Due Diligence before the acquisition of the business

Mainstream

Sanctions due diligence before acquiring a business is not a search for coincidences in sanctions lists. It is a strategy for preserving investment and business reputation.

The question is not whether the target is on the SDN or SSI list. The main question is whether the investment will survive the next round of sanctions regulation, whether the buyer will face secondary sanctions and whether the bank will block all settlements the next day after the closure.

Therefore, effective sanctions due diligence is based on three checks:

What is the real geography of the target’s operations – not registration, but supply chains, end consumers and financial flows?

If these three issues are not resolved before signing, the buyer risks not only losing the asset, but also putting his entire business at risk.

When due diligence is required

Sanctions verification is no longer an option and becomes a mandatory part of the transaction if:

• the target conducts or has conducted activities in Russia, Belarus, Iran, North Korea, Syria, Crimea or in the territories of Donbass
• The seller or beneficiaries have passports of countries under sanctions pressure
• business is related to sectors that are subject to sectoral sanctions: energy, defense industry, finance, production, high technologies, aviation, maritime transport
• Products or technologies of the purpose potentially relate to dual-use goods
• In the supply chain, there are companies from target-friendly jurisdictions used to circumvent restrictions.
• buyer – a company from the United States, the EU, the United Kingdom, Switzerland, Japan or other jurisdiction that actively applies secondary sanctions
• The financing of the transaction passes through Western banks or development institutions.
• After the purchase, the asset will continue export-import operations affecting subsanctioned jurisdictions.
• Ownership structure is opaque, several levels of offshore are used
• The target has already received requests from regulators or faced with a payment block

A mistake that most buyers make

Many investors start with the question:

Is there a target on the SDN list?

That's the wrong first question.

The right question is:

What kind of sanctions will the Western bank, which serves this business a year after the deal, see?

The absence of direct hits on the lists does not mean no risk. Blocking and sectoral sanctions apply not only to persons on the lists, but also to companies that are directly or indirectly controlled by such persons, act for their benefit or participate in prohibited transactions. The 50% rule and its extended counterparts in the US and the EU turn an unobvious link to a sanctioned person into a lock-in of the entire asset.

Step 1. Mapping the jurisdictional risks of the buyer

The first step is not to analyze the target, but to analyze the buyer.

Key questions:

• In which jurisdictions is the buyer and its ultimate beneficiaries registered?
• What sanctions regimes are directly applicable to it
• Is there a risk of secondary sanctions (US)?
• Does the structure of the transaction affect the European blocking statutes?
• Which banks will handle the transaction and further operations
• Whether the buyer is subject to the jurisdiction of OFAC, OFSI, BIS, EU Council or other regulators

Before the due diligence of the target, you need to know your own sanctions profile. A transaction that is safe for a European buyer could be fatal for a buyer with an American element.

Step 2. Discover the real structure of property

The formal register of shareholders is insufficient. You must reach the end person through all chains of ownership, including:

• nominal holders
• trusts and foundations
• Convertible loans that covertly give control
• optional arrangements
• Powers of veto over key decisions
• persons who receive the bulk of the profits without being shareholders

Particular attention is paid to persons connected with government agencies, politically exposed persons from sanctioned countries and persons with a history of inclusion in the lists even in the event of subsequent exclusion. Often it is through nominal structures that the control of sanctioned persons avoiding direct inclusion in the registers is implemented.

Step 3. Conduct multi-level screening of sanctions lists

To limit the check to the SDN List (OFAC) is a gross mistake. Full screening includes:

• SDN List, SSI List, CAPTA List (USA)
• Consolidated List of Financial Sanctions Targets (OFSI)
• EU Consolidated Sanctions List
• UN sanctions lists
• national lists of Switzerland, Japan, Canada, Australia
• Russian counter-sanctions lists (if relevant to target operations)
• Military End User List (BIS) - Military End User List (BIS)
• Lists of sectoral sanctions (SSI in the US, analogues in the EU and the UK)

Screening should be carried out on all legal entities and individuals in the ownership structure, management, key counterparties, as well as family members, if there is a risk of circumvention through relatives.

Step 4. Analyze sectoral exposure and export controls

Even if the target and its beneficiaries are not listed, prohibitions may stem from the nature of the activity.

It is necessary to evaluate:

• Whether business is subject to sectoral sanctions (oil, deep-water production, offshore projects, military products, dual-use goods, aviation, financial services)
• whether the company handles goods and technologies subject to export control (EAR, ITAR, Dual-Use Regulation of the EU, UK strategic export lists)
• Are such goods delivered to prohibited destinations or end users?
• Whether an export licence is required even for the continuation of current activities after the change of control
• Does the company have a history of undisclosed export transactions that could be considered a violation?

Especially dangerous are situations when the target is not the end user, but a link in the supply chain to the sanctioned projects.

