What to do if a customer is added to a sanctions list

Step 1: confirm the match

Read the new listed entry in full and compare it with your customer: legal name, aliases, country, address, registration number, owners. Check also whether the customer is owned or controlled by the newly listed party, because that can restrict it even when its own name is not on the list. Record the comparison and the result.

Do this quickly but carefully. New designations are often published with limited identifying data, and the same name can belong to several companies. If you cannot confirm or exclude the match within a short time, treat the customer as restricted while you collect more information, rather than letting payments continue by default.

Step 2: stop all dealings

Once the match is confirmed, stop making funds, goods or services available to the customer, directly or indirectly:

• block outgoing payments, refunds and credit notes;
• stop shipments and the provision of services;
• suspend access to platforms, accounts and software;
• tell sales, finance, logistics and customer service at once, in writing.

Restrictions often cover indirect dealings too, so watch for attempts to redirect payments or deliveries through third parties.

Check automated processes as well: recurring direct debits, scheduled payment runs, automatic renewals and integrations that ship orders without human approval. These are the places where a payment or a delivery most often slips through after a listing.

Step 3: freeze funds and assets

Funds or economic resources belonging to the listed party that are in your possession or control must be frozen: not moved, transferred, used or dealt with. In the United States, the property must be blocked, and incoming payments for the listed party are typically placed in a blocked, interest bearing account rather than returned. In the European Union and the United Kingdom, frozen funds stay where they are until the authority decides otherwise.

Step 4: report to the authority

Reporting obligations and deadlines differ by regime:

• United States: blocked property must be reported to the Office of Foreign Assets Control within 10 business days, and rejected transactions are reported within the same period, under 31 CFR part 501. Holders of blocked property also file an annual report.
• European Union: frozen funds and information that would facilitate compliance are reported to the national competent authority of the Member State concerned. The European Commission publishes the list of competent authorities.
• United Kingdom: relevant firms must report frozen assets and suspected breaches to the Office of Financial Sanctions Implementation as soon as practicable, following its reporting guidance.

If you suspect a breach already happened, for example a payment made after the listing, many authorities treat a voluntary disclosure as a mitigating factor.

Step 5: licences and open contracts

Some activities can continue under a licence: general licences published by the authority, for example to wind down existing contracts within a set period, or specific licences requested for a single case. Read the general licences issued with the new designation carefully, because they often have short deadlines. Without a licence, do not perform open contracts, accept payments outside the frozen account or settle debts with the listed party.

Step 6: records and review

Keep a full file: the listed entry, the match review, the instructions given internally, the frozen amounts, the reports filed and the correspondence with the authority. In the United States, records must be kept for 10 years. Then ask what the case teaches: how quickly was the listing found, and would a daily check have found it sooner?

What is at stake

Payments made to a listed party after the designation can be treated as violations. The maximum penalties set by law are shown here:

• United States, OFAC: up to $377,700 per violation or twice the value of the transaction; criminal penalties up to $1,000,000 and 20 years in prison. (source)
• United States, BIS (export controls): up to $374,474 per violation or twice the value of the transaction. (source)
• United Kingdom, OFSI: up to £1,000,000 or 50% of the value of the breach; criminal penalties up to 7 years in prison. (source)
• European Union, Directive 2024/1226: fines on companies of at least 5% of worldwide turnover or €40,000,000, and prison terms of at least 5 years. (source)
• Germany: fines on companies up to €40,000,000. (source)
• Netherlands: fines on companies up to 10% of annual turnover. (source)

Maximum amounts set by law, as published by the authorities linked, checked on October 29, 2026.

Where Unicorn Intelligence fits

Unicorn Intelligence alerts you the same day a customer in your CRM appears on an official list, with the evidence for your file; new accounts receive a $50 credit.

Frequently asked questions

What should I do first if a customer is sanctioned?

Confirm the match against the listed entry, then stop all payments, deliveries and services to the customer and inform your internal teams in writing.

Can I return the money to a sanctioned customer?

Generally not. Funds of a listed party must be frozen, not returned. In the United States they are typically held in a blocked, interest bearing account.

Do I have to report to the authorities?

Yes. In the United States blocked property is reported within 10 business days. In the EU you report to the national competent authority, and in the UK relevant firms report to the Office of Financial Sanctions Implementation.

Can I finish an existing contract?

Only if a general or specific licence allows it. Check the general licences issued with the designation, which often have short deadlines.

What if a payment went out after the listing?

Record the facts and inform your legal or compliance advisers at once. Many authorities treat a prompt voluntary disclosure as a mitigating factor.