Sanctions compliance for small businesses: a practical guide

Sanctions compliance for a small business comes down to three jobs. Check every vendor and customer against the sanctions lists that apply to you, before money moves and again when the lists change. If you find a real match, stop the deal, freeze what you hold, report it, and keep a dated record of every check.

No country covered here exempts small firms. This guide covers the US, the UK, the EU and Australia. It explains who each set of rules reaches, how liability works, and what a screening program looks like when the compliance team is you and your bookkeeper. If you want the short version for US companies only, read do small businesses need OFAC screening. If you are new to the subject, start with what a sanctions list is.

Who do sanctions laws apply to?

Sanctions rules attach to people and companies through nationality, place of incorporation and where the activity happens. A small business can fall under more than one country's rules at once.

United States

OFAC's FAQ 11 says "All U.S. persons must comply with OFAC sanctions." That covers US citizens and permanent residents wherever they are, anyone inside the United States, and US-incorporated companies and their foreign branches. Some programs also cover foreign subsidiaries owned or controlled by US companies.

Non-US businesses are not automatically outside it. The same FAQ says "Non-U.S. persons are also subject to certain sanctions prohibitions," for example when they cause a US person to violate sanctions. OFAC's sanctions lists are the ones to screen.

United Kingdom

Section 1.4 of OFSI's UK financial sanctions general guidance says UK financial sanctions apply "to all persons within the territory and territorial sea of the UK and to all UK persons, wherever they are in the world." UK persons means UK nationals and legal entities established under UK law, including their branches.

The list to screen is the UK Sanctions List, published by the Foreign, Commonwealth and Development Office (FCDO). GOV.UK says it is "now the only source for all UK sanctions designations." The old OFSI Consolidated List closed on 28 January 2026.

European Union

EU sanctions are set by Council regulations, one per regime. Each has a scope article. Article 17 of Council Regulation (EU) No 269/2014, one of the Russia and Ukraine regimes, is typical. It applies the regulation within the EU, to any national of a member state inside or outside the EU, to any entity incorporated under a member state's law, and "to any legal person, entity or body in respect of any business done in whole or in part within the Union."

That last limb matters for non-EU businesses. A US or UK company that does business partly inside the EU is caught for that business. The EU sanctions list explained covers the consolidated list of financial sanctions and how to search it.

Australia

DFAT's About sanctions page says Australian sanctions laws apply to "activities conducted in Australia," "activities conducted overseas by Australian citizens and bodies corporate," and activities on Australian-flagged vessels and aircraft. The Australian Sanctions Office (ASO), part of DFAT, maintains the Consolidated List. Our guide to the Australian Consolidated List explains how to search it.

How strict is sanctions liability in each country?

In three of the four places, a business can be penalized without anyone proving it knew who it was dealing with. The EU is the exception.

US. OFAC's 2020 ransomware advisory says it may impose civil penalties "based on strict liability." A person subject to US jurisdiction "may be held civilly liable even if it did not know or have reason to know" it was dealing with a prohibited person. Our OFAC screening guide for small businesses covers the General Factors OFAC weighs when it sets a penalty, and its 2019 compliance framework.

UK. OFSI can impose a civil monetary penalty. Its enforcement and monetary penalties guidance says the Economic Crime (Transparency and Enforcement) Act 2022 "removed the requirement for OFSI to demonstrate that a person had knowledge or reasonable cause to suspect." For breaches on or after 15 June 2022, that proof is no longer needed. The maximum is the greater of £1,000,000 and 50% of the estimated value of the funds or resources involved.

EU. Each member state sets and enforces its own penalties. Article 15 of Regulation 269/2014 says they "must be effective, proportionate and dissuasive." Article 10(2) gives a defense that the US and UK civil regimes do not:

That defense works only if you had no reasonable cause to suspect. A business that never screens will find it hard to argue that.

Australia. Section 16 of the Autonomous Sanctions Act 2011 makes contravening a sanction law a criminal offence. For a body corporate, subsection 16(8) says the offence "is an offence of strict liability." Subsection 16(7) gives a defense if the company proves it "took reasonable precautions, and exercised due diligence." The company carries the burden of proving that. The maximum fine for a body corporate is the greater of 10,000 penalty units and 3 times the value of the transaction.

How do I assess my sanctions risk?

A risk assessment for a small business fits on one page. Answer four questions and write the answers down.

