Sanctions compliance has undergone a fundamental shift. What was once treated as a peripheral element of AML frameworks is now emerging as a standalone, board-level risk discipline, with distinct enforcement thresholds, governance expectations, and personal liability implications.
This evolution was a central theme at Sanctions Compliance Nexus 3.0, where regulators and practitioners alike emphasised that sanctions failures are no longer viewed as technical lapses, but as systemic control failures.
From AML Adjunct to Independent Risk Pillar
One of the most recurring issues identified during supervisory inspections is that many firms still embed sanctions compliance within broader AML policies. This approach is increasingly insufficient. Sanctions risk involves different triggers, different escalation timelines, and often immediate legal consequences, particularly in the context of asset freezing, transaction blocking, and contract termination.
Firms are now expected to maintain stand-alone sanctions risk assessments, supported by clear customer acceptance criteria and ongoing screening frameworks that operate independently of AML transaction monitoring.
The Shift in the Burden of Proof
Perhaps the most consequential development discussed was the shifting burden of proof. In enforcement proceedings, officers of legal entities may now be personally liable for breaches that occurred during their tenure unless they can demonstrate that adequate policies, procedures, and controls were in place and operating effectively.
This represents a move away from reactive enforcement and toward preventive accountability, where governance failures can no longer be defended on the basis of intent alone.
Enforcement, Proportionality, and Efficiency
New enforcement thresholds, such as the €10,000 differentiation between administrative and criminal liability, are designed to increase judicial efficiency while still preserving deterrence. Combined with deferred prosecution agreements and out-of-court settlements, regulators are signalling a preference for rapid remediation and compliance uplift, rather than prolonged litigation for control failures.
This does not, however, imply leniency. Firms that fail to engage proactively with supervisory authorities or refuse to provide information may face escalating penalties.
Control Over Ownership
A particularly important insight relates to the concept of control, which increasingly extends beyond shareholding. Sanctions exposure may arise through debt dependency, veto rights, proxies, trusts, SPVs, or other mechanisms that traditional screening tools are not designed to detect.
As a rule of thumb, where a structure is unnecessarily complex and lacks a clear commercial rationale, it should be treated as a red flag rather than a puzzle to be solved.
Key Takeaway
Sanctions compliance is no longer about identifying names on lists. It is about demonstrating effective control frameworks, clear escalation paths, and board-level ownership of risk. Firms that continue to treat sanctions as a subsection of AML policies are likely to find themselves on the wrong side of supervisory expectations.
