Sanctions regime – Why firmwide risk assessments are a must

The UK sanctions regime applies to every law firm—not only practices acting for international or high-net-worth clients.

A firm-wide sanctions risk assessment helps a practice identify where it could encounter a designated person, frozen asset or prohibited transaction. It should also explain the controls used to reduce those risks.

Is a sanctions risk assessment compulsory?

The SRA states that a separate sanctions risk assessment is not compulsory. It nevertheless recommends one as good practice, particularly for firms with greater sanctions exposure.

This distinction is important. The sanctions regime operates on a strict-liability basis. A firm may therefore breach a prohibition unintentionally.

A risk assessment does not provide a defence to a breach. It can, however, help a firm identify its vulnerabilities, introduce appropriate preventative controls and demonstrate how sanctions risks are being managed.

What should a sanctions risk assessment cover?

The assessment should reflect the work the firm actually undertakes. Relevant factors may include:

• the firm’s clients and beneficial owners;
• the jurisdictions connected with its clients and transactions;
• high-value property or corporate transactions;
• international and third-party payments;
• trust and company service work;
• complex or opaque ownership structures;
• high-net-worth and politically connected clients;
• the services offered by the firm;
• how instructions are received and delivered;
• the firm’s use of agents or intermediaries; and
• the effectiveness of its screening and escalation procedures.

The size of the firm is relevant, but it does not determine whether sanctions risk exists. A small practice undertaking high-value conveyancing or handling international funds may face material exposure even if it has relatively few clients or employees.

Screening technology is part of the risk

A firm should not simply record that it conducts electronic sanctions checks. It should understand how the screening system works, what information it uses and how potential matches are investigated.

The £160,000 OFSI penalty imposed on Bank of Scotland provides a practical example. An automated screening system failed to identify a designated person because the name appearing on a British passport differed from the name captured in the sanctions data.

The case demonstrates why a successful electronic check should not automatically be treated as conclusive. The firm should understand whether its system can address:

• alternative spellings;
• known aliases;
• names transliterated from another alphabet;
• different name orders;
• incomplete dates of birth or other identifiers; and
• corporate ownership and control relationships.

Our analysis of the Bank of Scotland sanctions fine considers the resulting lessons for law firms, including name matching, escalation, training and voluntary disclosure.

Is your firm using the correct sanctions list?

Since 28 January 2026, the UK Sanctions List has been the single current source for UK sanctions designations.

The former OFSI Consolidated List is no longer updated and remains available only for reference purposes.

A firm’s assessment should therefore consider whether:

• its screening provider uses the current UK Sanctions List;
• policies and training materials contain the correct links;
• staff understand that the former Consolidated List is no longer a current screening source;
• designation data is incorporated promptly into the firm’s screening system; and
• the firm is notified when its provider materially changes its data or matching system.

Questions the assessment should answer

A useful sanctions risk assessment should enable the firm to answer the following questions:

1. Who must be screened?
2. At what stage should the screening take place?
3. When should clients and relevant parties be rescreened?
4. How are spelling, alias and transliteration variations handled?
5. Who investigates and clears a potential match?
6. How does the firm investigate beneficial ownership and control?
7. How are third-party payments assessed?
8. What evidence of the check and decision is retained?
9. How are staff trained to recognise and escalate concerns?
10. What happens if a possible sanctions breach is identified?

If the firm cannot answer these questions clearly, the risk assessment may be describing an intention rather than an operational control.

PEP and sanctions screening are not the same

A politically exposed person is not necessarily subject to sanctions. Equally, a person should not be assumed to fall outside the sanctions regime merely because a PEP check returns no match.

The two checks serve different purposes:

• PEP screening helps identify the heightened corruption and bribery risks associated with particular public functions and relationships.
• Sanctions screening helps identify people and entities subject to restrictions imposed under sanctions legislation.

A screening provider may check both datasets, but the firm should understand how the results are distinguished, assessed and recorded.

Connect the assessment to everyday decisions

The sanctions risk assessment should inform the firm’s policies, controls and procedures. Fee earners may also need to consider it when completing client and matter risk assessments.

For example, a conveyancing matter involving an overseas company, complex beneficial ownership and third-party funds may require different controls from a straightforward domestic transaction involving individuals whose identity and funding arrangements are readily established.

The risk assessment should help staff understand:

• when additional information is required;
• when a matter must be escalated;
• who can approve a higher-risk matter;
• how potential matches must be recorded;
• when ongoing or repeat screening is appropriate; and
• what steps must be taken if a possible breach is identified.

When should the assessment be reviewed?

The sanctions risk assessment should not remain unchanged simply because it was accurate when first approved.

A review may be required where:

• the firm begins offering a new service;
• its client or geographic profile changes;
• it opens another office or changes its working arrangements;
• a new screening provider or case-management system is introduced;
• the sanctions regime or official guidance changes;
• a weakness is identified during file review or audit;
• the firm encounters a potential match or suspected breach; or
• staff demonstrate uncertainty about the firm’s procedures.

The review should be recorded, even where the conclusion is that no substantive changes are required.

From written assessment to effective controls

A well-written risk assessment is the starting point. It is not proof that the firm’s sanctions controls are operating effectively.

The firm should be able to demonstrate that:

• staff have received relevant and current training;
• screening is performed at the required stage;
• alerts are investigated consistently;
• decisions are supported by retained evidence;
• higher-risk matters receive appropriate oversight; and
• identified weaknesses are corrected and retested.

Official guidance

The SRA’s guidance should be consulted when preparing or reviewing the assessment:

• SRA guidance on sanctions regime firm-wide risk assessments
• SRA guidance on complying with the UK sanctions regime
• Search the UK Sanctions List

This article provides general compliance information and does not constitute legal advice. Sanctions legislation and official guidance change, and the current requirements should always be checked.