Sanctions compliance does not end when due diligence is completed, a tender is evaluated, or a contract is signed. In many respects, that is when the greater challenge begins. Ownership changes, new designations, altered payment routes, substitute subcontractors, changing trade restrictions and unexpected geopolitical events can transform a previously lawful arrangement into one requiring immediate action. Procurement must therefore treat sanctions compliance as an active commercial control rather than a one-off onboarding exercise.
The consequences of getting that wrong can be significant. Recent UK enforcement has involved banks, technology companies, manufacturers, professional advisers and international service providers, demonstrating that sanctions exposure is not confined to obvious high-risk sectors. The common thread is often operational: payments continue, ownership is misunderstood, screening is incomplete, alternative routes are explored, or warning signs are not escalated quickly enough. Procurement sits directly within many of those decision points.
Effective control, therefore, depends on the entire procurement lifecycle working as a single system. Planning should identify sanctions exposure before approaching the market; tendering should obtain meaningful information; evaluation should distinguish legal prohibition from manageable risk; contracts should create enforceable rights; and purchase-to-pay processes should verify that the transaction is actually taking place. Contract management must then keep those controls alive through re-screening, change management, audit, reporting and senior oversight.
The objective is not to eliminate every conceivable sanctions risk, nor to surround procurement with disproportionate bureaucracy. It is to create a defensible framework in which risk is recognised early, decisions are evidence-based, responsibilities are clear and emerging concerns can stop a transaction before they become a breach. When sanctions compliance is embedded from sourcing to final payment, procurement becomes not merely a commercial function, but one of the organisation’s most important lines of protection.
Contracting Under Sanctions
Contracting under sanctions is not simply a legal drafting exercise. It is the process of converting sanctions law into controls over who an organisation buys from, what it buys, where goods and services move, how suppliers are paid and what happens when circumstances change. Procurement therefore sits where legal prohibition meets commercial action: before a purchase order is issued, a contract is signed, money moves, or a supplier becomes embedded in operations.
The scale of the exposure is substantial. The Office of Financial Sanctions Implementation (OFSI) 2024 Frozen Asset Review recorded £37.079 billion of assets frozen under UK financial sanctions, including £22.518 billion under the Russia regime, £12.955 billion under Libya and £1.178 billion under Belarus. In 2024–25, OFSI took 57 enforcement actions and, by April 2025, had 240 active investigations. These figures show why sanctions compliance cannot be treated as an occasional legal check.
Enforcement has also moved decisively into mainstream commercial activity. In August 2026, OFSI imposed a £4.733 million penalty on Citibank’s London branch; in June 2026, Sabre Global Technologies Limited received a £1.001 million penalty; and Colorcon Limited was penalised £152,750 in 2025. The organisations operate in banking, travel technology, and pharmaceuticals, respectively, demonstrating that sanctions risk is not confined to defence, commodities, or specialist international traders.
For procurement teams, the practical question is therefore not merely whether a supplier’s name appears on a sanctions list. The question is whether the entire transaction can lawfully proceed and remain lawful throughout performance. That requires controls over ownership, subcontracting, payment banks, origin, destination, end-use, licences and change. The objective is a defensible procurement trail that shows what was checked, what was found, who approved the decision, and why.
Why Procurement Is a Critical Sanctions Control Function
Procurement is a critical sanctions control because it creates the commercial relationships that later generate invoices, payments, deliveries and contractual dependencies. A weak onboarding decision can leave Finance attempting to stop a prohibited payment after goods have shipped, Legal trying to unwind an unsuitable contract, or Operations facing immediate supply failure. Effective sanctions control begins earlier, while the organisation still has leverage to ask questions, reject risk, change specifications or choose another supplier.
Colorcon Limited illustrates the point. Its Moscow representative office made 123 payments worth £191,290.57 to non-designated employees and service providers whose accounts were held with designated Russian banks. OFSI concluded that £128,277.72 of those payments breached UK financial sanctions and imposed a £152,750 penalty. The procurement lesson is direct: apparently acceptable counterparties cannot be assessed independently of the banks, payment routes and financial institutions through which contract performance will occur.
The public sector has an additional reason to build sanctions awareness into procurement. UK public procurement represents approximately £385 billion annually, while the Government Commercial Function directly manages about £90 billion and includes around 6,000 commercial professionals. At that scale, purchasing decisions can support or frustrate sanctions policy. Cabinet Office guidance has therefore required in-scope bodies to consider Russian and Belarusian suppliers and contractual exit options on a case-by-case basis.
Trade sanctions make procurement’s role equally important. Petrofac Facilities Management Limited paid HMRC a £569,157 compound settlement in 2026 after supplying sanctioned industrial goods to persons connected with Russia and providing related technical assistance while winding down Russian operations. The company self-reported and cooperated. The case demonstrates that purchasing, logistics, engineering support and contract management must be aligned: a lawful supplier relationship does not make every product, service, destination or transaction lawful.
Procurement is therefore best understood as a preventive control function rather than an administrative gateway. It can identify risks before commitment, ensure due diligence is proportionate to exposure, embed warranties and information rights, and create escalation points before commercial pressure takes over. When sanctions concerns emerge after award, procurement also controls supplier communications, change requests, purchase orders and contractual remedies. Few corporate functions have comparable influence over both entry into and continuation of third-party relationships.
Where Responsibility for Sanctions Compliance Should Sit
Responsibility for sanctions compliance should sit at organisational level, not within a single department. UK sanctions obligations apply regardless of how duties are divided internally. An organisation may appoint a sanctions officer, compliance team, or legal lead, but it cannot contract out of responsibility by assuming that a bank, screening provider, supplier, or external adviser will prevent prohibited activity. Governance must therefore identify accountable senior ownership and clear operational responsibilities.
A workable model places policy ownership with a senior executive or compliance function, oversight with an appropriate board or risk committee, and execution across Procurement, Legal, Finance, Operations and other exposed teams. OFSI’s enforcement guidance expects due diligence decisions to reflect sanctions risk and, ordinarily, to be made with reference to an internal framework or policy. It also treats appropriate ownership-and-control due diligence as potentially mitigating, while inadequate or bad-faith due diligence may aggravate enforcement.
Sabre Global Technologies Limited shows what weak ownership can look like. OFSI imposed a £1,000,920.59 penalty in 2026 after the company continued to provide services to the designated Ural Airlines and explored alternative payment routes. OFSI stated that the company lacked effective senior oversight and was unable to assess or mitigate its exposure properly. The case was assessed as “most serious”, making governance failure part of the enforcement narrative rather than an internal issue.
Public bodies must combine this governance with procurement-specific statutory duties. Under the Procurement Act 2023, contracting authorities undertaking covered procurement must check the centrally published debarment list and apply the Act’s exclusion regime where relevant. That process does not replace sanctions screening: a supplier absent from the debarment list may still pose sanctions risk through its designation, ownership, control, banks, or supply chains. Public procurement therefore needs both procurement-law and sanctions-law decision paths.
Procurement, Legal, Finance and Compliance – Shared Responsibility
Procurement, Legal, Finance and Compliance should operate as a connected control system rather than four separate reviewers. Procurement sees the supplier first and understands the sourcing route, commercial leverage, subcontracting model and operational dependency. Legal interprets prohibitions, licences, ownership and control, and drafts contractual protection. Finance controls payment execution and bank master data. Compliance designs screening methodology, escalation rules and monitoring. Each function sees different evidence, and failures often occur between them.
Procurement should own the commercial file: supplier declarations, due diligence evidence, approved subcontractors, sourcing geography, tender clarifications, and contract obligations. It should know when a bidder proposes delivery from a different country, changes a manufacturer, introduces an intermediary or requests a new bank account. Those events may look like ordinary commercial administration, yet each can alter sanctions exposure. Procurement therefore needs authority to pause progression until Legal or Compliance has resolved material concerns.
Legal’s role is not to approve every low-risk purchase. It should define the legal tests and handle exceptions: potential designation matches, indirect ownership or control, prohibited goods or services, licensing questions, circumvention concerns and conflicts between UK and overseas regimes. The aim is scalable governance. Routine low-risk transactions should follow documented rules, while unusual or high-risk cases move quickly to specialists before award, shipment, service provision or payment creates irreversible exposure.
Finance provides a separate line of defence because sanctions risk can change between contract signature and payment. Bank screening, beneficiary verification, frozen-funds controls, and segregation of duties can identify issues that are invisible during sourcing. Colorcon is instructive: the immediate payees were not designated, but their banks were. A procurement process screening only the supplier and a Finance process checking only account accuracy can therefore both appear compliant while the payment itself remains prohibited.
Compliance should connect the system through policy, screening standards, case management, training and management information. It should also test whether controls work in practice rather than merely exist on paper. OFSI’s 2024–25 review recorded 151 cases originating from non-self-reported sources, up from 108 the previous year, as enforcement became more intelligence-led. Organisations should assume that weak internal escalation may eventually be tested against external information, not simply against what they voluntarily disclose.
Building Sanctions Controls Into the Procurement Lifecycle
Sanctions controls should be embedded across the procurement lifecycle rather than added as a single pre-award screen. Planning establishes inherent risk; pre-qualification identifies ownership and geographic exposure; tendering obtains detailed declarations; evaluation tests evidence; approval records residual risk; contracting creates enforceable obligations; purchase-to-pay controls each transaction; and contract management monitors change. A lifecycle design reduces the likelihood that a single successful screening result is mistaken for permanent clearance for a supplier or transaction.
The first control should be risk segmentation. Low-value domestic purchases from transparent suppliers may justify proportionate screening. At the same time, high-value international sourcing, controlled goods, complex ownership structures, exposure to sanctioned regions, or unusual intermediaries should trigger a deeper review. OFSI states that there is no single prescribed form of due diligence and that the appropriateness depends on sanctions risk, the nature of the transaction, and the commercial relationship. That supports risk-based procurement controls, but requires organisations to document why their chosen level was reasonable.
Public procurement adds formal checkpoints. The Procurement Act 2023 has applied since 24 February 2025 and introduced a central debarment mechanism; covered procurements require contracting authorities to check the list and consider exclusions. Separately, sanctions screening must still address the UK Sanctions List, which became the sole official source for UK designations on 28 January 2026. Procurement systems should therefore distinguish debarment, sanctions designation and wider third-party risk rather than treating them as interchangeable checks.
Controls should repeat at meaningful transaction points. Re-screen before award, before purchase orders, when ownership changes, before high-risk shipments and when payment details alter; maintain evidence of the result and escalation. This is not bureaucratic duplication. OFSI says ownership and control are not static and expects ongoing relationships to be reviewed at appropriate times. A lifecycle framework is strongest when it responds to change rather than relying on the date a supplier first passed onboarding.
Procurement Planning and Early Risk Assessment
Procurement planning is where sanctions exposure can be reduced most cheaply. Before approaching the market, buyers should identify the countries associated with the supply, likely manufacturing locations, potential transit routes, end users, payment currencies, service delivery locations, and whether the requirement includes controlled or restricted goods, technology, or professional services. This early mapping determines whether ordinary supplier onboarding is adequate or whether the procurement needs specialist Legal, Compliance, export-control or security input before tender documents are released.
Country risk should be assessed as a transaction factor, not as a simplistic blacklist. A supplier incorporated in a low-risk jurisdiction may source components from, route goods through or bank in a higher-risk location. Conversely, lawful trade may remain possible with countries subject to targeted sanctions, provided the parties, goods, and activities are not prohibited. The procurement plan should therefore distinguish legal prohibitions from heightened due-diligence risk and record the evidence supporting either conclusion.
Product and service risk is equally important. The UK’s Russia sanctions, for example, include extensive restrictions covering goods, technology and services, while HMRC enforces relevant trade sanctions at the border. In May 2025, a UK exporter paid £1,160,725.67 in HMRC’s then-largest Russia sanctions compound settlement after making goods available to Russia. HMRC specifically warned that Russian companies can operate in third countries, meaning destination screening alone may be insufficient.
Planning should also test dependency and exit options. If the market has elevated sanctions exposure, the buyer should ask what happens if a supplier, owner, bank, vessel, insurer, or country becomes restricted in its operations. Alternative specifications, dual sourcing, alternative logistics routes, and contractual suspension rights can be designed before award at a lower cost than during a crisis. Public bodies must additionally preserve value for money, continuity and lawful procurement when considering replacement suppliers or termination.
A written sanctions risk assessment should conclude the planning stage for material procurements. It need not be lengthy, but it should identify inherent risks, required checks, specialist approvals, tender questions, contractual clauses, monitoring frequency, and transaction controls. The document then becomes the control blueprint for the procurement. It also provides evidence that sanctions risk was considered before commercial commitment, which is important because OFSI assesses the quality and proportionality of due diligence when determining enforcement outcomes.
Pre-Qualification and Supplier Due Diligence
Pre-qualification should establish who the organisation is actually proposing to trade with. At minimum, due diligence should verify legal identity, registration details, trading addresses, directors, ultimate beneficial owners, relevant parent companies and material associated entities. Screening the supplier name alone is inadequate because UK asset-freeze restrictions can extend to entities owned or controlled by designated persons even when those entities are not separately named on the UK Sanctions List.
OFSI’s current ownership-and-control guidance identifies three principal routes: more than 50% of shares or voting rights, the right to appoint or remove a majority of the board, or circumstances in which it is reasonable to expect that a person can ensure the entity’s affairs are conducted in accordance with that person’s wishes. Procurement teams should therefore obtain ownership information sufficient to test all three, rather than asking only for a percentage shareholding declaration.
Supplier evidence should be corroborated. Companies House data, corporate registries, audited accounts, reputable ownership databases, adverse media research, and direct documentary requests can expose inconsistencies that a questionnaire cannot. OFSI recommends caution where ultimate ownership cannot be reliably established. The standard should rise with risk: opaque holding companies, nominees, trusts, recent divestments, unusual shareholder agreements or ownership changes around designation dates warrant deeper investigation before the supplier advances.
Apple Distribution International Limited demonstrates why ownership analysis matters. OFSI imposed a £390,000 penalty in March 2026 after two payments totalling £635,618.75 were made to Okko LLC, which was wholly owned by designated JSC New Opportunities. Apple Inc. was not found to be in breach. The case underlines a procurement principle that applies beyond payments: the legal status of the immediate counterparty cannot be assessed safely without understanding who owns or controls it.
