Sanctions pose significant challenges for businesses due to their rapid changes and wide-reaching effects on trade relationships. In this conversation, David Savage and Daniel Martin discuss the complexities of managing sanctions, highlighting key issues like unpredictable geopolitical triggers, compliance responsibilities, and the need for proactive risk management. They also share practical steps for improving resilience against sanctions-related disruptions.

‍

Why are sanctions challenging for businesses to manage?

David: The key challenge with sanctions, compared to other trade rules like export controls, is how quickly they change.

Sanctions react almost immediately to geopolitical events.

Example: On the same day Ukraine was invaded by Russian forces—24 February 2022—the EU froze President Putin’s and Foreign Minister Lavrov’s assets.

Another challenge is that sanctions force businesses to consider all their trading and financial relationships, not just with direct customers and suppliers. Businesses must also monitor their customers' customers, their suppliers' suppliers, and any banks or financial intermediaries involved.

‍Example: The company itself may fully comply with sanctions, but its supplier sources parts from a sanctioned country. The company may still face penalties.

Sanctions can have a significant business impact on companies. Oftentimes sanctions hit companies unprepared. Is it possible to predict sanctions?

David: Prediction is difficult. Coercive sanctions—those imposed to force a change in behaviour by exerting pressure on a country or entity—are particularly hard to predict because they are tied to geopolitical strategy. It is not only difficult to foresee the event that triggers the sanctions, but also to anticipate which pressure points governments will use to change behaviour and to what extent they are prepared to inflict harm on their own domestic industries.

Example: When sanctions were imposed on Russia after the annexation of Crimea in 2014, many companies did not anticipate how intensely the energy sector would be affected. Businesses believed that due to Europe's heavy reliance on Russian oil and gas, sanctions against this sector were unlikely.

Who responds first when new sanctions emerge: companies or banks?

Daniel: Most major financial institutions have sophisticated compliance systems that automatically block payments when a counterparty is added to a sanctions list. Banks are very proactive today because they have been fined millions for breaches in the past.

However, the legal responsibility still falls on the company itself to ensure they are not violating sanctions. So, companies need to invest in their own systems to fulfil their legal obligations.

What happens if Company A has a contract to supply products to Company B, and Company B is suddenly hit with sanctions? Can Company A be sued for damages if they stop supplying Company B?

Daniel: In short, yes. If Company A stops supplying Company B, they may be in breach of their contract. However, if Company A is forced to choose between violating either the contract or the sanction rules, they are likely to follow sanctions rules, because the consequences of breaching them can be so severe.

Example: In 2018, when the U.S. reinstated sanctions against Iran, French energy company Total had a contract to develop the South Pars gas field in Iran. With the re-imposition of sanctions, Total had to cease its operations to comply with U.S. laws.

How can companies assess their litigation risks?

Daniel: Companies should first check if the contract has a sanctions clause that allows Company A to stop supplying Company B should sanctions impact the continuing operation of the contract. If a well-drafted sanctions clause exists, the problem generally disappears. Company A will not need to supply if the sanctions prohibit the sale.  

A sanctions clause ensures both parties comply with any applicable sanctions. If sanctions affect either party or the deal, the impacted party can suspend or terminate the agreement without being liable. Sanctions can be treated like an unavoidable event under the contract, so the party affected is not responsible for delays or failure to perform. Parties are usually required to inform each other if sanctions impact their ability to fulfil the agreement.  

If such sanction clause does not exist, there could be an at least technical breach of the contract. But then Company A should still assess broader legal principles like illegality or frustration and whether those principles would justify Company A to stop supplying.

If Company A and B are in different countries, what law applies?  

David: The first point to note is that the key factor is what the contract says – most contracts will state what law governs the relationship between the parties.  Practically, however, one is dealing with two potentially opposing regimes. One country may allow Company A to stop supplying, but the other law in the other country may not—which is likely especially if the other country is the one facing sanctions, such as Russia. This can create a number of problems.

Indeed, Russia has taken significant steps to limit foreign legal influence on its companies. They have passed laws that let Russian courts address contractual disputes that would usually be dealt with in other countries. If Company B is in Russia and brings a claim in a Russian court against Company A for non-performance, Company A may face difficulty defending itself on the grounds that it complied with a non-Russian sanction targeting Russian entities.

It seems hard to achieve legal certainty once sanctions are in place. Are there other ways to reduce the risk?

David: In any jurisdiction where your company has assets or personnel, there is an inherent risk of business harm if sanctions apply. No legal structure or argument, however strong, can completely eliminate that risk.

This is why many organisations are trying to anticipate restrictions to minimise the chance of supply chain disruptions. We have recently observed a significant amount of “self-sanctioning”, where global companies decide to stop doing business with Russia or Iran because the risk of their supply chains ultimately being disrupted is too high.

What are some simple and effective steps companies can take to improve their resilience against supply chain disruptions?

