Russia’s sanctions tested banks’ ownership data more than their name lists

The week

For most people, sanctions are something announced at a podium. For banks, they are something that has to be working inside every payment system by the next morning. The last days of February 2022 put that gap under enormous pressure.

Banks were not starting from nothing. After Russia annexed Crimea in 2014, the United States had imposed sectoral sanctions on major Russian banks and energy companies. Those measures were published on a separate list and worked through directives that restricted new debt and equity rather than blocking the companies outright. Compliance teams had therefore lived with activity-based Russian restrictions for eight years. What changed in 2022 was the scale, the speed and the number of governments moving at once.

The pressure had been building for a week. On February 21, after Russia recognized two breakaway regions of eastern Ukraine, President Biden signed an executive order prohibiting most dealings with those regions. On February 22, the Treasury sanctioned two Russian state-owned banks, VEB and Promsvyazbank, and widened existing restrictions on Russian sovereign debt to cover secondary-market purchases of new bonds. On February 24, the day of the invasion, it went much further.

The February 24 package showed how varied the tools would be. VTB, Russia’s second-largest financial institution, was fully blocked, along with Otkritie, Sovcombank and Novikombank and dozens of their foreign subsidiaries. Sberbank, the largest, was treated differently. A new directive required US banks to close its correspondent and payable-through accounts within 30 days, with the prohibition taking effect on March 26. A separate directive barred new debt of more than 14 days’ maturity and new equity for thirteen major Russian companies and banks, including Gazprom, Russian Railways and Alfa-Bank. The same day, the Treasury issued eight general licenses, covering activities from agricultural and medical trade to energy-related transactions and the wind-down of existing dealings.

On February 26, 2022, the United States, the European Commission, the United Kingdom, Canada and other allies announced that selected Russian banks would be removed from the SWIFT messaging system. SWIFT is the secure network banks around the world use to send each other payment instructions; it does not move money itself, but it carries the messages that tell banks to move it. A bank cut off from it still exists, but dealing with it becomes slow and awkward. The allies also committed to restrictive measures on the Central Bank of Russia, which would stop it using its foreign reserves to blunt the sanctions. They promised a transatlantic task force to identify and freeze the assets of sanctioned individuals and companies. For banks, that promise meant future requests to find assets held through layers of companies, trusts and nominees as well as in named accounts.

On February 28, the US Treasury prohibited US persons from engaging in transactions with the Central Bank of Russia, the National Wealth Fund of the Russian Federation and the Russian Ministry of Finance. It issued a general license allowing certain energy-related transactions with the central bank to continue. It also “designated” Russia’s sovereign wealth fund, the Russian Direct Investment Fund, along with its management company, a subsidiary and its chief executive. Designation is the formal term for adding a party to the government’s sanctions list, so that US persons must generally stop dealing with it and block its assets. The same day, the New York Stock Exchange and Nasdaq halted trading in a number of Russia-linked securities.

The European Union and the United Kingdom adopted their own measures in parallel, with lists and rules that overlapped but did not match. On March 2, the EU named seven Russian banks to be cut off from SWIFT from March 12. A bank operating in New York, Frankfurt and London therefore faced three related but distinct rulebooks at once, each moving on its own timetable.

And the rules kept coming. New designations, general licenses, directives and guidance continued through the following weeks. A general license is a published permission that allows certain otherwise-banned activities, often for a limited time, such as winding down existing contracts. A directive sets out specific prohibitions, such as on dealing in certain kinds of debt. Each new document could change what a bank was allowed to do, sometimes immediately. On March 7, the Treasury’s Financial Crimes Enforcement Network issued an alert urging vigilance for attempts to evade the Russia sanctions. It listed red flags for banks and other firms, including those dealing in digital assets.

Behind the headlines, boards put a deceptively simple question to compliance teams: whether the institution had exposure. Answering it turned out to depend far less on the lists themselves than on how well each institution understood who its customers really were, and who owned them.

Sanctions screening is often described as matching customer and payment data against lists of named parties. That description was always incomplete, and the Russia measures of 2022 showed how incomplete. They arrived in quick waves. They targeted state enterprises and private groups with hundreds of subsidiaries. They came from several governments with different lists and different tests, and many restricted particular activities rather than all dealings with a party.