Sanctions Questions Within Tender Documents
Tender documents should convert sanctions due diligence into precise questions that suppliers can answer, and evaluators can test. Questions should cover current designation status, ownership and control, countries of incorporation and operation, manufacturing and sourcing locations, subcontractors, intended logistics routes, banks and payment intermediaries, restricted goods or services, relevant licences and any previous sanctions investigations or breaches. Generic statements such as “confirm compliance with all sanctions” provide little diagnostic value unless supported by factual disclosure.
Bidders should be required to identify ultimate beneficial owners and material changes expected during the contract, rather than merely certify that the bidding entity is not designated as such. Tender documents can also ask whether any owner, director, affiliate, subcontractor, bank or logistics provider is subject to applicable sanctions, and require explanation of screening controls. For higher-risk procurements, evidence may include ownership charts, policy extracts, licence details, supply chain maps, and named compliance contacts.
Questions should be proportionate and legally relevant. A contracting authority or private buyer should not automatically reject a bidder simply because the bidder operates in a jurisdiction subject to sanctions. The decisive issues are the applicable prohibitions, ownership and control, the goods or services involved, destination, end-use and whether risks can lawfully be managed. In public procurement, exclusion decisions must also comply with the Procurement Act 2023 and cannot be replaced by informal geographic assumptions.
Public buyers should also obtain the information required to operate the Act’s exclusions regime, including relevant self-declarations concerning suppliers, associated persons, and connected persons, while checking the debarment list for covered procurements. Cabinet Office guidance also continues to address contracts with Russian and Belarusian suppliers in specified public bodies. Those procurement-law processes sit alongside, rather than instead of, sanctions checks, because a sanctions prohibition may arise even when no procurement exclusion ground has been established.
Responses should become part of the evidential record and, where appropriate, the contract. Material inaccuracies should trigger clarification, enhanced due diligence, or potential exclusion under the applicable procurement rules, rather than being silently corrected after award. The strongest tender packs also state that sanctions information may be independently verified and must be updated before contract signature. This discourages superficial certification and establishes an early expectation that transparency is a continuing condition of doing business.
Evaluation of Sanctions and Geographic Risk
Evaluation should separate legal permissibility from commercial risk. The first question is whether award or performance would breach applicable sanctions; if so, the procurement cannot simply score the risk and proceed unless a valid exception or licence applies. If the transaction is lawful but elevated risk remains, evaluators can then assess resilience, transparency, controls and deliverability. This distinction prevents a weighted scoring model from accidentally treating a legal prohibition as merely another commercial weakness.
A useful evaluation matrix considers counterparty, ownership, geography, product, service, logistics, payment and end-use risk separately. Each category should have evidence-based indicators and defined escalation thresholds. A bidder with transparent ownership but complex shipping through higher-risk jurisdictions presents a different risk from a domestically delivered supplier whose beneficial owner may be designated. Combining both into a single “country risk” score can hide the precise legal or operational issue that needs treatment.
Financial and operational viability should also be considered. A lawful supplier may depend on a sanctioned bank, insurer, carrier, parent company or critical sub-supplier whose removal could make performance impossible. Procurement should therefore ask whether the proposed supply chain can continue if one component is blocked. Colorcon’s £152,750 penalty, arising from payments involving designated banks, demonstrates why evaluation should consider the supplier’s infrastructure rather than the supplier itself alone.
Evaluation records should show both the evidence considered and the reason for the conclusion. This is especially important where ownership is complicated, or the decision rests on professional judgement rather than a straightforward list match. OFSI states that it expects evidence of a decision-making process that considered the degree of sanctions risk and an appropriate level of due diligence. A clear evaluation trail is therefore both a procurement discipline and potential enforcement mitigation.
When Enhanced Due Diligence Should Be Required Before Award
Enhanced due diligence should be required before award when ordinary checks leave material uncertainty or reveal elevated sanctions exposure. Common triggers include opaque or layered ownership, nominee shareholders, recent ownership transfers, links to designated persons, higher-risk jurisdictions, sanctioned-sector activity, unusual intermediaries, complex trans-shipment routes, restricted goods or technology, unexplained bank arrangements, adverse media, inconsistent tender answers or a supplier unwilling to identify beneficial owners, subcontractors or end-users.
Enhanced work should be targeted at the unresolved risk. It may involve obtaining certified corporate records, tracing ownership through multiple layers, testing control rights, reviewing shareholder agreements, verifying directors and connected persons, mapping deeper suppliers, checking banks and vessels, confirming origin and destination, validating licences and seeking specialist legal advice. The output should not be a larger file for its own sake; it should answer the specific question preventing a defensible award decision.
Trade exposure can require enhanced diligence even when the buyer sees no obvious Russian destination. HMRC’s £1,160,725.67 settlement in 2025 concerned goods made available to Russia and prompted an explicit warning that Russian companies operate in third countries. Procurement should therefore investigate end users, beneficial ownership, and onward movement when goods are sensitive, or routing appears unusual. A distributor in a third country is not evidence that sanctions exposure ends at that border.
The award decision should record whether enhanced due diligence resolved the issue, what residual risk remains, who approved it and what post-award controls are required. Where material uncertainty persists around designation, ownership, control or prohibited activity, commercial urgency should not substitute for evidence. OFSI’s enforcement guidance places the burden on the person seeking mitigation to demonstrate reasonable, appropriate and good-faith due diligence. Procurement should therefore treat unresolved uncertainty as an approval issue.
Approval and Escalation Procedures
Approval procedures should distinguish routine sanctions screening from cases requiring specialist escalation. Low-risk procurements may proceed through documented checks, while potential list matches, ownership concerns, restricted goods, unusual payment routes or sanctioned-country exposure should trigger a formal hold. The escalation path should identify who can clear false positives, who can approve enhanced due diligence, who may seek external advice and who has authority to stop award, shipment, performance or payment.
Escalation thresholds should be defined before a live case arises. A buyer should not have to decide under commercial pressure whether a sanctions concern is serious enough for Legal or Compliance. Useful triggers include any possible designated-person match, more than 50% ownership concerns, evidence of control, unexplained intermediaries, high-risk trans-shipment, requests involving restricted services, or inconsistencies between supplier declarations and independent evidence. Each trigger should generate a recorded decision and named approver.
Sabre Global Technologies Limited shows why escalation without effective senior oversight can fail. OFSI imposed a £1,000,920.59 penalty in 2026 after Sabre continued to provide services to the designated Ural Airlines and explored alternative payment routes. OFSI said the company lacked effective senior oversight and was unable to assess or mitigate sanctions exposure properly. Procurement governance should therefore require that unresolved sanctions cases reach people with authority, expertise, and independence from delivery pressure.
Sanctions Warranties and Representations
Sanctions warranties and representations convert due diligence findings into contractual statements that the buyer may rely on. Typical provisions require the supplier to confirm that it, specified owners and relevant affiliates are not designated, are not owned or controlled by designated persons, and will not knowingly involve sanctioned parties in performance. The drafting should identify which sanctions regimes are relevant and avoid an undefined promise to comply with every sanctions regime worldwide, regardless of legal applicability.
A representation usually addresses the factual position at the time it is made, while a warranty creates a contractual promise that can support remedies if untrue; the exact legal effect depends on the drafting and governing law. Procurement should therefore avoid treating the terms as interchangeable boilerplate. The contract should state when representations are repeated, such as at contract signature, on each purchase order, on each invoice, and for specified ownership changes or payment-account changes. Hence, the assurance remains connected to continuing performance.
The strongest warranties are specific enough to test. A supplier might warrant that no designated person owns more than 50% of its shares or voting rights, can appoint or remove a majority of its board, or otherwise controls its affairs. Those formulations mirror OFSI’s ownership-and-control framework. Where risk warrants it, procurement can extend declarations to key subcontractors, banks, freight forwarders, end-users and other parties necessary for performance rather than relying on the supplier alone.
Warranties should support, not replace, verification. OFSI’s enforcement guidance states that appropriate ownership-and-control due diligence may mitigate a breach where the conclusion was reached in good faith and was reasonable. A signed supplier warranty may therefore be useful evidence, but procurement should still corroborate material facts where risk justifies it. Contract language cannot transform weak due diligence into reasonable due diligence, nor can a supplier promise extinguish the buyer’s statutory responsibilities.
Contractual Obligations to Comply With Sanctions Laws
A sanctions compliance clause should require the supplier to comply with sanctions laws applicable to contract performance, including relevant financial and trade restrictions, licences and prohibitions on circumvention. It should also prohibit conduct that would cause the customer to breach applicable sanctions. This is more precise than a generic promise to obey “all laws”, because it identifies sanctions compliance as a material obligation and creates a clear basis for information requests, suspension and remedies.
The clause should recognise that different activities can engage different UK authorities. OFSI administers and enforces financial sanctions, while the Office of Trade Sanctions Implementation (OTSI) is responsible for specified trade sanctions and, since 27 April 2026, has expanded licensing responsibilities for sanctioned goods and ancillary services not subject to strategic export controls. The Export Control Joint Unit (ECJU) retains licensing responsibility for goods, software, or technology that are also subject to strategic export controls. Contract managers need obligations broad enough to accommodate this regulatory split.
The supplier should also be required to maintain controls proportionate to the contract’s sanctions exposure, retain relevant records and cooperate with lawful compliance enquiries. The obligation should continue throughout performance rather than operate only at signature. Sabre’s £1,000,920.59 penalty demonstrates why continuing performance matters: Ural Airlines was designated during an existing relationship, yet services and payment-related activity continued. Sanctions clauses should therefore address changing law and counterparty status, not merely initial eligibility.
Supplier Obligations Regarding Ownership and Control
Supplier obligations on ownership and control should require more than disclosure of a percentage shareholder list. OFSI’s guidance provides that an entity may be treated as owned or controlled where a person holds, directly or indirectly, more than 50% of shares or voting rights, can appoint or remove a majority of the board, or can reasonably be expected to ensure that the entity’s affairs are conducted according to that person’s wishes.
Contracts should therefore require an up-to-date ownership chart showing intermediate holding entities, ultimate beneficial owners and relevant control rights. For higher-risk suppliers, procurement may also require constitutional documents, shareholder agreements, voting arrangements, or other evidence to test control. A structure containing trusts, nominees, recent transfers, or offshore holding companies should not automatically be treated as improper, but it may require enhanced verification before the buyer can confidently rely on the supplier’s declared ownership position.
The obligation should extend to changes that could alter sanctions exposure. A supplier that was lawful when appointed may become owned or controlled by a designated person without itself being separately listed. OFSI expressly notes that entities subject to ownership-and-control restrictions may not appear on the UK Sanctions List. Procurement systems that monitor only the supplier’s name can therefore miss a legally material change occurring elsewhere in the corporate structure.
Contract drafting should define what the supplier must do if ownership information cannot be verified. The buyer may require further evidence, impose enhanced monitoring, suspend new orders or withhold approval for specified changes while sanctions implications are investigated. These rights should be exercised consistently with the contract and applicable law. The objective is not to punish corporate complexity, but to prevent commercial activity continuing when the buyer cannot establish whether prohibited ownership or control exists.
For public bodies, ownership information also intersects with the Procurement Act 2023 exclusions regime. Cabinet Office guidance requires contracting authorities to consider certain connected persons, including majority shareholders, directors, parent companies and subsidiaries, when applying relevant exclusion grounds. That regime is distinct from sanctions law, but the underlying information overlaps significantly. Well-designed supplier data can therefore support both statutory procurement checks and sanctions compliance without forcing separate teams to reconstruct the same corporate structure independently.
Notification of Changes in Ownership or Sanctions Status
Contracts should impose a positive duty on suppliers to promptly notify the customer when ownership, control, or sanctions status changes. The trigger should include the supplier’s designation, a relevant owner or controlling person, and acquisitions, disposals, voting changes, changes in board control, and other events that could affect sanctions analysis. Waiting for the buyer’s next periodic screening cycle creates a gap during which purchase orders, shipments, services or payments may continue on outdated information.
The notification period should reflect materiality. Immediate notice is appropriate for designation, suspected ownership by a designated person or loss of a required licence; short defined periods may suit routine corporate restructuring. Suppliers should provide enough information for the buyer to assess consequences, not merely announce that “a change has occurred”. Supporting documents, effective dates, ownership percentages, control rights and affected subcontractors should be supplied where relevant, subject to proportionate confidentiality safeguards.
The commercial importance is illustrated by sanctions imposed during existing relationships. Sabre Global Technologies had contracted with Ural Airlines since 2007; Ural Airlines was designated on 19 May 2022, and Sabre was informed that day. OFSI later penalised Sabre £1,000,920.59 for subsequent breaches. A notification clause cannot guarantee compliance, but it helps ensure that designation information reaches the customer’s control framework rapidly enough to stop, investigate and decide before further performance.
Notification should also be reciprocal where appropriate. The customer may need to notify the supplier if performance must be suspended because sanctions law changes, a licence expires, or a regulator imposes conditions that affect the contract. Clear communication provisions reduce the risk that operational teams continue issuing instructions after Compliance identifies a prohibition. The contract should identify designated contact points, escalation channels and consequences of failing to provide material sanctions information accurately and on time.
Flow-Down Clauses for Subcontractors and Sub-Suppliers
Flow-down clauses require the supplier to transmit relevant sanctions obligations into the parts of its supply chain that actually perform the contract. Without them, a prime supplier may make strong promises while relying on subcontractors, distributors, freight forwarders, or sub-suppliers that are subject to weaker controls. The clause should identify which obligations must be replicated, including screening, ownership disclosure, no-re-export commitments, record-keeping, notification, audit cooperation, and restrictions on engaging with designated or prohibited parties.
Flow-down should be proportionate rather than mechanically imposed on every remote supplier. Procurement should focus on entities whose role can affect legal exposure: key manufacturers, first-tier subcontractors, logistics providers, intermediaries, payment agents and parties handling restricted goods or technology. UK guidance for non-UK businesses specifically recommends verifying brokers, subcontractors, and freight forwarders and, where there is a Russia diversion risk, requiring contractual commitments against re-export and onward resale to parties that do not make equivalent commitments.
