Sanctions Risk Assessment: A Practical Methodology and Register

A useful sanctions risk assessment is a decision record, not a heat map created for its own sake. It should show where sanctions exposure enters the business, what evidence supports that view, how effectively the controls operate, what risk remains and who must close each material gap.

The methodology must fit the organisation's applicable legal perimeter, activities and operating model. FCA guidance and supervisory findings are directly relevant to firms within FCA scope, while OFSI, EU, FATF and OFAC material must be attributed to their respective jurisdictions and status. None creates one prescribed global assessment form for every business.

This guide focuses on the business-wide assessment. It deliberately does not recreate the customer risk assessment methodology, the practical sanctions-screening control guide or the sanctions-screening software buyer guide.

Keep three assessments separate

Teams often use “sanctions risk assessment” for different jobs. Separating them prevents a customer score or a system test from being mistaken for the organisation's overall exposure assessment.

The assessments can inform each other, but their records should remain distinct so each conclusion is traceable.

Define the scope and legal perimeter

Begin by fixing the assessment boundary. Record:

• the legal entities, branches, products and activities covered;
• relevant jurisdictions, sanctions regimes and authorities;
• customer, counterparty and transaction populations;
• outsourced processes, intermediaries and material data providers; and
• the assessment date, evidence period, owner and approver.

Do not start with a generic checklist of sanctions countries or a single global list. The applicable restrictions depend on the relevant jurisdiction, regime, activity and facts. OFSI's general guidance explains the UK financial-sanctions framework and directs readers to the applicable regulations; it is not a substitute for identifying the legal instrument that governs a specific activity.¹

EU restrictive measures likewise arise through specific legal acts. The Council's sanctions best-practices document is non-binding and non-exhaustive implementation guidance rather than a universal assessment law.²

FATF provides international standards for countries to implement in their own frameworks.³ Use FATF material as context, not as if FATF were the private firm's regulator.

Build the sanctions risk universe

The risk universe is the structured inventory of how exposure could enter the business. Use categories that reflect the operating model rather than copying another firm's headings.

FCA guidance for firms in scope says sanctions systems and controls should be appropriate to the nature, size and risk of the business.⁴ OFAC's US-specific compliance framework similarly identifies customers, counterparties, products, services, supply chains, intermediaries, transactions and geographies as possible risk-assessment inputs.⁵

These are prompts, not a rule that every organisation must assign the same risk to every category.

Assess inherent exposure before controls

Inherent exposure is the risk arising from the activity before giving credit for sanctions controls. Keeping this stage separate prevents a strong control description from obscuring a fundamentally exposed business line.

For each risk statement:

1. Describe the scenario in plain language.
2. Identify the relevant business activity, population and jurisdiction.
3. Link current, dated evidence.
4. Explain why the potential likelihood or impact is higher or lower, including uncertainties and evidence gaps.

A useful risk statement is specific enough to test:

A cross-border payout product can introduce beneficiaries and intermediary banks that are not present in customer-onboarding data, creating a risk that relevant transaction parties do not enter the approved sanctions control.

Avoid labels such as “high-risk geography” without explaining the applicable regime, activity and evidence. Do not use a sanctions-list match as the only measure of exposure; the absence of historical alerts does not prove the underlying activity is low risk.

Evaluate actual control effectiveness

Now identify the controls that address each inherent risk and test how they operate in practice. Do not award effectiveness solely because a policy, vendor or system exists.

Evidence can include:

• approved policies and procedures aligned with current practice;
• population and trigger mappings;
• source, configuration, change-control and data-quality records;
• alert volumes, ageing, outcomes and sampled case rationale;
• testing, incidents, outages and remediation history; and
• training, operational ownership and third-party oversight.

The FCA's May 2026 supervisory findings for firms it reviewed highlight the importance of understanding exposure, data, calibration, testing, alert handling, backlogs, resilience and third-party systems.⁶ These are supervisory findings within FCA scope, not a universal control checklist. They do, however, show why design evidence and operating evidence should be assessed separately.

Use the practical sanctions-screening guide for detailed screening design and testing. Use the third-party sanctions-screening policy guide for supplier and governance controls. Regime-specific ownership questions belong in sanctions ownership and control.

