ChecklistGeopolitics

Sanctions compliance program checklist for US, EU and UK expectations

A sanctions compliance program is judged on whether it fits the organization's real risk and can show that its controls work. This checklist follows the five components of OFAC's compliance framework, namely management commitment, risk assessment, internal controls, testing and auditing, and training, then adds what EU and UK regimes require differently, from ownership and control tests to contract clauses against diversion, recordkeeping and disclosure decisions.

Reviewed 10 October 2026 6 min read

On this page

The framework behind this checklist
Management commitment and resourcing
Inputs to the sanctions risk assessment
Ownership and control tests compared
Screening configuration and alert handling
Goods, trade and diversion controls
Testing, training and recordkeeping
Root causes that undo sanctions programs
Questions and answers
Sources

The framework behind this checklist

In May 2019 OFAC published A Framework for OFAC Compliance Commitments, which sets out five essential components of a sanctions compliance program and lists root causes found in past enforcement cases¹. It remains the clearest single statement of what a US authority expects, and EU and UK supervisors look for broadly similar elements even though their legal bases differ.

EU restrictive measures are adopted as Council regulations that apply directly in every member state and are enforced by national authorities. UK sanctions regulations are made under the Sanctions and Anti-Money Laundering Act 2018, with OFSI enforcing financial sanctions². A program serving all three regimes should meet the strictest relevant requirement for each control and record where the regimes diverge.

Sanctions compliance program design is one of the offerings of ColdAI's geopolitics practice, alongside sanctions screening and export control advisory³. This checklist is the structure we work from, and your own team can use it directly.

Management commitment and resourcing

0 of 5 checked

A named senior owner for sanctions complianceWith authority to stop a transaction and a direct reporting line to the board or its risk committee.
A board-approved policy that states which regimes apply and whyUS nexus through people, currency or US-origin goods; EU or UK nexus through incorporation, nationals or activity in the territory.
Resources matched to the risk assessmentStaff, screening tools and budget sized to volume and risk, with the reasoning written down.
Compliance decisions that the business cannot quietly overrideAny override goes through documented escalation.
A clear route for raising concernsStaff know how to escalate a suspicion and are protected when they do.

Inputs to the sanctions risk assessment

0 of 6 checked

Customers and counterparties, including ownership chainsNames alone do not reveal blocked owners.
GeographiesWhere you sell, source, ship through and bank, including transshipment hubs.
Products and servicesGoods on control or high-priority lists, and services such as software updates or cloud access that could benefit a restricted party.
Payment channels and currenciesDollar payments create a US nexus, and correspondent and payment-provider relationships carry their own expectations.
Shipping and logisticsRoutes, vessels, freight forwarders and documentary practices.
Defined refresh triggersReassess when you enter a market, launch a product, acquire a company or when a regime changes materially.

Ownership and control tests compared

Screening names is not enough: each regime also restricts entities that listed persons own or control, and the tests differ.

Question	US (OFAC)	EU	UK (OFSI)
Ownership threshold	Ownership of 50 percent or more, directly or indirectly, by one or more blocked persons⁴	Ownership of more than half of the proprietary rights, or a majority interest	More than 50 percent of the shares or voting rights, directly or indirectly⁵
Aggregation across listed persons	Yes: stakes held by different blocked persons are added together⁴	Check the Council's best-practice guidance and national authority views on joint ownership	Holdings are not simply added together unless there is a joint arrangement or one party controls the other's rights⁵
Control without majority ownership	Does not by itself block the entity, but OFAC warns that dealings carry risk and the entity may be designated⁴	A separate test, judged on criteria such as the power to appoint or remove most board members	A separate test, met where it is reasonable to expect the designated person could ensure the entity's affairs follow their wishes⁵
What it means in practice	Collect ownership chains and add up blocked stakes	Assess ownership and control separately, with documented reasoning	Assess board rights and practical influence, not only shareholdings

Summaries of public guidance at this page's review date. Ownership questions in complex structures, such as trusts or nominee holdings, need legal review.

Screening configuration and alert handling

0 of 6 checked

Lists in scope, refreshed automaticallyOFAC's SDN and other lists, the EU consolidated list, the UK Sanctions List and any others your footprint requires.
Matching thresholds set by testing, not by vendor defaultTune fuzzy matching against known variants of listed names and record why each threshold was chosen.
Transliteration and alias handlingCover non-Latin scripts, name order and common alternative spellings.
Full re-screening when lists changeScreen the existing customer and supplier base again, not only new onboarding.
Written disposition standardsWhat evidence clears an alert, who may clear it and when it must be escalated.
False positives documentedEach cleared alert records the identifiers compared, so an auditor can retrace the decision.