The UK Government’s no-Russia clause guidance provides a useful model. It recommends that importers or buyers use their best efforts to prevent downstream parties from frustrating the restriction, maintain adequate monitoring mechanisms, and provide compliance information when requested. The guidance does not make such clauses universally mandatory under UK Russia sanctions; rather, it presents them as a due diligence tool. Procurement can adapt that logic to other sanctions risks where downstream conduct could expose the contracting organisation.
Public procurement creates an additional reason to understand important subcontractors. Cabinet Office guidance under the Procurement Act 2023 recognises that associated persons may include specialist subcontractors or consortium members relied upon to satisfy conditions of participation, sometimes deeper than the first tier. Exclusion analysis and sanctions analysis remain legally distinct, but both require visibility at the prime contractor level. Contract terms should therefore secure information rights proportionate to the subcontractor’s importance and risk.
Flow-down clauses should also contain an enforcement mechanism. The prime supplier might be required to investigate suspected breaches, obtain corrective action, replace a problematic subcontractor where lawful and feasible, or suspend affected activities while the issue is reviewed. Simply requiring “equivalent obligations” is weak if the buyer cannot ask whether they were imposed or enforced. For critical supply chains, procurement should retain the right to inspect evidence that the required downstream terms actually exist.
Restrictions on Changing Subcontractors Without Approval
Restrictions on changing key subcontractors prevent a supplier from replacing an approved low-risk delivery partner with an unreviewed higher-risk entity after award. The contract should identify which subcontractors require prior written approval and which routine lower-tier changes merely require notification. Approval should be based on objective criteria such as sanctions status, ownership, geography, capability and supply-chain role, rather than giving the customer an arbitrary veto unrelated to legitimate contractual or compliance concerns.
For public contracts, the mechanism must also sit coherently with the Procurement Act 2023. Cabinet Office exclusions guidance recognises associated persons and subcontractors within the exclusion framework and, in certain circumstances, requires suppliers to receive an opportunity to replace problematic associated persons before exclusion. Contract drafting should therefore align sanctions approval rights with statutory procurement obligations, competition principles and any modification rules, particularly where the proposed replacement materially changes the tendered delivery model.
A sensible clause allows urgent replacement when continuity is threatened, but prevents the new subcontractor from performing until the required checks are complete, unless a documented emergency process authorises otherwise. Procurement should obtain identity, ownership, location, function and relevant sanctions information before approval. The purpose is not administrative control for its own sake: subcontractor substitution can alter country exposure, payment routes, end-use risk and access to restricted goods or technology in a single operational change.
Country-of-Origin and Supply-Chain Transparency Clauses
Country-of-origin clauses should require suppliers to provide accurate information about where relevant goods, components and materials originate and where manufacturing, assembly or processing occurs. Origin is not synonymous with the supplier’s registered office or invoice address. For sanctions-sensitive procurement, the contract should permit the buyer to request supporting evidence and should require notification before material sourcing changes. This gives procurement a factual basis for assessing import restrictions, circumvention risk, and emerging-country measures.
Supply-chain transparency should also cover transit and intermediary jurisdictions where these are material. Goods may be manufactured in one country, sold by an entity in another, financed by a third, and trans-shipped by a fourth. Each link can affect sanctions risk. The contract should therefore secure proportionate visibility into manufacturers, distributors, freight forwarders, brokers, and other parties whose involvement could affect the legality of performance, rather than relying solely on the contracting supplier’s nationality.
Transparency clauses should specify the types of evidence that may be requested. Depending on the goods, this can include certificates of origin, manufacturer declarations, customs documentation, bills of lading, commodity codes, supplier invoices, shipping instructions and end-user certificates. The buyer should avoid demanding every document for every purchase. A risk-based approach is stronger: high-risk goods, jurisdictions or routing patterns justify deeper evidence, while straightforward domestic supply can remain proportionate and commercially workable.
The information must be usable, not merely collected. Procurement systems should link declared origin and manufacturing locations to sanctions screening, restricted-goods checks and change-control alerts. A new manufacturing country can simultaneously alter tariff treatment, sanctions exposure, export licensing requirements, or continuity risk. Contract managers should therefore treat origin data as dynamic commercial information. Material inconsistencies between declarations and shipping records should generate an investigation before further orders or payments are released.
For public bodies, transparency must also be balanced against proportionality, confidentiality, and requirements of procurement law. Authorities should request information on genuine contract and compliance risks, appropriately protect commercially sensitive supply chain data, and apply requirements consistently. The objective is defensibility: the authority should be able to explain why particular visibility was needed and how it influenced the decision. Excessive information gathering that is never reviewed can create cost without improving sanctions control.
End-Use and End-User Obligations
End-use and end-user clauses address a central sanctions risk: lawful delivery to an immediate customer can still be prohibited if goods, technology, or services are ultimately intended for a restricted person, activity, or destination. Contracts should require the supplier or customer, as appropriate, to identify the intended end-user, final destination and stated use, and to notify material changes. Higher-risk transactions should be supported by documentary evidence rather than relying entirely on unverified commercial assurances.
UK guidance for non-UK businesses specifically recommends examining the end use, end user, and ultimate destination country when Russian connections or diversion concerns are present. It also recommends open-source research and documentary corroboration. The logic is broader than Russia: procurement professionals should ask whether the stated use is commercially plausible, whether quantities fit the customer’s operations and whether intermediaries have a credible role. Implausible explanations can be red flags requiring enhanced due diligence.
The 2025 HMRC settlement of £1,160,725.67 reinforces this point. HMRC warned that Russian companies operate in third countries and that exporting sanctioned goods to such companies can breach prohibitions on making goods available to persons connected with Russia. A third-country delivery address therefore does not settle the legal analysis. Contract clauses should enable buyers to obtain and verify end-user information when product sensitivity or routing creates a credible risk of diversion.
End-use obligations should contain practical remedies. The supplier should not redirect goods, substitute an end-user or materially change use without required approval where sanctions risk could be affected. The buyer should be able to suspend delivery or seek further evidence if information becomes inconsistent. For controlled or sanctions-sensitive items, procurement should coordinate contractual end-use controls with the relevant OTSI or ECJU licensing requirements, as contractual permission cannot authorise activity that is prohibited by law.
No-Re-Export Clauses
A no-re-export clause restricts a buyer or intermediary from reselling, exporting or re-exporting specified goods to a prohibited destination or for prohibited use. For UK businesses, the clearest official example is the Government’s January 2025 guidance on the no-Russia clause. It states that such clauses can reduce the risk of diversion and circumvention, particularly for items relevant to Russian military capability, but confirms that UK Russia sanctions do not impose a universal requirement to include one.
That distinction matters when drafting policy. UK organisations may decide that no-re-export wording is required internally for particular goods, countries or risk categories, but they should not describe that internal requirement as a general statutory UK obligation. The EU position is different: Article 12g of Regulation 833/2014 requires relevant EU operators to include a no-Russia clause in certain contracts concerning specified sensitive goods and technology, subject to the Regulation’s scope and exceptions.
UK Government template guidance suggests prohibiting direct or indirect re-export to Russia or use in Russia, requiring best efforts to prevent downstream circumvention, maintaining a monitoring mechanism, and treating breaches as material. It also contemplates information being supplied within two weeks of request. These elements are useful because they combine prohibition with monitoring and evidence collection. Procurement should adapt the wording to the goods, governing law, supply chain and remedies rather than copying it wholesale.
A defensible clause should therefore sit inside a wider control framework. Procurement should still screen counterparties, understand end use, verify suspicious routing, monitor changes, and investigate red flags. The Government expressly cautions that no-Russia clauses do not replace strong due diligence. Used properly, they are one layer of protection: they establish expectations, support downstream accountability and create contractual remedies. At the same time, statutory responsibility for complying with UK sanctions remains with the persons to whom those sanctions apply.
Audit and Information Rights
Audit and information rights give the buyer the means to test whether contractual sanctions promises are being honoured after award. A proportionate clause may permit review of ownership records, screening evidence, relevant invoices, payment instructions, shipping documents, licences, end-user information and subcontractor records. Rights should extend far enough to investigate credible sanctions concerns while remaining connected to the contract, and to protect legally privileged material, personal data, and genuinely unrelated commercially sensitive information.
Public-sector contracting already provides a useful benchmark. The Government’s Public Sector Contract General Terms allow the relevant authority or an auditor to inspect contract records, sites, systems and supplier staff, and require reasonable cooperation. Those terms also require full and accurate contract records throughout the term of the contract and for 7 years after the end date. Sanctions-specific drafting can build on that structure by identifying the additional evidence needed for sanctions assurance.
Audit rights should become more extensive when risk increases. A supplier sourcing sensitive goods through higher-risk jurisdictions may reasonably be required to provide evidence of origin, freight documents, and downstream compliance records. At the same time, a low-risk domestic services provider may justify much lighter assurance. The contract should define who may conduct an audit, notice periods, confidentiality protections, cost allocation, and circumstances that permit immediate review when delay could allow prohibited activity to continue.
An audit clause has little value if findings cannot lead to action. The contract should permit the buyer to require corrective measures, additional evidence, enhanced screening, replacement of problematic subcontractors, suspension of affected activity or escalation to Legal and Compliance. Government core terms similarly allow reasonable post-audit instructions and recovery of audit costs where material default is identified. Procurement should therefore design audit rights as an operational control, not merely a document-access provision.
Supplier Cooperation With Compliance Investigations
Supplier cooperation clauses should require prompt assistance when a sanctions concern is investigated internally or by a competent authority. Cooperation may include preserving documents, answering reasonable questions, identifying relevant employees, providing transaction records, explaining ownership or payment arrangements and helping trace goods or funds. The supplier should also be required to notify the buyer if it receives a regulatory information request concerning contract performance, where disclosure is lawful and does not prejudice an official investigation.
The clause should distinguish ordinary contractual enquiries from statutory demands. OFSI and OTSI possess legal powers to gather information that operate independently of private contracts. A buyer cannot instruct a supplier to withhold information lawfully required by a regulator, nor should contractual confidentiality obstruct mandatory reporting. Procurement drafting should instead require the supplier to cooperate with lawful regulatory processes and, where legally permitted, keep the buyer sufficiently informed to manage contractual, operational and reputational consequences.
Svarog Shipping & Trading Company Limited demonstrates that information failures can themselves attract enforcement. OFSI imposed a £5,000 penalty in April 2025 after Svarog failed, without reasonable excuse, to respond within the required timeframe to a statutory request for information under the Russia Regulations. OFSI ultimately concluded that Svarog had not committed another financial-sanctions breach, making the penalty instructive: poor cooperation can create a separate compliance failure even where the underlying suspicion is not substantiated.
OTSI takes a similarly demanding approach. Its enforcement guidance identifies poor cooperation, withholding information, obstructing access and attempts to conceal or destroy evidence as potential aggravating factors. Conversely, compliance with information requests and good due diligence practices can mitigate enforcement outcomes. Supplier clauses should therefore require preservation and cooperation from the moment an issue arises, rather than waiting until a regulator has formally opened an investigation or commercial positions have hardened.
Procurement should plan how cooperation will work across subcontracting tiers. A prime supplier may possess only part of the evidence if manufacturing, logistics, payment processing or technical services are delegated. Flow-down provisions should require relevant subcontractors to preserve and provide information through the prime contractor, while allowing direct access where justified and contractually agreed. Without that structure, an investigation can stall because the buyer’s immediate counterparty lacks contractual leverage over the party holding critical records.
Cooperation rights should remain proportionate and procedurally controlled. Requests should identify the suspected issue, required information, responsible contact and reasonable deadline, subject to urgency and legal obligations. The contract should address privilege, confidentiality, data protection and regulatory restrictions, while making clear that these protections cannot be misused to frustrate legitimate enquiries. A well-designed clause gives investigators timely evidence while protecting lawful rights, reducing the temptation to improvise during a high-pressure sanctions event.
Record-Keeping Requirements
Record-keeping requirements should preserve the evidence needed to reconstruct sanctions decisions after the event. Relevant records may include screening results, ownership assessments, supplier declarations, licences, purchase orders, invoices, bank details, approvals, shipping documents, end-user certificates, escalation notes and correspondence. The contract should specify retention, accessibility, and format requirements, but avoid assuming a single universal sanctions retention period, as statutory and licensing obligations vary by regime, activity, and authorisation relied upon.
Public-sector practice again offers a useful benchmark. The Government’s Public Sector Contract General Terms require suppliers to maintain full and accurate contract records throughout the contract term and for 7 years after its end date. Separately, individual OFSI general licences can impose their own reporting and record-keeping conditions; historical legal-services licences, for example, required records of use to be retained for six years. Procurement should therefore align contractual retention with whichever legal requirements actually apply.
Records must also be retrievable, not merely retained. OTSI guidance lists the documents it may request during an investigation, including commercial invoices, due diligence reports, electronic transfer evidence, end-use certificates, export licences, letters of credit, risk assessments, contracts and transport documents. If requested documents are not held, a person may need to take reasonable steps to obtain them. Effective procurement records, therefore, need clear ownership, indexing, access controls, and preservation procedures when an investigation begins.
Suspension Rights Where Sanctions Concerns Arise
Suspension rights allow an organisation to pause performance while a sanctions concern is investigated without immediately terminating the contract. The clause should identify triggers such as a potential designation match, an ownership or control concern, a blocked payment, licence uncertainty, suspicious routing, or a credible indicator of circumvention. It should permit suspension of affected orders, services, deliveries or payments to the extent lawful and necessary, while requiring prompt review so that precaution does not become indefinite commercial paralysis.
The distinction between suspension and refusal to perform matters. A sanctions concern may prove to be a false positive, may be resolved through additional evidence, or may be capable of lawful performance under an exception or licence. Immediate termination can therefore destroy value unnecessarily. Conversely, continuing performance while questions remain can deepen exposure. A structured suspension right gives Legal and Compliance time to establish the facts while Procurement preserves contractual leverage and operational alternatives.
Financial sanctions can also require that funds or other economic resources be frozen, meaning that a contractual payment suspension may reflect a statutory prohibition rather than a discretionary remedy. OFSI guidance makes clear that transactions involving designated persons may require a licence before otherwise prohibited activity proceeds. Contract wording should therefore avoid promising automatic release of withheld sums after a fixed period if applicable law still prevents payment, transfer or other performance.