Step 5. Check supply chains and geography of operations

Here is revealed the true sanction map of the business. Analyzed:

• all suppliers and buyers, especially those in countries of risk or with an opaque structure
• routes of physical delivery of goods (transit through the sanctioned territories, transshipment in the ports of Crimea, the use of ships under flags of convenience with a questionable track)
• Countries of origin of goods and components
• End User (End User) Products
• presence among contractors of companies related to the defense sector of countries under sanctions
• transactions with companies from friendly jurisdictions, which can be gaskets for deliveries to the sanctioned countries (UAE, Turkey, Kazakhstan, etc.)

If elements linked to Iran, North Korea, Syria or Crimea are found in the chain, the deal can be irrevocably infected.

Step 6. Evaluate the contractual basis of the objective

Every contract of purpose must be read through the prism of sanctions. Key nodes:

• The availability and quality of the sanction clause
• right of termination when imposing sanctions against one of the parties
• Compliance obligations with certain jurisdictions (e.g., no business with Iran)
• Effects of Change of Control in the Point of View of Sanctions Assurances
• obligation to notify the counterparty of the sanctions risks
• the possibility of enforcement of a contract in the light of sanctions restrictions (especially if the applicable law is the country imposing the sanctions)
• the existence of an arbitration clause, which may not work due to the blocking of arbitration fees or the prohibition of legal services

Weak contractual base is the risk of losing major counterparties immediately after the transaction, when they do not want to risk due to a link with a sanctions-toxic asset.

Step 7. Check financial flows and banking relationships

Financial due diligence shall include:

• servicing banks and their jurisdictions (bank under sanctions or in a country disconnected from SWIFT)
• presence of correspondent accounts in dollars and euros
• History of blocking and compliance requests
• Use of alternative payment routes that hint at circumventing sanctions
• settlements in currencies that may be cut off from conversion
• loans from persons included in the sanctions lists or having a structure characteristic of hidden financing of sanctioned persons

The buyer should clearly understand whether he will be able to settle in the same banks and currencies after the transaction and whether the target account will be frozen soon after the transfer of ownership.

Step 8. Learning compliance history

The past behavior of the target provides the key to future risks. It is necessary to request and analyze:

• history of interaction with regulators (requests of OFAC, BIS, OFSI, EU, national authorities)
• facts of blocking payments or refusal of banks from operations
• correspondence with compliance departments of counterparties
• Availability of its own compliance program and its actual compliance
• past internal investigations into sanctions
• Contracts terminated due to sanctions requirements

The absence of documents in the presence of signs of activity in risk areas is a red flag in itself.

Step 9. Evaluate reputational risks and the effect on the buyer’s business relationships

Purchasing a target with Russian or Iranian roots can immediately affect the buyer’s own business.

• Western buyer banks may start asking questions about the KYC of the whole group
• Existing contractors may break off relationships to avoid touching sanctions toxicity
• Rating agencies and insurers may review their valuations
• Investors or shareholders may initiate internal investigations.

Therefore, the sanction due diligence should include modeling the reaction of key stakeholders of the buyer to the transaction.

Step 10. Develop a protective structure of the transaction

If after all the checks it is decided to move forward, the structure of the transaction should be built in mechanisms of protection:

• assurances and guarantees of the seller of the sanctions cleanliness with a wide cover
• Special indemnity in case of sanctions claims and losses, including loss of banking services and business value
• Suspensionary conditions related to obtaining clarifications or licenses from regulators
• a mechanism for holding part of the purchase price (escrow, holdback) to cover potential sanctions losses
• Buyer’s right to unilaterally withdraw from the transaction when sanctions are tightened before closing
• post-closure conditions: Seller’s obligation to assist in licensing and disclosure
• a condition of applicable law and arbitration that will remain enforceable in any sanction scenario

The sanction clause in an M&A contract should be as elaborated as in an international commercial contract, but adjusted for the complexity of the corporate structure.

Automatic screening or deep due diligence: pick

A buyer who restricts himself to automatic checks on lists accepts a business risk that may exceed the transaction value.

Common mistakes in due diligence sanctions

1. Restrict yourself to the SDN list and not to check sectoral sanctions. Getting under SSI is as dangerous as direct blocking.
2. Do not apply the 50% rule. Consolidated possession of a sanctioned person can make a target blocked, even if it is formally clean.
3. Do not take into account secondary sanctions. A buyer from the EU or Asia may think that the US secondary sanctions do not apply to him, but the loss of dollar settlements and banking relationships will destroy the business.
4. Ignore the jurisdiction of the seller's registration. Buying from a person who will be on the list in a month, entails the risk of blocking the asset.
5. Check the target, but not check its key customers. The counterparty’s sanction risk immediately becomes the target risk.
6. Do not analyze products and technologies. Supplying an innocuous-looking spare part classified by ECCN to Russia could be a criminal offense in the United States.
7. Rely on assurances without verification. The seller’s assurance without documentary evidence is nothing.
8. Don't make a post-deal. Even after closing, a compliance integration plan is needed to ensure that day-to-day management does not create a breach.