For banks and other financial institutions, the hard work was data: knowing who owned whom, knowing which rule applied from when, and knowing which jurisdiction’s version of it governed a transaction.

The sections below begin with why name matching, the traditional core of screening, could not carry the load. They then take the three data problems in turn: ownership, timing and jurisdiction. A fifth section sets out what building the data involves and what it costs, and the last offers questions for testing readiness in a calm month.

A doorman with a list

Governments publish lists of people, companies and organizations that are subject to sanctions. In the United States, the best-known is the Specially Designated Nationals and Blocked Persons list, maintained by OFAC, the Office of Foreign Assets Control, part of the Treasury. Financial institutions must not deal with listed parties, except as specifically permitted, and must often freeze any of their assets they hold.

How screening works

To comply, banks run screening software. It compares names in their customer records and in each payment against the lists, and raises an “alert” when it finds a possible match. A compliance analyst then reviews each alert to decide whether it is a real match or a coincidence. The software works like a doorman with a list of banned guests, checking every arrival’s name. He has to account for nicknames, misspellings and people who happen to share a name with someone on the list.

Two kinds of screening run side by side. Customer screening checks the institution’s whole customer base against the lists, usually overnight and again whenever a list changes. Payment screening checks each transaction as it moves, including the names of senders, receivers, intermediary banks and sometimes free-text fields such as payment references. Payment screening has to be fast, because payments are expected to settle within hours or minutes, so a held payment creates pressure to decide quickly.

Matching is fuzzy by design. The software scores how similar two names are, allowing for spelling variants, reordered words and missing middle names. A threshold decides which scores become alerts. Set it too high and real matches slip through; set it too low and analysts drown. Most institutions tune it over years against their own customer base, and that tuning is part of what a regulator examines.

What examiners look for

Screening is judged as part of a wider program. In 2019, OFAC published a framework for sanctions compliance programs built on five components: management commitment, risk assessment, internal controls, testing and auditing, and training. Bank examiners review sanctions compliance alongside anti-money-laundering programs, using the federal examination manual for both. The questions are practical: whether the institution has assessed where its sanctions risk lies, whether its screening covers the right data, whether thresholds are justified and documented, and whether someone independent tests the system.

That framework matters for the argument here. A risk assessment that identifies ownership as a source of exposure, and then relies on a name screen alone, has documented its own gap. The 2022 waves made that gap visible at many institutions that had described ownership risk in their policies without building the data to manage it.

Where the doorman fails

This works well when the people you need to stop are the ones named on the list. It works much less well when the person you need to stop is standing behind someone else. It also struggles when the rule is not “never let this person in” but “let them in, but not into the bar, and only until Thursday.” Both of those situations were common in 2022.

The Russia measures broke the doorman model in three distinct ways. A party could be restricted without being named, because of who owned it. A party could be permitted on Monday and prohibited on Friday, because a license expired or a directive took effect. And a party could be prohibited in one jurisdiction and permitted in another, so the answer depended on which part of the bank was handling the transaction. Each failure needs a different kind of data to fix.

The subsidiaries no list named

Under OFAC’s 50 percent rule, an entity owned 50 percent or more, directly or indirectly, individually or in aggregate, by one or more blocked persons is itself blocked, even if it appears on no list. OFAC applies the same logic to the directives: a company majority-owned by an entity subject to the debt and equity restrictions is subject to them too. For Russian state-owned enterprises and for groups held by sanctioned individuals, those rules caught many subsidiaries, joint ventures and holding companies that no list named.

Why the name screen cannot see them

A name screen cannot find an unnamed subsidiary. Finding it requires the ownership structure of the customer and, for trade and correspondent business, of counterparties, traced to enough depth. (Correspondent banking is when one bank provides accounts and payment services to another bank, often in a different country. That bank’s customers’ payments then flow through it.) That ownership information comes from corporate registries, commercial data providers and customer due diligence files, the records banks keep when they check who a customer is.

Its quality varies, and it is poorest for entities registered in jurisdictions with little transparency or held through chains of trusts and nominees. A nominee is a person or firm that holds shares in its own name on someone else’s behalf, which can hide the true owner. Ownership also changes. A structure confirmed at onboarding five years earlier may no longer be accurate, and sanctioned owners had every incentive to rearrange their holdings once designations began.

