Sanctions checks in vendor due diligence: what to screen and what to keep

In vendor due diligence, the sanctions check answers one question: may we pay this business at all? Screen the vendor's legal and trading names against OFAC's SDN and Consolidated lists, screen its significant owners, and note the countries it operates from and is paid in. OFAC's compliance framework lists due diligence on customers, supply chain, intermediaries and counter-parties as a fundamental part of a sanctions program, and names incomplete ownership checks as a root cause of past violations (OFAC framework).

Where sanctions sit among the other checks

Vendor due diligence usually covers several questions. Sanctions is the one that can make a payment illegal regardless of how good the vendor is.

Check	Question it answers	Can it block a payment outright?
Identity and registration	Is the vendor who it says it is?	Not on its own
Bank account verification	Will the money reach the vendor?	Not on its own
Financial health	Will the vendor still be here next year?	No
Sanctions screening	Are we allowed to deal with this party?	Yes

That is why the sanctions result belongs in the approval, not in a report someone reads later.

Three things to screen

The vendor. Its legal name and every trading name you know. Listed parties often carry several aliases, and OFAC's method for checking a hit compares the full list entry, including aliases, addresses and identifiers, with what you know (OFAC FAQ 5).

Its owners. An entity owned 50 percent or more, directly or indirectly, by one or more blocked persons is blocked, even if the entity is not named on any list (OFAC FAQ topic 1521). Stakes held by different blocked persons are added together (OFAC FAQ 399), and ownership through intermediate companies counts (OFAC FAQ 401). An entity that is controlled, but not 50 percent owned, by blocked persons is not automatically blocked; OFAC still advises caution with it (OFAC FAQ 398).

Its people. Even when the entity is not blocked, a blocked individual cannot act for it in a deal with you. OFAC says sanctions generally prohibit transactions involving a blocked person even when that person acts for a non-blocked entity, and that U.S. persons may not, for example, enter into contracts signed by a blocked individual (OFAC FAQ 400). Screen the signatory and the main contact.

Scale the effort to the risk

OFAC expects a risk-based program sized to the business. Its framework suggests the risk assessment look at customers, supply chain, intermediaries and counter-parties, the products and services involved, and the geographic locations of the organization and its partners (OFAC framework). In practice:

A domestic office-supplies vendor: screen the name, file the result.
A vendor paid abroad, or one with owners you cannot see: screen the owners and the bank country as well.
A vendor that changed owners or bank details: screen again before the next payment.

Write the tiers into your policy so the same vendor gets the same treatment whoever onboards it. Our compliance program template has a place for this.

What the file should contain

The screening date and the list versions used.
The names, owners and people screened.
Each candidate, who reviewed it, the decision and the reason.
The ownership evidence you relied on, such as a registry extract or a signed ownership statement.

OFAC requires anyone engaging in a transaction subject to its rules to keep a full and accurate record of it for at least 10 years (31 CFR 501.601). The due diligence file is the part of that record that shows you looked before you paid.

After approval

Due diligence is a point-in-time check. OFAC's lists change often, and the framework names failure to update screening for new SDN list entries as a root cause of violations (OFAC framework). Put approved vendors on a re-screen schedule; see how often to re-screen and screening the whole vendor master file.

This is screening data, not legal advice. Run a free OFAC check on the vendor, its owners and its signatory before you approve it.