David: From both a risk management and business strategy standpoint, we recommend companies closely monitor the following:

• First, understand your customers and suppliers, including your suppliers’ suppliers and your customers’ customers. This is a key step in reducing both enforcement risks and potential supply chain disruptions. Example: The U.S. authorities took enforcement action against U.S. cosmetics company e.l.f. after components of makeup kits they purchased from China were traced back to North Korea.

• Second, keep close track of where your assets are, particularly valuable and crucial ones (e.g., intellectual property, valuable freight, machinery). When sanctions apply, it is often not about who has the better legal argument but rather about practicalities of recovering these assets.

• Third, know where your people are. Our clients have had issues with expatriate staff, where they could not pay salaries because the employees banked with sanctioned institutions.

What are the jurisdictions that impose the most stringent sanction regimes and need to be monitored particularly closely?

David: The UK and EU have the most stringent measures against Russia, primarily due to geographical proximity and reliance on Russian fuels. The U.S. too has significant sanctions on Russia but has taken a different approach when it comes to implementing these sanctions.  ‍

What are the most impactful sanctions today?

Daniel: Based on the time David and I spend on counselling on sanctions, about 70% relates to Russia, with the other 30% often involving Iran, Syria, and Venezuela. That reflects broad views in the market about which are currently the key sanctions programmes, as well as the areas where they have sanctions compliance challenges.

Companies that are scaling quickly often lack the resources of larger organizations to manage sanctions compliance at the same level. How can leaner businesses effectively handle sanctions risks?

David: The first thing we advise startups and growth companies is to ensure they have strong contractual protections. That is key when engaging with third parties—you need those protections in place from the start.

Next, consider where you are actively marketing your products. If you are actively marketing your products in the U.S., for example, you need to monitor U.S. sanctions against other states or entities. Generally, the same applies to EU and UK sanctions.  

When it comes to sanctioned individuals, any screening can either be automated or handled manually, depending on the number of suppliers and customers you have.

Last, designating someone with responsibility for sanctions compliance within the organisation is important. We often see General Counsels taking responsibility, but I think we have reached a point where it is unrealistic to expect someone to handle this alongside other duties.  

When implementing a process to comply with sanctions, what common mistakes have you observed, and how can companies avoid them?

Daniel: First, do not assume that effective compliance is only about systems and controls—it is equally about the organization and the people managing them. One of my most rewarding projects involved a client whose compliance manager, responsible for sanctions, was widely perceived as a block on business. The company was considering replacing him. However, we discovered that his frustration stemmed from the organizational structure. By moving sanctions due diligence and decision-making from the final stage of the process to being a part of the business onboarding phase, he was able to gather information and influence decision-making much earlier in the process. This prevented deals from being blocked at the last minute, and as a result, he stayed with the company for much longer.

Second, invest some time in producing your compliance training materials. The key to successful training is ensuring materials are clear and relevant. A generic training deck cannot address the specific issues your company faces. It's essential to tailor sanctions training for different parts of your business to ensure it is practical and effective.  

In an increasingly multipolar world, companies that operate on both sides of a conflict must prepare for conflicting sanctions regimes. How can businesses manage their exposure?

Daniel: Companies sometimes try to mitigate this risk by ring-fencing or air-gapping parts of their organization. Ring-fencing involves isolating certain parts of the business, such as subsidiaries or departments, to prevent them from being subject to sanctions which are imposed on the parent company or other divisions.  

Example: A European subsidiary might be ring-fenced from the operations of a U.S.-based company to avoid their activities exposing the parent to U.S. sanctions against Venezuela.

Air-gapping is a more extreme measure, where there is no physical or electronic communication between parts of the organization to ensure they remain separate. An example would be keeping IT systems or decision-making processes entirely independent between branches in different countries.

In our experience, managing these strategies can be extremely difficult, especially if the company has centralized legal, compliance, or treasury functions, or if individuals take on multiple roles. Convincing regulators that Person A didn’t know what Person B was doing is a tough task.

Regardless of the strategy, companies must always keep jurisdiction in mind. For example, anyone physically present in the U.S. is automatically subject to U.S. jurisdiction. I recall being in a hotel in New York, overlooking the UN building when I received a call from someone on the SDN list, asking for help to get off the list. Since I was keen to comply in full with U.S. sanctions, I promptly ended the call.  

What is the single most important advice for companies looking to future-proof their business against the impact of sanctions?

David: Never assume someone else is handling your compliance responsibilities. Relying on counterparties to meet your own compliance obligations is a critical mistake. Similarly, don't assume there is perfect alignment between you, your bank, and your customer.

Banks, having faced millions in fines for sanctions breaches, often take a “freeze first, ask questions later” approach. If they have concerns about a payment, they may freeze the funds and report it to regulators, making it difficult to reach their internal sanctions team for clarification.

In short, a company must take full responsibility for its own sanctions compliance.

‍

David Savage and Daniel Martin are partners at Holman Fenwick Willan (HFW) in London.