Sanctions compliance: screening, ownership tests and reporting

Sanctions compliance means checking, before money moves or goods ship, that no counterparty, owner, vessel or end user is caught by a restrictive measure. If one is, you freeze what the law says must be frozen and report it. For a business in the Netherlands, the binding rules are the directly applicable EU sanctions regulations, enforced nationally through the Sanctions Act 1977 (Sanctiewet 1977). A breach is an economic offence under the Economic Offences Act (Wet op de economische delicten, WED). The rule that catches most companies out is not the list itself but the ownership and control test. An unlisted company is treated as listed once one or more listed parties together hold 50 percent or more of it, or once a listed party controls it.

Who is bound by sanctions in the Netherlands?

Every business established in the Netherlands is bound by EU sanctions, and so is every Dutch national. The rules also cover any business done in whole or in part within Dutch territory.

That obligation reaches far beyond exporters and banks. It applies to the haulier who arranges a shipment and the software company that grants a licence. It applies to the accountant who issues an invoice, the landlord who lets warehouse space and the shareholder who receives a dividend. Restrictive measures apply to funds and economic resources, to goods and technology, and to a growing list of services.

What does sanctions compliance require of your business?

In essence, four recurring duties. You know who you deal with and who owns them, you know where your goods go, you freeze on a match, and you report it.

First, you must know who you are dealing with, including who ultimately owns and controls them. Second, you must know what you are supplying and where it will actually end up. Third, you must stop and freeze the moment a match appears, not after you have taken advice. Fourth, you must report to the authority the regulation designates, within the period it sets. Every policy, screening tool and training session exists to make those four things happen reliably and repeatably.

There is no minimum threshold. A small payment to a listed party is a breach in exactly the same way as a large one. It makes no difference that a shipment was routine, unprofitable or a favour to a long-standing client. A sanctions breach is also not a matter of intent alone. The prohibitions are drafted objectively, and the absence of bad faith affects the sentence rather than the offence. Not knowing a counterparty’s ownership structure is no defence if a reasonable enquiry would have revealed it.

This article deals with restrictive measures against states, entities and individuals. For sanctions in the sense of punishments in criminal and administrative proceedings, see our complete guide to international and domestic penal measures.

Where do the rules come from?

From EU Council regulations, which apply directly in the Netherlands. Dutch law adds the enforcement machinery through the Sanctions Act 1977 and the WED.

EU sanctions take the form of Council regulations. They apply in the Netherlands without any national implementing act. They enter into force on publication in the Official Journal, in practice on the day they appear. A counterparty that was acceptable on Friday afternoon can therefore be prohibited by Monday morning. The regulations that matter most in practice are the asset freeze regulation adopted in 2014 in response to the situation in Ukraine, the sectoral Russia regulation of the same year, the Iran regulation of 2012 and the dual-use regulation of 2021.

National law supplies the enforcement machinery. The Sanctions Act 1977 is a framework act. It empowers the responsible ministers to issue sanctions orders (sanctieregelingen), arranges supervision, and turns a breach of an EU regulation into a punishable act in the Netherlands. For financial institutions, the Act designates De Nederlandsche Bank (DNB) and the Dutch Authority for the Financial Markets (Autoriteit Financiële Markten, AFM) as supervisors. The Regeling toezicht Sanctiewet 1977 requires those institutions to maintain adequate administrative organisation and internal control, and to report any match to their supervisor without delay.

Companies outside the financial sector have no licence-based supervisor. This is often misread as an absence of obligation. It is not. It simply means that enforcement arrives through Customs and the criminal law rather than through a dialogue with a supervisor.

How does the criminal law apply?

Through the WED. A breach of the rules made under the Sanctions Act 1977 is an economic offence, and a deliberate breach is a serious crime.

