encourages non-U.S. businesses that deal with the United States, with U.S. persons or in U.S.-origin goods or services to take a risk-based approach to sanctions compliance.

Which rules apply to your business depends on where you are based, where you sell, who you buy from and how you are paid. That is a question for a qualified lawyer, not something to settle from a general guide.

OFAC's public sanctions lists

• The SDN List. The List of Specially Designated Nationals and Blocked Persons names individuals and entities whose property is blocked. OFAC says U.S. persons are generally prohibited from dealing with them.
• Non-SDN lists. OFAC also maintains lists of persons subject to non-blocking sanctions. These restrict certain dealings without requiring that property be frozen.
• Ownership. OFAC explains that blocking can also apply to entities owned 50 percent or more by blocked persons, even when the entity is not named on a list. A name search alone will not always show this.

OFAC describes blocking as a freeze, not a seizure. The owner keeps title, but transfers or dealings of any kind with the property are prohibited without OFAC authorization.

OFAC's free Sanctions List Search tool searches the SDN List and several other OFAC lists. It uses fuzzy matching, so it returns near matches based on a minimum score you set. OFAC says it does not recommend any particular score, and that using the tool is not a substitute for appropriate due diligence.

Why suppliers screen buyers and destinations

OFAC's own framework says its regulations do not require a formal sanctions compliance program, but it encourages one, particularly for businesses with customers or counterparties outside the United States. The framework also lists root causes it has seen in past enforcement cases. Several are directly relevant to a small online store:

• having no formal program at all
• screening software that was not updated when OFAC's lists changed
• not allowing for alternative spellings of country or party names
• incomplete due diligence on customers, such as their ownership and location

For a research supplier the practical reasons are simple. You want to know you are not dealing with a blocked party or shipping to a destination you cannot serve, and you want a record that shows you checked.

What screening looks like in a small store

• Decide what you screen. Typically the buyer's name, the business or institution name, the billing and ship-to addresses and countries, and any separate consignee.
• Decide when you screen. At the first order or account approval, and again when a buyer's details change. OFAC's framework expects a program to adjust as its lists and programs change, so a buyer who cleared last year is not cleared for good.
• Screen destinations as well as names. Keep a written list of destinations you do not ship to and apply it at checkout and in fulfillment. Shipping restrictions by destination covers how to write and enforce that list.
• Record every result. Note the date, the tool or list used, the exact name searched and the outcome, including searches with no match.
• Name an owner. One person should own the routine and the escalation path. Compliance roles for small teams explains how to split duties when you are two or three people.

What to do with a possible match

OFAC's FAQ on potential matches sets out an order of steps. In outline:

1. Confirm the alert relates to an OFAC list or program, and not to another agency's list or a vendor's own list.
2. Read the full list entry, including aliases, dates of birth, identification numbers, nationality and addresses, and compare each detail with what you hold for the buyer.
3. Weigh the match honestly. OFAC notes that many potential matches from screening are false positives, and that a shared address on its own does not establish a match.
4. If several details match, pause the order and follow your written procedure for likely matches.
5. Escalate to the owner and get advice from a qualified lawyer. OFAC's FAQ explains when property must be blocked or a transaction rejected, and says blocked or rejected transactions must be reported to OFAC within 10 business days.
6. Keep records of the steps you took and the information you relied on. OFAC says it may request them.

OFAC also says it does not confirm potential matches or false positives. The decision on a possible match rests with your business and its advisers, which is why the written procedure and the record matter.

How screening fits with your other buyer checks

Sanctions screening is one part of knowing your buyer. It sits alongside confirming that the buyer is a real business or research organization, which how to verify business and research buyers covers, and keeping questionable orders on hold until a person reviews them.

Claddr's buyer checks compare buyer type, credentials and ship-to against your compliance profile, and its rules can hold a matching order, authorized but not captured, until a reviewer on your team approves it. Those checks are not sanctions list screening, so keep your own screening step and its record. The product overview describes the checks and holds in more detail.

What screening cannot tell you

A clean search shows that a name did not match a list on the day you searched. It does not tell you who ultimately owns a business, where goods will end up, or whether any other rules apply to a shipment. Treat screening as a record of reasonable checks, not a guarantee, and take specific questions to a qualified lawyer.