How to build an effective corporate compliance system

Mainstream

Building an effective corporate compliance system is not a formal code of ethics or a set of formulaic policies. This is the introduction of a working mechanism that allows the company to safely conduct business in the context of multiple jurisdictional requirements and rapidly changing sanctions regimes.

The question is not whether the company has any compliance documents. The main question is whether the system works in a way that actually prevents violations, protects assets and management from liability.

An effective compliance system starts with three checks:

1. What specific risks do our operations pose in terms of sanctions, export controls and regulatory restrictions?
2. How to build procedures that don’t paralyze business but cut off unacceptable transactions
3. How to ensure that every employee at their level understands and adheres to the rules and that the system responds to change quickly.

If these three issues are not addressed, the company either lives in the illusion of security or loses opportunities due to excessive compliance barriers.

When a company needs to build or revise a Compliance system

The construction or audit of a corporate compliance system is critically necessary if:

• the company enters international markets or interacts with foreign counterparties;
• business involves dual-use goods, technologies or services;
• The supply chain includes jurisdictions with increased sanctions risks (including the EAEU countries, Iran, North Korea, Syria);
• The company attracts foreign financing or interacts with Western banks;
• export restrictions are in force in the EU, the USA (EAR, ITAR), the UK and other countries;
• Russian contractors or beneficiaries are already included in the sanctions lists (SDN, SSI, EU Consolidated list);
• Respecting counter-restrictions and decrees of the Russian Federation (e.g., Decrees No. 79, 81, 95, counter-sanctions regulation) is required;
• The company deals with goods subject to export control (including: codes of the CN FEA of the EAEU, lists of the Ministry of Industry and Trade;
• transactions are structured with the participation of companies from friendly and unfriendly jurisdictions;
• Compliance requirements arise from partners;
• The company plans an M&A, IPO or a strategic investor.

The mistake most companies make

Many companies start with the question:

“What policies should we adopt?”

That's the wrong first question.

The right question is:

What risks are threatening our business and how do we build the minimum protections that are sufficient and work?

Sometimes the best results come from a focus on contractor screening and automation. Sometimes a deep classification of the nomenclature of goods. Sometimes, the restructuring of the contract base. Sometimes – training top management and creating a compliance committee. The compliance system is not a set of documents, but a management technology that is inscribed in business processes.

Step 1. Risk assessment (Risk Assessment)

The first thing to do is not to order policy templates, but to map risks.

Key areas of evaluation:

• Sanctions risks: whose jurisdictions are applicable (US, EU, UK, UN, Russian counter-sanctions); What contractors, banks, cargo carriers participate.
• Export and control risks: whether the products are subject to the regulations (EU 2021/821, US EAR, ITAR, Russian 312-FZ, decisions of the EEC Board); What is the ECCN classification and license?
• End-use risks: whether products are restricted in persons or countries, including for military end-use purposes.
• Supply chain risks: at what stage the transfer of goods occurs, who is the actual manufacturer, consignor, consignee.
• Corruption risks and risks of business reputation: FCPA, UK Bribery Act, Russian anti-corruption legislation.
• Risks of currency regulation: Restrictions on foreign exchange transactions between residents and non-residents, special procedures under Decree No. 79.

Without a good risk map, the system is blind.

Step 2. Develop policies and procedures

Only after understanding the risks can we start to document.

Preparation should be made for:

• Code of Conduct (Code of Conduct)
• The Sanctions Compliance Policy (SCC)
• Export Control Policy (Export Control Policy)
• The due diligence policy of counterparties (KYC/KYS);
• Screening Procedure (Screening Procedure)
• The procedure for identifying red flags (Red Flags)
• The policy of reporting violations (Whistleblowing);
• Procedure for internal investigations;
• Gift and hospitality policies;
• Regulations on the compliance committee.

It is important that politicians do not copy Western models without adapting to Russian realities and counter-regulation. Each document should answer the question: “How exactly will we act in a particular situation?”

Step 3. Implement screening and in-depth due diligence

The heart of any system is the verification of counterparties.

Effective compliance does not require a single check, but continuous screening:

• automatic screening for sanctions lists (OFAC SDN, EU Consolidated, UK Sanctions List, Russian list on PP No. 1300, lists of the US Treasury, etc.);
• identification of beneficial owners (up to the end natural persons);
• verification of related companies and group structures;
• analysis of jurisdictional risks of the country of registration, bank, cargo route;
• identification of subsanctioned indirect signs (addresses, directors, coincidences in the chain of ownership of 50% or more);
• Monitoring of daily changes in lists (continuous screening).

Automation is critical here. Manual screening stops working with hundreds or thousands of contractors.

Step 4. Provide training and information to staff

The most perfect policies are useless if employees don’t know about them or don’t understand why they’re needed.

The training system should include:

• mandatory introductory course for all employees;
• in-depth trainings for sales, procurement, logistics, finance, lawyers;
• Regular update of knowledge when changing regulation;
• analysis of practical cases and red flags;
• testing of material assimilation;
• Compliance officer mentoring for key units.