Committed deliberately, the offence is a crime (misdrijf); otherwise it is a lesser regulatory offence (overtreding). The WED allows imprisonment and fines, confiscation of the profit obtained, and additional measures such as placing the business under administration or ordering its closure. The Fiscal Information and Investigation Service (FIOD) investigates, under the direction of the Functioneel Parket. That is the specialist branch of the public prosecution service that handles economic and financial crime.

Which changes should you track?

Two: an EU directive that harmonises criminal penalties, and a Dutch bill that will replace the Sanctions Act 1977. Until that bill enters into force, the current Act applies in full.

At EU level, Directive (EU) 2024/1226 of 24 April 2024 obliges member states to criminalise a defined catalogue of sanctions breaches, including circumvention. It also requires effective penalties for legal persons.

At national level, a bill for an International Sanctions Measures Act (Wet internationale sanctiemaatregelen) was submitted to the House of Representatives (Tweede Kamer) in February 2026 and is still under consideration there. According to the government, it will replace the Sanctions Act 1977 and create a single Central Sanctions Reporting Point (Centraal Meldpunt Sancties). It also adds administrative enforcement alongside criminal prosecution. Until the bill is passed and brought into force, the Sanctions Act 1977 continues to apply in full.

The substance of the Russia measures changes with every package, so a summary here would be out of date within weeks. For the shape of the successive packages and what they cover, see our overview of the additional sanctions against Russia. For the practical realities of trade with the region, see our Eurasia and CIS Desk.

Which lists should you screen against?

Primarily the EU consolidated list of persons, groups and entities subject to financial sanctions. Add the Dutch national terrorism list and, if you have US exposure, the US SDN list.

Screening is the operational core of sanctions compliance. You check against lists, not against countries. The authoritative source for a business in the Netherlands is the EU consolidated list, maintained by the European Commission and shown in the EU Sanctions Map. United Nations designations reach you through that same EU list. Alongside it sits the national terrorism list kept by the Dutch government. Companies with exposure to the United States also check the Specially Designated Nationals list of the Office of Foreign Assets Control.

Whom should you screen?

Far more parties than the one you invoice. Everyone in the chain of the transaction, from owners to carriers and banks, needs to be checked.

A defensible programme checks the customer, the customer’s parent company and shareholders, and its directors and ultimate beneficial owners. It also checks suppliers and subcontractors, agents and intermediaries, freight forwarders and carriers, the banks on both sides of the payment, insurers, and the end user named on the shipping documents. Where goods travel by sea or air, vessels and aircraft may be designated in their own right. Identify them by IMO number or registration mark rather than by name, because names change and IMO numbers do not.

How often should you screen?

At onboarding, before each material transaction, and every time the EU list is updated. Screening only at onboarding is not enough, because new designations take effect immediately.

Designations are added continuously. A workable rhythm is a check at onboarding, a check before each material transaction or shipment, and an automated rescreen of your entire counterparty file whenever the EU list changes. Record the date, the list version and the result of every check. When the authorities look at a file two years later, the question is not whether you were right. It is whether you can show what you knew and when.

How should you handle false positives?

With a written procedure. Decide in advance who reviews a potential match, what extra information is gathered, who may clear it and who must be told if it stands.

How does sanctions screening differ from anti-money laundering checks?

Sanctions rules apply to everyone and allow no proportionality. Customer due diligence under the Dutch anti-money laundering act applies only to designated institutions and is risk-based.

Sanctions screening is often confused with customer due diligence under the Money Laundering and Terrorist Financing (Prevention) Act (Wet ter voorkoming van witwassen en financieren van terrorisme, Wwft). The two are genuinely different. Wwft due diligence applies only to designated institutions, is risk-based, and allows a proportionate approach. Sanctions rules apply to everyone: a listed party is prohibited, full stop.

In practice the two regimes reinforce each other, and the same file usually serves both. For the client-identification side of that work, see our guide to KYC obligations. For the wider financial-crime picture, see our guide to money laundering in the Netherlands. Note that money laundering itself is a crime under articles 420bis to 420quater of the Dutch Criminal Code (Wetboek van Strafrecht), not under the Wwft. The Wwft imposes preventive duties only.

When is an unlisted company treated as listed?

When listed parties own 50 percent or more of it, directly or indirectly and counted together, or when a listed party controls it. Its funds and economic resources must then be frozen as well.

How does the ownership test work?

Ownership is a bright-line test. Where one or more listed persons or entities hold 50 percent or more of the proprietary rights in another entity, that entity is caught. Its funds and economic resources must be frozen in the same way. The holding may be direct or indirect, and the holdings of several listed parties are added together.

An illustrative example: two listed shareholders hold 30 percent and 25 percent of a company. Together they cross the threshold, even though neither does so alone. Because the test aggregates, you have to trace a chain of intermediate holding companies all the way through. Do not stop at the first unlisted layer.

The EU used to describe the threshold as more than 50 percent. The European Commission’s updated best practices now use 50 percent or more, in line with the US approach. The UK still applies more than 50 percent, so check which regime you are applying.

How does the control test work?

Control is a separate test and has no percentage at all. A listed party may control an entity through the right to appoint or remove a majority of the board, or through a shareholders’ agreement that gives it dominant influence. Control can also run through day-to-day management, through guaranteeing the entity’s debts, or through any other arrangement that lets it direct the entity’s affairs. A minority stake combined with such rights is enough. An ownership chart alone is therefore insufficient. For higher-risk counterparties, you also need to see the articles of association and any shareholders’ agreement.

Why is the 25 percent UBO threshold different?

Do not confuse the sanctions threshold with the 25 percent figure from the UBO register. Under the Wwft, an ownership interest of more than 25 percent identifies an ultimate beneficial owner; it tells you whom you must identify. Fifty percent or more is the sanctions threshold; it tells you whom you may not pay.

Mixing the two produces two classic errors. One is clearing a counterparty because no single listed shareholder reaches 25 percent. The other is freezing a relationship that in fact falls outside the ownership test.

What should you do in practice?

Ask every higher-risk counterparty for a current ownership chart down to natural persons. Verify it against company registers where they are reliable, and record the date of verification. Require the counterparty to notify you of any change. Ownership structures are sometimes deliberately rearranged to move below the threshold. A chart obtained before a designation should therefore be refreshed after one.

What must you do when a match is confirmed?

Freeze immediately, and report. Nothing may leave your control, and the competent authority must be told.

Freezing means that nothing leaves your control. Payments are stopped, goods are not released and services are suspended. Credit balances stay where they are, and no economic resource of any kind is made available to the listed party, directly or indirectly.

Making available is read broadly. Paying a supplier who will pass the money on, releasing goods that can be sold, or providing a service with economic value all fall within it. You may not set the frozen amount off against a debt, and you may not release goods against a bank guarantee.

Where do you report frozen assets?

Today, reporting depends on your sector and the type of asset. Financial institutions report to DNB or the AFM; other businesses report to the government body that rijksoverheid.nl designates.

Reporting in the Netherlands is currently fragmented. That is precisely the problem the pending bill is meant to solve with a single Central Sanctions Reporting Point. Until then, check the current reporting addresses on rijksoverheid.nl before you report, because they differ by sanctions regime and by type of asset. The Netherlands passes the information on to the European Commission.

Financial institutions supervised by DNB or the AFM report a match to their own supervisor without delay under the Regeling toezicht Sanctiewet 1977. For everyone else, the practical rule is simple. If you hold something that belongs to or benefits a listed party, the government needs to be told, and quickly.

Do listed parties have their own reporting duty?

Yes. A person or organisation listed under the Russia, Belarus, Haiti or Iran regimes must report the assets it holds in the EU within six weeks of being listed.

Can frozen assets be released?

Not on your own decision. A release requires a derogation that the competent authority grants in advance, in writing and on the conditions of the regulation.

