Sanctions compliance in 2026: what General Counsel must change

The US Treasury's Office of Foreign Assets Control announced 14 enforcement actions in 2025, according to Sidley's review, up from 12 in 2024 but below the 17 of 2023. A reader looking only at the count might conclude that enforcement is flat. The money tells a different story. Total penalties and settlements in 2025 exceeded US$265 million, compared with approximately US$49 million in 2024, and OFAC's own enforcement page lists the same 14 actions for the year.

The distribution matters more than the total. Sidley notes that over US$215 million, approximately 81%, resulted from a single action against GVA Capital Ltd., and that eight of the 14 actions related to violations of US sanctions targeting Russia. Strip out the largest case and the remaining 13 actions total a far more modest sum. The risk profile is therefore a long tail of modest penalties and a short tail of severe ones, and the severe ones are driven by the facts, not by the size of the company.

For General Counsel, the lesson is not to plan for the average case. A programme that is calibrated to routine settlements of a few million dollars will not be built to prevent the conduct that leads to a nine-figure outcome. That conduct is typically knowing, concealed or repeated, and involves senior people. The control that matters most is the one that stops a decision being made, not the one that records it afterwards.

What to do: review the last three years of your own near-misses and escalations. Ask which would have become a serious case had a senior person pressed ahead, and which control, if any, stopped them. Then ask whether that control depends on a person or a system. Controls that depend on a person's judgement under commercial pressure are the ones to strengthen first.

Context also matters for planning. A General Counsel who reports to the board that enforcement is flat may be reporting the wrong metric. The number of actions is a function of agency resources and case selection; the severity of the worst case is a function of corporate conduct. Boards are better served by a narrative about the conduct that has attracted the most severe outcomes in the last three years, and a plain statement about whether any of that conduct could occur inside the company.

OFAC's 2025 list is instructive. Alongside GVA Capital Ltd. at US$215,988,868 are Interactive Brokers LLC at US$11,832,136, IPI Partners, LLC at US$11,485,352, Gracetown, Inc. at US$7,139,305, an individual at US$4,677,552, and Unicat Catalyst Technologies, LLC at US$3,882,797. The list includes a broker, an investment firm, a catalyst manufacturer and private persons. Sanctions exposure is not confined to banks.

Sidley also records that three of the publicly announced enforcement actions were directed against individuals. That detail should concern General Counsel as much as the corporate penalties. Individuals who approve, structure or conceal transactions can be named, and the personal consequences, including reputational harm and, in some jurisdictions, criminal liability, are not covered by corporate insurance or indemnities in the way a company fine might be.

The pattern also reflects how investors and intermediaries now operate. Capital moves across borders through funds, vehicles and nominee structures. A fund manager or an investment adviser that does not look through to beneficial ownership can find itself dealing in property in which a blocked person has an interest. Private capital transactions, where ownership chains are opaque by design, are especially exposed and merit a standing enhanced-diligence protocol.

The practical consequence is that every business with cross-border dealings should assume it is within scope. If the company has US dollar flows, US-origin goods or technology, US persons in the chain or US-listed counterparties, OFAC can take an interest. For General Counsel, a one-page jurisdictional map showing where US, UK and EU touchpoints arise in the business is a simple but revealing exercise, and it should be refreshed with each new market or product.

The second category worth attention is the sanction that arises from a failure to identify a secondary link. In many enforcement cases the company did not knowingly deal with a listed person; it failed to notice that an owner, signatory or vessel was connected to one. This is a data and process problem as much as a legal one. It argues for investment in ownership data, name-matching quality and the discipline of documenting why an alert was closed.

A useful internal exercise is to ask what the equivalent of each of these cases would look like in your own business. For a fund manager it is a look-through failure; for a broker, a customer in a restricted location reached through a technical workaround; for a manufacturer, an end user hidden behind a distributor. Writing three such scenarios and tracing them through the control framework is quicker than an audit and more persuasive to a board.

The Office of Financial Sanctions Implementation published its 2024-25 annual review in October 2025. Baker McKenzie's summary records 394 suspected breach cases in the year, following a record 396 in 2023-24, with 329 reports relating to Russia sanctions. OFSI also issued 19 general licences and processed 904 specific licensing decisions. The scale of activity shows a regime that is both busy and increasingly expected to enforce.

Steptoe reports that OFSI had 240 active cases under investigation in April 2025, an increase of approximately 40%, and in January 2026 published reforms to its civil enforcement process. OFSI will seek to double the maximum civil monetary penalty from the higher of £1,000,000 or 50% of the breach value to £2,000,000 or 100% of the breach value, introduce fixed penalties of £5,000 or £10,000 for information, reporting and licensing offences, and offer a voluntary disclosure discount of up to 30% of the baseline penalty.

