When Should Suppliers Be Rescreened for Sanctions?

A supplier that cleared screening six months ago may not present the same sanctions exposure today. A government can add or amend a designation, the supplier can restructure, its payment beneficiary can change, or a new distributor, bank, end user or operating country can enter the relationship. The earlier result remains evidence of what was checked at that time; it is not a permanent conclusion.

The practical question is therefore not simply how many months have passed? It is what has changed since the last decision, whether that change can affect sanctions exposure, which parties are affected, and what evidence supports the new conclusion.

This guide focuses on post-onboarding triggers. For the broader control—from mapping the supplier relationship through alert investigation—see the guide to supplier and third-party sanctions screening.

There is no universal supplier rescreening interval

In the United States, OFAC FAQ 28 says the frequency of database scanning should be governed by an organisation's policies and procedures. It does not prescribe a universal interval. OFAC FAQ 65 gives an insurance-specific example in which renewal, policy amendments, changes to insured parties or beneficiaries, claims and sanctions-list updates can create later screening points. That example supports event-based reasoning, but it is not a supplier-screening mandate.

For the broader legal perimeter, list selection and alert fundamentals, use the practical sanctions-screening framework.

In the United Kingdom, OFSI's enforcement guidance says there is no one-size-fits-all approach to due diligence. It considers the degree of sanctions risk, the transaction and the nature of the relationship, and recognises regular checks or ongoing monitoring of ownership and control information where appropriate. The relevant UK regulations and facts still determine the legal position.

European Commission guidance on enhanced due diligence against Russia-sanctions circumvention recommends updating risk mapping when sanctions are amended or new measures are adopted. It also discusses changes in ownership, stakeholders, routes, end users, contractual arrangements and payment structures. Those are useful trigger examples for relevant EU operators and risk scenarios. They are not a general EU law requiring every supplier to be rescreened after every change.

A sound policy can therefore combine two mechanisms:

• event-led review, when a known change may alter sanctions exposure; and
• scheduled review, used as a policy backstop where risk, applicable requirements and data reliability justify it.

The scheduled review can find changes that internal systems did not capture. It should not replace a response to a material event between review dates.

For a large or fast-changing supplier population, ongoing monitoring can provide a repeatable way to apply policy-defined rescreening triggers, provided the relevant records, change signals, review ownership and escalation process are well defined. It remains a control-design choice—not a substitute for deciding which events matter under the organisation's policy and applicable sanctions regimes.

Events that can justify a new sanctions review

Not every supplier update requires a full investigation. Policy should explain which changes matter, which records are affected and what response is proportionate. This table is an operational design model, not a universal statement of law.

Sanctions-list and programme changes

Authorities add, amend and remove designations, while programmes can change in ways a name result will not capture. OFAC's compliance framework identifies failure to incorporate list updates as a root cause of compliance failures. The Commission's Russia-circumvention guidance similarly recommends updating risk mapping when sanctions change.

A list update does not always mean rerunning every record. Policy should identify which entities, relationships and jurisdictions the change affects. The response may range from targeted screening to escalation of a restriction that name matching cannot resolve.

Ownership and control changes

Ownership and control are not static. A share transfer, restructuring, divestment or new controller can alter the analysis even when the supplier is not named on a sanctions list.

The test must be identified by jurisdiction. OFAC's U.S. 50 Percent Rule treats an entity owned, directly or indirectly and in aggregate, 50% or more by blocked persons as blocked. It is not universal. UK guidance includes ownership and broader control concepts; EU analysis requires the relevant legal act and current programme guidance.

An ownership change is a reason to reassess, not proof that a supplier is restricted. The organisation needs appropriately sourced ownership and control information for the relevant analysis. Screening software should not be presented as automatically discovering registry or UBO changes.

Supplier identity and operating-profile changes

A new legal name, address, registration identifier or operating jurisdiction can affect matching and exposure. Refresh the reliable identifiers, retain their source and date, and decide whether connected records also need review. The control question is whether the update changes facts relied on previously or introduces a new jurisdiction, restriction or relationship.

Payment-party changes

The contracting supplier may not receive the funds. A new beneficiary, bank, intermediary, destination or account can introduce a party and nexus absent from onboarding. Procurement and finance should define how material changes reach compliance while investigation remains possible. Payment institutions have additional considerations addressed in the guide to sanctions screening for payment institutions. A new beneficiary can be a policy trigger; it does not automatically mean the payment must be blocked.