Adding up holdings

Aggregation adds difficulty: two sanctioned owners holding 30 percent each produce a blocked entity under the US rule that neither holding would reveal alone. To see it, a bank has to add up holdings across different owners, which is impossible if ownership is recorded only as a sentence in a file note. Indirect holdings compound the problem. A sanctioned person who owns 60 percent of a holding company, which owns 60 percent of an operating company, makes both blocked, though the person’s economic interest in the second is only 36 percent.

The data banks already collect does not line up neatly with this test. US anti-money-laundering rules require covered financial institutions to identify the individuals who own 25 percent or more of a legal entity customer. That captures large owners but stops at a different line. A company held 26 percent by one sanctioned person and 24 percent by another meets OFAC’s aggregate test. A file built for the 25 percent rule might record only the first owner. Data collected to satisfy one rule does not automatically answer another.

Ownership versus control

The EU and UK apply their own ownership and control tests, which differ in detail. Both use a threshold of more than 50 percent, where OFAC’s rule starts at 50 percent exactly. Both also ask about control, meaning the ability to direct a company’s decisions even without owning most of it, through board appointments, agreements or influence. Current UK guidance says it would not automatically add together the holdings of different designated persons unless there is a joint arrangement or one controls the other’s rights. The two 30 percent holdings in the example above would block the company under US rules, but not under UK rules on ownership grounds alone, though a control finding could still apply.

Those differences make a single “blocked or not” flag inadequate. The same company can be blocked in New York and not in London, or caught in London on control grounds that OFAC’s ownership test would not reach. Recording the underlying facts, with percentages, dates and control indicators, lets each jurisdiction’s test be applied separately. Recording only a conclusion forces the analysis to be redone every time.

The shipping company that matched nothing

Consider a mid-sized bank with a trade finance desk that serves importers and exporters. One of its customers is a shipping company registered abroad. The bank’s files show the customer’s name, address and a note from five years ago saying it is “owned by a holding company.”

When the sanctions waves begin, the screening system finds no match for the shipping company. It is not on any list. A closer look tells a different story. The holding company turns out to be owned 30 percent by one sanctioned individual and 30 percent by another. Under OFAC’s 50 percent rule, that aggregate holding makes the holding company blocked, and so the shipping company it owns is blocked too, even though no list names either.

A bank with structured ownership data could have found this with a query. This bank finds it only because an experienced analyst, reviewing a payment for another reason, decides to dig. In the meantime, payments have continued to flow. The exposure was there from the start; what was missing was the data to see it.

Getting results in days

Institutions that held structured ownership data, with percentages and dates, and that ran entity resolution across their systems, could answer exposure questions within days. “Structured” here means stored in a database in consistent fields that a computer can add up, rather than written in prose. Entity resolution is the work of recognizing that a customer record, a payment counterparty and a trade finance applicant are the same company. It sounds trivial, but the same firm may appear under slightly different names, addresses and identifiers in each system. Institutions relying on name matching and free-text due diligence notes spent weeks on manual research, often with outside counsel, and still lacked confidence in the answer.

Rules with start and end dates

The second problem was speed. New designations, general licenses, directives and guidance were published every few days. Some took effect immediately. Others came with wind-down periods that permitted certain transactions until a set date, giving businesses time to exit existing arrangements in an orderly way. General licenses authorized defined activities, such as some energy-related payments, under conditions that later changed.

One week, many effective dates

The February 24 package alone shows the shape of the problem. Some banks were blocked at once. Sberbank’s correspondent accounts had to close within 30 days, by March 26. Debt and equity restrictions on thirteen named companies applied only to new issues above a maturity threshold, not to all dealings. Eight general licenses carved out activities that would otherwise have been caught, some of them time-limited. Four days later, the central bank prohibition arrived with its own energy carve-out.

Each of those measures had a different start, a different scope and, in some cases, a different end. A payment that was permitted under a wind-down license on one date could be prohibited a week later. A trade in a company’s existing shares could be permitted while a purchase of its new bonds was not. The question had changed from whether a party was sanctioned to whether this activity, with this party, was permitted today.