Some regulations allow derogations for basic needs, professional fees, pre-existing contracts or humanitarian purposes. Wind-down periods work the same way. They are fixed deadlines written into the regulation, not a negotiable grace period. Once they expire, performance becomes prohibited whatever the contract says.

Do you need an export licence for dual-use goods?

Yes, for exports from the EU of items on the dual-use control list. Country-specific sanctions add further export bans on top of that list.

Sanctions screening deals with who; export control deals with what. Dual-use items are goods, software and technology with both civil and military applications. Under the dual-use regulation, their export from the European Union requires a licence. In the Netherlands, licences are issued by the Central Import and Export Office (Centrale Dienst voor In- en Uitvoer, CDIU), part of Customs, on the basis of policy set by the Ministry of Foreign Affairs. The control list is technical and covers far more than weapons. High-performance computing, certain sensors and lasers, machine tools, encryption software and semiconductor manufacturing equipment all appear on it.

Which rules surprise businesses most?

The first is the catch-all. Even an item that is not on the control list needs a licence if the authorities have told you, or you are otherwise aware, that it is or may be intended for a military end use or a weapons of mass destruction programme. Awareness is judged by what a diligent exporter would have concluded from the circumstances.

The second is that country-specific sanctions add their own export bans on top of the dual-use list. That is how ordinary industrial goods, vehicles, chemicals and luxury items came to be prohibited for Russia. For a defined group of sensitive items, EU rules also require exporters to include a contractual ban on re-export to Russia in their sales contracts, with a remedy if the buyer breaches it.

What does the circumvention ban mean for you?

You may not knowingly and intentionally take part in activities whose object or effect is to get around a restrictive measure. Much enforcement attention now focuses on re-routing through third countries.

The warning signs are consistent and worth training your staff to recognise:

• a new intermediary appears in a market with no history of buying the product;
• the declared end user runs a business that does not plausibly need the goods;
• order volumes jump without explanation;
• payment comes from a jurisdiction unconnected to the buyer;
• the customer declines to sign an end-user statement, refuses an on-site visit, or is unusually indifferent to price, specification or after-sales support.

Can services breach sanctions too?

Yes. EU measures prohibit a range of services to entities established in Russia, so you can breach sanctions without shipping anything.

The prohibited services include accounting, auditing, business and management consulting, public relations, IT consultancy and certain legal advisory services, subject to defined exceptions. A Dutch consultancy or software supplier can therefore breach sanctions without ever shipping a physical item. Keep end-user statements, licences, transport documents and correspondence for the applicable retention period. Make sure the file explains not only what was decided, but why.

Who enforces sanctions in the Netherlands?

Several bodies at once: Customs, the FIOD with the Functioneel Parket, the financial supervisors and the ministries.

Customs checks consignments at the border and holds those that raise questions. The FIOD investigates suspected offences and works with the Functioneel Parket, which decides on prosecution. DNB and the AFM supervise financial institutions and can impose administrative measures on them. The Ministry of Foreign Affairs coordinates sanctions policy, while the competent ministries handle freezes and derogations in their own areas.

What are the penalties for a breach?

A deliberate breach is a crime under the WED. It can lead to imprisonment, substantial fines, confiscation and measures against the business itself.

The fines are set by penalty category under article 23 of the Criminal Code. On top of that come confiscation of the advantage obtained and additional measures, such as placing the business under administration or ordering its total or partial closure. Sanctions breaches are prosecuted as serious economic crime, not as an administrative slip.

Can directors and employees be held personally liable?

Yes. Under article 51 of the Dutch Criminal Code, an offence committed by a company can also be charged against those who ordered it or directed it.

A director who overruled a compliance objection may be prosecuted personally. So may a sales manager who accepted an implausible end-user statement, or a finance officer who processed a payment after a hit was flagged. Voluntary disclosure, prompt remediation and cooperation are taken into account by the prosecution service. A documented decision trail is what makes such a disclosure credible.

What are the commercial consequences?

They often arrive faster than the legal ones. Banks, insurers, carriers and customers tend to react at the first sign of exposure.