Buyer's checklist

Before signing the transaction, you must get affirmative answers to 15 questions:

1. Are the ultimate beneficiaries of the target set to individuals?
2. None of these individuals are on the SDN, SSI, EU or UK lists?
3. Does anyone control the target in an aggregated way of 50% or more?
4. Are the chains of ownership checked to the level of trusts, nominee shareholders, options?
5. Does the target have links to Crimea, Iran, North Korea, Syria or Donbas?
6. Are the activities subject to EU, US or UK sectoral sanctions?
7. Are dual-use or military products that require licenses traded?
8. Have the main suppliers and buyers been checked for their presence on the sanctions lists and links with the sanctioned states?
9. Are financial flows and correspondent accounts not tied to banks disconnected from SWIFT or under blocking sanctions?
10. Has the target had requests from OFAC, BIS, OFSI, European regulators or payment blockages over the past 5 years?
11. Does the contract of sale include special sanction assurances, indemnity and a withholding mechanism?
12. Is there a plan of action in the event of new sanctions being imposed against the seller or related persons before closing?
13. Have the buyer’s banks reacted to the transaction?
14. Is it possible to obtain OFAC/OFCOM licenses if necessary?
15. Has a post-closure compliance plan been prepared for the asset?

What a strong due diligence strategy looks like

A strong strategy has five levels, each one building on the previous one:

1. Screening & Identification: Multi-list screening, direct and indirect link identification, application of the 50% rule, analysis of ultimate beneficiaries.

2. Business & Supply Chain Deep Dive Sectoral sanctions, export controls, geography of supply, end users, contract analysis and financial flows.

3. Risk Quantification & Structuring Assessment of the probability and consequences of risk realization, development of contractual safeguards (guarantees, indemnity, escrow, termination conditions).

4. Regulatory Engagement Analysis of the need for licenses, preparation of voluntary disclosure in case of detection of historical violations, communication with regulators before closing.

5. Post-Closing Integration: Implementation of a sanctions compliance program in the acquired business, monitoring of regulatory changes, regular re-screening of counterparties, personnel training.

A skip of any level turns due diligence into a formal report that does not protect the investment.

FAQ

Yes, but provided that neither the target, nor its beneficiaries, nor the activities are subject to blocking or sectoral sanctions, and the buyer is not an American person or carefully manages the risks of secondary sanctions. A deep due diligence and often a legal opinion from a counsel is required.

Immediately stop all transactions, do not transfer funds, engage an external sanction lawyer, assess whether an asset lock and OFAC notification are required, and consider obtaining a license to defrost or sell. Continuing a transaction without a license may be a violation of its own.

Does the sanctions due diligence work if the target is in Russia and the buyer is from the EU? It requires analysis of available registries, understanding of the structure of control through nominee holders, and knowledge of sanctions circumvention practices. A risk-based approach and enhanced assurances from the seller are needed.

Can you rely on automatic scoring service?Exclusively as a primary filter. It does not see control through aggregate ownership, trusts, sectoral risk, and does not analyze context. Transactions of any scale require human analysis by an experienced sanctions specialist.

How to protect a transaction if the seller does not disclose the ultimate beneficiaries? If the seller refuses to disclose the ultimate owners for reasons of confidentiality, either withdraw from the transaction or build an indemnity and retention structure that covers the full risk of locking the asset. That's often impossible.

Yes, if the target or the buyer plans transactions involving currency restrictions, a ban on capital withdrawals, restrictions on transactions with shares in strategic companies or interaction with unfriendly persons. Counter-sanctions analysis is an integral part of the full picture.

Related services

• Sanctions, export controls and international compliance
• Corporate and Regulatory Investigations, Business Integrity
• International M&A and Cross-Border Transactions
• Commercial contracts
• International regulatory risks and strategic advice
• Asset tracing and recovery

Related material

• How to structure the sanctions clause in the international treaty Secondary sanctions of the United States: Risks to non-U.S. businesses Export controls and dual-use goods: What has changed for Russia and the CIS
• How to check the foreign counterparty: Compliance outside of the SDN list
• Sanctions Compliance for International Holdings Acquisition of assets in the CIS: Regulatory Risks and Investment Protection
• How OFAB and OFSI view control: The 50% rule and its boundaries

Conclusion

Sanctions due diligence before acquiring a business is not a compliance procedure for the sake of a tick. It is a deep intelligence process that determines whether a deal will create value or destroy it.

The risk is not that the target will be on the sanctions list, it is obvious immediately. The risk is that a year after the closure, the buyer learns from the bank that its new asset is toxic, that payments are blocked, that counterparties are leaving, and the regulator begins an investigation.

Therefore, real protection is not based on screening alone, but on the ability to reveal the true structure of control, understand the sanction map of the target operations, and sew legal protection mechanisms into the very fabric of the transaction. The winner is not the one who first signs the term sheet, but the one who understands in advance how not to turn the purchase into a sanctions trap.