On The Sanctions Frontline

Thousands of Russian individuals and entities have been sanctioned by more than 20 countries since the war in Ukraine began.

But for financial crime teams and regulatory risk managers implementing these sanctions, the ‘nightmare’ is only just beginning as they unpack what the sanctions really mean for different transactions and parts of their business, and how Russian individuals and entities may be connected. “The sheer volume and complexity of sanctions and nebulous Russian flagships means there is the risk of missing something,” warns David Schwartz, president and CEO of the Financial & International Business Association (FIBA), a US-based non-profit trade body for banks in the US, Latin America and the Caribbean.

Sanctions have been imposed by various countries against Russianstate-owned entities like Sberbank, but when you drill down into the fine print of some of the sanctions, certain transactions with these entities may still be permitted. These nuances just add complexity for banks, says Schwartz. “If a bank has a transaction filter that says no Sberbank transactions can be processed, then you’re done. But if they are allowed to do a transaction with other parties, this will be a nightmare for some banks to manage. Large banks have sophisticated systems, smaller banks do not.”

Implementing sanctions against Russia is not just about scanning names against lists of sanctioned entities and individuals, says Daniel Gutierrez, vice president and Regulatory Risk Manager at Ocean Bank in Miami and co-chair of FIBA’s Legal & Regulatory Affairs committee. “We need to ensure areas of the bank such as trade finance or foreign correspondent banking are trained so they know what to look for.”

Different spellings of Russian oligarchs’ and entities’ names also throw up challenges for bank sanctions screening systems. “When Gaddafi was still alive, there were approximately 160 ways to spell his name,” Gutierrez explains. “We need to calibrate our systems to ensure they are capturing the specific naming conventions and different nuances used in Russian vocabulary.” When it comes to online banking, IP addresses for certain regions need to be disconnected in order to comply, and Gutierrez says it also needs to look at ways  he sanctions could be evaded—the use of a family member or unrelated person not on the sanctions list to get into the banking system—to ensure the bank has controls in place to prevent that from happening.

One of his biggest concerns, he says, is the crypto community. The world’s largest crypto exchange Binance, stated it would not “unilaterally” ban all Russian users as it “flies in the face of why crypto exists.” But Gutierrez says this presents challenges for banks, which are used by crypto exchanges to liquidate. “If the crypto world has said no we will not comply with the level of sanctions imposed on Russia, that’s a concern to us. They should comply with OFAC too.”

But sanctions  have different implications depending on whether you are a centralized or decentralized crypto exchange. Mark Lurie, CEO and co-founder of Shipyard Software, which builds decentralized crypto exchanges (DEXs) like Clipper, says centralized crypto exchanges are already set up to comply as they do KYC and can cross-reference customer names against the Office of Foreign Assets Control’s sanctions list. However, decentralized crypto apps are more complicated, he adds, as they are non-custodial and don’t usually do KYC, which means they can’t easily cross-reference users to the normal OFAC lists. “What DeFi can do is blacklist specific wallet addresses. Clipper, for example, blacklists all OFAC addresses,” he explains. “We built it into the smart contracts. But we need OFAC to update that list of addresses.” Lurie hopes other DeFI protocols take a similar approach to Clipper, but he says most do not blacklist these wallet addresses. Instead they are taking a clumsy approach of blocking all Russian IP addresses, which is overly broad and unfair to specific users. All it’s going to do in practice is drive users toward less compliant DEXs.”

The sanctions challenges doesn’t end there. Often sanctions or executive orders contain information not only concerning what activities are prohibited, but also ‘general licenses’ relating to certain types of business that are still permitted. “When you get into the specific language of these general licenses you’ll find they’re very broad,” says Gutierrez. He reports that the banking industry in South Florida is already fielding queries from Latin American banks, which route customer transactions bound for Russia via US dollar accounts, asking whether a specific plant or flower their customers want to export, fits into the agricultural general license contained in US sanctions against Russia.

“The first thing I would recommend for banks in Latin America that have these customers, is to lawyer up,” says Gutierrez. “If the transaction comes through, and the name of the originator is broad and the name of the beneficiary doesn’t give me the analysis I need, or there are no references on the wire that tells me this is for a specific business included in the general license, then I’m going to stop that wire and start requesting supporting documentation like bills of lading and invoices. If the shipment contains not only flowers, but also other items, Gutierrez says he would be reluctant to let it through until he has legal advice to support the bank’s decision. “But why should the US bank be the only one getting with their attorneys and spending that money to get a comfort level? Let’s meet halfway, so when the transaction is processed, both banks are aware of what is going on.”

One of the biggest challenge banks are likely to face, says Schwartz of FIBA, is countries in Latin America that don’t have sanctions regimes. The concern, he says, is countries like Venezuela, for example, could be used to divert Russian money. “That creates concerns in correspondent banking  in terms of which banksdid sanctions due diligence before it reaches me. It can pass through two, three, four different hands. LatAm banks are not going to want to run the risk of losing US correspondent banking relationships, but it is a question of whether they are set up to do a sophisticated level of OFAC screening.”