Sanctions Due Diligence Checklist for Financial Institutions

A financial institution can screen a customer against a sanctions list and still miss important risks. A customer may use an alias, own a company through several layers, or become sanctioned after onboarding.

That is why sanctions due diligence needs to go beyond a one-time sanctions check. Financial institutions need a structured process for screening customers, beneficial owners, transactions, and counterparties, investigating potential matches, and keeping records of decisions.

This sanctions due diligence checklist breaks the process into practical steps financial institutions can use to strengthen sanctions screening, AML watchlist checks, and AML sanctions screening.

What Is Sanctions Due Diligence?

Sanctions due diligence is the process of identifying and assessing whether customers, businesses, beneficial owners, counterparties, or transactions may be connected to sanctioned individuals, entities, countries, or activities.

A typical sanctions screening process compares customer or transaction information against relevant sanctions lists and watchlists. A sanctions check may happen during onboarding, before a transaction, when customer information changes, or when a sanctions list is updated.

For financial institutions, effective AML sanctions screening should not stop at matching a customer's name. It should consider aliases, spelling variations, ownership structures, jurisdictions, and other information that can help determine whether a potential match is genuine.

More so, an AML watchlist may include sanctions lists as well as other risk databases used by a financial institution. The exact sources a bank or fintech needs depend on its jurisdictions, customers, products, and regulatory obligations.

For example, a Nigerian bank serving international customers may need to consider relevant Nigerian, UN, US, UK, EU, and other applicable sanctions sources rather than relying on a single list. 

Why Sanctions Due Diligence Matters for Financial Institutions

Imagine a bank onboards a new corporate customer. The company itself does not appear on a sanctions list, so the account is approved.

A few months later, the bank discovers that one of the company's ultimate beneficial owners (UBO) has been added to a sanctions list. If the bank only performed a one-time sanctions check at onboarding, it may have missed the change.

This is why sanctions due diligence should be ongoing. Financial institutions need to know who they are dealing with and whether their risk profile changes during the customer relationship.

Effective sanctions screening helps institutions:

• Identify sanctioned individuals and entities before onboarding or processing transactions.

• Detect potential exposure through beneficial ownership structures.

• Support ongoing AML watchlist monitoring.

• Reduce the risk of processing prohibited transactions.

• Create evidence of screening and investigation decisions.

• Strengthen broader AML sanctions screening controls.

A good sanctions check also needs context. A name match does not automatically mean a customer is sanctioned. Compliance teams need enough information and oversight to determine whether the customer is the same person or entity on the list.

Sanctions Due Diligence Checklist

Use this sanctions due diligence checklist to review your institution's current process.

1. Define the Sanctions Lists You Need to Screen

Start by identifying the sanctions lists and other watchlists relevant to your institution.

Your sanctions screening programme should cover the jurisdictions where you operate, the currencies you process, your customer base, and your correspondent banking relationships.

Checklist:

• Identify applicable international sanctions lists.

• Identify relevant local and regional lists.

• Document why each list is included.

• Make sure list updates are received promptly.

• Review the list universe regularly.

An AML watchlist program should also make it clear which lists are used for sanctions purposes and which are used for other compliance checks.

You Should Read: What Is a Sanctions List?

2. Screen Against Sanctions Lists

Run the customer's information against the sanctions lists that apply to your institution, customers, jurisdictions, and products.

Key sanctions lists include:

• OFAC SDN List (U.S.): Specially Designated Nationals and Blocked Persons

• UN Security Council Consolidated List: Individuals and entities subject to UN sanctions measures

• EU sanctions: EU restrictive measures and associated sanctions listings

• UK Sanctions List (OFSI): Individuals and entities subject to UK financial sanctions

• Relevant national and regional sanctions lists: Lists issued by authorities in the countries where your institution operates or does business

Do not treat every AML or law-enforcement database as a sanctions list. FATF's black and grey lists, for example, identify jurisdictions subject to increased monitoring or other AML/CFT concerns rather than sanctioned individuals or entities.

Other databases, such as law-enforcement or debarment lists, can still form part of a broader AML watchlist or risk-screening program where relevant.

3. Screen Customers at Onboarding

Every new customer should go through an appropriate KYC and sanctions check before the relationship is established or services are provided.