Suspension procedures should define the operational steps during the hold. Procurement may stop new purchase orders, Finance may block payment, Logistics may prevent dispatch, and the supplier may be required to preserve goods or information pending review. The contract should allocate reasonable responsibilities for storage, insurance, mitigation and communication without predetermining liability for resulting costs. Those consequences may depend on whether the concern is substantiated, whether either party caused it, and what sanctions law permits.
The right should be linked to clear decision-making and evidence. A buyer should record the trigger, date, affected transactions, legal basis, approvals, communications and conditions for resumption. This protects against arbitrary use and assists later audit or enforcement review. OFSI’s enforcement guidance expects evidence of risk-based decision-making and appropriate due diligence. A documented suspension process demonstrates that the organisation responded to emerging information rather than allowing commercial momentum to override compliance.
Termination Rights Following a Sanctions Event
Termination rights should address circumstances in which sanctions make continued performance unlawful, materially impracticable or unacceptable after investigation. Triggers may include designation of the supplier, ownership or control by a designated person, loss or refusal of a necessary licence, prohibited goods or services, confirmed circumvention, or serious breach of sanctions warranties. Drafting should distinguish mandatory cessation required by law from discretionary termination based on contractual risk, because the legal and financial consequences may differ.
Termination clauses should also address consequences rather than stop at the right itself. The contract may need provisions for outstanding orders, goods already produced, title, return of customer property, transition assistance, records, confidential information and payments lawfully due. A supplier becoming sanctioned does not mean every contractual obligation can be discharged through ordinary settlement. Payment or transfer of economic resources may itself require freezing, an exception or an OFSI licence.
Procurement should avoid clauses that automatically terminate on any sanctions-related event without analysis. Designation, ownership, trade restrictions and licensing rules operate differently, and an automatic trigger may create avoidable continuity problems where lawful wind-down or licensed performance remains possible. Conversely, a clause requiring prolonged cure periods could be unworkable where continuing performance is prohibited immediately. The better approach combines immediate suspension with termination rights tailored to the event’s seriousness and legal effect.
Can Contractual Clauses Transfer Sanctions Liability?
Contractual clauses can allocate commercial risk between parties, but they cannot transfer responsibility for complying with sanctions law away from a person to whom the law applies. A supplier indemnity, warranty or compliance undertaking may give the buyer a private contractual remedy, yet it does not bind OFSI, OTSI, HMRC or a court exercising statutory jurisdiction. Regulators assess the conduct and legal obligations of each relevant person independently of private risk allocation.
This distinction is important because civil sanctions enforcement increasingly uses strict-liability models. For financial sanctions breaches occurring on or after 15 June 2022, OFSI can impose civil monetary penalties without proving that the person knew of or had reasonable cause to suspect a breach. For most breaches under OTSI’s civil regime, a lack of knowledge similarly does not preclude a monetary penalty. A supplier’s contractual promise therefore cannot operate as a defence to the buyer’s own prohibited conduct.
Contracts can nevertheless allocate financial consequences of supplier wrongdoing, subject to governing law and the clause’s enforceability. An indemnity might cover specified losses arising from false sanctions declarations, prohibited subcontracting or failure to notify ownership changes; damages may be available for breach of warranty or covenant. Procurement should draft these mechanisms carefully, defining causation, exclusions, caps, and interactions with broader liability provisions, rather than assuming a “sanctions indemnity” automatically covers all regulatory or commercial losses.
The practical limitation is that recovery may be impossible when it matters most. A supplier that becomes designated, insolvent, or inaccessible may be unable to lawfully pay an indemnity, while receipt or enforcement of funds may itself engage sanctions restrictions. Insurance may contain sanctions exclusions, and contractual liability caps may constrain recovery. Procurement should therefore view indemnities as secondary financial protection rather than the primary mechanism for preventing unlawful transactions or preserving continuity.
Nor can one party delegate screening to another and cease making its own risk-based decisions. OFSI’s enforcement guidance considers whether due diligence was appropriate to the degree of sanctions risk, transaction type and commercial relationship, and expects evidence of a decision-making process. Contractual allocation may help demonstrate responsibilities, but the organisation still needs assurance that assigned controls are operating effectively. Outsourcing an activity does not automatically outsource the statutory exposure generated by that activity.
The strongest drafting, therefore, separates three concepts: compliance responsibility, contractual responsibility, and financial risk allocation. Each party remains responsible for complying with sanctions applicable to it; contractual clauses specify who must perform particular checks, disclosures, and controls; and liability provisions determine the available remedies if those promises are broken. Keeping those concepts distinct prevents the dangerous assumption that a well-drafted contract has transferred legal accountability, when in reality it has only created rights between the contracting parties.
Purchase Orders and Transaction-Level Controls
Purchase orders are an important sanctions checkpoint because they convert an approved supplier relationship into a specific transaction. A supplier may remain acceptable even if a particular order introduces a restricted product, a new destination, an unusual consignee, a different manufacturer, or a higher-risk delivery route. Procurement systems should therefore apply transaction-level controls proportionate to risk rather than assuming that successful onboarding authorises every future purchase made under the contract or supplier account.
Useful controls include mandatory fields for delivery country, ship-to party, end-user, manufacturer, commodity classification, and a relevant licence reference, where applicable. Higher-risk orders can be routed automatically for sanctions or export-control review before release. The objective is not to burden every routine requisition with specialist approval, but to ensure that system data captures the variables that can change legal exposure and can trigger escalation before goods, services, or funds move.
Purchase-order terms should also reinforce contract-level sanctions requirements. They can restate that performance remains subject to applicable sanctions, prohibit unauthorised changes to destination or subcontracting, and require immediate notice where fulfilment would involve a restricted party or activity. Where framework agreements or master contracts generate large numbers of call-offs, these transaction-specific conditions help ensure that sanctions compliance remains tied to each order rather than being treated as a historical onboarding exercise.
Controls should extend to amendments. A buyer changing quantity, destination, technical specification or delivery instructions may unintentionally alter sanctions or export-control exposure. At the same time, a supplier proposing a substitute product or ship-from location may create the same problem. Material purchase-order changes should therefore be reassessed using the original risk triggers. A compliant order should not retain its approval automatically when the factual basis on which that approval depended has materially changed.
System design matters because high transaction volumes make manual review unrealistic. Procurement platforms can block orders involving specified countries, require additional approval for sensitive categories and prevent release where mandatory compliance data is missing. Those rules should be tested and periodically reviewed. Automated gating is valuable only if the underlying sanctions lists, product classifications, country logic, and escalation workflows remain current; otherwise, technology can process risk consistently yet incorrectly.
Payment Screening and Bank Verification
Payment screening should be treated as a separate control from supplier onboarding. Before release, organisations should verify the beneficiary, relevant bank, payment country, currency and any material intermediary against applicable sanctions information, using risk-based escalation for uncertain matches. The check should be linked to the current supplier master data and to the underlying invoice or purchase order. A supplier approved months earlier may remain unchanged even as its banking arrangements or sanctions environment have changed materially.
Colorcon Limited provides one of the clearest procurement lessons. Its Moscow office made 123 payments worth £191,290.57 to non-designated employees and service providers whose accounts were held at designated Alfa Bank, Promsvyazbank, Sberbank and VTB Bank. OFSI found that 79 payments totalling £128,277.72 were breaches and imposed a £152,750 penalty. UK signatories checked amounts and payees but did not review the sanctions status of recipient banks.
The case also shows why reliance on a payment provider is insufficient. Colorcon believed its bank would apply relevant sanctions screening, but OFSI noted that this assumption had never been explicitly tested through appropriate enquiries. Payment controls should therefore clarify what the organisation screens, what its bank screens and where responsibility overlaps. Procurement and Finance should not infer that a successful payment means the transaction was lawful merely because a bank’s systems allowed it through.
Recent banking enforcement reinforces the point. OFSI imposed a £160,000 monetary penalty on Bank of Scotland after 24 payments totalling £77,383.39 were made to a designated customer, and a spelling variation contributed to an automated screening failure. In August 2026, OFSI also imposed a £4,732,830.58 penalty on Citibank N.A., London Branch, for sanctions breaches involving funds. Sophisticated financial institutions can fail, so buyers should maintain their own proportionate transaction controls rather than outsourcing judgement entirely.
Changing Bank Accounts – A Potential Red Flag
A request to change bank details is not evidence of sanctions evasion, but it is a red flag warranting verification before payment. The change may alter the beneficiary institution, jurisdiction, currency, intermediary chain or account holder while leaving the supplier name unchanged. UK Government guidance identifies last-minute changes in payment routing through a different country or company as a warning indicator. Procurement and Finance should therefore treat banking amendments as compliance events rather than clerical updates.
The control should begin with independent verification. Bank-change instructions received by email should be confirmed through a trusted contact route already held on file, rather than using telephone numbers or links contained only in the change request. Organisations should verify the account holder, bank, country and commercial reason for the amendment, then re-screen relevant parties before supplier-master data is updated. Segregation of duties should prevent one person from requesting, approving and activating sensitive payment changes.
Sanctions scrutiny should increase when a supplier requests a payment redirection to an unrelated company, a personal account, a newly incorporated intermediary, or a bank in a jurisdiction with no obvious connection to performance. A similar concern arises when the supplier proposes splitting invoices, using cryptocurrency, or moving funds through small overseas banks without a convincing rationale. Government guidance identifies shell companies, cryptocurrency, and circuitous financial flows as potential indicators of Russia sanctions evasion that warrant further examination rather than automatic rejection.
Sabre Global Technologies Limited provides a particularly strong example. After payments from designated Ural Airlines to Sabre’s UK bank were frozen for sanctions concerns, Sabre explored alternative payment routes and asked Ural Airlines to make a test payment to a non-UK Sabre account. OFSI treated that conduct as circumvention and imposed a £1,000,920.59 penalty in May 2026. A blocked payment should therefore trigger escalation, not an operational search for another route.
Colorcon demonstrates the converse risk: the account may genuinely belong to the intended payee while the bank itself is designated. Its 123 payments, worth £191,290.57, involved non-designated employees and service providers but were made to accounts at four designated Russian banks. Procurement and Finance should therefore verify more than account-name consistency. A bank change can transform the sanctions analysis, even when the supplier, invoice, underlying service, and beneficial recipient appear unchanged.
A defensible process should record the previous and new banking details, the verification method, the screening results, the business justification, the approvers, and the effective date. High-risk changes should place invoices on hold until Compliance or Legal clears them, with no override based solely on urgency or supplier pressure. The objective is not to make bank amendments difficult; it is to ensure that when money changes direction, the organisation reassesses whether the new route remains lawful, credible and commercially consistent.
Goods in Transit and Emerging Sanctions
Goods already in transit can become legally problematic when sanctions change between dispatch and delivery. Procurement should identify the physical location of goods, their origin, destination, consignee, carrier, and contractual title position before deciding what to do next. Under the UK Russia regime, import prohibitions may apply by origin, location, or consignment, and some restrictions may apply even where Russia is only a transit point in a wider journey.
The existence of a purchase contract, a bill of lading, or a pre-sanctions shipment date does not automatically authorise completion. Buyers should check the commencement provisions of the new measure, any transitional arrangements, exceptions and available licences before accepting delivery, making payment or instructing onward movement. Where goods transit the UK, separate export-control rules may also apply; goods destined for Russia do not benefit from the ordinary transit exception described in current statutory guidance.
Operationally, procurement should place affected shipments on controlled hold while Legal, Compliance, Logistics and Finance establish the permissible options. Relevant evidence may include customs entries, certificates of origin, commodity codes, shipping instructions, vessel information, insurance documents and payment status. The buyer should also consider storage, demurrage, deterioration and insurance exposure, but commercial cost cannot justify conduct prohibited by sanctions. Contracts should allocate these risks without purporting to override statutory restrictions.
Emerging sanctions therefore require rapid communication across the supply chain. Suppliers, freight forwarders, customs agents and internal logistics teams should know who may instruct a stop and what information must be preserved. Government guidance is updated frequently, while general licences can create narrow, temporary routes for specified activity. Procurement teams should monitor changes affecting live shipments and avoid assuming that yesterday’s lawful route remains lawful when the legal framework changes during transit.
What Happens When a Supplier Becomes Sanctioned Mid-Contract?
When a supplier is designated under an existing contract, the immediate response should be to stop and assess, rather than automatically terminate or continue. Procurement should identify outstanding orders, payments, goods, services, licences and subcontracting relationships, while Finance blocks potentially prohibited transfers. Legal and Compliance must then determine whether the designation imposes an asset freeze, whether the supplier is the designated person itself, and which contractual activities are affected.
An asset freeze can prohibit making funds or economic resources available to, or for the benefit of, a designated person unless an exception applies or OFSI licenses the activity. That can affect ordinary invoices, advance payments, refunds and transfer of goods. The commercial fact that the debt arose before designation does not, by itself, create permission to pay. Procurement should therefore distinguish amounts contractually owed from amounts that may lawfully be transferred.
Sabre Global Technologies Limited demonstrates the danger of treating pre-existing obligations as grounds for continuing performance. Sabre had supplied services to Ural Airlines since 2007; Ural was designated on 19 May 2022, and Sabre was informed that day. OFSI later penalised Sabre £1,000,920.59 after services continued and alternative payment routes were explored for pre-existing contractual amounts. Commercial history did not neutralise the new sanctions restrictions.
The contract should provide suspension, information and termination mechanisms, but sanctions law determines what the organisation may actually do. Procurement may need to preserve goods, stop new orders, suspend access to services, secure customer property or plan replacement supply. Any action involving the designated supplier’s funds or economic resources should be carefully reviewed, as even steps intended to unwind the relationship can entail prohibited transfers without appropriate authorisation.
Government may sometimes issue a general licence permitting limited wind-down activity following designation. OFSI issued such licences in 2025 and 2026 for several Russian energy, shipping and insurance-related entities, including PJSC Transneft and Maritime Mutual entities. Those licences were entity-specific, time-limited and conditional. Procurement should therefore verify the exact licence wording and expiry date rather than relying on a general assumption that every newly sanctioned supplier receives a wind-down period.
What Happens When a Supplier’s Owner Becomes Sanctioned?
A supplier need not be named on the UK Sanctions List to become subject to an asset freeze. If a designated person owns or controls the supplier within the relevant legal tests, restrictions can apply to the supplier as an owned or controlled entity. Procurement should therefore re-screen ownership when a shareholder is designated, establish direct and indirect holdings and control rights, and suspend affected transactions while the legal position is determined.
Apple Distribution International Limited illustrates the risk. OFSI imposed a £390,000 penalty in March 2026 after two payments totalling £635,618.75 were made to Okko LLC, which was wholly owned by designated JSC New Opportunities. Okko was the immediate recipient, but the ownership relationship brought the payments within the prohibition. The case reinforces why sanctions monitoring must extend beyond the supplier’s own name to the entities and persons controlling it.
The response should be evidence-led rather than automatic. Procurement should obtain an updated ownership chart, shareholder information, and relevant governance documents, then determine whether more than 50% ownership, board appointment rights, or other control tests are met. If the supplier is not legally owned or controlled by the designated person, elevated risk may still justify monitoring. If it is, payment, supply and contractual remedies must be handled within the applicable sanctions framework.
Existing Contracts and Newly Introduced Sanctions
New sanctions can alter the legality of contracts that were entirely lawful when signed. Unless legislation, an exception, or a licence provides otherwise, an existing contractual commitment generally does not create a grandfather right to engage in prohibited activity. Procurement teams should therefore maintain an inventory of contracts with meaningful sanctions exposure so that new designations, sectoral restrictions, product bans, or service prohibitions can be quickly matched against live obligations.
The first task is to identify what has changed and when it takes effect. Regulations may contain commencement dates, transitional provisions or exceptions for defined activities, while Government may issue general licences permitting limited continuation or wind-down. The exact language matters. A transition applying to contracts concluded before a specified date may cover only certain performance, counterparties or periods, so procurement should never treat the phrase “existing contract” as sufficient evidence of permission.
OFSI’s general-licence programme shows how specific these permissions can be. In February 2026 it issued a wind-down licence concerning PJSC Transneft, while a separate licence addressed pre-designation insurance policies written by Maritime Mutual entities. The Maritime Mutual licence was subsequently extended to 7 October 2026 and acquired a monthly reporting requirement. Such changes demonstrate why using a licence requires continuing monitoring, not a one-off legal check when the licence first appears.
Contract management should translate the legal change into operational instructions. Buyers may need to stop new orders, prevent automatic renewals, suspend call-offs, amend delivery instructions, block payments or notify suppliers that performance is under review. Finance, warehouse teams, and project managers should receive clear instructions because a central legal decision has little value if operational systems continue to process the affected contract automatically and routine workflows defeat the intended control.
The organisation should also assess continuity and value exposure. Where lawful performance can no longer continue, procurement may need an alternative supplier, emergency sourcing, stock reallocation or technical substitution. Public bodies must manage those steps in a manner consistent with procurement law and sanctions requirements. Private-sector organisations face the same commercial pressures without the same procurement law framework, but both should document why the chosen continuity response was necessary, proportionate and lawful.
Finally, contract drafting should anticipate legal change through sanctions clauses covering newly introduced restrictions, suspension, information, change control and termination. Clauses cannot guarantee continued performance, but they can reduce disagreement over process and evidence. The key principle remains statutory: a contract may allocate consequences between parties, yet it cannot compel conduct that later becomes prohibited or dispense with a licence that sanctions legislation requires.
Frozen Payments and Outstanding Invoices
A frozen payment is not the same as a cancelled debt. Where financial sanctions prevent payment to a designated person, the underlying invoice may remain contractually relevant even though funds cannot lawfully be transferred without an applicable exception or licence. Procurement and Finance should therefore separate accounting treatment from sanctions treatment, place affected sums under appropriate control, preserve supporting documentation and avoid describing non-payment as a contractual dispute when the immediate barrier is regulatory.
Sabre illustrates the point sharply. Ural Airlines made three payments linked to invoices totalling £744,305.13, and Sabre’s UK bank froze the payments. Sabre subsequently explored alternative methods of receiving money from the designated airline. OFSI regarded aspects of that conduct as circumvention. A blocked banking route should therefore trigger legal escalation, not a search for another account, intermediary or jurisdiction capable of completing payment.
There may be lawful routes for particular payments. OFSI can issue specific licences where a licensing ground exists, and general licences can authorise defined categories of activity without an individual application when their conditions are met. Legal-services payments provide a current example: General Licence INT/2026/9512597 permits qualifying payments to UK legal businesses or counsel from persons designated under specified autonomous regimes, subject to its detailed limits and requirements.
Procurement should maintain a schedule of frozen or unpaid amounts, identifying invoice dates, contractual basis, associated goods or services, responsible business owner and any licence application. Accruing interest, storage charges or contractual remedies should be reviewed with Legal rather than allowed to develop unnoticed. Where money is already frozen, Finance must preserve the relevant controls and reporting information while the organisation determines whether payment, release, return or continued freezing is legally permitted.
Existing Orders and Undelivered Goods
Existing purchase orders should be reviewed individually when sanctions are imposed, because different orders may be at different stages of performance. Some goods may be unmanufactured, others completed but unpaid, others in transit or held at customs. Procurement should map the title, possession, origin, destination, end user, payment status, and cancellation rights for each affected order. That transaction-level analysis is more reliable than assuming the entire contract either continues or must cease immediately.
The key question is what acts remain lawful. Cancelling an undelivered order may be straightforward in one case but involve payment, transfer of title, release of deposits or return of materials in another. Where a designated person is involved, economic resources and funds can be restricted. Procurement should therefore seek sanctions advice before releasing goods, accepting returned items, transferring ownership or agreeing compensation intended to settle an order affected by designation.
Goods restrictions can create separate exposure even where no party is designated. Current Russian statutory guidance explains that import prohibitions may apply to goods based on origin, location, or consignment, and can apply even where Russia is part of a wider transit route. A buyer reviewing an outstanding order must therefore assess both counterparty sanctions and the goods themselves, including commodity classification, origin, destination and any associated technical, financial or brokering services.
Where performance can lawfully continue under an exception or licence, the purchase order should record the authority relied upon and any operational conditions. Delivery teams should receive only the permissions relevant to their activity, and Finance should separately confirm whether payment is authorised. A licence allowing one step in a transaction does not necessarily authorise every connected act, particularly where financial and trade sanctions overlap, or more than one licensing authority has jurisdiction.
Where performance cannot continue, procurement should manage mitigation. Alternative suppliers, substitute specifications, use of existing stock and revised delivery priorities may reduce operational disruption. Contractual rights against the supplier should be considered, but sanctions may restrict how settlements or refunds can be received or paid. The objective is to preserve continuity without improvising around prohibitions, while retaining an audit trail showing how each outstanding order was assessed and resolved.
Licences, Exceptions and Seeking Regulatory Permission
A sanctions exception operates directly under legislation when its stated conditions are satisfied, whereas a licence grants permission for activity that would otherwise be prohibited. Procurement teams should not use the terms interchangeably. Before relying on either, the organisation should identify the precise prohibition, confirm that the exception or licensing ground applies, and record the evidence. Contractual urgency does not permit prohibited activity to begin while a required licence application remains undecided.
Licensing responsibility depends on the activity. OFSI licenses activity otherwise prohibited by UK financial sanctions. From 27 April 2026, OTSI’s expanded trade-sanctions remit includes licensing certain goods, technology, and related or standalone services that are not subject to strategic export controls, while ECJU remains responsible where relevant goods, software, or technology are also subject to strategic export controls. One transaction can therefore require consideration of more than one regulator or licence.
OTSI states that a licence must be obtained before prohibited activity occurs and that its standard maximum licence duration is 24 months, although exceptionally longer periods may be considered. A licence authorises only the named parties, activities and period covered and remains subject to its conditions. Procurement should therefore build licence references, expiry dates, reporting requirements and transaction limits into contract and purchase-order controls rather than keeping the licence solely within Legal.
Suspected Sanctions Matches – Stop, Investigate or Proceed?
A suspected sanctions match should trigger a proportionate investigation, not an automatic accusation or clearance. Screening systems generate false positives because names, transliterations, dates of birth and corporate identifiers can overlap. Procurement should temporarily prevent the relevant commitment, shipment or payment from progressing where necessary, then compare the candidate against authoritative identifiers. The objective is to establish whether the person or entity is genuinely the designated party or is legally owned or controlled by the designated party.
The UK Sanctions List is the official source for UK designations and, since 28 January 2026, newly designated persons subject to financial sanctions use the List’s Unique ID rather than receiving a new OFSI Group ID. Investigators should compare names alongside aliases, dates, addresses, nationality, registration information and other identifiers. A weak name-only process risks both false clearances and unnecessary disruption to innocent suppliers whose names happen to resemble those of listed persons.
Where the immediate supplier does not match, ownership and control must still be checked where relevant. Apple Distribution International’s £390,000 penalty arose from payments to Okko LLC, wholly owned by designated JSC New Opportunities. The case shows why “supplier not listed” is not equivalent to “transaction cleared”. Procurement should trace corporate relationships sufficiently to determine whether asset-freeze restrictions extend beyond the entity named on the sanctions list.
The decision to proceed should be documented. A clear false positive can normally be released once reasonable checks support that conclusion. An unresolved or probable match should remain escalated while Legal or Compliance assesses the restrictions, licences and reporting consequences. Procurement personnel should not override a hold because delivery is urgent, nor should they leave cases indefinitely unresolved when readily available evidence could distinguish an innocent supplier from a designated person.
Technology can help prioritise matches but cannot replace judgement. Bank of Scotland’s £160,000 OFSI penalty followed 24 payments totalling £77,383.39 involving a designated customer after an automated system failed to detect a spelling variation. Screening configurations, matching thresholds and data quality therefore need testing. Procurement should capture sufficient supplier identifiers at onboarding so investigators have more than a trading name when a potential match appears during tendering or payment.
Where a match indicates that prohibited activity may already have occurred, the process should shift from pre-transaction screening to incident management. Evidence must be preserved, further potentially prohibited activity stopped, senior stakeholders informed and reporting obligations assessed. Teams should avoid deleting records, altering explanations retrospectively or contacting counterparties in ways that could compromise an investigation. The organisation’s response after discovery can materially affect both regulatory assessment and its ability to explain what happened.
Internal Escalation and Decision-Making
Internal escalation should convert sanctions uncertainty into a controlled decision with named accountability. A practical model routes routine false positives to trained screening personnel, ownership questions to Compliance or Legal, payment concerns to Finance and complex trade restrictions to specialist sanctions or export-control advisers. Material cases should reach a senior decision-maker who can balance continuity, legal risk and operational consequences without allowing the commercial team responsible for delivery to determine the outcome alone.
Each escalation record should capture the trigger, transaction, counterparties, sanctions regime, checks performed, evidence reviewed, advice obtained and decision reached. It should also state whether orders, payments or deliveries were placed on hold and what conditions allow release. OFSI’s enforcement guidance places weight on risk-based due diligence and evidence of internal decision-making. A concise contemporaneous record is therefore more defensible than reconstructing an undocumented conversation months after a regulator asks questions.
Sabre demonstrates the consequences of weak governance. OFSI found that the company lacked effective senior oversight of sanctions and could not properly assess or mitigate its exposure after Ural Airlines was designated. The case was assessed as “most serious”, and a £1,000,920.59 penalty followed. Procurement escalation must therefore reach people who understand the legal issue and have authority to stop revenue-generating activity when the correct answer is commercially inconvenient.
Escalation should also specify who decides whether external legal advice, an OFSI or OTSI licence application, voluntary disclosure, or contact with a regulator is necessary. Different decisions may require different expertise, and the organisation should avoid forming a committee so large that no one takes ownership of the outcome. A defined sanctions lead, supported by functional specialists and senior governance for material cases, generally produces clearer accountability than informal consensus across multiple departments without documented authority.
Reporting Potential Breaches
When an organisation identifies a potential breach, it should first establish what activity occurred, which sanctions regime may apply, who was involved, when the conduct happened and whether it is continuing. Further potentially prohibited activity should be controlled while facts are preserved. Reporting should not be delayed merely to achieve perfect certainty; rather, the organisation should provide accurate information and distinguish facts from assumptions, unresolved matters, or preliminary legal conclusions.
A potential self-report should be coordinated through Legal or Compliance but supported by procurement evidence. Tender submissions, supplier declarations, purchase orders, invoices, screening records, correspondence, shipping documents, approvals and payment instructions may establish the sequence of events. OFSI’s reporting service asks organisations to prepare a narrative of the circumstances, while OTSI treats voluntary disclosure as a potential mitigating factor. Prompt preservation and coherent chronology can therefore materially improve the quality of any disclosure.
OFSI, OTSI and HMRC Reporting Responsibilities
UK sanctions reporting is divided among authorities based on the type of restriction and the activity involved. OFSI, within HM Treasury, receives reports concerning suspected breaches of financial sanctions. OTSI handles specified trade-sanctions matters, particularly sanctioned services and activity involving sanctioned goods or technology outside the UK. HMRC remains responsible for border-related trade sanctions, strategic export controls and criminal enforcement of all trade sanctions.
For financial sanctions, relevant firms must inform OFSI as soon as practicable when information obtained in the course of business gives them knowledge or reasonable cause to suspect that a person is designated or has breached specified sanctions obligations. Other organisations may report voluntarily. Procurement teams should therefore know whether their organisation falls within a mandatory-reporting category and ensure potential breaches discovered through tendering, payment or supplier management reach the responsible reporting function quickly.
OTSI’s remit differs. Providers of legal or financial services and money service businesses have mandatory reporting duties for suspected breaches within OTSI’s civil enforcement jurisdiction, while others may report voluntarily. During 2025–26, OTSI received 178 suspected-breach reports or referrals: 111 mandatory reports, 25 voluntary reports, 23 referrals from other government bodies and 19 from other sources. Russia accounted for 156 of those 178 recorded cases.
HMRC enforces trade sanctions where goods or controlled technology cross the UK border and is responsible for criminal enforcement of all trade sanctions. Its 2025–26 sanctions data recorded 58 seizures of sanctioned goods and 22 ongoing criminal investigations, with two cases awaiting trial following charging decisions. Procurement should not choose a reporting body by familiarity: the facts of the suspected activity determine whether OFSI, OTSI, HMRC or another competent authority is appropriate.
Voluntary Disclosure
Voluntary disclosure can materially affect regulatory treatment, but it should be prompt, accurate and supported by evidence. An organisation should not wait until every factual issue has been resolved before making initial contact where delay would be unreasonable. OFSI’s current guidance allows an early disclosure containing partial information, followed by a fuller account. Procurement’s role is to preserve the transaction history and ensure commercial teams do not reshape the record while facts are being established.
Since February 2026, OFSI’s revised enforcement framework has provided a Voluntary Disclosure and Co-operation discount of up to 30% of the baseline monetary penalty. A separate Early Account Scheme discount can reach 20%, while settlement attracts a 20% discount. Where more than one applies, discounts are added before application to the baseline penalty. Those incentives reward prompt self-reporting, complete factual accounts, and sustained cooperation, rather than disclosure made only after OFSI becomes aware of the case.
Historical enforcement still provides useful evidence of the value of disclosure. Herbert Smith Freehills CIS LLP Moscow received a £465,000 penalty in March 2025 for six payments totalling £3,932,392.10 to designated persons. HSF London voluntarily disclosed the breaches on its behalf, and OFSI applied a 50% reduction under the policy then in force. The current maximum voluntary-disclosure discount is lower, but cooperation remains a significant factor in enforcement outcomes.
OTSI likewise states that voluntary disclosure may mitigate civil enforcement. Its 2025–26 annual review recorded 25 voluntary breach reports among 178 reports or referrals received. OTSI had not imposed a civil monetary penalty by the end of that financial year, but it had numerous investigations at advanced stages. Businesses should therefore establish a reporting protocol before the first difficult case, including who authorises disclosure, who communicates with OTSI and who controls supporting evidence.
HMRC’s approach makes self-reporting equally tangible for trade and export-control breaches. During 2025–26, it received 29 voluntary disclosures concerning sanctions matters, issued 18 warning letters and 7 no-further-action letters, and made 1 compound-settlement offer arising from those disclosures. Separate HMRC guidance states that compound settlements may be appropriate where a breach was inadvertent or reflected internal control weaknesses, and the exporter voluntarily disclosed it, rather than deliberately seeking to evade controls.
Petrofac Facilities Management Limited provides a recent example. In June 2026, HMRC announced that the company had paid a £569,157 compound settlement for Russia sanctions breaches involving the export of sanctioned industrial goods and related technical assistance during the wind-down of its Russian operations. Petrofac self-reported and fully cooperated. Disclosure did not erase the breach or financial consequence, but it became part of the enforcement narrative and demonstrates why organisations should escalate suspected trade-sanctions failures rather than conceal them.
Preserving Evidence and the Audit Trail
Preserving evidence begins as soon as a sanctions concern becomes credible. Procurement should secure tender submissions, due-diligence files, supplier declarations, screening results, ownership records, purchase orders, invoices, shipping documents, payment instructions, approvals and relevant correspondence. Records should be protected from routine deletion or amendment while an investigation is active. The purpose is to preserve what decision-makers actually knew, when they knew it and what action they took, rather than reconstructing a cleaner story afterwards.
A defensible audit trail should connect evidence to decisions. Each escalation should record the potential match or risk trigger, sources checked, people consulted, legal analysis, approvals, transactions placed on hold and the reason for release or continued restriction. Organisations should preserve system logs where automated screening or workflow rules influenced the outcome. This creates evidence not merely that a check occurred, but that sanctions risk was interpreted and acted upon through an accountable process.
Contract Management and Periodic Re-Screening
Sanctions compliance must continue after contract award because designations, ownership structures, banks, logistics routes and sanctions legislation all change. Government guidance recommends repeating screening for existing partners and customers regularly and reassessing due diligence when circumstances change. Contract managers should therefore treat onboarding as the beginning of monitoring, not its conclusion. The frequency should reflect risk, with additional screening triggered by material events rather than relying only on a fixed annual review.
A practical monitoring schedule may combine routine re-screening with event-driven checks. High-risk suppliers could be screened more frequently than low-risk domestic providers. In contrast, all material suppliers should be reviewed whenever ownership changes, bank details are amended, new subcontractors are added, delivery countries change, or sanctions lists are updated. OFSI’s enforcement guidance specifically notes that ownership and control are not static and considers the regularity of checks when assessing whether due diligence was reasonable.
Monitoring should also extend beyond the supplier’s legal name. Ownership and control, payment banks, key subcontractors, manufacturers, freight providers and relevant end-users may each alter sanctions exposure without changing the prime supplier record. Procurement systems should therefore store enough structured information to support targeted re-screening. A contract manager who sees a new intermediary, bank or country should recognise that change as a potential sanctions trigger rather than merely a routine operational amendment.
The UK Sanctions List has been the sole official source of all UK sanctions designations since 28 January 2026, when OFSI’s former Consolidated List ceased to be updated. Organisations should ensure screening systems and procedures now draw from the correct source and use identifiers beyond names where appropriate. The Government makes the UK Sanctions List available in machine-readable CSV and text formats, as well as in PDF format, to support both automated screening and manual investigation of potential matches.
Periodic review should test the control framework itself. The Government’s sanctions guidance for non-UK businesses recommends spot checks, audits and post-transaction reviews, and advises businesses to map vulnerabilities repeatedly as customers, trade flows and circumvention techniques change. Procurement can apply the same logic domestically by sampling supplier files, overdue re-screenings, bank changes and high-risk purchase orders. Monitoring is credible only when management can demonstrate both that checks were scheduled and that exceptions were investigated.
Supplier Change Control
Supplier change control prevents sanctions risk from being altered silently after award. Contracts and procurement systems should identify changes that require notification or approval, including ownership, directors, legal name, registered address, bank account, manufacturing location, subcontractors, logistics routes, and end-users. The objective is not to control every administrative amendment, but to ensure that changes capable of affecting sanctions exposure generate a fresh assessment before the altered arrangement becomes operational or money begins to move.
The control should distinguish information changes from risk changes. A corrected postcode may require only record maintenance; a new parent company, payment intermediary, or manufacturing country may require re-screening and enhanced due diligence. Workflows should automatically route the latter to the appropriate reviewers and prevent affected transactions from progressing until they are cleared. Procurement should also capture the effective date, supporting evidence, approver, and reason for acceptance so that the organisation can reconstruct the decision if it is later challenged.
Government guidance highlights why this matters. It recommends repeating due diligence even for established trading partners and notes that changes in directors, organisational status or transactional patterns can indicate a significant shift in operations. Procurement should combine supplier notifications with independent monitoring because contractual notice obligations depend on the supplier recognising and disclosing the change. Public registries, screening providers and transaction data can reveal developments before a supplier formally communicates them.
Change control should also address emergency substitutions. A supplier facing disruption may propose a replacement manufacturer, freight forwarder or subcontractor with little notice. Commercial pressure can make that substitution appear necessary, but it can introduce an undisclosed sanctions nexus. The contract should permit rapid review rather than automatic refusal, and require sufficient information on identity, ownership, location, and role to enable procurement to determine whether the replacement is lawful, appropriately controlled, and consistent with the original risk assessment.
Monitoring Changes in Ownership and Corporate Structure
Ownership monitoring is essential because asset-freeze restrictions can extend to entities that are not themselves named on the UK Sanctions List. Under OFSI guidance, an entity may be owned or controlled where a designated person holds more than 50% of shares or voting rights, can appoint or remove a majority of the board, or can reasonably be expected to ensure that the entity’s affairs are conducted according to that person’s wishes.
Procurement should therefore monitor more than ultimate beneficial ownership percentages. Relevant indicators include changes to intermediate holding companies, shareholder agreements, voting arrangements, board appointment rights, trusts, nominees, and financing structures that can affect control. A supplier may remain legally incorporated under the same name while the underlying sanctions analysis changes materially. High-risk suppliers should be contractually required to promptly provide updated ownership charts and supporting documents following significant corporate events.
Independent verification is particularly important where ownership becomes more opaque shortly before or after a designation. Transfers between relatives, minority holdings combined with governance rights, nominee arrangements and rapid restructurings may require specialist review. None proves circumvention by itself. OFSI’s enforcement guidance expects reasonable, risk-based ownership-and-control due diligence. It places the burden on the person seeking mitigation to demonstrate that the conclusion reached was made in good faith and reasonably supported by evidence.
Monitoring should also capture acquisitions affecting subcontractors or parent groups, not just the contracting entity. A designated person acquiring control of a critical parent company may alter the supplier’s position; acquisition of a remote affiliate may not. Procurement needs a materiality framework capable of distinguishing those outcomes. Automated corporate data alerts can identify when a structure changes, but Legal or Compliance may still need to determine whether the statutory ownership or control tests are met.
The review cycle should be recorded explicitly. OFSI states that where relationships or activities are ongoing, due diligence assessments should be reviewed at appropriate times because ownership and control are not static. A defensible procurement file should therefore show the ownership information relied upon, the date last verified, the sources checked, the identified changes, and the resulting decision. Monitoring is weakest where the organisation can produce a historic ownership chart but cannot explain whether anyone checked that it remained accurate.
Training Buyers and Contract Managers
Training should enable buyers and contract managers to recognise when an ordinary commercial event becomes a sanctions issue. Core content should cover designation screening, ownership and control, restricted goods and services, country and end-use risk, bank changes, subcontractor substitutions, licensing, escalation and reporting. Staff do not need to become sanctions lawyers, but they must know which facts are material, what they may stop themselves and when specialist advice is required before a transaction progresses.
Training should be role-based rather than identical across the organisation. Strategic sourcing teams need deeper knowledge of due diligence and tender evaluation; purchase-to-pay teams need bank and beneficiary controls; contract managers need change monitoring; warehouse and logistics staff need destination and goods awareness. Senior approvers need enough understanding to challenge commercial pressure. Short scenario exercises that use actual supplier changes, blocked payments, and potential list matches are generally more useful than reading the annual policy alone.
Technology and Procurement Systems
Technology can embed sanctions controls into procurement at scale by connecting supplier onboarding, due diligence, purchase orders, contract management and payment workflows. Useful functions include automated list screening, ownership data integration, country and commodity flags, bank change approval, licence expiry alerts, and workflow holds. The system should capture evidence of the check and decision, not merely return a pass or fail result, so later reviewers can understand which data, rules and sanctions list version were applied.
The UK Sanctions List supports system integration because Government publishes it in CSV and text formats as well as PDF. Since 28 January 2026 it has been the sole official source for UK sanctions designations. Organisations that still rely operationally on the withdrawn OFSI Consolidated List risk screening against information no longer updated. System owners should therefore document source feeds, refresh frequency, failed-feed alerts and responsibility for verifying that updates have loaded correctly.
Procurement technology should integrate supplier master and transactional information. A supplier may pass onboarding but later request payment through a different bank, ship from another country or introduce a new subcontractor. Those changes should trigger workflow rules rather than remain isolated in emails. Connecting contract, purchase order, logistics, and accounts payable data allows the organisation to detect inconsistencies, such as a new country, beneficiary, or end-user that does not match the approved commercial arrangement.
System governance matters as much as functionality. Access rights should prevent unauthorised overrides, while configuration changes, screening thresholds and exception rules should be approved and logged. Periodic testing should use spelling variants, aliases, corporate identifiers, and known historical sanctions entries to confirm that expected alerts are triggered. OFSI’s Bank of Scotland enforcement shows that having automated screening does not establish effective screening if configuration or data prevents the relevant match from being recognised.
Technology should also support management evidence. Dashboards can show overdue screenings, unresolved matches, suppliers lacking ownership data, high-risk country exposure, bank changes awaiting verification and licences approaching expiry. These measures allow Procurement and Compliance to manage workload before individual exceptions become failures. Systems should nevertheless preserve the underlying documents and reasoning because a regulator investigating a transaction will need evidence of the actual decision, not simply a dashboard showing that a control once appeared green.
Automating Screening Without Automating Judgement
Automated screening is valuable because manual comparison of large supplier populations against frequently changing sanctions data is inefficient and inconsistent. Software can identify exact and fuzzy name matches, aliases, addresses and other identifiers at onboarding and throughout a relationship. It can also re-screen entire populations when lists change. The control becomes dangerous, however, when staff assume that the absence of an alert proves legality or that every alert means the supplier is genuinely designated.
Bank of Scotland provides the clearest recent warning. OFSI imposed a £160,000 penalty after 24 payments totalling £77,383.39 were made to a designated customer. Automated screening failed to detect a spelling variation in the designated person’s name. OFSI’s subsequent compliance guidance stated that automation is not a safety net. It urged businesses to consider spelling and transliteration variants, and to enrich screening and contingency procedures appropriate to their sanctions risk.
Human judgement is especially important for ownership and control. A screening engine may identify that an individual is designated, but determining whether that person controls an unlisted supplier can require analysis of indirect holdings, board rights, shareholder agreements and practical influence. Conversely, fuzzy matching can produce innocent false positives. Procurement should therefore distinguish automated detection from legal determination: technology raises cases, while trained personnel evaluate identity, relationship, transaction context and applicable restrictions.
Controls should also test the screening engine itself. Organisations should monitor false-positive rates, false-negative incidents, unresolved queues, feed failures and average investigation times, while periodically testing known names and variants. Excessive sensitivity can overwhelm reviewers and encourage superficial clearance; insufficient sensitivity can miss relevant parties. Tuning should therefore be risk-based and documented, with Compliance approving material configuration changes rather than leaving sanctions thresholds solely to software administrators.
Management Information and Sanctions Compliance KPIs
Sanctions management information should show whether controls are operating, where risk is concentrated and whether problems are being resolved. Useful indicators include the proportion of active suppliers screened on time, overdue ownership reviews, unresolved potential matches, average clearance time, high-risk suppliers, bank-detail changes, unapproved subcontractor changes, licence expiries, blocked transactions, training completion and reported incidents. KPIs should measure both control activity and outcomes rather than rewarding teams simply for processing high volumes of checks.
