The international sanctions landscape is becoming broader and more complex, with the UK expanding its sanctions regimes and the US increasing pressure on Iranian financial and commercial networks. For compliance teams, identifying indirect exposure is increasingly important, as sanctions risk can extend beyond designated individuals and entities into their wider business relationships and networks.

What can enhanced due diligence (EDD) uncover that sanctions screening may miss? During a recent customer due diligence investigation, FACT found business relationships and historical records connecting the overseas commercial interests of a non-Iranian individual to sanctioned entities and the Iranian oil trade. These findings revealed sanctions exposure well before any formal designation: several months later, the individual and his business entity were added to the US sanctions list.

The case demonstrates why sanctions screening, while an important component of customer due diligence, may provide only part of the picture.

Investigating the Wider Commercial Footprint

FACT was instructed by a client to conduct enhanced due diligence on an individual and his business interests. The individual, an Arab national residing in the Middle East, operated in the ship-management sector.

Rather than limiting the assessment to current sanctions status, FACT’s investigators examined the individual’s wider commercial footprint, including his declared business interests, counterparties and historical corporate records.

That deeper scrutiny uncovered a series of concerning connections.

FACT identified financial transactions involving US-sanctioned entities. Investigators also traced an email address recorded on the business licence of one of the individual’s former, inactive companies to leaked data connecting the business to sanctioned entities. Further research linked the business to the trade in Iranian oil through a US-sanctioned entity.

On their own, historical company records or contact details may appear unremarkable. When investigated and assessed in context, however, they can reveal relationships that materially alter the assessment of sanctions risk.

Investigative enhanced due diligence extends beyond checking whether an individual or company is currently sanctioned. It examines their wider network, including past business interests, counterparties, transactions and less obvious connections.

Risk Identified Before Designation

In this case, that distinction became particularly significant. A few months after FACT completed its report, the US Department of the Treasury added the investigated individual and his business entity to its sanctions list.

The subsequent designation did not create the underlying risk. It formalised concerns that FACT’s investigation had already brought to light.

What This Means for Compliance Teams

The case highlights the limitations of sanctions screening alone. Sanctions lists identify individuals and entities that have already been designated, whereas enhanced due diligence can uncover indirect relationships and potential exposure that might otherwise remain hidden.

This principle is also reflected in regulatory findings, which note that sanctions connections can be indirect, embedded within corporate groups or identifiable through emerging external intelligence. They also highlight the importance of looking beyond name and payment screening when assessing potential sanctions exposure.

For organisations assessing higher-risk customers and counterparties, the question should therefore not simply be:

“Is this person sanctioned?”

It should also be:

“What might conventional screening be missing?”

Going Beyond Database Screening

FACT’s enhanced due diligence services investigate this broader risk landscape across financial transactions, corporate structures and UBO identification, reputational exposure, geopolitical risk and relationship mapping.

Read more of FACT’s analysis on our website to explore emerging sanctions risks, evolving due diligence challenges and why effective risk assessment needs to go beyond database screening.