Why Sanctions Exist

Sanctions are restrictions that governments and international bodies place on specific countries, organisations and individuals to achieve a foreign policy or security goal without using military force. A sanctioned party cannot freely access the global financial system, so banks become the enforcement point. When a payment mentions a sanctioned person or country, the bank must stop it, freeze the funds or refuse the transaction entirely, depending on the programme. This is why sanctions screening sits at the heart of every payment operation, not in some distant compliance corner. A single missed payment can expose a bank to criminal liability, so screening is treated as a hard control that cannot be bypassed for speed or customer convenience. Sanctions programmes differ in scope and in who must follow them. The United States Office of Foreign Assets Control, known as OFAC, runs programmes that apply to US persons and to any transaction in US dollars, which in practice means almost every cross border payment touches OFAC rules because dollars clear through the United States. The United Nations Security Council issues sanctions that member states must implement, while the European Union runs its own consolidated list that binds banks operating in the EU. A bank in India handling a payment for a European client may therefore need to screen against OFAC, UN and EU lists at the same time, and the strictest rule wins whenever the lists disagree. For a business analyst, the practical point is that sanctions are not a policy document, they are a live data problem inside the payment flow. Lists change frequently, sometimes several times a week, when new names are added or existing entries are amended. Screening engines must consume those updates quickly and apply them to payments already in flight as well as new ones. Requirements work in this area therefore covers list ingestion, screening timing, alert handling, audit trails and the exact wording of customer communications when a payment is delayed or blocked. A BA who understands this can write requirements that compliance teams will actually accept. The typology that every screening analyst must know is the use of a front company. A sanctioned entity sets up a company in a third country, with a nominee director and a bank account, and routes payments through it. The payment looks legitimate: the payer is a trading company, the beneficiary is a supplier, the amount is plausible, and the goods are described. The screening system does not flag it, because the names do not match any list. The typology is only caught when an analyst notices that the trading company has no website, no employees, and a registered address that is a mailbox, and that its payments always go to the same small set of beneficiaries. The lesson is that list matching catches the obvious cases, and typology awareness catches the rest. The Office of Foreign Assets Control 50 percent rule is the most commonly missed screening requirement. OFAC's rule states that a company owned 50 percent or more, in aggregate, by one or more blocked persons is itself blocked, even if it is not named on any list. A payment to a company owned 30 percent by one blocked person and 25 percent by another is a payment to a blocked company, because the aggregate ownership is 55 percent. The screening system must therefore have ownership data, not just names, and the analyst must be able to trace the ownership chain. A bank that screens only the names on the payment will miss the 50 percent rule entirely. Screening configuration is a set of decisions that the business analyst must specify. The first is which lists to screen against: the UN list, the EU list, the US OFAC list, the UK list, and any local lists. The second is which fields to screen: the payer, the beneficiary, the banks, the remittance information, and the free-text fields. The third is the matching threshold: how close a name must be to a list entry before it generates an alert. A threshold that is too loose generates thousands of false positives a day, and a threshold that is too tight misses true hits. The threshold must be tuned, tested, and documented, and the tuning must be reviewed quarterly.