• Who do you pay? List your vendors by country. Note any paid in foreign currency or through an intermediary.
• Who pays you? List customers by country. An online shop that ships worldwide has a different profile from a plumber with local customers.
• Where? Note every country where you buy, sell, hold a bank account or have staff. Check each against the sanctions programs on the OFAC sanctions programs page or the EU Sanctions Map.
• What do you sell? Software, electronics, chemicals and machine parts can raise export control questions. Haircuts and bookkeeping rarely do.

Your answers decide which lists you screen and how often. A US business with only domestic vendors may screen OFAC's lists alone. A UK business that invoices EU customers in dollars may need the UK, EU and OFAC lists.

Export controls are a separate topic

Sanctions restrict who you deal with. Export controls restrict what goods, software and technology you can send, and to whom. In the US they are run by the Bureau of Industry and Security, part of the Department of Commerce. Its Entity List imposes license requirements on listed parties for "activities contrary to the national security or foreign policy interests of the United States." If you ship physical goods or software abroad, check the export rules on their own. This guide does not cover them.

How do I set up a sanctions screening program?

The program has six parts: which lists, when to screen, who reviews hits, how to clear false positives, what to record, and how long to keep it.

1. Pick your lists

Use your risk assessment. The usual starting points:

2. Decide when to screen

Screen at three points:

• Onboarding. Search the name before you create the vendor or customer and before the first payment or invoice.
• Before payment. Recheck any payee whose name, bank details or address changed since the last check.
• On list changes. The lists change without a fixed schedule. OFSI's general guidance says the FCDO aims to update the UK list within one working day for new UN and UK listings. OFAC posts each change on its Recent Actions page. When a list changes, rescreen your whole vendor and customer file, or the names the change could affect.

If you cannot rescreen on every update, set a fixed cycle you can keep, such as monthly.

3. Name who reviews matches

Pick one person to review possible matches. In a small business that is usually the owner or the bookkeeper. Name a backup for holidays. The person who creates vendors should not be the only one who clears their own hits, if you have enough staff to split it.

4. Clear false positives properly

Most hits are false positives. A common name will match someone on a list. OFAC's FAQ 5 sets out how to check one: compare the full list entry with what you know, including date of birth, ID numbers, nationality and address. If "you can reasonably determine the match is not valid, then you may proceed." OFSI says the same thing in its own words: a name match "does not necessarily mean" your contact is the person on the list.

Write down why you cleared it. "Different date of birth (list: 1961, our customer: 1990)" is a good note. "Not them" is not.

5. Record every check

For each search, record:

• the date and time
• the name searched, as entered
• the lists covered, and the list version or date if the tool shows it
• the result: no hit, cleared false positive, or escalated
• who reviewed it, and the reason for any clearance

Keep the clean results too. OFAC FAQ 5 tells you to retain records of your investigation, and a record of a clean search shows what the list said on the day you paid.

6. Keep the records long enough

The US sets a clear rule. 31 CFR 501.601 says records of transactions subject to OFAC's rules must be available "for at least 10 years after the date of such transaction." Blocked property records must be kept while the property is blocked and for at least 10 years after it is unblocked.

The other three are less direct:

• UK. OFSI's general guidance does not set a retention period for ordinary businesses. General licences carry their own record-keeping terms.
• EU. Regulation 269/2014 does not set a retention period. Your member state's law may.
• Australia. Section 26 of the Autonomous Sanctions Act requires 5 years of records from anyone who applies for or holds a sanctions permit.

A simple rule covers all four: keep screening records for at least 10 years. Store them somewhere that survives a staff change or a switch of accounting software.

When is a company sanctioned without being on the list?

A company can be subject to sanctions because of who owns or controls it. A clean name search on the company does not settle the question. Each jurisdiction has its own test.

US: the 50 Percent Rule

OFAC's 50 Percent Rule FAQs say the rule applies to entities "owned 50 percent or more in the aggregate by one or more blocked persons." Ownership counts directly or through other companies. Two blocked owners with 30% and 25% make 55%, so the company is blocked. OFAC's FAQ 398 says the rule "speaks only to ownership and not to control." Our guide to the OFAC SDN list works through more examples.

UK: ownership or control

Section 4.1 of OFSI's general guidance treats an entity as owned or controlled by a designated person in any of these cases:

• the person holds, directly or indirectly, "more than 50% of the shares or voting rights"
• the person has the right to appoint or remove a majority of the board
• "it is reasonable to expect that the person would be able to ensure the affairs of the entity are conducted in accordance with the person's wishes"

The UK threshold is more than 50%. A company exactly 50% owned by a designated person is caught in the US but not by the UK share test, though the control test may still apply.