External enforcement data provides useful context for boards. OFSI recorded 394 suspected-breach cases in 2024–25 and had 240 active cases as of April 2025. It took 57 enforcement actions during that year, while 151 cases originated from non-self-reported sources, up from 108 previously. Financial services accounted for 142 recorded cases, legal services for 46, and cryptoassets for 40. Procurement leaders can use such data to challenge assumptions that sanctions exposure concerns only specialist exporters.
OTSI’s first full annual review adds a trade-sanctions benchmark. During 2025–26 it received 178 suspected-breach reports or referrals, of which 156 concerned the Russian regime. It closed 104 enforcement cases: 41 with no breach and no further action; 40 by referral to HMRC; 9 with no recordable activity; 7 by referral elsewhere; and 7 with no view on breach. Approximately 6% of cases opened were proactively initiated.
Internal KPIs should therefore include leading indicators, not merely confirmed breaches. A rising number of ownership changes, diverted shipments, manual screening overrides or transactions involving higher-risk jurisdictions may signal increasing exposure before any violation occurs. Procurement can combine those indicators with spend and supplier criticality to create a risk-weighted picture. A £5,000 low-value purchase involving sensitive technology can warrant greater attention than millions of pounds spent with transparent, low-risk domestic suppliers.
Metrics must also distinguish control effectiveness from workload. A high number of alerts may indicate effective detection, poor supplier data or badly calibrated screening. A very low number may reflect genuinely low exposure or a system that is missing risk. Management should therefore review trends, root causes, repeat exceptions and ageing alongside raw volumes. Sampling cleared alerts and completed due diligence files ensures that attractive headline percentages correspond to sound decisions beneath the dashboard.
Governance and Board-Level Oversight
Sanctions governance should provide the board with sufficient visibility to assess exposure without turning directors into transaction reviewers. Management should define risk appetite, allocate senior accountability, approve the sanctions framework and establish escalation thresholds for material incidents. Board reporting should cover significant suppliers, high-risk jurisdictions, unresolved matches, blocked transactions, licences, regulatory developments and remediation. The central question is whether governance can demonstrate that sanctions risk is understood, resourced, challenged and acted upon.
The scale of public purchasing makes senior oversight particularly important. Cabinet Office guidance published in 2026 describes UK public bodies as spending approximately £385 billion annually under the Procurement Act 2023 framework. Boards and equivalent governing bodies should therefore treat third-party compliance as part of stewardship, resilience, and value for money, not as a specialist legal issue detached from purchasing strategy, supplier dependency, or the continuity of essential public services.
Private-sector governance should follow the same principle of accountable ownership. OFAC’s widely used sanctions compliance framework identifies five essential components: management commitment, risk assessment, internal controls, testing and auditing, and training. Although it is US guidance, the structure provides a useful benchmark for multinational organisations. UK enforcement experience similarly shows that weak senior oversight can exacerbate exposure when operational teams continue activities after sanctions concerns have already become apparent.
Sabre Global Technologies Limited illustrates the governance consequence. OFSI imposed a £1,000,920.59 penalty in 2026 after continued services to the designated Ural Airlines and attempts to route payments. OFSI stated that Sabre lacked effective senior oversight and was unable to assess or mitigate sanctions risks properly. Board assurance should therefore test whether escalation genuinely stops questionable activity, rather than assuming policies, screening software or decentralised compliance teams will do so automatically.
Managing Conflicting UK, EU and US Requirements
Multinational procurement must identify which sanctions regimes apply to each transaction rather than indiscriminately applying a single global rule. UK sanctions can apply to UK-incorporated organisations and UK nationals abroad; EU measures bind EU operators within their legal scope; and US sanctions can apply through US persons, US jurisdiction, US financial channels, or other specified connections. Procurement should map contracting entities, personnel, currencies, banks, goods, technology and locations before determining the relevant compliance standard.
Ownership rules illustrate why the analysis cannot simply be copied between jurisdictions. UK financial sanctions can extend to an unlisted entity in which a designated person owns more than 50%, controls board appointments, or otherwise ensures its affairs are conducted in accordance with that person’s wishes. OFAC’s 50 Per cent Rule instead automatically blocks entities owned 50% or more in aggregate by blocked persons but does not block an entity merely because a blocked person controls it.
EU requirements add further differences. The European Commission’s Russia-sanctions FAQs were consolidated again on 24 August 2026, reflecting a framework that includes anti-circumvention duties, ownership analysis, sectoral restrictions and specific contractual obligations. Article 12g of Regulation 833/2014 requires a no-Russia clause in specified contracts concerning certain sensitive goods and technology. In contrast, the UK recommends comparable wording as due-diligence best practice but does not impose a universal statutory clause.
Conflicts can also arise because one jurisdiction licenses activity that another still prohibits. A UK licence does not constitute EU or US authorisation, and an OFAC licence does not release a UK person from UK restrictions. Procurement should therefore maintain a jurisdiction matrix for complex contracts, identify required approvals separately and avoid contractual wording promising performance whenever “a licence” is obtained without specifying which authority and which prohibited acts the permission actually covers.
The practical objective is not automatically to apply the strictest conceivable rule worldwide. That can create unnecessary de-risking, competition constraints and supply disruption. Instead, organisations should first identify mandatory legal obligations, then decide whether a consistent internal standard is commercially sensible. Where requirements genuinely conflict, Legal should document the issue, available restructuring or licensing options, prohibited workarounds and the approved path, while Procurement ensures suppliers and operational teams follow that decision.
When Banks, Insurers or Logistics Providers Refuse a Transaction
A bank, insurer or logistics provider may refuse a transaction even when Procurement believes it is lawful. UK Government guidance recognises that businesses may adopt cautious internal policies and decline to enter into relationships due to minority-sanctioned ownership, unresolved links, or broader de-risking concerns. Such refusal is therefore not proof of illegality, but it should not be treated as an inconvenience to be routed around. It is new risk information requiring investigation before alternative arrangements are considered.
The first response should be to establish the provider’s reason where it can lawfully be disclosed. The issue may concern a designated bank, vessel, insurer, end-user, commodity, destination or internal risk appetite rather than the supplier itself. Procurement should involve Finance, Legal, Compliance, and Logistics, preserve evidence of rejection, and recheck the entire transaction. If lawful alternatives exist, they should be independently assessed rather than selected simply because another provider is willing to proceed.
Sabre demonstrates the danger of confusing commercial obstruction with permission to find another route. After payments to the designated Ural Airlines account were blocked, Sabre explored receiving funds through a non-UK account and requested a test payment. OFSI treated that conduct as circumvention. A rejected payment, insurance placement or shipment should therefore strengthen escalation. Re-routing is acceptable only where the revised arrangement is independently lawful and is not designed to frustrate sanctions restrictions.
Sanctions and Business Continuity
Sanctions should form part of business continuity planning because a designation can remove a supplier, bank, carrier, insurer, or entire trade route with little warning. Procurement should identify contracts whose interruption would threaten safety, statutory services, production, revenue, or critical infrastructure, and then assess substitutability, stock coverage, technical dependencies, and mobilisation times. The objective is not to predict every designation, but to know which relationships could create disproportionate operational harm if sanctions suddenly prevent normal performance.
Public-sector guidance provides a practical model. PPN 007 requires in-scope organisations reviewing Russian or Belarusian suppliers to consider business criticality, switching costs, replacement timescales, intellectual property issues, and disruption to public services before termination. It also emphasises value for money and affordability. Those principles translate well beyond Russia: the sanctions response should preserve legal compliance while avoiding an unnecessarily abrupt decision that shifts risk from regulatory exposure to service failure.
Continuity planning should distinguish immediate controls from recovery actions. The organisation may need to stop payments or deliveries immediately while simultaneously preserving stock, securing data, protecting tooling and activating alternative sourcing. Contracts should support this through transition assistance, access to records, step-in arrangements where appropriate and rights over customer-owned materials. Procurement should also identify dependencies that remain with the sanctioned supplier after termination, including software licences, proprietary specifications, maintenance knowledge or specialist certification.
Inventory strategy may need adjustment for highly exposed categories. A low-risk domestic service can often be replaced quickly, whereas a specialist component requiring months of qualification may justify dual sourcing, safety stock or pre-approved alternatives. The cost of resilience should be compared with the likely disruption cost and legal exposure rather than treated as wasted duplication. Sanctions risk is therefore one input into broader supply-chain segmentation, alongside geopolitical, financial, quality and cyber risks.
Financial continuity matters as well. Alternative banks, currencies, or payment methods should be evaluated before a crisis arises, but contingency planning must never become a playbook for circumvention. Any fallback arrangement should preserve the transparency of the payer, payee, and underlying trade. Procurement and Treasury should know which critical suppliers rely on higher-risk financial institutions and whether lawful alternative banking channels genuinely exist, reducing pressure to improvise when a bank suddenly freezes or rejects a payment.
Business-continuity exercises should include sanctions scenarios. A useful simulation might designate a critical supplier’s parent company overnight, block its principal bank and strand goods already in transit. Teams should then test who stops orders, who assesses ownership, how stock is protected, which regulator or licence may be relevant and how replacement sourcing begins. Exercises reveal dependencies that policies often miss and provide senior management with evidence that the organisation can translate compliance decisions into operational action.
Finding Alternative Suppliers Following a Sanctions Event
Alternative sourcing following a sanctions event should begin as soon as continuity risk becomes credible, not only after termination. Procurement should define the affected specification, minimum service requirements, available stock, and replacement timescale, then assess frameworks, approved suppliers, market capacity, and technical substitutes. The replacement must itself undergo sanctions and broader due diligence; urgency does not justify onboarding a counterparty whose ownership, manufacturing route or payment arrangements are less transparent than those being replaced.
For public bodies, PPN 007 states that termination of Russian or Belarusian suppliers should proceed only where an alternative can be sourced in a way that is consistent with value for money, affordability, and minimal disruption to public services. Authorities should consider switching complexity, mobilisation time, intellectual property constraints, and effects on other contracts. Any replacement procurement must also comply with the Procurement Act 2023, including whichever competitive, direct-award or urgency provisions lawfully apply to the circumstances.
Supplier substitution should examine the whole delivery model rather than compare names and prices. A replacement manufacturer may use the same sanctioned sub-supplier, bank, technology licence or logistics route that created the original problem. Procurement should therefore map critical inputs, subcontractors, country of origin, end-users and payment infrastructure before award. Otherwise, the organisation may incur switching costs without actually removing the sanctions dependency that forced the change in the first place.
Commercial leverage can deteriorate rapidly during emergency sourcing. Buyers should therefore establish fallback suppliers, benchmark prices, and maintain technical documentation before sanctions disrupt the category when it is critical. Pre-qualified alternatives do not guarantee immediate availability, but they reduce mobilisation time and information asymmetry. Where practical, contracts can require suppliers to maintain contingency plans, disclose critical single-source dependencies and support orderly transition if sanctions make their continued involvement impossible.
Sanctions, Modern Slavery and Wider Responsible Procurement
Sanctions should not be managed in isolation from modern slavery, bribery, fraud, human-rights and wider responsible-procurement risks. The same opacity that conceals a designated owner can conceal forced labour, corrupt intermediaries or illicit sourcing. Procurement can therefore reuse core due diligence capabilities: supplier identity, beneficial ownership, geographic mapping, subcontractor visibility, adverse media review, contractual transparency, audit rights, and escalation. Integrated controls reduce duplication while preserving the different legal tests that apply to each risk area.
The Modern Slavery Act 2015 creates a useful governance parallel. Section 54 requires qualifying commercial organisations that carry on business in the UK, supply goods or services, and have an annual turnover of at least £36 million to publish an annual modern slavery statement. Government guidance expects coverage of supply chains, due diligence, risk assessment, effectiveness and training, with board approval and director-level sign-off. These disciplines complement sanctions governance even though the underlying legal obligations are distinct.
Public procurement increasingly links these issues. PPN 009, published for the Procurement Act 2023 environment, explains that certain Modern Slavery Act offences are mandatory exclusion grounds and encourages a proportionate assessment of suppliers’ supply chain controls. Sanctions screening and modern-slavery assessment should therefore share supplier intelligence where lawful and relevant. A high-risk manufacturing country may raise both concerns, but Procurement must still investigate the specific evidence rather than treating geographic risk as proof of either breach.
Responsible procurement also requires attention to unintended consequences. Abruptly terminating a supplier because of sanctions can shift production to less visible subcontractors, increase workers’ vulnerability, or create pressure to pursue unsafe sourcing. Conversely, refusing to act on sanctions because a supplier has strong labour standards would be legally indefensible. The organisation should manage each obligation separately, then coordinate remediation, continuity and supplier-change decisions so that solving one compliance problem does not unnecessarily create another.
An integrated approach is particularly valuable for management information. Supplier criticality, ownership opacity, high-risk geography, labour-risk indicators, adverse media and financial anomalies can be combined to prioritise deeper review. However, scores should direct attention rather than determine guilt or automatic exclusion. Procurement remains responsible for applying the correct legal and evidential test to the issue identified. Responsible sourcing works best when shared data supports specialised judgement rather than collapsing different risks into one generic rating.
Building an Integrated Third-Party Due Diligence Model
An integrated third-party due diligence model should create a single reliable supplier profile that different compliance disciplines can work from. Core data should include legal identity, ownership, directors, jurisdictions, bank accounts, subcontractors, products, services, end-users and critical logistics relationships. Sanctions, modern slavery, anti-bribery, fraud, tax, cyber, and financial-risk teams can then apply their own tests to consistent information, reducing the need for repeated questionnaires and the risk that one department knows something another never sees.
Risk segmentation should determine depth. A transparent UK professional services supplier may require straightforward screening. At the same time, an international distributor of sensitive technology through multiple intermediaries may require ownership tracing, export-control checks, end-user verification and enhanced adverse-media research. The model should distinguish inherent risk from residual risk after controls, identify mandatory escalation triggers and define re-screening frequency. This prevents high-risk suppliers from receiving the same superficial treatment as routine low-risk vendors.
Workflow design is critical. Procurement should capture due diligence evidence once, route specialist questions to the correct function, and prevent award when mandatory approvals remain outstanding. Changes in ownership, bank details, destination, or subcontracting should automatically reopen the relevant parts of the assessment. A supplier should not need to complete the entire onboarding process whenever a single fact changes, but neither should a material change fall outside the control framework simply because the original file was marked complete.