The enforcement record already includes large professional firms. On 20 March 2025 OFSI imposed a £465,000 monetary penalty on Herbert Smith Freehills CIS LLP Moscow for payments to designated persons. The case is a reminder that service providers and advisers, and not only banks and traders, can fall foul of the regime, and that penalties can be imposed for breaches in a foreign office of a UK-registered entity.

The implication is that the UK is moving from a regime that was widely seen as lenient to one with credible deterrence. The fixed penalties for administrative failures are as significant as the headline cap, because they make late reporting and licence non-compliance routine enforcement matters. General Counsel should treat reporting obligations as a process with an owner, a calendar and an audit trail, and should decide in advance when voluntary disclosure will be made.

There is a strategic consequence too. A higher cap and a disclosure discount change the economics of self-reporting. A company that identifies a breach early, investigates it properly and reports voluntarily may receive a significantly lower penalty than one that waits to be found. General Counsel should therefore have a playbook for internal discovery: who is told, who investigates, how privilege is protected, and when the decision to disclose is taken by the board.

The EU's 2024 directive on criminal offences for violating restrictive measures sets minimum standards. Paul Hastings reports that member states must now impose maximum corporate fines of at least 1% to 5% of global turnover, or €8-40 million depending on the breach, and that natural persons face maximum prison terms of at least one to five years depending on the violation. Breaches involving small amounts may be excluded, but the direction of travel is clear.

Implementation is uneven. The transposition deadline of 20 May 2025 passed, and the Commission sent letters of formal notice to 18 member states. For a multinational, uneven transposition means that the same conduct may be treated differently from one EU jurisdiction to another for a time, which complicates group-wide policies. The safe approach is to write policies to the strictest standard in the countries where the group has operations, not to the most lenient.

The listings are also expanding. Steptoe reports that on 23 July 2026 the Council adopted its 21st sanctions package against Russia, designating 216 individuals and entities, the highest number of listings since 2022, and bringing the total number of listed shadow fleet vessels to 673. The package listed 51 entities supporting Russia's military-industrial complex or enabling circumvention, with 27 established in third countries, including two in the United Arab Emirates.

For companies using Gulf hubs for trade or finance, this is a material development. The UAE and other Gulf jurisdictions are major commercial centres, and a counterparty there is not by that fact suspect. But the EU has shown it will list entities in such locations where it believes they frustrate sanctions. What to do: strengthen onboarding for intermediaries in transit and re-export jurisdictions, require end-use and end-user declarations, and monitor listings so that a customer's status is checked continuously, not only at onboarding.

Finally, group structure matters. A multinational with EU subsidiaries, a UK parent and US dollar flows will face several regimes at once, and the rules do not always align. Differences in the scope of jurisdiction, in how ownership and control are defined, and in licensing practice can produce conflicting obligations. A clear hierarchy, with the strictest applicable standard as the default and documented exceptions approved centrally, is easier to defend than a patchwork of local interpretations.

For General Counsel in Saudi Arabia, the UAE and other Gulf markets, the point cuts both ways. Local entities benefit from the expansion of trade and finance but face higher scrutiny from European and American banks and counterparties. A Gulf-based business that can show a tested programme, clean ownership records and prompt answers to due diligence requests will find correspondent banking and partnership discussions easier. Compliance becomes a commercial asset.

Sanctions are often discussed in terms of who you deal with. Export controls are about what you ship, transfer or enable, including technology and software. The Department of Justice announced that Cadence Design Systems agreed to plead guilty and pay aggregate net criminal and civil penalties and forfeiture totalling more than US$140 million, relating to electronic design automation tools supplied to a Chinese university on the Entity List. Cadence and its China subsidiary exported the tools at least 59 times through September 2020.

The case matters beyond its size. The conduct was not a single transaction but a pattern over years, involving a subsidiary and a series of contracts, and the enforcement outcome combined criminal and civil penalties across US agencies. A technology or software business without a rigorous process for classifying products, screening end users and controlling intangible transfers should recognise that exposure in its own operations.

PwC's 2024 Global Economic Crime Survey found that 59% of executives agree export controls have grown more complex in the last two years, and 51% believe they are being enforced more robustly than two years ago. Both figures come from a survey conducted before some of the most recent enforcement, so the direction of travel may be stronger today. They also reflect a view that complexity is outrunning internal capability.

What to do: build a product and technology classification register, and make classification a gating step in product launch and customer onboarding. Include software, data, technical support and cloud services as well as physical goods. Ensure that overseas subsidiaries cannot sign contracts that involve controlled items without central review. Many violations in this field arise not from bad faith but from a regional team that did not know a rule applied.

