A new approach to issuing and enforcing sanctions is critical to their efficacy in the 21st century

The first recorded use of sanctions was in 432 BC, and while they’ve only been commonly used in their current form for several decades, the fundamentals of how they’re applied haven’t changed. 

Yet technological advances have reshaped the world around us, opening new cross-border, largely anonymous ways to move money. As a result, governments are applying—and financial institutions are enforcing—a 20th-century solution to a problem that has taken on a new form in the 21st century.

Put simply, sanctions continue to target individual persons or entities when the reality of a highly connected international system is that measures can be circumvented through a network of people or companies that disguise the origins and/or destination of funds. When new, online-only methods of moving money, such as crowdfunding and decentralized crypto exchanges, are added to the mix, the scale and complexity of the problem become clear. The result is a game of “whack-a-mole.” A government sanctions a person. The sanctioned person uses their network to evade the measures. Those individuals are, in turn, sanctioned. New partners or shell companies are found to facilitate further evasion. The cycle continues. 

Concealing more than blemishes 

The impact of this is a lose-lose situation for governments and businesses. Despite years of sanctions on Russia’s economy, the country is selling oil abroad for more than the G7’s price cap, according to the Atlantic Council, which says it uses a “shadow fleet” of 1,000 tankers to ship it. Russia has also continued to import many sanctioned Western goods, accessing them through third countries, including Georgia, Belarus, and Kazakhstan. The International Monetary Fund estimates Russia’s economy grew by 2.2 percent in 2023 and 1.1 percent in 2024 – figures some Western economies would be very happy with. 

To see the impact on the private sector, look no further than Murad, a California-based cosmetics company acquired by Unilever. Before the acquisition, Murad was, according to OFAC, engaged in “an apparent eight-year conspiracy that resulted in the export of services and more than $11 million in goods to Iran on at least 62 occasions.” An executive at the company worked through this time with distributors in the Middle East who exported products to Iran. The company was fined $3.3m, and the executive who facilitated the deal agreed to pay $175,000. 

How did this go undetected for so long? In addition to the complicity of a senior executive, “another contributing factor was the lack of a sanctions compliance program.” Specifically, OFAC found that:

• As primarily a cosmetics company, Murad’s compliance efforts focused on product safety despite the company’s international sales. 
• What compliance reporting structures it later had in place following its acquisition by Unilever US were likewise” inadequate” in relation to the sanctions risks it faced. 
• Compliance reporting lines ran to UK personnel who “lacked an adequate understanding of OFAC sanctions.” 

A mitigating factor of the penalties OFAC applied was the company’s remedial actions, including “developing sanctions and export control policies and procedures, conducting sanctions and export control training for senior management and key personnel, and implementing screening for all parties involved in its international transactions.” 

Murad’s 2023 settlement was just the tip of the iceberg. That year was a record for US sanctions enforcement, with OFAC issuing $1.5bn in penalties. Given how much firms invest in their sanctions programs, would any CEO look at those numbers and believe they’re getting a good return on their investment?

Where do we go from here? 

With so much geopolitical instability, solving this challenge has become more urgent. By funding terrorist groups and rogue states, continued sanctions evasion on the scale we are seeing today will only further undermine the international order. It will also harm economic growth, as businesses sink more money into ineffective programs, only to shell out more on fines—and still more in reputational damage—at the other end.

At ComplyAdvantage, we believe a new approach is needed to the way sanctions are issued and enforced. Reimagining both requires a network view of risk that considers the full scope of a person’s business, financial, and personal relationships.  

• Issuing sanctions: The G7, UN, and major powers like the United States, who drive global sanctions, need to move beyond issuing lists of individuals and ensure measures consider anyone who is one or two “hops” away from the targeted person. While ‘implicit sanctions’ cover individuals and entities not directly named but implicated in a government’s statement, these could and should go much further.
  This could be in the form of a more codified second tier of sanctions—for example, naming and designating connected individuals as “high-risk monitored persons,” ensuring there is no assumption of guilt or collusion but recognizing the increased probability that they could be involved in evasion.While the world is becoming more integrated through the advent of real-time payments, in other ways, it is becoming more fragmented in ways that threaten the efficacy of sanctions. For example, an estimated 10 percent of banks use China’s SWIFT alternative, which unifies payments and banking. Whether by reforming SWIFT or through diplomatic measures, G20 leaders should make securing a unified global payments ecosystem a major strategic priority.

• Enforcing sanctions: Improving enforcement on the front lines in the private sector hinges on two technology-related factors. The first is the need for a compliance platform to aggregate data from multiple, diverse sources to create this network view of risk. Today many firms use separate platforms for various aspects of their compliance program, leading to siloes, misaligned data formats, and the reality that they are not seeing the full picture. The second element is the importance of timely data. Sanctions lists and the relationships between high-risk individuals change not just by the day but by the hour. Sanctions screening solutions that process batch updates every 24 hours leave firms exposed to unwittingly processing a payment to someone who is now on a sanctions list. 

The good news is that, from a technology perspective, a network view of a sanctioned entity’s risk profile is closer than ever. Delivering this 360-degree view of true risk has been a core goal of ComplyAdvantage since I founded the company a decade ago. What we need now is an honest, hard look from policymakers at the efficacy of the sanctions programs they invest so much time and money building – and a recognition that they could achieve much more by reworking them for the world we live in today – not the one we lived through in the last century.

(If you’d like to learn more about the first use of sanctions in 432 BC, check out this article.)