The model should also create a single audit trail. Screening results, beneficial ownership evidence, modern slavery assessments, licence information, approvals, remediation actions, and supplier correspondence should be retained with clear dates and ownership. Access can remain role-based where confidentiality requires it. The objective is not to expose every compliance record to every buyer, but to ensure decision-makers can see whether material issues exist and investigators can reconstruct how the organisation reached its conclusion.
Technology can support integration, but governance determines whether it works. Data feeds may identify sanctions designations, corporate changes or adverse events, yet human reviewers must determine significance. Common risk taxonomies and supplier identifiers help systems connect information that would otherwise remain fragmented. Management should periodically test whether alerts reach the right teams, whether duplicate supplier records obscure exposure, and whether remediation actions are actually closed before new transactions are permitted.
A mature model ultimately reduces supplier burden and compliance risk. Instead of separate annual questionnaires from Procurement, Compliance, Sustainability, and Finance, suppliers can maintain a controlled core profile and respond to targeted questions based on their risk. That improves data quality and makes material changes more visible. Integration should therefore be measured not by the number of checks completed, but by whether the organisation can consistently identify, explain, and act on third-party risk.
Case Study – A Supplier Becomes Designated During a Contract
Sabre Global Technologies Limited provides a clear example of a counterparty becoming sanctioned during an established commercial relationship. Sabre had supplied travel-technology services to Ural Airlines since 2007. The UK designated the airline on 19 May 2022, and Sabre was notified that day. The relationship therefore moved instantly from ordinary contract management into sanctions control, requiring the company to reassess continued services, payments and the legal consequences of existing obligations.
OFSI found that Sabre nevertheless continued providing access to its Global Distribution System for seven months after designation. When payments to Sabre’s UK bank were blocked, the company explored alternative routes and asked Ural Airlines to make a test payment to a non-UK account. OFSI concluded that the conduct included circumvention and imposed a £1,000,920.59 monetary penalty in 2026. The case was assessed within OFSI’s “most serious” category.
The procurement lesson is that designation must trigger a coordinated stop-and-assess procedure. Contract managers should identify open orders and services; Finance should control payments; Legal should determine the consequences of asset freezing; and Procurement should consider suspension, termination, and replacement supply. Existing contractual history does not create permission to continue. The organisation also needs a clear prohibition on operational teams creating alternative payment or delivery arrangements before specialists have confirmed that the revised route is lawful.
Case Study – Procurement Discovers a Sanctioned Beneficial Owner
Apple Distribution International Limited demonstrates how sanctions exposure can sit behind an apparently unlisted counterparty. OFSI imposed a £390,000 penalty in March 2026 after Apple Distribution International made two payments totalling £635,618.75 to Okko LLC. Okko was wholly owned by JSC New Opportunities, which was designated as a person. The immediate recipient, therefore, could not be safely assessed by name alone; ownership changed the transaction’s legal character.
For Procurement, the case demonstrates why beneficial-ownership information must be operational rather than decorative. Supplier onboarding should identify direct and indirect owners, and higher-risk relationships should be re-screened when ownership changes, or new designations occur. A system that screens only the contracting entity can remain green while the underlying owner becomes sanctioned. The supplier file should therefore link ownership data to ordering and payment controls, so that significant changes can automatically interrupt transactions.
The UK ownership-and-control test is wider than a simple beneficial-owner percentage. An entity can be subject to financial sanctions where a designated person holds more than 50% of shares or voting rights, can appoint or remove a majority of the board, or can otherwise ensure its affairs are conducted according to that person’s wishes. Procurement teams should therefore escalate governance and control indicators even where the shareholding figure alone appears below a majority.
The case also reinforces the importance of independent corroboration. Supplier declarations can provide useful evidence, but corporate registries, ownership databases, constitutional documents and reliable open-source material may be necessary where risk is material. Procurement should preserve the ownership position relied upon at award and record subsequent reviews. If the organisation later seeks mitigation from OFSI, it may need to demonstrate that its ownership-and-control conclusion was reasonable, proportionate and reached in good faith.
Practical Scenario – A Supplier Requests Payment Through a New Intermediary
A supplier that suddenly requests payment through a new intermediary should trigger enhanced verification, particularly where that entity has no obvious connection with the contract. The arrangement may be legitimate, such as factoring, treasury centralisation or an authorised payment agent, but it changes the transaction that was originally assessed. Procurement and Finance should establish who will receive the money, why the structure has changed and whether the proposed route remains lawful.
The organisation should independently verify the intermediary’s legal identity, ownership, bank account, jurisdiction and relationship with the supplier before changing payment instructions. Documentary evidence might include an assignment notice, a factoring agreement, an agency appointment, or another document that explains the intermediary’s authority to receive funds. Confirmation should also be obtained through an established supplier contact rather than relying solely on details provided in the payment-change request, particularly when the amendment is unexpected or urgent.
Additional scrutiny is justified where the intermediary is newly incorporated, located in an unrelated jurisdiction, owned through an opaque structure, or associated with a bank or payment route that presents elevated sanctions risk. A similar concern arises where invoices are split, payment is repeatedly redirected, or the supplier cannot provide a credible commercial explanation. These factors do not establish circumvention on their own, but collectively they may justify pausing payment and escalating the transaction for specialist review.
Recent UK enforcement illustrates why alternative payment arrangements require particular care. After payments associated with designated Ural Airlines were blocked, Sabre Global Technologies Limited explored alternative payment routes and requested a test payment to a non-UK account. OFSI subsequently treated aspects of the conduct as circumvention. The lesson is broader than that specific case: a blocked or problematic payment should prompt legal analysis rather than an operational search for another route for funds to move.
Where the explanation remains implausible, or the proposed structure appears designed to avoid sanctions restrictions, payment should remain suspended. At the same time, Legal or Compliance determines the appropriate response and any reporting obligations. Procurement should preserve the original request, supporting documents, correspondence, screening results and approval record. The objective is not to find a route that can process the payment, but to determine whether the revised transaction can proceed lawfully and transparently.
A Practical Procurement Sanctions Control Framework
A practical procurement sanctions framework can be organised around three questions: who is involved, what is being supplied and how the transaction will occur. The first covers suppliers, owners, subcontractors, banks, and end-users; the second covers goods, technology, services, and origin; the third covers destination, logistics, payment, and contractual performance. Procurement should capture enough structured information at each stage to answer these questions before commitment and whenever material facts later change.
Planning should establish inherent sanctions risk before tendering begins. Buyers should identify sensitive jurisdictions, restricted categories, likely supply routes and critical dependencies, then specify which checks and approvals will be required. Pre-qualification should verify legal identity and ownership, while tender documents should obtain subcontractor, origin, bank, end-use and compliance information proportionate to the requirement. High-risk findings should trigger enhanced due diligence before award rather than being deferred to contract management.
The contract should then convert due diligence into continuing obligations. Appropriate provisions include sanctions compliance warranties, ownership notifications, subcontractor flow-down, origin transparency, end-use restrictions, no-re-export terms where relevant, audit rights, record-keeping, cooperation, suspension and termination. Clauses should create enforceable information and remedy rights without implying that statutory liability has been transferred. Contractual protection is strongest when it enables the organisation to detect and respond to change quickly.
Purchase-to-pay controls should reassess transaction-specific facts. Purchase orders can capture destination, manufacturer, end-user and licence information, while Finance verifies beneficiaries, banks and material account changes before release. Automated screening can identify potential matches, but trained personnel must resolve issues of identity, ownership, and control. Any blocked payment, unusual intermediary, or last-minute routing change should trigger an escalation rather than prompting operational staff to search for another channel.
Contract management completes the control cycle through periodic re-screening, ownership monitoring, supplier change control and licence tracking. Management information should expose overdue reviews, unresolved matches, high-risk suppliers, blocked transactions and significant incidents. Testing should sample both successful and cleared transactions to determine whether controls work in practice. A sanctions programme is defensible only when the organisation can show not merely that policies existed, but that they influenced actual procurement decisions.
The framework should remain proportionate. Low-risk domestic purchasing does not require the same evidence as sensitive international trade, while higher-risk activity should receive deeper scrutiny and senior approval. OFSI’s enforcement guidance expressly considers the degree of sanctions risk and the reasonableness of due diligence. The strongest procurement model is therefore neither minimal nor indiscriminate: it directs resources toward transactions in which errors could have the greatest legal, financial, operational, or reputational consequences.
Summary – Compliance From Sourcing to Final Payment
Sanctions compliance in procurement is a continuous control process that extends from market planning to final payment and beyond. It begins by understanding counterparties, ownership, goods, services, countries, banks and end-users, then translating that understanding into tender questions, evaluation, contractual obligations and approval routes. The same information must remain up to date throughout the performance because sanctions status, corporate ownership, subcontractors, logistics, and payment arrangements can change even after the most thorough initial due diligence.
The strongest control is early intervention. Procurement can reject an unacceptable risk before dependence forms, require enhanced evidence before award and design contracts that preserve information, suspension and termination rights. Once goods are in transit, services have been delivered, or invoices are blocked, choices narrow and become more expensive. Effective sanctions management therefore belongs inside commercial decision-making rather than being treated as a legal review conducted after the organisation has already committed itself.
Recent UK enforcement demonstrates how varied failures can be. Sabre’s £1,000,920.59 penalty involved continued services and attempted circumvention; Apple Distribution International’s £390,000 penalty demonstrated ownership risk; Colorcon’s £152,750 penalty exposed designated-bank risk; and Citibank’s £4,732,830.58 penalty showed that sophisticated financial institutions remain vulnerable. These cases collectively confirm that sanctions compliance depends on the whole transaction, not merely whether the supplier’s trading name appears on a list.
For public bodies, the implications are especially significant because UK public procurement represents approximately £385 billion annually. For private organisations, the same controls protect access to markets, banks, insurers, customers and supply continuity. In both sectors, the objective is a defensible record: proportionate risk assessment, verified due diligence, informed approval, effective contractual controls, transaction screening, monitoring and prompt response when circumstances change. Compliance depends on procurement decisions being commercially disciplined and legally aware.
Additional articles can be found at Commercial Management Made Easy. This site looks at commercial management issues to assist organisations and people in increasing the quality, efficiency, and effectiveness of their products and services to the customers' delight. ©️ Commercial Management Made Easy. All rights reserved.
Sources and Further Reading
This article draws on the following primary sources, consulted and verified during drafting. Readers seeking the full legal or statistical detail behind the key statements above should refer directly to the guidance, legislation and enforcement notices listed below.
HM Treasury, Office of Financial Sanctions Implementation, ‘Financial Sanctions General Guidance’, available at GOV.UK.
Financial Sanctions General GuidanceHM Treasury, Office of Financial Sanctions Implementation, ‘Financial Sanctions Enforcement and Monetary Penalties Guidance’, available at GOV.UK.
Financial Sanctions Enforcement and Monetary Penalties GuidanceHM Treasury, Office of Financial Sanctions Implementation, ‘OFSI Annual Review 2024 to 2025: Effective Sanctions’, available at GOV.UK.
OFSI Annual Review 2024 to 2025: Effective SanctionsHM Treasury, Office of Financial Sanctions Implementation, ‘Enforcement of Financial Sanctions’ — collection of monetary penalty notices, including those against Citibank, N.A., London Branch; Sabre Global Technologies Limited; Colorcon Limited; Bank of Scotland plc; Apple Distribution International Limited; Herbert Smith Freehills CIS LLP; and Svarog Shipping & Trading Company Limited — available at GOV.UK.
Enforcement of Financial SanctionsDepartment for Business and Trade, Office of Trade Sanctions Implementation, ‘Trade, Aircraft and Shipping Sanctions, Civil Enforcement: Guidance’, available at GOV.UK.
Trade, Aircraft and Shipping Sanctions, Civil Enforcement GuidanceHM Revenue & Customs, ‘Sanctions Enforcement: Technical Note’, available at GOV.UK.
Sanctions Enforcement: Technical NoteHM Government, ‘UK Government’s Strategic Approach to Sanctions Enforcement’, policy paper, available at GOV.UK.
UK Government’s Strategic Approach to Sanctions EnforcementProcurement Act 2023, available at legislation.gov.uk.
Procurement Act 2023Cabinet Office, ‘PPN 007: Contracts with Russia and Belarus’, available at GOV.UK.
PPN 007: Contracts with Russia and BelarusDepartment for Business and Trade, Office of Trade Sanctions Implementation, ‘OTSI Annual Review 2025 to 2026’, available at GOV.UK.
OTSI Annual Review 2025 to 2026Foreign, Commonwealth & Development Office, ‘The UK Sanctions List’, available at GOV.UK.
The UK Sanctions ListForeign, Commonwealth & Development Office, ‘UK Sanctions Guidance for Non-UK Businesses’, available at GOV.UK.
UK Sanctions Guidance for Non-UK BusinessesHM Government, ‘No-Russia Clause Guidance’, available at GOV.UK.
No-Russia Clause GuidanceCrown Commercial Service, ‘The Public Sector Contract – General Terms’, available at GOV.UK.
The Public Sector Contract – General TermsCabinet Office, ‘PPN 009: Tackling Modern Slavery in Government Supply Chains’, available at GOV.UK.
PPN 009: Tackling Modern Slavery in Government Supply ChainsModern Slavery Act 2015, available at legislation.gov.uk, and Home Office, ‘Transparency in Supply Chains (TISC): Statutory Guidance’, available at GOV.UK.
Modern Slavery Act 2015
Transparency in Supply Chains: Statutory GuidanceUS Department of the Treasury, Office of Foreign Assets Control, ‘A Framework for OFAC Compliance Commitments’, and OFAC’s ‘50 Percent Rule’ guidance, available at treasury.gov.
A Framework for OFAC Compliance Commitments
OFAC 50 Percent Rule GuidanceCouncil Regulation (EU) No 833/2014 concerning restrictive measures in view of Russia’s actions destabilising the situation in Ukraine, available at EUR-Lex, and the European Commission’s consolidated FAQs on sanctions against Russia and Belarus.
Council Regulation (EU) No 833/2014
European Commission – Consolidated FAQs on Sanctions Against Russia and Belarus