The goal is to create a culture where the employee is not just “following instructions” but is aware that a wrong act can lead to a payment block, personal liability or criminal prosecution.

Step 5. Incorporate compliance into contractual work

Contracts are the first line of defense.

International and domestic treaties should include:

• Sanctions Clause with the right of immediate termination;
• Export Control Clause prohibiting re-export in violation of applicable regulations
• assurances about the absence of the counterparty in the sanctions lists;
• End-Use and End-User Undertaking (End-Use/End-User Undertaking)
• the right to suspend execution when red flags are triggered;
• The obligation of the counterparty to inform about the change in the ownership structure.

Reservations must be adapted to the applicable law and effectively protect the company in the event of litigation.

Step 6. Ensure monitoring, auditing and continuous improvement

The compliance system cannot be static.

It is necessary:

• Update the risk map quarterly;
• conduct internal audit of compliance procedures at least once a year;
• Monitor changes in the regulation of all relevant jurisdictions;
• Test the effectiveness of screening and procedures on model transactions;
• Analyze incidents (including: Delays in payments by banks) and lessons learned;
• Involve external consultants to independently assess the maturity of the system.

Only a living, adaptive system can provide real protection.

Step 7. Establish a mechanism for investigation and interaction with regulators

Even in a well-established system, there may be violations. It is important how the company reacts to them.

It is necessary to have:

• the procedure for receiving and recording reports of violations (hotline);
• guarantees of protection of applicants from reprisals;
• Procedure for conducting an internal investigation;
• Protocol of escalation to the Board of Directors or Compliance Committee;
• criteria for voluntary disclosure to regulators;
• Strategy of interaction with Russian and foreign government agencies.

The right response can mitigate or even eliminate liability for the company and its officials.

Step 8. Consider the specifics of Russia and the CIS: Counter-sanctions and currency control

A compliance system focused only on Western sanctions would be blind to the risks of the Russian legal landscape.

It is necessary to build:

• compliance with the decrees of the President of the Russian Federation on counter-sanctions (Nos. 79, 81, 95, 138, 416, etc.);
• special procedure for transactions with residents of “unfriendly” states (requirements of the Government Commission);
• restrictions on dividend payments and repatriation of capital;
• ban on transactions with shares of LLC and shares of JSC without permission;
• currency control: restrictions on foreign exchange transactions, mandatory repatriation of proceeds;
• special rules for settlements involving accounts of type “C”, “Z”, etc.

Ignoring this block makes the system incomplete and dangerous for business in Russia and the CIS.

Step 9. Classification of goods and export controls

For manufacturing and trading companies, export-control compliance is critical.

The system shall include:

• classification of goods according to the EAEU FEA HS and lists of dual-use goods;
• definition of applicable export controls (Russian, EU, USA);
• obtaining the necessary licenses, permits and conclusions (FSTEC, Ministry of Industry and Trade, customs authorities);
• Procedure for identifying goods with an unknown ECCN code;
• control of re-exports: guarantee that the sanctioned products will not reach the banned countries or end users.

Lack of attention to export control - the risk of criminal liability under the article. 226.1 of the Criminal Code of the Russian Federation and analogues abroad.

Step 10. Automate processes where possible

Automation greatly increases reliability and reduces the impact of the human factor.

An effective system uses:

• Integration of screening with accounting systems (SAP, 1C);
• automatic updating of sanctions lists;
• robots for initial verification of counterparties (registration data, beneficiaries);
• dashboards for compliance officer and top management;
• Red flag alerts with automatic transaction blocking prior to verification;
• Document management systems with mandatory compliance checklists.

Technology does not replace the expert, but frees up his time to analyze complex cases and improve the culture of compliance.

Formal compliance vs. effective system: pick

The choice does not depend on the size of the company, but on the strategic maturity of the management.

How to strengthen the system before problems arise

The best compliance is implemented when the “thunder has not yet come.”

Preferably preventively:

• conduct an independent audit of existing procedures;
• train the board of directors and top management personally;
• Standardize compliance clauses for all types of contracts;
• set up automatic screening for the entire counterparty base;
• identify a compliance officer with direct access to the Director General;
• create a compliance committee with the participation of business block managers;
• Prescribe KPI compliance for key employees.

The system must be prepared for a crisis before it comes.

Common mistakes in building a Compliance system

1. Start by buying software without understanding the risks. The tool should follow the strategy, not the other way around.
2. Copy Western politicians without taking into account Russian counter-sanctions. It creates a gap between the document and reality.
3. Do not involve management ("tone from the middle"). Compliance does not work if the first person shows neglect.
4. Compliance is the function of lawyers only. This is a business function that requires the involvement of commerce, logistics, IT.
5. Ignore the currency regulation of the Russian Federation. This leads to blocking payments and penalties.
6. Checking the contractors only at the beginning of the relationship. Sanctions lists are updated daily.
7. Do not flag red flags or decisions. The absence of an audit trail makes it impossible to protect the company.
8. Save money on training. Employees become the weakest link.
9. Delay internal investigation at the signal. It allows the problem to grow.
10. Neglecting export classification before the first shipment. A mistake at the start leads to irreversible consequences.