Goods, trade and diversion controls

0 of 5 checked

Diversion red flags built into sales reviewNew buyers in known transshipment hubs, orders that do not fit the buyer's business, and payment from unrelated third parties.
Products mapped against high-priority item listsIncluding the EU's common high-priority items list and US guidance on items sought for diversion.
The EU no-re-export-to-Russia clause where requiredArticle 12g of Council Regulation (EU) No 833/2014 requires EU exporters to contractually prohibit re-export to Russia of specified goods, including common high-priority items, when selling to most third countries⁶.
Group-wide reach for EU parentsEU operators must use best efforts to ensure that entities they own or control outside the EU do not undermine EU sanctions⁶.
End-use statements for sensitive goodsCollected, checked against what you know about the buyer and kept on file.

Testing, training and recordkeeping

0 of 5 checked

Independent testingInternal audit or an external reviewer samples screening decisions, checks tuning evidence and confirms that controls run as written.
Findings tracked to closureEach finding has an owner, a date and evidence that it was fixed.
Training by roleSales on red flags, operations on screening, finance on payments and leaders on accountability, repeated when rules change.
Record retention aligned with current US rulesOFAC extended its recordkeeping requirement to ten years, matching the longer statute of limitations enacted in 2024⁷; reconcile this with data-protection deletion rules elsewhere.
A documented route for disclosure decisionsHow the organization decides, with counsel, whether to disclose an apparent violation to OFAC, OFSI or a national EU authority.

Root causes that undo sanctions programs

Screening set up once and never tuned

Early signalThresholds date from implementation and there are no tuning records.

MitigationTest against known name variants on a schedule and keep the evidence.

Counterparties checked by name only

Early signalOnboarding files show the counterparty but no ownership chain.

MitigationCollect beneficial ownership data and screen each owner against the relevant tests.

Non-US subsidiaries assuming US rules cannot reach them

Early signalDollar payments, US-origin goods or US staff appear in deals booked abroad.

MitigationMap US nexus points for each business line and set controls accordingly.

Decentralized compliance

Early signalBusiness units run their own screening with different lists and thresholds.

MitigationSet central standards and oversight while letting local teams operate them.

Questions and answers

What are the five components of an OFAC compliance program?

OFAC's framework names management commitment, risk assessment, internal controls, testing and auditing, and training. OFAC expects each to be tailored to the organization's size, products, customers and geographic footprint, and it weighs the existence and quality of such a program when deciding how to respond to an apparent violation. A policy document alone does not satisfy the framework; evidence that controls operate is what counts.

Do non-US companies need an OFAC compliance program?

Many do. OFAC sanctions can apply to non-US companies that cause US persons to violate them, for example by routing dollar payments through US banks or exporting US-origin goods to sanctioned destinations, and secondary sanctions can target non-US firms directly. A company with no US nexus at all may need less, but it should reach that conclusion through a documented risk assessment rather than assume it.

How often should a sanctions risk assessment be updated?

Update it whenever the business or the rules change materially, for instance when entering a new market, launching a product, acquiring a company or responding to a major new sanctions package, and review it on a regular cycle, commonly once a year. Each update should show what changed, how controls were adjusted and who approved the result.

How is a sanctions compliance program different from AML transaction monitoring?

Sanctions controls are prohibitions: they stop dealings with listed persons, owned or controlled entities and restricted goods or destinations, mostly before a transaction happens. Anti-money laundering monitoring looks for suspicious patterns after transactions occur and leads to reporting. The two share data and teams, and AI can help with both, as our AML alert triage use case shows, but they need separate controls and evidence.

Sources

A Framework for OFAC Compliance Commitments — US Department of the Treasury, Office of Foreign Assets Control · checked 10 October 2026
Sanctions and Anti-Money Laundering Act 2018 — legislation.gov.uk · checked 10 October 2026
Geopolitics capability: sanctions and trade compliance offering — ColdAI
Entities Owned by Blocked Persons (50% Rule): frequently asked questions — US Department of the Treasury, Office of Foreign Assets Control · checked 10 October 2026
UK financial sanctions general guidance — Office of Financial Sanctions Implementation, HM Treasury · checked 10 October 2026
Council Regulation (EU) No 833/2014 concerning restrictive measures in view of Russia's actions destabilising the situation in Ukraine (consolidated) — EUR-Lex · checked 10 October 2026
U.S. Treasury Extends Recordkeeping Requirement for Economic Sanctions Compliance to 10 Years — Greenberg Traurig · checked 10 October 2026

More in Geopolitics

Back to Geopolitics

Next step

Have your sanctions program reviewed against this checklist

Share your current policy, risk assessment and screening setup. We will tell you where the gaps against US, EU and UK expectations are likely to be and what to fix first, working alongside your counsel.

Discuss a program review

The framework behind this checklist

Management commitment and resourcing

Inputs to the sanctions risk assessment

Ownership and control tests compared

Screening configuration and alert handling

Goods, trade and diversion controls

Testing, training and recordkeeping

Root causes that undo sanctions programs

Screening set up once and never tuned

Counterparties checked by name only

Non-US subsidiaries assuming US rules cannot reach them

Decentralized compliance

Questions and answers

Sources

Related reading

More in Geopolitics

Have your sanctions program reviewed against this checklist