For individuals, this may include their full name, date of birth, nationality, and other identifying information.

For companies, the sanctions due diligence process should also consider directors, shareholders, and ultimate beneficial owners where appropriate.

4. Screen Beneficial Owners and Related Parties

A company may not appear on a sanctions list even though someone who owns or controls it does. 

Checklist:

• Identify ultimate beneficial owners.

• Screen relevant owners and controllers.

• Review directors and related parties where required.

• Review complex or layered ownership structures.

• Document how ownership information was assessed.

5. Screen Transactions and Counterparties

Customer screening alone is not enough. Financial institutions should determine whether their risk profile requires sanctions screening at the transaction level. This can help identify potential exposure involving sanctioned counterparties, beneficiaries, originators, vessels, jurisdictions, or other relevant information.

Transaction-level sanctions checks are particularly important for banks handling international payments and correspondent banking activity.
 

Read Also: Sanctions Checks: A Full Guide to AML Compliance

6. Re-screen When Risk Changes

A customer who passes an initial sanctions check can become a sanctions risk later.

Re-screening should therefore be triggered by relevant events, including sanctions list updates, changes to customer information, ownership changes, or other risk events.

This turns sanctions due diligence from a one-time onboarding activity into an ongoing control.

7. Investigate Potential Matches

Not every alert generated by AML sanctions screening is a confirmed sanctions match.

Compliance teams should investigate potential matches using additional information such as:

• Full name and aliases

• Date and place of birth

• Nationality

• Address

• Identification numbers

• Company registration details

• Ownership information

• Transaction information

The purpose of the investigation is to determine whether the alert is a true match, a false positive, or requires further escalation.

8. Document the Decision

Every important sanctions check should leave an audit trail. Record what was screened, which list was used, when the check occurred, what alert was generated, what information was reviewed, and why the final decision was made.

This documentation helps demonstrate that the institution's sanctions due diligence process is being applied consistently.

9. Escalate Confirmed or High-Risk Matches

A potential sanctions match should follow a defined escalation process.

The compliance team should know who reviews alerts, when senior approval is required, what actions can be taken, and when reporting or other regulatory obligations may apply.

A clear escalation workflow is an important part of both sanctions screening and broader AML sanctions screening.

Common Sanctions Due Diligence Gaps and How to Fix Them

Even institutions with an AML watchlist program can have gaps in their controls.

- Relying on One Sanctions List

Screening only one list can leave gaps.

Fix: Build a documented list universe based on your customers, jurisdictions, products, and regulatory obligations.

- Screening Only at Onboarding

A customer can become a sanctions risk after the initial sanctions check.

Fix: Introduce ongoing sanctions screening and event-driven re-screening when relevant lists or customer information change.

- Ignoring Beneficial Ownership

Screening only the registered company may miss sanctioned individuals behind the business.

Fix: Include beneficial ownership in your sanctions due diligence process.

- Treating Every Name Match as a Confirmed Hit

Common names can create large numbers of false positives.

Fix: Use additional identifiers, configurable matching rules, and human investigation to determine whether a potential match is genuine.

- Keeping Poor Records

A financial institution may have completed the right sanctions check but struggle to prove it later.

Fix: Keep clear records of screening results, alerts, investigations, decisions, and escalations.

- Depending Entirely on Manual Screening

Manual AML sanctions screening can become difficult to manage as customer and transaction volumes increase.

Fix: Automate routine checks while keeping human review for alerts and cases that require judgement.

How to Strengthen Sanctions Screening with Youverify

Effective sanctions due diligence needs more than checking an AML watchlist. Financial institutions need a clear workflow for screening, investigating potential matches, and taking the right action.

Youverify Cowork brings sanctions screening into a unified compliance workspace, helping teams manage identity checks, watchlist screening, transaction monitoring, investigations, and regulatory reporting in one workflow. Automated sanctions checks handle routine screening, while compliance teams retain control over reviewing and resolving potential matches.

When a potential risk requires further investigation, Cowork connects the alert to the relevant customer and transaction information, making it easier for teams to assess the case and document their decision.

Need help strengthening your sanctions controls? Speak to our fraud analysts to discuss your screening and compliance needs.

About the Author: