The Conventional Wisdom
Many compliance teams believe that a strong financial sanctions program covers all bases. You've got automated screening running daily, hitting the UK Sanctions List with high accuracy, and your governance framework integrates sanctions into your broader AML/CFT reporting. The assumption is: sanctions are sanctions. Apply the same controls across trade, and you're compliant.
This approach seems efficient. It's also incorrect.
Why This Approach Falls Short
The FCA recently assessed over 150 firms and found a critical misunderstanding: trade sanctions and financial sanctions are not the same compliance issue. They involve different risks, evasion methods, and detection needs.
Financial sanctions screening is binary and name-based. Either the counterparty is on the list or they're not. Automated tools excel here. You screen names, freeze assets, and file reports. The control architecture is mature because the problem is well-defined.
Trade sanctions, however, are more complex. The risk involves not just who you're transacting with, but what you're moving, how it's documented, where it's routed, and whether the declared purpose matches the actual use. Evasion appears as mis-declared dual-use goods, falsified bills of lading, or shipments routed through intermediaries to obscure the final destination.
You can't screen your way out of that. Yet, the FCA found most firms are trying to do just that, treating trade sanctions as an extension of financial sanctions controls instead of building a separate program with distinct risk assessments and monitoring.
The Evidence
Regulatory penalties are already happening. The FCA fined Starling Bank £29m in September 2024 for incomplete sanctions Name Screening since 2017. Metro Bank paid £16.7m for transaction monitoring failures. In 2025, Monzo was fined £21m for AML control failings, and Barclays was penalized £42m for weaknesses in high-risk client management.
The pattern is clear: the FCA penalizes control failures, not just confirmed breaches. Inadequate systems are now enforcement triggers.
The report highlights that few firms collect, analyze, or escalate management information on trade sanctions exposure. Risk assessments often omit trade-specific considerations or limit them to trade finance desks instead of applying them across the business. The insurance and digital assets sectors under-report breaches, likely because their controls aren't designed to detect trade-based evasion through Russia's shadow fleet or cryptocurrency routing.
Meanwhile, frozen assets reported in the UK rose from £24.4bn for 2023-24 to £37bn for 2024-25. The volume and complexity are increasing, and the FCA's supervisory intensity is rising accordingly.
What to Do Instead
You need a standalone trade sanctions program, not just an add-on to your financial sanctions framework. Build a distinct compliance architecture from the ground up.
Start with a dedicated gap analysis. Map your exposure to dual-use goods, document your customer due diligence for trade counterparties, and identify which business lines handle cross-border shipments or payments tied to physical goods. Trade risk isn't confined to trade finance; it exists wherever goods, services, or technical data cross borders.
Develop transaction Transaction Monitoring Rules targeting trade-specific evasion typologies. Look for layering through intermediaries, third-country rerouting, and discrepancies between declared and actual shipment routes. If you're in insurance or digital assets, your scenarios should reflect documented evasion methods: shadow fleets, obfuscated vessel ownership, cryptocurrency intermediation.
Continuously test your screening calibration. The FCA found that one-word names, names with digits, and long names exceeding character limits failed to generate alerts at some firms. If your system can't handle fuzzy matching, non-Latin scripts, name variants, and vessel identifiers, you're missing significant risks.
Stop relying solely on contractual assurances from third-party vendors. Independently test their outputs. Set contractual standards for data quality and update frequencies. Document who owns sanctions risk at each stage of the customer lifecycle. If a vendor's tool misses a designated entity due to a character limit, that's your enforcement action, not theirs.
Conduct proactive lookback reviews. Don't wait for a known breach to trigger remediation. The FCA's top performers conduct regular retrospective analyses to identify control gaps before the regulator does. The gap between them and the rest of the market is widening.
When the Conventional Wisdom Is Right
There's some truth in the unified approach. Financial and trade sanctions share foundational requirements: accurate data, timely updates, clear escalation paths, and senior management oversight. If your financial sanctions program lacks these basics, you won't succeed at trade sanctions either.
For firms with no trade exposure, the conventional wisdom holds. If you're a retail-focused digital bank with no cross-border goods movement, dual-use technology transfers, or exposure to shipping or commodities, then your financial sanctions controls are likely sufficient. The FCA's findings apply to firms with trade risk, not every supervised entity.
However, most firms underestimate their trade exposure. They think "trade sanctions" means letters of credit and containerized freight. It also includes software exports, technical assistance, insurance coverage for sanctioned vessels, and cryptocurrency payments tied to physical goods. If you haven't mapped your full trade risk surface, you don't know if you're in scope.
The FCA has flagged the unified approach as inadequate. That's not guidance; it's a compliance expectation backed by enforcement precedent. Frozen assets are up 52% year-over-year. Supervisory intensity is rising. The next round of fines will target firms that ignored the warning.
Your trade sanctions controls need to match the maturity of your financial sanctions program. If they don't, close the gap now.