Rules as data

That turned the sanctions regime into a stream of dated rules rather than a static list. Screening systems had to take list updates quickly and reliably. Compliance teams also had to track which authorizations applied to which transactions and when each expired. Institutions that stored these as data, with an effective date, an expiry date, a source document and an owner, could configure filters and answer questions from the business. Those that tracked them in email and memos found that different teams were applying different versions of the same rule.

A dated rule record also creates an audit trail. When an examiner later asks why a payment was released on a given day, the answer can point to the license in force that day and the person who applied it. Without that record, the institution has to reconstruct its reasoning from inboxes, months after the fact.

What happens after a true match

Finding a match starts a further chain of obligations. Under OFAC’s rules, property of a blocked person that comes into a US institution’s possession must be blocked, typically by placing funds in a separate interest-bearing blocked account. The institution must report the blocked property to OFAC within ten business days and file an annual report of blocked property it holds. Transactions that are rejected rather than blocked, because they are prohibited but involve no blocked property, must also be reported within ten business days.

Each of those steps depends on data. The report needs the parties, amounts, dates and the legal basis for the action. Getting the basis right matters, since blocking under a full designation and rejecting under a directive are different actions with different consequences for the customer. An institution that could not say which rule it was applying to a payment struggled to report it correctly.

Wind-downs from the customer’s side

A wind-down period is an operational project, not a date in a memo. When Sberbank’s correspondent accounts had to close within 30 days, US banks holding them had to settle pending payments, stop accepting new ones on the right day and close the accounts cleanly. Customers who relied on those channels to pay or be paid in Russia needed to be told, and some needed help finding lawful alternatives.

The same applied to customers with contracts affected by the new rules. A US importer with an existing supply contract might be able to complete deliveries under a wind-down license, but only until its expiry. Relationship managers needed a clear, consistent message, approved by compliance, about what the bank could and could not process and until when. Without it, customers heard different answers from different staff, and complaints followed. The dated rule record served the front line as much as the screening engine.

The alert surge

Alert volume rose sharply. Russian names transliterate from Cyrillic in several ways, meaning the same name can be spelled differently once converted into the Latin alphabet, and common surnames match many unrelated customers. A “false positive” is an alert that turns out not to be a real match, and each one costs an analyst’s time. Institutions with tuned matching logic, good reference data and clear escalation rules absorbed the surge.

Those with poorly tuned systems either drowned in false positives or raised thresholds in haste, which risked missing true matches. A hasty threshold change also leaves an awkward record: an examiner can see that the institution reduced its screening sensitivity at the moment risk was highest. Measuring alert quality before a surge, as the share of alerts that led to escalation, gave teams a baseline to tune against during it. A documented, tested tuning change is defensible. An undocumented one made at midnight to clear a queue is not.

Staffing followed the alerts. Many institutions moved analysts from other compliance work or brought in contractors. Contractors needed training on the institution’s procedures and the new rules, which took time when time was shortest. Clear written guidance on the most common Russia-related alert types let new reviewers decide consistently.

Speed of list loading

List updates themselves had to move fast. OFAC publishes changes to its lists as they are made, and the EU and UK publish their own consolidated lists. An institution, or its vendor, has to ingest each change, test it and push it to every screening engine. A delay of a day can mean a day of payments screened against an out-of-date list. Institutions that had measured the time from publication to live screening knew their gap. Many others discovered it in March 2022.

Three rulebooks, one transaction

The third problem was the gap between jurisdictions. A global bank had to comply with US, EU and UK measures, and often others, at once. The lists overlapped heavily but not completely. Ownership tests differed. Some measures prohibited specific activities, such as dealing in new debt or equity of named entities, providing certain services, or investing in particular sectors, rather than all dealings.

Who is bound by which regime

Each regime binds its own persons. US sanctions bind US persons, including US banks and their foreign branches, and reach transactions that pass through the US financial system, which includes most dollar payments. EU measures bind EU nationals and entities and activity within the EU. UK measures bind UK persons and activity in the UK. A bank group therefore faces different obligations in different legal entities, and a single transaction can touch several of them.

That made screening a rules problem as well as a matching problem. Beyond whether a party was listed, a bank had to know which restrictions applied to this type of transaction, in this currency, through this booking entity, with this counterparty. A booking entity is the specific legal company within a banking group that records a transaction on its books; a London subsidiary and a New York branch of the same bank may face different rules.

When the regimes diverge

Consider a payment to a counterparty that is allowed under a US general license until a set date, but booked through the bank’s European subsidiary, where the EU rules apply instead. If the license is tracked in an email that only the US team saw, the European team may apply the wrong rule, in either direction. It may block a permitted payment and frustrate a customer, or allow a prohibited one and create a regulatory problem.

The SWIFT measures added another layer. The EU’s list of banks to be disconnected from SWIFT did not match the US blocking list exactly. A bank cut off from SWIFT could still be reachable through other channels, and a bank still on SWIFT could be blocked under US rules. Operations teams had to understand both, because a payment that failed for one reason could be rerouted in a way that breached the other.

Correspondent banks as a second line

Large US banks that clear dollar payments for foreign banks screen those payments too. In 2022, many of them sent their respondent banks detailed questions about Russia exposure, ownership and controls, and some ended relationships where answers were weak. For a regional bank abroad, the quality of its own ownership data now determined whether it kept access to dollar clearing.

The same dynamic ran downward in the United States. A community bank that relied on a larger correspondent for international wires found that correspondent asking about its customers. The smaller bank’s files, built for domestic lending, often lacked the ownership detail requested. Answering slowly or vaguely put the relationship itself at risk.

Writing the rules down

Answering consistently required the rules to be written down in structured form: the jurisdiction, the targeted party or sector, the restricted activity, the exceptions and the effective dates. A booking-entity view of which regimes applied to each part of the group was the starting point. Organizations should check with counsel, since applying these rules to specific facts is a legal judgment. Data can make the question answerable; it does not replace the lawyer who answers it.

How the problem differed by type of institution

Smaller institutions faced a narrower version. Most community banks and credit unions had little direct exposure to Russian parties. They still had to apply list changes promptly through their screening vendor, review the extra alerts with care, and watch for indirect exposure through correspondent relationships or business customers with international trade. For them, the practical priority was vendor oversight: how quickly the vendor loaded each change, and whether it covered ownership as well as names.

Broker-dealers and wealth managers faced a securities version. The debt and equity directives restricted dealings in new securities of named companies, while trading in many existing securities remained permitted for a time. Firms had to know which instruments in client portfolios were issued by restricted entities and when. When US exchanges halted trading in some Russia-linked securities, clients holding them faced positions they could not easily sell. Custody and client communications became part of the sanctions problem.

Fintechs and payment firms often depended on a sponsor bank for access to payment systems. The sponsor bank remained responsible for its own sanctions compliance, and many tightened controls on fintech programs with international flows. Firms dealing in digital assets faced particular scrutiny, as FinCEN’s March alert singled out evasion risks in that market. Insurers and asset managers had their own exposures through investments and policies. Each type of institution had to work out which of its products created exposure, and that inventory was itself a data exercise.

Building the data, and what it costs

“Getting the data right” is less mysterious than it sounds, and more organizational than technical. It has four parts: ownership records, entity resolution, rules stored as records, and oversight of the vendors that supply much of it.

Ownership records that can be added up

Start with where ownership information lives. When a business opens an account, the bank collects details about who owns and controls it. In many institutions, that information ends up in a scanned form, a PDF from a corporate registry and a few lines typed by a relationship manager. It satisfies the onboarding checklist. It is almost useless when someone later needs to ask, across thousands of customers, which of them are 50 percent owned, in total, by people on a new list.

Turning that into usable data means recording each owner as a distinct entry, with the percentage held, the date the information was confirmed and the source. Where ownership runs through several layers of companies, each layer is recorded and linked, so the chain can be followed up to the ultimate owners. Commercial data providers sell much of this information for larger companies, and many banks combine it with what they collect themselves. Neither source is complete, so knowing which records are thin or stale is part of the job.

Not every customer needs the same depth. A risk-based approach records full chains for customers with international ownership, trade activity or exposure to high-risk jurisdictions, and lighter records for local businesses owned by local individuals. The trade-off is explicit: depth costs analyst time and data fees, and the institution has to decide where that money does most good.

Entity resolution

Entity resolution forms the next layer. Most banks run many separate systems: one for retail accounts, one for commercial lending, one for payments, one for trade finance, sometimes several of each inherited from past mergers. Each has its own customer list. Entity resolution uses identifiers such as registration numbers, addresses and names, plus matching rules, to recognize when records in different systems describe the same company. The output is a single view of each entity and its relationships.

When a new designation lands, the bank can look up the sanctioned party and follow its ownership links down to the companies it owns. It can then find every place those companies appear in the bank’s systems. That turns a weeks-long research project into a query, followed by targeted review. The query does not replace judgment. It tells analysts where to look first.

Rules as records

The rules side works in a similar way. Instead of a memo describing a general license, the license becomes a record: what it permits, for whom, under which jurisdiction, from when, until when, and who in compliance owns it. Screening and payment systems can then be configured from those records, and when the license is amended, one update flows through rather than a dozen emails.

Ownership of each record matters. A named compliance officer watches for amendments and expiries, confirms that system settings match the record, and signs off on changes. Without an owner, records go stale, and a stale rule record is worse than none because people trust it.

Vendor oversight

Most institutions buy their list data, screening software and much of their ownership data from vendors. That shifts the work but not the responsibility. Regulators expect institutions to understand and test the tools they rely on. Useful tests are concrete. Seed known test names and confirm alerts fire. Measure the time from an OFAC update to live screening, and check whether the vendor’s ownership data flags subsidiaries of a newly designated group. Results belong in a file that an examiner could read.

Sequencing the work

None of the four parts needs to be finished before the others start, and a sensible sequence delivers value early. The first step is an inventory: which systems hold customer and counterparty records, where ownership information lives in each, and which customers have foreign ownership or international activity. That inventory alone tells the institution where its blind spots are.

The second step targets the highest-risk segment. Trade finance customers, correspondent relationships and commercial customers with foreign owners get structured ownership records first, with percentages, dates and sources. Entity resolution follows for those segments, linking their records across systems. Rules as records can start at the same time, since they depend mainly on compliance discipline rather than technology.

Ownership of the program needs to be clear. The sanctions or BSA officer owns the requirements and the judgments. Data and technology teams own the records, the matching and the plumbing. Relationship managers own the accuracy of what they collect from customers. A short set of metrics keeps it honest. Useful ones are the share of high-risk customers with complete ownership records and the age of the oldest confirmation. Others are the time to load a list change and the time to answer a test exposure question.

Costly in both directions

Sanctions breaches carry serious consequences: regulatory penalties, legal costs, reputational harm and, in serious cases, restrictions on how an institution can operate. But over-compliance has costs too. Blocking legitimate payments damages customer relationships, and a backlog of unreviewed alerts delays business for everyone. Exiting whole categories of customers to avoid the analysis, sometimes called de-risking, can cut off legitimate businesses and push activity into less transparent channels.

Sanctions compliance is only as good as the customer data underneath it. Ownership data, entity resolution and well-maintained rules are not glamorous investments, and they rarely make the case for themselves in an uneventful year. Their value shows up all at once, in the weeks when the board asks “what is our exposure?” and expects an answer in days rather than months. The same data also supports anti-money-laundering work, credit risk and customer onboarding, so the investment pays back beyond sanctions.

The case for staying with names

A fair counter-argument runs the other way. For a community bank with no international business, the ownership data project may cost more than the exposure it addresses. Its vendor’s list screening, applied carefully, may be proportionate. Building entity resolution across two core systems is a large project for a small team.

The argument holds for the deepest layers of ownership data. It does not hold for the basics. Even a small institution benefits from knowing which customers have foreign owners or international trade, from recording the date and source of ownership information, and from testing its vendor. Those steps cost little and turn a blind spot into a known, managed limit. Proportionality is a reason to scale the work, not to skip it.

Infrastructure that answered in days

• Ownership as data. Beneficial ownership, meaning the real people at the top of the chain who own or control a company, is stored with percentages, dates and sources, not buried in notes.
• One view of each entity. Entity resolution links the same company across customer, payment and trade systems.
• Rules as records. Every designation, license and wind-down period is stored with its effective date, expiry date, source document and owner.
• A baseline for alerts. Teams know their normal alert volume and quality, so they can tune calmly when a surge arrives.
• A map of regimes. Each booking entity has a clear list of which countries’ sanctions apply to it.
• Tested vendors. Institutions that rely on vendors check how quickly changes load and whether ownership is covered.

