INTERNATIONAL TRADE LAW
Sanctions Vendor Risk Management Checklist
Your vendors are one of your largest sanctions blind spots, and a third party’s violation can become yours — so managing vendor risk means screening, contracting, monitoring, and documenting every supplier relationship. OFAC liability is strict: paying a blocked vendor is a violation whether or not you knew. Because suppliers, distributors, and agents sit between you and parties you never directly see, they introduce exposure your internal controls won’t catch unless you extend them outward. This checklist does that.
Why Vendors Are the Weak Point
Third parties are central to operations and central to risk. A freight forwarder, distributor, or component supplier can route your money or goods to a sanctioned party without your knowledge — and under OFAC’s strict-liability standard, your lack of knowledge is not a defense. Worse, under OFAC’s 50 Percent Rule, a vendor owned 50% or more by blocked persons is itself blocked even though its name never appears on the SDN list. Managing vendor risk is how you see through those layers before money moves.
The Checklist
1. Define Risk Appetite and Tiers
- Set the organization’s tolerance for sanctions risk in writing.
- Tier vendors by exposure: jurisdiction, product type, ownership opacity, and access to your funds or goods.
- Concentrate diligence on high-risk tiers; apply a lighter, documented touch to low-risk ones.
2. Screen Before Onboarding
- Screen every prospective vendor against OFAC’s SDN list and other applicable restricted-party lists.
- Look through ownership to apply the 50 Percent Rule — screen beneficial owners, not just the contracting entity.
- Resolve and document any potential match before the relationship begins.
3. Build Compliance Into the Contract
- Include sanctions compliance representations and warranties.
- Add the right to audit, the right to terminate for sanctions concerns, and a notice obligation if the vendor’s status changes.
- Require flow-down of these terms to the vendor’s own subcontractors where relevant.
4. Monitor Continuously
- Re-screen the active vendor book against updated lists on a defined cycle — lists change constantly.
- Watch for red flags: ownership changes, new jurisdictions, unusual payment routing, or reluctance to provide ownership information.
- Escalate any hit to a named decision-maker and pause payment until cleared.
5. Train and Document
- Train procurement, accounts payable, and contracting staff on what to flag and how.
- Keep a dated record of every screen, hit resolution, and decision — documentation is your evidence of a real program.
| Stage | Core action | Why it matters |
|---|---|---|
| Onboarding | Screen + ownership check | Catches blocked and 50%-owned vendors up front |
| Contracting | Sanctions clauses + audit rights | Allocates risk and evidences good faith |
| Ongoing | Periodic re-screening | Lists change; a clean vendor can become blocked |
| Always | Recordkeeping | Proves the program worked under scrutiny |
How This Reduces Your Exposure
A documented vendor program does two things. It prevents most violations outright by catching blocked parties before payment. And if something slips through, the program — combined with a voluntary self-disclosure, which generally halves the base civil penalty in a non-egregious case — sharply limits the damage. That matters because the civil maximum is, as of 2026, the greater of roughly $377,700 or twice the transaction value per violation, adjusted annually for inflation. The screening mechanics here mirror those in our sanctions screening guide, applied specifically to suppliers.
Frequently Asked Questions
Can my company be penalized for a vendor’s sanctions violation?
Yes. OFAC liability is strict, so a payment that reaches a blocked party through a vendor can be your violation even without intent or knowledge. That is why vendor screening and monitoring are essential.
Do I need to screen a vendor that isn’t on the SDN list?
Often, yes. Under OFAC’s 50 Percent Rule, a vendor owned 50% or more by one or more blocked persons is itself blocked even though it is not separately listed, so screening must look through ownership.
How often should I re-screen existing vendors?
On a regular, defined cycle, because sanctions lists change frequently and a vendor that was clear at onboarding can later become blocked through a designation or an ownership change.
What contract terms help manage vendor sanctions risk?
Sanctions compliance representations and warranties, audit rights, a right to terminate for sanctions concerns, a status-change notice obligation, and flow-down of these terms to subcontractors where relevant.
Vendor risk is where strict liability meets parties you can’t directly see — exactly where a documented program earns its keep. Reidel Law Firm builds vendor screening and third-party risk programs for a predictable flat fee: get a flat-fee compliance memo before onboarding your next supplier.
