Sanctions list check – Basic knowledge & background

Relevance: Who has to carry out sanctions checks?

All companies operating economically in the EU or based in the EU must ensure that none of their business partners are listed on the European Common Foreign & Security Policy (CFSP) list – this is stipulated by the relevant EU regulations and the Foreign Trade Act (AWG). This results in an indirect obligation to carry out checks. Organisations in the financial sector and foreign trade – such as banks or companies involved in exports and supply chains – are also explicitly required to check sanction lists.

Conclusion: Not only exporting companies, but also companies that only do business in Germany should check all business partners, suppliers, customers and employees against the various sanction lists.

Sales

No weapons, goods, money or information may flow to people, groups, organizations or companies that are on a sanctions list. Therefore, simply making an offer can result in you violating anti-terror regulations. The offer can theoretically be used to raise funds from e.g. B. to preserve banks and thus promote terrorism.
It is therefore advisable to check new business partners before exchanging information.

Purchasing

Purchasing must ensure that services or goods are only purchased from suppliers who are not on a sanctions list.

HR/Recruiting

In human resources, screening employees is controversial. Because it violates data protection guidelines. However, it must be ensured that no employee who is listed on a sanctions list is allowed to receive money.
Especially when new employees are being sought, it is advisable to check them early in the application phase.

Reasons: Why must the sanctions list check be carried out?

Regardless of whether your company is involved in import or export, management is obliged to carry out business partner screening. It must ensure that customers, suppliers, organisations and individuals are not listed on a sanctions list or an anti-terrorism list. If this is the case, the contact in question may not receive any goods, services or financial contributions. There are various reasons for this:

• Potential damage to reputation: Contacts with sanctioned individuals, organisations or countries may be viewed critically by the public and lead to a negative corporate image.
• Legal compliance: Sanctions list checks are necessary to comply with legal requirements. Failure to comply can result in fines and imprisonment. The persons affected are primarily managing directors and, in some cases, those responsible for exports.
• Economic risks: Without regular checks against sanctions lists, companies take on high risks. For example, a company in Europe or the UK may come into conflict with US sanctions law, even if local legislation would not be an issue.

Background: What are the legal bases for…

…sanctions list screening of business partners and customers?

The legal bases for sanctions list screening vary depending on the country and legal system:

• In the European Union, for example, sanctions list checks are regulated by the respective EU regulations and decisions. These regulations and decisions specify which persons or organisations are to be placed on the sanctions lists and which measures must be taken to comply with the sanctions.
• In Germany, Section 34 of the Foreign Trade and Payments Act must also be observed, and in Switzerland, the SECO embargo regulations.

… Sanctions list screening of employees?

The screening of employees against EU sanctions lists has been recognised as a legal basis by case law under Section 26(1) of the Federal Data Protection Act (BDSG). According to this provision, personal data may be processed for the purposes of the employment relationship, especially if this is necessary for the establishment, implementation or termination of the employment relationship. Further authorisation would then arise if the screening of employees is carried out on the basis of a law or a works agreement. Regular wage payments by the employer require that the employee is not listed on sanctions lists (especially those of the EU). Thus, the employer’s own employees may be checked accordingly. The same applies to AEO certification, because employees in security-relevant areas in particular must be checked against sanctions lists.

Which sanctions lists should be checked?

All currently valid sanctions lists must always be observed. These include the various EU sanctions lists, but also, for example, US sanctions lists. We provide a brief overview of existing lists in our article on sanctions lists. To cover all important sanctions lists during the check, we recommend using secure software for sanctions screening.

What data needs to be checked?

A thorough sanctions list check requires a careful comparison between sanctions lists and customer data, as well as data from business partners, suppliers and, where applicable, (future) employees. In addition to the name or the correct and complete company name, the following data can be useful for obtaining certainty after a similarity match:

• For individuals: surname and first name, date of birth, nationality
• For companies: legal form of the organisation, registration number, name of the managing director

How does a sanctions check work?

The typical process for a thorough sanctions check includes:

1. Defining the individuals or companies to be checked and researching the relevant data
2. Researching relevant sanctions lists
3. Comparing the data records – manually or automatically using software
4. Analysing possible matches to rule out potential errors
5. In the case of genuine matches: Initiating measures (e.g. terminating business transactions and notifying the relevant authorities)

Automated or manual testing?

The manual check and the necessary documentation (customs, BAFA) of the processes result in a lot of effort. Thanks to automated queries in the background and connection to the ERP system, software for sanctions list screening can be an attractive solution. Then the address creation, address change or even just the address usage can be checked at any time. SANSCREEN is integrated into SAP ® ERP, SAP S/4HANA®, Dynamics NAV, Dynamics AX, Sage and APplus and many other systems available.

What are false positives on sanctions lists?

If there is a similarity or even an exact match between names in your company database and a sanctions list, this can lead to false positives. In any case, a thorough investigation is necessary; the more data available for this, the better.

What to do if a contact is affected by sanctions?

1. Involve your internal compliance officers.
2. Document the result, including the date of the check, the sanctions list and the exact match. The relevant authorities may require a template under certain circumstances.
3. Terminate all business relationships immediately. For example, do not pay out any funds and stop providing services.
4. Report the sanctions list match to the relevant authorities, such as the Bundesbank or the BAFA.

Free online tools: How can I check for free?