Guides · Updated 10 October 2026

Sanctions screening for small businesses

Which lists matter, who to screen and when, how to handle a potential match, and what to do if a match turns out to be real.

Why it isn't only for banks

Sanctions rules apply to every business, not just banks and large exporters. In the EU, the UK and the US, it's against the law to make money, goods or services available to a sanctioned person or company, directly or indirectly, or to deal with their assets. That includes selling to them, buying from them, and paying them.

Not knowing is a weak defence. In the UK, the Office of Financial Sanctions Implementation (OFSI) can fine a business for a breach even if it didn't know or suspect it was dealing with a sanctioned party, and the US applies the same strict standard. The EU now requires every member state to treat deliberate sanctions breaches as a crime.

Which lists matter

EU Consolidated Financial Sanctions List: binding on anyone in the EU and on EU companies everywhere.
UK Sanctions List: binding on anyone in the UK and on UK businesses abroad.
US OFAC Specially Designated Nationals (SDN) List: binding on US businesses and people, but it reaches further: payments in US dollars usually pass through the US banking system, and banks may block them.
UN Security Council Consolidated List: the EU and the UK put most UN sanctions into their own lists, but often with a delay.

The lists change often, sometimes several times a week. A customer who was clear when you took them on can be added later.

Who to screen, and when

New customers and suppliers, before the first sale or payment.
Existing ones whenever a list is updated, not just once a year.
When something changes: a new owner, a new country, a payment from or to an unexpected place.
Owners, for higher-risk relationships. A company that isn't listed can still be caught if a sanctioned person owns or controls it, so for customers in higher-risk countries or sectors, find out who owns them and screen those names too.

Handling a potential match

Screening compares names, and names are messy: transliterated, abbreviated, shared by unrelated companies. Most potential matches are false. A potential match isn't a finding that the company is sanctioned; it's a prompt to look closer.

Open the list entry and compare it with what you know: country, address, registration numbers, dates.
If the details clearly differ, record why you decided it's a false match, and carry on.
If you can't rule it out, pause the transaction until you can, and take advice.

If the match is real

Don't complete the sale or the payment, don't release goods, and don't tell the customer why in a way that would help them get around the sanctions. Hold any money you owe them. Then report it to the authority: OFSI in the UK, your country's competent authority in the EU, or OFAC in the US. Reporting frozen funds is often a legal duty, and a lawyer can help with what to do next.

How Validitool screens

Validitool screens company names against the EU, UN, UK and US OFAC lists, each refreshed daily from its official publisher. Each potential match shows the list entry, its reference and how similar the names are.

Monitoring (all paid plans): companies on your watchlist are screened again whenever a list is updated, and you're emailed about any new potential match.
Bulk uploads (Growth and Scale): every company in the spreadsheet can be screened as its VAT or EORI number is checked.
The compliance check API (all paid plans): one call checks a counterparty's VAT and EORI numbers and screens its name, with a PDF certificate as a record.

Validitool screens the company names you give it and those in the official registers. It doesn't find out who owns a company, so screening owners and directors is up to you.

See plans with sanctions screening

Sanctions screening is on paid plans, from $9 a month.

This guide is general information, not tax or legal advice. Rules and their application differ by country and by transaction; check with an adviser for your situation.