Intangible transfers are the quietest risk in this field. Sharing technical data with an overseas engineer, granting a supplier cloud access to design files, or letting a visiting delegate see a prototype can all be treated as exports in some regimes. Companies often overlook them because nothing physically crosses a border. A short staff guide, together with access controls on technical repositories, is a proportionate answer and one that the commercial and engineering teams will accept.

PwC's survey gives a diagnosis. Sixty-six per cent of executives consider the possibility of third parties engaging in impermissible activity one of the top two sanctions risks, and 44% consider sanctions compliance a significant priority. Yet only 30% undertake a range of steps to test the strength of their sanctions compliance programme, and a full 19% do not regularly test it at all. The gap between awareness and assurance is the weakness.

Third parties are the hardest part of any programme. Distributors, agents, freight forwarders and joint-venture partners operate under their own controls, make their own decisions about counterparties, and are often paid by results. A General Counsel cannot supervise them directly. They can, however, set contractual requirements, verify through audit rights and sampling, and withdraw from relationships that fail. Those three tools are underused because they require commercial agreement.

Testing is the cheapest improvement available. A simple annual exercise, in which an independent person attempts to route a prohibited transaction through the organisation's controls, will reveal gaps that policy review never finds. It can be supported by review of a sample of closed transactions and a check on whether alerts were cleared with documented reasoning. Regulators treat evidence of testing as a mark of a functioning programme.

The implication is that a programme should be judged by outcomes, not by documents. A strong policy that has not been tested, or an onboarding questionnaire that nobody reads, provides false comfort. What to do: set two or three measurable indicators, such as the share of high-risk third parties with completed enhanced diligence and the share of alerts cleared within a set time, and report them to the board or audit committee at each meeting.

Technology can help, but only if it is configured well. Screening tools that generate thousands of false alerts train staff to clear them quickly. Tuning match thresholds, enriching data with ownership information and measuring alert quality turns the system into a genuine control. General Counsel should ask for the false-positive rate, the average time to clear and the proportion of alerts reviewed by a second person, and should treat poor numbers as a risk to be resolved.

The board has a role here. Directors do not need to understand the technical detail of screening, but they should ask whether the programme has been tested, what the results were and what has changed as a result. A board that asks those three questions each year sets the tone. A board that receives a policy attestation and nothing else has no basis for assurance, and may find itself asked, after an incident, what it knew.

The strongest sanctions programmes we can describe in principle are those where legal review is built into the commercial workflow. In a market-entry decision, that means exposure is assessed alongside the commercial case, when options are still open. In an acquisition, it means sanctions, export-control and ownership-chain diligence is a condition of exclusivity. In a distribution agreement, it means compliance terms and audit rights are negotiated from the outset.

We would put four gates in the process. First, a screen at concept stage, to decide whether a market, sector or counterparty type is closed, restricted or open. Second, an enhanced review of the structure and flow of funds at term-sheet stage. Third, contractual protections at signing, including termination rights, representations and information covenants. Fourth, ongoing monitoring after closing, including re-screening and event-driven review when listings change.

The gates should be proportionate. Not every transaction needs enhanced review, and a programme that treats everything as high risk will be bypassed. A risk-tiering model, using jurisdiction, sector, counterparty type and product, allows low-risk activity to proceed quickly and focuses scarce attention on the cases that need it. Commercial leaders are more willing to accept review when it is predictable and when they can see it distinguishes between routine and unusual cases.

What to do now: agree with the CEO and CFO that no term sheet in a defined set of higher-risk categories is signed without legal sign-off, and document it in the delegation of authority. Brief the commercial teams on three recent cases, such as OFAC's GVA Capital action, OFSI's Moscow penalty and the Cadence plea, so that the cost of late review is concrete. Then test the process on the next live deal, not on a hypothetical one.

Finally, culture. Commercial teams under pressure to close will sometimes treat compliance as an obstacle. The best defence is to make the pathway to a compliant yes as short as possible: pre-approved structures, standard clauses, a named contact and a commitment to respond within a fixed time. When legal is seen as a partner that finds a route, deal teams bring problems forward. When it is seen as a gatekeeper that says no, problems arrive late or not at all.

Where a decision is already in progress, the same logic applies in compressed form. A one-page sanctions and export-control note, produced in days rather than weeks, can identify the three questions that matter most: who ultimately owns and controls the counterparty, where the goods or services will go, and how funds will flow. Even a brief note changes the conversation, because it forces the deal team to put its assumptions on paper.

Karter McKinley helps General Counsel build sanctions and export-control checkpoints into market-entry and deal decisions under our International Expansion and Market Entry service: structuring the gates, mapping jurisdictional exposure and preparing the commercial teams. We work alongside qualified legal advisers and do not provide legal advice.