A sanctions compliance program rarely breaks in one place. It grows over time: a UN list is added to the screening tool, a local list follows, OFAC and EU requirements arrive with a new correspondent relationship, and each addition is handled by whoever was available. After several years, the program works in parts but may not work as a whole. A sanctions compliance program review is the way to find out which of those parts no longer connect.
This article sets out eight observable signs that a program needs attention. You can check each one against your own records without outside help. At the end, we describe how to decide between a review and a redesign, and what a good outcome looks like.
Why programs drift
Sanctions obligations come from several directions. In the Kingdom, institutions must act on UN and local designations, and many also follow OFAC, EU and UK measures because of their correspondent banks, customers and trade flows. Each regime has its own list format, update rhythm and legal basis. Programs that add them one at a time tend to end up with separate procedures, separate owners and uneven coverage between screening, trade and payment controls, escalation and reporting.
Eight warning signs
1. List updates have no named owner
Ask who is responsible for each list update, from receipt to confirmed loading in every screening system. If the answer is "the vendor" or "whoever sees the notice", the program depends on chance. Look for a record showing when each update was published, when it was applied and who confirmed it.
2. Alerts are unreviewed or reviewed inconsistently
Check the alert queue for age and backlog. Then sample closed alerts and ask whether two analysts would reach the same decision on the same facts. Unreviewed alerts are a visible failure; inconsistent closure rationale is a quieter one, and regulators notice both.
3. Screening coverage does not match your customer and payment footprint
Map every system that holds customer, counterparty or payment data against what is actually screened. Gaps often sit in legacy products, new digital channels, beneficial owners, and payment messages that pass through a separate platform.
4. Trade-finance and correspondent banking controls sit outside the main program
Trade exposure brings risks that name screening alone does not catch, including dual-use goods, vessels and transshipment red flags. If trade operations follow their own checklist that the sanctions function has never reviewed, the program has a seam.
5. Escalation depends on individuals, not procedure
When a potential match is found, can staff say who decides, within what time, and on what criteria? If outcomes vary with who is on shift, or if senior decisions are not documented, escalation is inconsistent.
6. Regulator reporting is assembled by hand
Reporting that requires several people to reconstruct events from emails and spreadsheets is fragile. A sound program can show what was identified, when, what was decided and what was reported to the competent authority, without a scramble.
7. The risk assessment is old or disconnected from controls
A sanctions risk assessment should cover products and geographies, and it should drive screening scope, thresholds and training. If it was written once for an audit and never changed after a new product, market or customer segment, the controls are not tied to your actual exposure.
8. Training does not match roles
Front-line staff need to recognize red flags and know when to escalate. Decision-makers need to understand how to judge a potential match and document the reasoning. If everyone receives the same annual module, neither group is well served.
How to read the results
Count the signs that apply, but also note where they cluster. One or two isolated issues, such as an unowned list update or a stale risk assessment, usually point to a targeted review. Several signs across different areas suggest that the structure itself is the problem: policy, ownership and controls were never designed together. That is the case for a redesign.
A useful test is to ask whether fixing each issue separately would leave the underlying cause in place. If list ownership, alert handling and escalation all fail for the same reason, such as no single policy that spans the regimes, then patching each one will not hold.
Related work may also be needed alongside the program. If the concern is whether the screening tool itself performs, an independent model validation of name-screening data quality, thresholds and fuzzy matching addresses that question directly. If the concern is staff capability, role-based training for the board, front line, operations and compliance teams is a separate and complementary step.
What a good outcome looks like
A program that works is easy to describe, and easy to check:
- Every list update across UN, local, OFAC, EU and any other relevant regime has a named owner and a dated record.
- Screening coverage is documented across customers and payments, and gaps are known and accepted or closed.
- Trade-finance and correspondent banking controls follow the same policy as the rest of the program.
- Escalation paths, decision rights and regulator reporting are written down and tested.
- Staff in each role know what they are expected to do.
- The risk assessment explains why the controls look the way they do.
How we run a sanctions compliance program engagement
Our Sanctions Compliance Program service is the design or review of your sanctions compliance program covering UN, local, OFAC and EU regimes: screening, trade and payment controls, escalation and reporting. It is delivered as a project of 6–12 weeks. The work is mapped to Sanctions, SAMA AML/CTF and Wolfsberg.
The engagement follows four steps:
- Assess: sanctions risk across products and geographies.
- Design: policy, screening coverage and escalation.
- Test: screening quality and control testing.
- Train: front-line and decision-maker training.
The deliverables are a sanctions policy and procedures, a screening coverage assessment, control testing results and training for front-line staff. The service includes a sanctions risk assessment, screening coverage across customers and payments, trade-finance and correspondent banking controls, and escalation and regulator reporting.
Two questions come up often. On lists, we cover UN, local lists, OFAC, EU and UK, and any others your risk assessment requires. On trade, we do cover trade-based risks, including dual-use goods, vessels and transshipment red flags.
Next step
If several of the eight signs describe your program, start by recording which ones apply and where the evidence sits. That record is the natural starting point for a sanctions compliance program review, and it will show whether a focused review or a fuller redesign is the right scope. To discuss your situation, contact CISO Consulting and ask about the Sanctions Compliance Program service.