EU: ownership or control

The Council's EU Best Practices for the effective implementation of restrictive measures, updated on 3 July 2024, set the ownership test at "50% or more of the proprietary rights of an entity or having majority interest in it." Paragraph 63 adds that "aggregated ownership" should be taken into account, with the same 30% plus 25% example. Paragraph 64 lists control criteria, including the right to appoint or remove a majority of the board and de facto dominant influence.

Australia: controlled assets

DFAT's guidance note for accountants says assets are generally controlled assets "if they are owned or controlled by a designated person or entity." It adds that they may also be controlled assets if owned or controlled by someone acting on a designated person's behalf.

What do I do if I find a true match?

Stop first. Do not pay, ship, refund or move money for the party until you are sure. Then follow the rules for each jurisdiction that applies to you.

US. Under 31 CFR 501.603, reports of blocked property "shall be filed within 10 business days from the date that property becomes blocked." Section 501.604 requires reports of rejected transactions too. FAQ 5 says to report a block or reject "within 10 business days." Questions go to the OFAC Compliance Hotline.

UK. Section 3.1.2 of OFSI's general guidance says that if you know or have reasonable cause to suspect you hold or deal with a designated person's funds, you must "freeze them," not deal with them or make them available, and "report them to OFSI." OFSI takes reports through its reporting page. Relevant firms, which include accountancy service providers, must report "as soon as practicable."

EU. Article 2 of Regulation 269/2014 requires that listed persons' funds "shall be frozen" and that no funds be made available to them. Article 8 requires anyone to "supply immediately" relevant information, such as amounts frozen, to the competent authority of the member state where they are resident or located. The Commission publishes a list of national competent authorities.

Australia. DFAT's guidance note for accountants says a person who holds an asset and forms the opinion it is a controlled asset "must provide information about that asset to the Australian Federal Police." It adds that any attempt to use or deal with controlled assets should be reported to the ASO at sanctions@dfat.gov.au.

What goes in a one-page sanctions policy?

Write it once, have the owner sign and date it, and review it each year. One page is enough. Use these headings:

1. Scope. Which jurisdictions apply to you and why.
2. Lists. Which lists you screen, from your risk assessment.
3. When. Onboarding, before paying a new or changed payee, on list changes, and your fallback cycle.
4. Who. The person who screens, the person who reviews hits, and the backup.
5. False positives. The details you compare and how you record a clearance.
6. True matches. Stop, freeze, report, and who calls the lawyer. Put the authority contacts here.
7. Ownership checks. When you ask a vendor or customer who owns it.
8. Records. What you record, where it is stored, and for how long.
9. Review. The date of the next review and a short annual walkthrough for anyone who pays bills or adds contacts.

How do I screen in QuickBooks Online or Xero by hand?

The manual process is the same in QuickBooks Online and Xero:

1. Export your vendor and customer lists to a spreadsheet.
2. Search each name on the official search tool for each list you chose.
3. Add columns for date, lists checked, result and reviewer, and fill them in.
4. Save the file with the date in its name, and keep every version.

Step-by-step guides for each platform:

• How to screen QuickBooks vendors against the OFAC list
• How to check Xero contacts against sanctions lists

This works for a few dozen contacts. It gets slow once you have hundreds and the lists change every week. Sanctions Clear, opening to QuickBooks Online and Xero users, will screen vendors and customers against eight sources, including OFAC, UK, EU, UN and Australia's DFAT list. It rechecks a contact when it changes or appears on a new bill or invoice after a list update, rescreens everyone monthly, and keeps a dated record of each check.

When should I call a sanctions lawyer?

Call one in these situations:

• You have a likely true match and need to freeze, block or report.
• You already paid or received money from someone who turns out to be listed. Under OFAC's enforcement guidelines, a voluntary self-disclosure halves the base penalty. OFSI's penalty guidance offers a discount of up to 30% for voluntary disclosure and co-operation. A lawyer can tell you how to make one.
• A vendor or customer is owned in part by a listed person and you cannot tell whether the ownership or control test is met.
• You need a license or permit to finish a deal.
• You sell goods or software abroad and are unsure whether export controls apply.
• More than one country's rules apply and they point in different directions.

Accountants and bookkeepers who screen on behalf of clients have their own duties in some countries. Our guide to sanctions compliance for accountants covers those.

This guide is general information, not legal advice.