Banks end relationships, insurers withdraw cover, carriers refuse bookings and customers require sanctions warranties before they will contract. EU regulations also bar listed parties from bringing claims in connection with contracts affected by sanctions. The counterparty therefore cannot sue you for performance you have lawfully withheld. That protection, however, depends on the withholding being lawful in the first place.

Should you simply follow the strictest rule, including US sanctions?

No. For certain US measures on Iran and Cuba, EU law actually prohibits you from complying. A conflict between the regimes needs advice on both together.

US primary sanctions bind you when a transaction touches US persons, US-origin goods or technology, or the US financial system. Clearing in US dollars can be enough. US secondary sanctions can penalise a non-US company for conduct outside US jurisdiction. But for a defined set of US measures concerning Iran and Cuba, the EU Blocking Regulation prohibits EU operators from complying with them and from giving effect to foreign judgments based on them, unless the European Commission authorises compliance. A Dutch company facing that conflict needs advice on both regimes together, not a blanket policy of following whichever rule is stricter. Our compliance lawyers advise on exactly that combination of EU, Dutch and US rules.

How do you build a compliance programme that holds up?

Start with a written risk assessment and build proportionate, documented controls on it. The authorities do not expect a bank-grade function from an SME, but they do expect the file to show your reasoning.

The risk assessment should map your exposure honestly. Which countries do the goods and money touch? Which product categories could be dual-use? Which counterparties sit behind opaque structures? Which currencies and correspondent banks are used, and which transport routes pass through jurisdictions known for re-export?

Which controls follow from the assessment?

Screening must cover the parties identified in the risk assessment and follow the rhythm set out above. It needs a documented hit procedure and a named person, at board level, who owns the decision.

Contracts need sanctions clauses that do real work:

• a warranty that neither the counterparty nor its owners are listed;
• a continuing duty to disclose changes in ownership and control;
• an end-use and re-export undertaking;
• an audit and information right;
• a right to suspend and terminate immediately, without liability, if a designation occurs.

A clause that merely says the parties will comply with applicable law achieves nothing.

Who should be trained?

The people who see the red flags first: sales, logistics, procurement and finance, not only the legal department. Keep the training concrete. Show what an implausible end user looks like, why a change of delivery address matters, what to do with a payment instruction from an unexpected country, and whom to call. Add an internal escalation route that does not run through the person whose deal is at stake. Keep a record of who was trained and when.

How do you prove your programme works?

Keep the evidence. A compliance programme is judged after the fact, on the file. Screening logs, cleared hits with reasons, ownership charts with verification dates, licences, end-user statements and board minutes recording the decisions are what turn a good-faith mistake into a defensible one. Test the system periodically, for example with a small internal audit or a sample of transactions traced end to end. Record what you found and what you changed.

What can we do for you with sanctions compliance?

Our compliance lawyers advise businesses on EU, Dutch and US sanctions rules:

• We trace the ownership and control of a counterparty and assess whether the 50 percent or control test is met.
• We draft your sanctions risk assessment, screening procedure and hit procedure.
• We draft sanctions clauses: warranties, re-export undertakings and suspension and termination rights.
• We advise on freezing, the report to the competent authority and requests for a derogation or licence.
• We check whether goods or services need a dual-use export licence from the CDIU.
• We assist directors and the company during a FIOD investigation or prosecution under the WED.

Summary

• EU sanctions regulations bind every business in the Netherlands directly; a breach is an economic offence under the WED, and a deliberate breach is a crime.
• An unlisted company is caught if listed parties own 50 percent or more of it, counted together, or if a listed party controls it.
• Screen all parties in the chain, at onboarding, before each material transaction and after every list update, and record each check.
• On a confirmed match, freeze immediately and report; only the competent authority can release frozen assets.
• Export controls, service bans and the circumvention ban apply alongside the lists; directors and staff can be prosecuted personally (article 51 of the Criminal Code).

Frequently asked questions