Sanctions compliance in 2026: how to avoid secondary sanctions exposure

The expansion of sanctions regimes in recent years has fundamentally reshaped the architecture of international payments and corporate compliance. While primary sanctions once dominated the risk landscape, by 2026 secondary sanctions have emerged as a key source of exposure, targeting companies for engaging with sanctioned persons or sectors. Regulators have intensified scrutiny of circumvention schemes involving third countries, banks are applying enhanced due diligence, and transparency requirements for ownership structures have become significantly stricter. For businesses, this means that the absence of a direct violation no longer guarantees safety. Insufficient screening, weak supply chain controls, or opaque ownership models may result in serious operational and financial restrictions. In this article, we examine the nature of secondary sanctions, identify high-risk exposure areas, and outline a practical sanctions compliance model for 2026.

Secondary sanctions: what has changed by 2026

By 2026, secondary sanctions have firmly established themselves as an independent instrument of external economic pressure. While the primary focus previously lay on direct restrictions (primary sanctions) applicable to residents of a specific jurisdiction, the mechanism of secondary sanctions is now increasingly applied to foreign companies that do not formally fall under the direct jurisdiction of the sanctioning state.

The key feature of secondary sanctions is their extraterritorial nature. A company may not operate in the US or the EU, may have no registration there, and may not conduct direct transactions through local banks, yet interaction with sanctioned persons or sectors may result in restrictions on access to the financial system, US dollar clearing, or international capital markets.

Expansion of the concept of “material support”

Regulators are broadening the interpretation of “material support” and “significant transaction”. Sanctions risk may arise not only from direct supply of goods or financing, but also from intermediary services, logistics support, IT services, or payment processing.

In 2026, particular attention is given to indirect operations through third countries. The use of intermediary jurisdictions is no longer viewed as automatic protection against sanctions exposure. Supervisory authorities assess the transaction chain as a whole, including ownership structure and ultimate beneficiaries.

Stronger enforcement and inter-regulatory cooperation

Sanctions authorities have strengthened coordination both among themselves and with financial institutions. Information exchange between regulators and banks has become more systematic, increasing the likelihood of detecting high-risk transactions.

Banks, in turn, have adopted a more conservative approach. Even a potential connection to high-risk jurisdictions may lead to transaction blocks or a reassessment of banking relationships. Under intensified enforcement, the risk is not only legal but also operational.

Increased personal accountability

By 2026, the trend toward personal liability of directors and compliance officers has significantly intensified. Regulators assess not only the existence of a sanctions policy, but also the actual level of control, board oversight, and internal risk escalation.

Who is at high risk?

With the expansion of secondary sanctions, risk is no longer limited to companies operating directly with sanctioned jurisdictions. In 2026, heightened scrutiny targets organisations involved in cross-border capital flows, international trade, or digital financial instruments. Regulators and banks assess not only direct connections, but also indirect transactional and corporate chains.

The most vulnerable are:

• Financial institutions and payment providers processing international transactions;
• Fintech companies and electronic money issuers;
• Crypto platforms and digital asset providers;
• Trading companies operating in commodities markets and complex logistics routes;
• Holding structures with multi-layered ownership models and distributed management;
• Companies actively using intermediaries and third countries for settlements.

Particular risk arises for businesses whose models involve high transaction volumes, numerous counterparties, or operations in jurisdictions under enhanced monitoring. Even without a direct sanctions breach, such structures increase the likelihood of secondary sanctions exposure.

An additional risk factor is opaque ownership structures or insufficient verification of counterparties’ beneficial owners. In 2026, regulators increasingly analyse not only formal lists, but also actual connections, corporate affiliations, and the economic rationale of transactions.

Triggers of secondary sanctions: what is most often the cause

In 2026, the application of secondary sanctions is less frequently linked to direct and obvious violations. More often, sanctions exposure arises from indirect connections, insufficient controls, or incorrect assessment of transaction risk. Regulators evaluate a combination of factors, including the economic rationale of operations, corporate links, and the company’s conduct after risks are identified.

Circumvention schemes through third countries

One of the most common triggers remains the use of intermediary jurisdictions to conduct operations involving sanctioned persons or sectors. Formally, a transaction may pass through a “neutral” country, but analysis of the full chain often reveals the ultimate economic purpose.

Regulators focus on:

• Repeated supply routes through the same intermediary companies;
• A sharp increase in activity in a particular jurisdiction without economic justification;
• A mismatch between transaction volume and the counterparty’s actual infrastructure.

The use of third countries is no longer viewed as a safe distance from sanctions risk.

Insufficient sanctions screening

Formal screening against basic lists is no longer considered sufficient. Risk arises where a company:

• Fails to verify the ownership structure of counterparties;
• Ignores affiliated parties and indirect ownership;
• Does not update sanctions lists in real time;
• Fails to document screening results.

Particular concern arises when screening is performed without analysing the economic context of the transaction.

Trade-based risk and economic inconsistency

Secondary sanctions are often applied in investigations involving trade-based schemes. Indicators of heightened risk may include:

• Atypical supply routes;
• Disproportionate margins or pricing anomalies;
• Inconsistency between the company’s profile and transaction volume;
• Complex settlement chains lacking a transparent business purpose.

Banks and regulators increasingly use analytical tools to detect such anomalies.

Correspondent relationships and financial infrastructure

For financial institutions, particular risk relates to correspondent accounts and payment infrastructure. Processing transactions for sanctioned persons, even indirectly, may result in restricted access to international clearing.