Checklist: 15 Questions to Evaluate Your Compliance System

Before starting or auditing the system, you must answer:

1. Has the Risk Assessment been carried out on sanctions and export controls over the past 12 months?
2. Are all Russian and foreign subsidiaries included in the perimeter?
3. What sanctions lists are monitored and at what frequency?
4. Is the screening of counterparties automated when creating a new partner in the accounting system?
5. Are the beneficial owners vetted to the end-users?
6. Are there any validated red flags and algorithms for how to detect them?
7. Are there any sanctions and export control clauses adapted to the deal?
8. Is the whole range of goods classified in terms of export control?
9. Has the training been provided to all employees of the sales, procurement and logistics departments this year?
10. Is there a compliance officer with direct access to the DG/Board of Directors?
11. Are the requirements of Russian counter-sanctions and currency legislation integrated into the system?
12. Is there a privacy-guaranteed breach hotline?
13. Is there an approved internal investigation procedure?
14. Has the compliance system been audited in the past two years?
15. Is there a protocol for emergency inclusion of a key counterparty in the SDN list?

What an Effective Corporate Compliance System Looks Like

An effective system usually works on five levels:

1. Risk Intelligence Map of sanctions, export, counter-sanctions and currency risks, constantly updated and integrated into business planning.

2. Governance & Policies: A clear framework of responsibilities, policies and procedures that are tailored to specific risks, not formulaic ones.

3. Operational Controls Automated screening, KYC/KYS, product classification, compliance clauses, red flag blocking of transactions.

4. Training & Culture: Continuous learning, compliance communication, real leadership support and an open-minded environment where problems are discussed.

5. Monitoring & Response Audit, monitoring of regulatory changes, internal investigations, voluntary disclosure and continuous system improvement.

Without the fifth level, the previous four degrade over time.

FAQ

What is a corporate Compliance system?

It is a set of policies, procedures, controls and cultures that aim to ensure compliance with applicable laws, regulatory requirements and internal ethics standards.

Is it necessary to build a Compliance system for companies in Russia?

There is no direct obligation to have a formal compliance department for everyone, but for international businesses, companies with foreign participation, participants in foreign trade, as well as to protect management from liability, this becomes a de facto mandatory requirement.

Where do you start building a system?

Risk Assessment – formalized assessment of sanctions, export and regulatory risks in relation to your products, geography and counterparties.

What is the difference between compliance for Russia and the CIS and Western models?

A double circuit is required: taking into account Western sanctions and at the same time Russian counter-sanctions, currency and decree restrictions. Ignoring any of the circuits makes the system dangerous.

Do I need a separate compliance officer?

If a company makes more than 50 international transactions per year or deals with dual-use goods, yes. For small businesses, the function can be combined, but clearly fixed.

Can compliance be automated on a turnkey basis?

The software solves screening and monitoring tasks, but customizing rules, product classification, training and investigations require skilled human expertise.

What are red flags (red flags)?

Indicators that signal an increased risk of a disorder: non-standard delivery route, fictitious end user, refusal to provide beneficiaries, request to break the payment to circumvent limits, etc.

Should I report violations to regulators?

In some jurisdictions, voluntary disclosure significantly reduces fines. However, the decision must be made after a legal analysis of the possible consequences in all the jurisdictions involved.

How often should the system be updated?

The sanctions lists are continuous (automatically). Policy – at least once a year, as well as with significant changes in regulation. Training at least once a year.

Can Compliance be a Competitive Advantage?

Yeah. Companies with mature Compliance system pass bank compliance faster, gain access to complex international projects and gain trust among partners and investors.

Related services

• Sanctions, Export Controls & International Compliance
• International Regulatory Risk & Strategic Advisory
• Corporate Investigations, Regulatory Investigations & Business Integrity
• International Arbitration, Commercial Litigation & Cross-Border Disputes
• Commercial Contracts
• International Trade, Distribution & Cross-Border Transactions

Related material

• How to conduct compliance check of a foreign counterparty
• Sanctions clauses in international treaties: How to protect business
• Export control in Russia and the EAEU: What the manufacturer needs to know
• Counter-sanctions regulation of the Russian Federation: case-case
• How to build a KYC/KYS procedure in a company
• Red flags in transactions with international element
• Personal liability of management for violation of sanctions
• Automation of sanction screening: review
• Internal investigations: When to start and how to conduct
• How to prepare your company for an external compliance audit

Conclusion

Building an effective corporate compliance system does not require a set of documents, but rather the introduction of risk-oriented management technology that protects business, its assets and management in the context of multi-layered sanctions and export control regulation.

A strong system is built on a risk map, smart policy makers, automated screening, continuous learning, compliance clauses in contracts, and constant monitoring of change. Of particular importance for companies operating in Russia and the CIS is the dual loop, which takes into account not only Western sanctions, but also Russian counter-sanctions and currency regulation.

In the end, the winner is not the one with the thickest compliance manual. The winner is the one who has implemented a living system that can prevent tomorrow’s catastrophe and ensure sustainable development today.