Sanctions compliance
Sanctions rules have no de-minimis and no risk weighting: a single missed hit can trigger criminal liability, freezing obligations and reputational damage. We make your sanctions compliance robust and workable.
Sanctions compliance means knowing who you deal with, screening your book and your transactions against the applicable lists, freezing and reporting immediately when there is a hit, and being able to evidence all of it. Unlike AML, this is not a risk-based obligation. There is no amount below which it does not apply and no client category that is exempt.
The legal framework in brief
| Instrument | What it does | Who it binds |
|---|---|---|
| EU sanctions regulations | Directly applicable prohibitions: asset freezes, the ban on making funds available, trade and service bans | Everyone in the EU, and EU nationals abroad |
| Dutch Sanctions Act 1977 (Sanctiewet) | National basis for implementing and enforcing international sanctions | Everyone in the Netherlands |
| Regulation on Supervision under the Sanctions Act 1977 | Duty to maintain administrative organisation and internal controls, and to report hits | Financial institutions supervised by DNB and the AFM |
| Economic Offences Act | Criminalises breaches of sanctions measures | Everyone |
Non-financial companies are not caught by the explicit internal-control duty, but the prohibitions bind them fully. In practice: a firm without screening cannot prevent a breach, and cannot show afterwards that it acted with care.
What we do
- Sanctions risk assessment: which countries, clients, products, counterparties and flows expose you — including the risk that your services are used to circumvent measures.
- Internal controls: governance and controls in line with the Dutch Regulation on Supervision under the Sanctions Act 1977, proportionate to your size. Not a bank framework for a twelve-person firm.
- Screening design: tool selection and calibration, fuzzy matching, alert handling and escalation — against EU, UN and national lists, and where relevant OFAC and the UK.
- Ownership & control: practical application of the 50% rule and unravelling structures where the sanctioned party is not the first name you see.
- Freezing & reporting: a protocol that works under pressure, with a clear decision tree, defined authority and prepared wording for reports to DNB or the AFM.
- Export & circumvention: the Russia sanctions packages, the anti-circumvention provisions and supply-chain due diligence.
- Independent testing: an assessment of whether your screening actually does what you believe it does, using a controlled test set.
The 50% rule, with an example
You onboard a trading company in Cyprus. Its name appears on no list. Two shareholders hold 30% each, a third holds 40%. None of the three is listed. But two of them are the same individual acting through two vehicles — and that individual is sanctioned. Combined: 60%. The company falls within the asset freeze, even though it is nowhere named.
This is exactly where name screening yields nothing and only structural research helps. We design that research to stay proportionate: deep where the risk sits, light where that is defensible, and documented either way.
What to do when a hit is confirmed
- Stop. No payment, no delivery, no service — not even to 'finish the current order'.
- Test whether the hit is real. Compare name, date of birth, address, passport or registration number, and record the comparison.
- Freeze. Funds and economic resources, so also goods, receivables and access to services.
- Report without delay. Financial institutions report to DNB or the AFM; other companies to the authority competent for the relevant regulation.
- Document. Who decided what, when, on what basis. This is the file that shows you acted correctly.
- Review. How did this party get in? Is there a gap in acceptance, screening or list management?
What it costs
A sanctions risk assessment including a review of the screening process typically runs between €5,500 and €9,500, depending on the number of systems, lists and entities. A focused calibration test with a controlled test set is a shorter engagement. Design and implementation work is charged at a day rate with an agreed cap. Amounts exclude VAT.
Further reading
Frequently asked questions
Do Dutch sanctions rules apply to non-financial companies?
Yes. EU sanctions regulations apply directly to everyone in the Union, including trading, logistics, manufacturing and professional services firms. The specific internal-control and reporting duties in the Dutch Regulation on Supervision under the Sanctions Act 1977 apply to financial institutions supervised by DNB and the AFM, but the underlying prohibitions apply to all businesses, and breaching them is an economic offence under Dutch law.
What is the 50% rule?
An entity owned more than 50% by a sanctioned party is treated as sanctioned itself, even if it does not appear on any list. The same applies where a sanctioned party exercises control, regardless of percentage. This is why name screening alone is never sufficient: you need visibility of ownership and control structures.
What must we do when we get a confirmed hit?
Stop the transaction, freeze funds and economic resources, stop providing any services, and report without delay to the competent authority — DNB or the AFM for financial institutions. Do not complete the transaction first. Document each step with timestamps and named decision-makers.
How often should we rescreen our client base?
After every relevant list update, which can be several times a month. In practice that means automated rescreening of the full book following each update, plus screening at onboarding and at transaction level where applicable. Quarterly screening is demonstrably too slow.
Our screening tool produces hundreds of false positives. Can that be reduced?
Almost always. Excess false positives usually stem from poorly tuned fuzzy matching, missing dates of birth and screening fields that do not contain names. We test calibration with a controlled set of known and unknown names so you can show that you tightened the process rather than simply raising the threshold. Less noise must never mean fewer true hits.
How do sanctions obligations differ from AML obligations?
AML is risk-based: you decide how much scrutiny a client warrants. Sanctions are rule-based with zero tolerance and no de-minimis threshold. A sanctioned party is prohibited, full stop. That difference means sanctions compliance needs its own controls and its own testing, not a paragraph inside the AML policy.
What that looks like in practice
Not sure your screening would hold up? We test it with a controlled test set and deliver a verdict you can put in front of your board or supervisor. Book a call or ring +31 6 11 32 53 62.