What is sanctions screening?

Sanctions screening is the process of checking individuals, companies, and other parties to a relationship against relevant sanctions lists and regimes. Its purpose is to identify situations in which specific restrictive measures may apply to a customer, beneficial owner, owner, controlling person, counterparty, or party to a transaction.

Screening is not limited to entering a person’s name or a company’s name into a search engine. Similarity of data also does not mean that a particular person or entity is actually subject to sanctions. A potential match must be verified, the identity of the person or entity must be established, the relevant sanctions regime must be checked, and the legal consequences arising from a confirmed match must be determined. In the case of business customers, the ownership and control structure may also be relevant. A company that is not directly listed may require further analysis if it is owned or controlled by a person or entity subject to specific restrictions.

Screening detects a potential match. Sanctions analysis determines what that match means.

How does sanctions screening work?

“Sanctions screening” is an operational term. The law establishes specific sanctions, prohibitions, and obligations, while screening is a process that helps determine whether they may apply to a particular person, entity, or transaction. In simplified terms, the process can be presented as:

data → relevant sanctions sources → potential match → verification → analysis of connections → assessment of legal consequences → decision → documentation.

The first step is to determine who should be screened. Depending on the nature of the relationship, this may include, among others:

• the customer;
• the beneficial owner;
• the owner or person controlling the entity;
• a person authorised to represent the entity;
• an attorney-in-fact;
• a counterparty;
• the recipient or sender of a payment;
• another party to the transaction.

The data of those persons or entities are then compared against the relevant sanctions sources. In the case of a natural person, relevant information may include, among other things, first name and surname, alternative spellings of the name, aliases, date and place of birth, citizenship, and other available identifiers. In the case of entities, the analysis may include, among other things, the name and its variants, country of registration, address, registration details, and information concerning ownership and control.

A screening system may generate a potential match, meaning a possible match. This does not yet confirm that the screened person or company is subject to sanctions. If further analysis shows that the result concerns a different person or entity, the alert may be classified as a false positive. If the match is confirmed, the relevant legal basis and the restrictions arising from it must then be determined.

Data similarity creates an alert. Only verification makes it possible to determine whether there is an actual match.

Which sanctions lists and regimes should be taken into account?

There is no single universal “sanctions list” that answers every sanctions-related question. What matters are specific sanctions regimes, legal acts, and lists of persons and entities, which may differ in scope, legal basis, and consequences. In Poland, particular importance is attached primarily to:

• sanctions and restrictive measures applicable within the European Union;
• the national sanctions list maintained under Polish law;
• specific restrictive measures provided for within the AML/CFT framework;
• other sanctions regimes where they apply to the organisation’s activities, a particular relationship, or a transaction.

An organisation may also use foreign sanctions lists and commercial databases. This does not mean, however, that every list included in a screening tool produces the same legal consequences for every Polish entity. The significance depends, among other things, on the relevant jurisdiction, the parties to the transaction, the type of activity, and the specific sanctions regime.

Therefore, a screening result should lead not only to the question:

“is the person on the list?”

but also:

“which regime applies and what obligations or prohibitions result from it?”

Not every list used by a screening tool has the same legal significance.

Does the absence of a company from a list mean that sanctions do not apply to it?

Not always. Direct screening of a company’s name is an important element of the process, but under certain sanctions regimes it may also matter who owns or controls the entity. This means that the analysis of a business customer should not always end with establishing that its name does not appear on the relevant list. Depending on the applicable rules, it may be necessary to determine:

• who owns shares or stock in the entity;
• whether the ownership is direct or indirect;
• who exercises control over the entity;
• whether a sanctioned person may exercise decisive influence;
• whether making funds available to the entity could mean making them available to a sanctioned person or acting for that person’s benefit.

The criteria used in sanctions analysis should not automatically be equated with the definition of beneficial ownership used in AML. UBO and sanctions-related ownership and control criteria serve different purposes and may be based on different rules. It would therefore be incorrect to apply a universal rule such as:

“if a sanctioned person holds more than 25% of the shares, the sanctions automatically apply to the company”.

The relevant criteria must be determined on the basis of the specific sanctions regime. Screening of a business customer should therefore be appropriately linked with KYB, because without understanding the ownership and control structure, the entity’s name alone may not provide the full picture.

The absence of a company’s name from a list does not always end the analysis. Who owns and controls the company may also be relevant.

What does a sanctions alert mean?

A sanctions alert means that the data of the screened person or entity show a certain level of similarity to data contained in a sanctions source. An alert is not yet confirmation of sanctions. In the case of a natural person, the analysis may compare, among other things:

• first name and surname;
• aliases and alternative spellings;
• date of birth;
• place of birth;
• citizenship;
• place of residence;
• other available identifiers.

In the case of a company, relevant information may include, among other things:

• full name;
• alternative names;
• address;
• country of registration;
• registration number;
• business profile;
• owners and controlling persons.

The result of the analysis may be, among other things:

• false positive — an apparent match relating to a different person or entity;
• confirmed match — a confirmed match;
• a case requiring additional information before a decision can be made.

This distinction is particularly important in the case of common surnames, different transliterations, changes in entity names, or incomplete input data. A confirmed match also does not mean that exactly the same action should be taken in every case. The content of the specific restrictive measure and its legal basis must be determined. Depending on the regime, there may be, among other things, obligations or prohibitions concerning the freezing of assets, making funds or economic resources available, or other specified activities.

Sanctions screening should also be distinguished from PEP screening. PEP status means that specific AML measures must be applied and is not a prohibition on doing business with the person. Sanctions, on the other hand, may impose direct legal restrictions or prohibitions.

An alert requires verification. A confirmed match requires identification of the applicable regime and its consequences.

Does sanctions screening need to be repeated?

Yes. Screening performed during onboarding reflects the situation only at a particular point in time. Sanctions lists and legal acts change over time. A person or entity that is not subject to specific restrictions today may become subject to them later. The customer itself may also change, including its:

• name or other identifying data;
• owner;
• ownership structure;
• controlling person;
• beneficial owner;
• representative;
• links with other persons or entities.

Transactions may also involve new parties, recipients, senders, or counterparties that have not previously been analysed. Therefore, the process should allow for rescreening in response to, among other things:

• changes to relevant sanctions lists;
• changes in customer data;
• changes in the ownership or control structure;
• changes in the beneficial owner;
• the appearance of new parties to a transaction;
• other events relevant from a sanctions perspective.

There is no single universal rule under which every customer should be screened only, for example, once every 6 or 12 months. The method and frequency of rescreening should reflect the applicable obligations, the business model, the nature of the relationship, and the risk, and should ensure a sufficiently prompt response to material changes. It should also be remembered that name screening is not the entirety of sanctions compliance.

Sanctions may concern not only specific persons and companies, but also certain:

• goods;
• services;
• sectors of the economy;
• countries or territories;
• methods of financing;
• imports and exports;
• investments;
• other types of activity.

Therefore, the absence of a match between a person’s or company’s name and a sanctions list does not always mean that the relationship or transaction falls outside the scope of all sanctions restrictions.

Screening primarily answers the question of whether a particular person or entity may be subject to the relevant sanctions regime. A full sanctions compliance assessment may require a broader analysis of the transaction, ownership, control, and nature of the activity.