EU Sanctions: what “minimum” due diligence actually requires

No One-Size-Fits-All Approach

EU sanctions regulations do not prescribe a single due diligence process for all businesses. Operators are expected to calibrate their checks to their own risk exposure and to develop, implement and routinely update a sanctions compliance programme reflecting their business model, geography and customer base. The European Commission does, however, provide a framework which focuses on risk assessment, multi-level due diligence, and ongoing monitoring. In practice, this will generally include screening the relevant parties against sanctions lists and, where appropriate, carrying out adverse media checks to identify risks that a sanctions-list search would not reveal.

The Baseline Put in Writing

Since the 14th sanctions package, the Commission’s guidance has made clear that the non-liability protection (Article 10(2) of Regulation (EU) 269/2014 and Article 10 of Regulation (EU) 833/2014) depends on the quality of the checks actually carried out. The protection is therefore conditional on the operator having carried out appropriate checks and taken into account the relevant publicly available information. At a minimum, due diligence should extend to all parties involved in the transaction, including indirect participants such as suppliers, transporters and banks. Companies should also establish whether the goods or services are subject to other controls, including dual-use or military controls. Finally, they should assess the transaction itself, taking into account factors such as the contractual documentation, commercial rationale, financial flows, shipment route, end-use and the risk of diversion. How extensive those checks need to be should depend on the circumstances and the level of risk involved. For example, a low-risk EU-based counterparty does not warrant the same depth of review as a high-risk intermediary.

Beneficial Ownership and Control

The Commission treats assessing who actually owns or controls a counterparty as a due diligence obligation in its own right. This is particularly important where ownership is spread across multiple entities or holding companies.  In the context of EU sanctions law, ownership means being in possession of 50 % or more of the proprietary rights of a legal person, group or entity, or having a majority interest therein. Control is assessed separately. The Commission’s Best Practices identify a number of circumstances that may warrant further investigation into whether control exists. These include a designated person holding the largest single stake relative to other shareholders, a buyback

FAQ on Russian sanctions, A.2, q. 2.

Link: https://finance.ec.europa.eu/system/files/2024-01/faqs-sanctions-russia-consolidated_en.pdf

FAQ on Russian sanctions, A.2, q. 10.

Link: https://finance.ec.europa.eu/system/files/2024-01/faqs-sanctions-russia-consolidated_en.pdf

option retained by a designated former owner, transfers of shares shortly before or after designation, the use of front persons, and unnecessarily complex structures involving shell companies or trusts.

What This Means for Businesses

At a minimum, sanctions due diligence results must show that the relevant parties were screened, that applicable goods and services controls were considered, and that the transaction itself was assessed for sanctions risk. That assessment also needs to address ownership and control, rather than stopping at the sanctions screening result. This does not remove the need for risk-based calibration, particularly for higher-risk sectors, jurisdictions or transactions. The practical implication is that businesses should be able to demonstrate, through records, what checks they performed and what those checks established.

 Best Practices for the effective implementation of restrictive measures, VIII (64-67).

Link: https://data.consilium.europa.eu/doc/document/ST-11623-2024-INIT/en/pdf 

Myroslava Makarchuk