New agents, distributors, end users or routes

Changes beyond the direct supplier can matter in goods and export relationships. The Commission's Russia-circumvention guidance highlights stakeholders, intermediaries, banks, end users, routes, destinations, trading terms and documentation. These examples are especially relevant to affected export supply chains; they should not become identical checks for every services supplier.

Information that undermines the earlier evidence

Rescreening may be appropriate when new information contradicts the earlier record: inconsistent ownership documents, an unexplained beneficiary change, identifiers that no longer align, or a correction showing that the wrong entity was screened. Do not rerun weak data; resolve what is unreliable, then screen relevant parties using the refreshed record.

Turn a trigger into an owned workflow

A trigger creates work only if it reaches an accountable owner. Procurement may observe an ownership update, finance a beneficiary change, logistics a different route, and compliance a sanctions-data update.

Policy should state which events can pause approval or payment, who can clear an immaterial change, who investigates an alert, and when specialists must be involved.

Ongoing AML and sanctions monitoring can support repeatable rescreening and return relevant changes to review. The organisation still decides which records enter scope, which data is supplied, which regimes apply and what action is authorised.

A rescreening alert starts an investigation

OFAC FAQ 48 notes that software can produce potential matches that are not OFAC targets. FAQ 5 describes comparing the complete sanctions entry with available identifiers and obtaining missing information before a conclusion.

That distinction is operationally useful beyond the United States, but legal analysis remains jurisdiction-specific. A reviewer should establish:

1. which supplier or connected party generated the alert;
2. whether names, aliases, addresses, locations, registration details and other identifiers align;
3. whether available ownership or control information changes the assessment;
4. which sanctions programme and jurisdiction may apply;
5. what facts remain unresolved and who is authorised to decide the next step; and
6. why the alert was cleared, escalated or otherwise resolved.

Case management and analyst review can keep screening context, evidence, notes, ownership and decision history together. It does not replace the accountable human review or determine whether sanctions law applies.

Keep screening separate from the legal response

Even a strong identity match does not determine the response. That depends on jurisdiction, nexus, programme, party role, ownership/control, goods or services, and any exception, licence or reporting duty.

For example, OFAC's blocking and rejection concepts arise under U.S. rules and particular restrictions. UK measures have their own ownership/control, licensing and reporting provisions. Within the EU, binding consequences come from the applicable restrictive measure; Council Regulation (EU) No 269/2014 is one regime-specific example, not a model for every EU sanctions programme.

Policy should separate whether the identity match is credible, whether a legal restriction applies, and which response is authorised. Questions about freezing, blocking, rejection, reporting, licensing or continuation require current, jurisdiction-specific assessment.

Retain evidence of the rescreening decision

OFSI's enforcement guidance makes evidence supporting ownership/control due diligence and decisions relevant to its assessment. A reviewable record shows what changed, what was known and why the outcome was reached.

A practical record should retain:

• the trigger, date and source of the change;
• the supplier, relationship, transaction and connected parties considered;
• the identifiers, ownership/control context and source dates used;
• the sanctions source or programme and screening timestamp;
• the alert details and attributes compared;
• the analyst's rationale, evidence requests and unresolved questions;
• specialist escalation, authorised reviewer and outcome; and
• any condition or event set for the next review.

Retention requirements vary by jurisdiction and sector. This is an operational evidence model, not a universal statutory requirement.

Frequently asked questions

Must suppliers be rescreened annually?

No universal annual rule is supported by the guidance reviewed here. Scheduled reviews can be a policy backstop based on applicable requirements, risk and event-capture reliability. Material changes may justify earlier review.

Does every sanctions-list update require the full supplier population to be screened again?

Not necessarily. Assess the changed authority data or programme, identify affected entities and relationships, and document the selected population. Some changes require targeted screening; others need broader programme analysis.

Should an ownership change trigger rescreening?

It can, but tests differ across U.S., UK and EU regimes. Refresh the context and apply a jurisdiction-specific assessment rather than concluding automatically that the supplier is restricted.

Is a new bank account enough to trigger a review?

A new beneficiary, bank, intermediary, destination or unexplained account can introduce facts absent from the earlier decision. Scope and response depend on the relationship, transaction and regime.

Does ongoing monitoring replace scheduled reviews?

No. Event-led monitoring responds to known changes; a scheduled backstop may find changes missed by event feeds. Policy should explain how both controls work together.

Build rescreening into the supplier lifecycle

Supplier rescreening works best as an owned response to meaningful change: identify the event, define the affected population, refresh the relevant information, investigate any alert and retain the decision. Checklynx supports sanctions screening, ongoing monitoring and controlled case review using third-party and ownership context available to the organisation. Legal applicability and final action remain with the organisation and its advisers.