In 2026, not only the transaction itself but also the company’s response after identifying potential risk is critical. Failure to escalate, conduct an internal review, or implement corrective measures may be interpreted as bad faith or gross negligence.

Banking risk: de-risking, account freezing and denial of service

In 2026, banks often act more strictly than legislation formally requires. For financial institutions, sanctions risk is not only a legal but also a reputational factor. Even a potential link to high-risk jurisdictions or sanctioned sectors may lead to restrictive measures without a formal regulatory decision.

De-risking has become standard practice. Banks prefer to terminate relationships with higher-risk clients rather than face investigations or sanctions penalties.

Enhanced due diligence during expansion

When scaling operations, banks initiate enhanced review. The assessment covers not only current transactions, but also:

• Changes in ownership structure;
• New jurisdictions of operation;
• The nature of the client base;
• Sources of funds and investment rationale.

If a company cannot convincingly explain the economic basis of its operations, the bank may suspend services pending completion of an internal review.

Transaction blocks and account freezes

Unlike regulatory procedures, bank responses are often preventive. Upon identifying potential sanctions exposure, banks may:

• Temporarily block specific transactions;
• Freeze funds on the account;
• Restrict international transfers;
• request additional documents and explanations.

Even if the risk is later cleared, operational consequences may be significant, ranging from delayed settlements to loss of counterparties.

Reputational impact and cascading effect

Information about sanctions risk or a banking investigation may affect relationships with other financial institutions. A refusal by one bank often triggers a chain reaction, complicating account openings in alternative jurisdictions.

In 2026, secondary sanctions exposure increasingly materialises through the banking channel. There may be no formal violation, yet conservative banking policies can effectively restrict access to the global payment system.

Practical model of sanctions compliance in 2026

An effective sanctions compliance model is no longer limited to basic screening against sanctions lists. It requires a systematic approach, integration of controls into operational processes, and active management involvement. A formal policy without practical implementation does not provide protection against secondary sanctions exposure.

Integrated sanctions screening

Modern screening must be embedded into transaction processes and operate in real time. The review should cover not only direct counterparties, but also their ownership structure, affiliated parties, and indirect links. Regular updates of sanctions databases and documentation of screening results are essential.

Screening must also include analysis of the economic context of the transaction. Even without a list match, risk may arise where there are signs of circumvention schemes or abnormal transaction structures.

UBO and corporate link analysis

Secondary sanctions are often linked to opaque ownership structures. The compliance model should therefore include enhanced verification of beneficial owners, sources of capital, and potential hidden links to sanctioned persons.

Particular attention should be paid to complex holding structures, nominee elements, and jurisdictions with high levels of confidentiality. Insufficient UBO verification remains one of the main causes of sanctions claims.

Geographic risk assessment

Sanctions compliance in 2026 requires systematic assessment of operational geography. Companies must analyse not only the counterparty’s country of registration, but also the actual destination of goods, place of service delivery, and ultimate economic beneficiary.

Geographic risk should be integrated into the overall company risk assessment model and regularly reviewed in light of changes in international sanctions practice.

Escalation and the role of management

A critical element is an internal procedure for escalating sanctions risks. Employees must understand when a transaction requires additional review, and management must have a mechanism for prompt decision-making.

Board oversight plays a key role. The board must not only approve sanctions policies, but also monitor their practical implementation and respond to identified risks. A documented position and active management involvement significantly reduce personal and corporate exposure.

Liability of directors and compliance officers

In 2026, sanctions risk increasingly extends beyond corporate liability and affects specific officers. Regulators and banks assess not only the existence of a sanctions policy, but also the actual level of management involvement in overseeing cross-border operations. Formal approval of procedures is no longer considered sufficient protection.

Personal exposure arises where it is established that management knew or should have known about heightened sanctions risk but failed to take reasonable measures to mitigate it. Particular attention is given to cases involving ignored internal warnings, lack of risk escalation, or approval of transactions without proper review.

Risks for directors and compliance officers may include:

1. Administrative fines and restrictions on holding managerial positions;
2. Involvement in regulatory investigations;
3. Prohibition from working in licensed entities;
4. Civil liability for damages;
5. Significant reputational consequences affecting future professional activity.

Even without criminal proceedings, personal consequences may substantially impact career prospects and access to international markets. Under intensified enforcement, protection depends not on formal delegation, but on documented involvement, systematic risk assessment, and a transparent governance model.

How Structum helps minimize secondary sanctions exposure

Amid increasing sanctions pressure and the extraterritorial application of secondary sanctions, companies require not a formal list check, but a comprehensive sanctions risk management system. Structum supports international groups, financial institutions, fintech companies, and cross-border business structures in building a resilient sanctions compliance model aligned with 2026 requirements.

Within this practice, Structum team provides:

• Legal analysis of sanctions exposure considering applicable jurisdictions and cross-border operations;
• Assessment of secondary sanctions risk when engaging with high-risk counterparties;
• Audit of existing sanctions screening systems and UBO verification procedures;
• Development and update of sanctions policies and escalation protocols;
• Structuring of governance mechanisms and board oversight in sanctions control;
• Advisory on banking de-risking and preparation for enhanced due diligence;
• Support in interactions with regulators and financial institutions;
• Assistance with business restructuring to reduce sanctions exposure.

If your company operates cross-border, works in a regulated sector, or plans expansion in 2026, the Structum team is ready to conduct an independent sanctions risk assessment and develop a practical model to mitigate secondary sanctions exposure. Contact us for an individual consultation and legal review of your current structure.