The failures follow from treating screening as name matching. They include assuming no match means no exposure, tracking licenses in inboxes, raising thresholds in a panic to clear backlogs, and trusting a vendor’s coverage without ever testing it.

Testing readiness in a calm month

• If a major new sanctions wave were announced tomorrow, could we say within days which customers are affected, including through ownership?
• Do we store beneficial ownership with percentages and dates, or as free text?
• Where do we record general licenses and wind-down dates, and who owns each one?
• Which countries’ sanctions apply to each of our legal entities, and is that written down?
• How quickly does our screening vendor load list changes, and have we tested its ownership coverage?

With hindsight

The Russia program grew into one of the largest sanctions regimes ever, with thousands of designations across the United States, the EU and the UK. What began as a burst of announcements in February 2022 became a permanent, constantly updated feature of international finance. The operational strain of those first weeks turned out to be a preview rather than a one-off.

The pace barely slowed in the weeks that followed. In early March 2022, the Justice Department launched a task force to pursue sanctioned Russian elites and their assets, and the United States banned imports of Russian oil. Mid-month, the allies set up a multilateral task force to share information on the assets of sanctioned elites. Each step added new parties, new prohibitions and new pressure on institutions to find assets held through layers of companies.

The UK changed its own enforcement model. The Economic Crime (Transparency and Enforcement) Act, which became law in March 2022, allowed the UK’s sanctions authority to impose civil penalties without proving that a firm knew or suspected it was breaching sanctions. It also created a register of overseas entities owning UK property. For banks operating in London, strict liability made the quality of ownership data a direct enforcement issue.

Attention shifted from direct exposure to evasion through third countries, front companies and trade in restricted goods. A front company is a business set up to disguise who is really behind a transaction. In June 2022, FinCEN and the Commerce Department issued a joint alert on evasion of export controls on Russia, asking financial institutions to watch trade finance and payments for signs of restricted goods. That shift made the ownership and entity problems described above even more central. Banks had to ask whether someone sanctioned was hiding behind a party, as well as whether the party itself was sanctioned.

New kinds of rules demanded new kinds of data. The G7 price cap on Russian seaborne oil took effect for crude in December 2022. It allowed Western firms to finance, insure and ship Russian oil only if it was sold below a set price. Banks and insurers had to collect and keep attestations about prices, a document trail rather than a list check. The rule could not be applied by a name screen at all.

In December 2023, a US executive order authorized secondary sanctions on foreign financial institutions that facilitate significant transactions for Russia’s military-industrial base. Secondary sanctions reach beyond a country’s own banks and citizens: they threaten penalties against foreign institutions that do certain business with the target. That pushed screening and due diligence obligations further into global banking, including banks with no US branches of their own. In June 2024, the Treasury designated the Moscow Exchange, further complicating dealings in Russian securities and currency.

Record-keeping horizons lengthened too. In April 2024, Congress extended the statute of limitations for US sanctions violations from five years to ten, and OFAC later extended its record-keeping requirement to match. An institution may now need to explain a screening decision a decade after making it. Rules stored as dated records, with sources and owners, are far easier to defend over that span than a reconstruction from old email. In the EU, a 2024 directive set common criminal offenses and penalties for violating EU sanctions, which member states had to bring into national law by May 2025.

Public ownership data did not become the reliable backstop some had hoped for. In November 2022, the EU’s Court of Justice struck down the general public’s right of access to member states’ beneficial ownership registers on privacy grounds. In the United States, beneficial ownership reporting to FinCEN under the Corporate Transparency Act began in January 2024. In March 2025, FinCEN exempted US companies and US persons from that reporting. Banks still depend largely on what they collect and buy themselves.

By this point in 2026, ownership data, entity resolution and rules that screening systems can apply are treated as core sanctions infrastructure at larger institutions. Many smaller firms still depend on vendors whose ownership coverage they have never tested. The early weeks of 2022 showed why that matters: a list is only as useful as the data it is matched against. The practical step is to ask, in a calm month, the question that will be asked urgently in the next crisis: how quickly the institution could tell who it really does business with. One that can answer in days, with evidence, is in a far stronger position with regulators, correspondents and its own board than one that has to start the research from scratch.