Reach an explained residual-risk conclusion

Residual risk is the exposure remaining after considering the demonstrated effectiveness of relevant controls. It is not simply inherent risk minus a control score.

The conclusion should identify the remaining exposure, the controls relied upon, evidence of their effectiveness, weaknesses that reduce confidence, the accepted or escalated position and its approver.

A rating can help compare entries, but the rationale is the durable part of the record. Two entries with the same colour may require different action because the evidence, legal perimeter, control dependency or potential impact differs.

Turn gaps into owned remediation

Every material gap should become an action that can be closed and verified. Record the problem, interim treatment, owner, target date, expected evidence and approval route.

Examples include a missing population or trigger, incomplete identifiers, an untested configuration, an alert backlog, an unclear escalation route or an outsourced dependency without sufficient assurance.

Closure should mean more than marking an action complete. Retain evidence that the change was implemented, tested and approved, and reassess the residual-risk conclusion. If a temporary control remains, identify its owner and expiry or review point.

Scoring is optional machinery

An organisation may use qualitative bands, ordinal scores or another consistent internal method. The score supports comparison; it does not replace judgement or establish the legal consequence of an activity.

Avoid universal weights presented as regulatory requirements, false precision from weak evidence, automatic averaging that hides a severe exposure, customer-risk factors copied into the business-wide methodology and vendor-generated scores treated as the organisation's conclusion.

If scoring is used, document each definition, evidence expectation, override route and approval. Record both the score and the narrative rationale so the conclusion remains intelligible when the model changes.

Sanctions risk assessment register

The register below is a practical Checklynx documentation model, not a regulator-issued form. Use one row per clearly stated exposure or risk scenario; attach detailed evidence outside the table where necessary.

Governance and reassessment

Assign one accountable owner and the contributors needed from legal, compliance, operations, product, data, technology and the business. The approver should have authority to accept residual risk and fund remediation.

Set event-driven reassessment triggers rather than relying only on a calendar. Possible triggers include:

• a new product, service, jurisdiction or material outsourcing arrangement;
• a material shift in customer, counterparty or transaction populations;
• a sanctions-rule or designation change affecting the business;
• a screening incident, control failure or sustained backlog; and
• material data or technology changes, or evidence that an assumption is no longer reliable.

A periodic review can provide a backstop, but no single frequency is universally appropriate. Document why the cadence and events fit the applicable requirements and business exposure.

The assessment may identify a need for new or improved sanctions-screening controls. Checklynx can support that screening layer through portal, CSV batch, API, configured monitoring, analyst review, cases and audit evidence. It does not establish the legal perimeter, produce a regulator-approved enterprise risk score, discover every ownership structure or make the organisation's legal and residual-risk decisions. Explore Checklynx sanctions screening once the assessment has defined the control need.

Frequently asked questions

What is a sanctions risk assessment?

A business-wide sanctions risk assessment documents where the organisation is exposed to sanctions risk, the evidence supporting that view, the effectiveness of relevant controls, the remaining residual risk and any required remediation.

Is a sanctions risk assessment the same as a customer risk assessment?

No. A business-wide assessment evaluates the organisation's exposure and controls. A customer risk assessment applies a separate methodology to an individual relationship and determines the treatment that follows under the applicable framework and policy.

Does every business need the same sanctions risk assessment?

No universal worldwide form or methodology applies to every business. Requirements and supervisory expectations depend on jurisdiction, sector and activity. The assessment should identify and attribute the framework that applies to the organisation.

Should a sanctions risk assessment use a numerical score?

Not necessarily. A consistent qualitative or numerical method can help comparison, but the organisation should preserve the evidence and rationale. No universal set of weights or pass thresholds should be presented as regulator-approved.

What is the difference between inherent and residual sanctions risk?

Inherent risk describes exposure before giving credit for controls. Residual risk is the exposure remaining after considering how effectively the relevant controls are demonstrated to operate.

How often should the assessment be updated?

Use documented event triggers and an appropriate periodic backstop. Reassess when legal, product, geographic, population, ownership, data, technology or control changes could alter the existing conclusion.

Can sanctions-screening software complete the assessment automatically?

No. Software can support screening, monitoring, review and evidence for controls identified by the assessment. The organisation remains responsible for legal scope, assessment methodology, evidence, residual-risk conclusions and remediation decisions.