Russia’s sanctions tested banks’ ownership data more than their name lists

The week

On February 26, 2022, the United States, the European Commission, the United Kingdom, Canada and other allies announced that selected Russian banks would be removed from the SWIFT messaging system. They also committed to restrictive measures on the Central Bank of Russia. On February 28, the US Treasury prohibited US persons from engaging in transactions with the Central Bank of Russia, the National Wealth Fund of the Russian Federation and the Russian Ministry of Finance. It also designated further entities and individuals. These actions followed sanctions announced days earlier on major Russian financial institutions, state-owned enterprises and members of the elite. The European Union and the United Kingdom adopted their own measures in parallel, with lists and rules that overlapped but did not match. New designations, general licenses, directives and guidance continued through the following weeks.

Sanctions screening is often described as matching customer and payment data against lists of named parties. That description was always incomplete, and the Russia measures of 2022 showed how incomplete. They arrived in quick waves. They targeted state enterprises and private groups with hundreds of subsidiaries. They came from several governments with different lists and different tests, and many restricted particular activities rather than all dealings with a party. For banks and other financial institutions, the hard work was data: knowing who owned whom, knowing which rule applied from when, and knowing which jurisdiction’s version of it governed a transaction. We look at those three problems in turn: ownership, timing and divergence.

Ownership

Under OFAC’s 50 percent rule, an entity owned 50 percent or more, directly or indirectly, individually or in aggregate, by one or more blocked persons is itself blocked, even if it appears on no list. The EU and UK apply their own ownership and control tests, which differ in detail and give more weight to control. For Russian state-owned enterprises and for groups held by sanctioned individuals, those rules caught many subsidiaries, joint ventures and holding companies that no list named.

A name screen cannot find an unnamed subsidiary. Finding it requires the ownership structure of the customer and, for trade and correspondent business, of counterparties, traced to enough depth. That information comes from corporate registries, commercial data providers and customer due diligence files. Its quality varies, and it is poorest for entities registered in jurisdictions with little transparency or held through chains of trusts and nominees. Aggregation adds difficulty: two sanctioned owners holding 30 percent each produce a blocked entity that neither holding would reveal alone.

Institutions that held structured ownership data, with percentages and dates, and that ran entity resolution across their systems, could answer exposure questions within days. Entity resolution is the work of recognizing that a customer record, a payment counterparty and a trade finance applicant are the same company. Institutions relying on name matching and free-text due diligence notes spent weeks on manual research, often with outside counsel, and still lacked confidence in the answer.

Timing

The second problem was speed. New designations, general licenses, directives and guidance were published every few days. Some took effect immediately. Others came with wind-down periods that permitted certain transactions until a set date. General licenses authorized defined activities, such as some energy-related payments, under conditions that later changed.

That turned the sanctions regime into a stream of dated rules rather than a static list. Screening systems had to take list updates quickly and reliably. Compliance teams also had to track which authorizations applied to which transactions and when each expired. Institutions that stored these as data, with an effective date, an expiry date, a source document and an owner, could configure filters and answer questions from the business. Those that tracked them in email and memos found that different teams were applying different versions of the same rule.

Alert volume rose sharply. Russian names transliterate from Cyrillic in several ways, and common surnames match many unrelated customers. Institutions with tuned matching logic, good reference data and clear escalation rules absorbed the surge. Those with poorly tuned systems either drowned in false positives or raised thresholds in haste, which risked missing true matches. Measuring alert quality, as the share of alerts that led to escalation, before a surge gave teams a baseline to tune against during it.

Divergence

The third problem was the gap between jurisdictions. A global bank had to comply with US, EU and UK measures, and often others, at once. The lists overlapped heavily but not completely. Ownership tests differed. Some measures prohibited specific activities, such as dealing in new debt or equity of named entities, providing certain services, or investing in particular sectors, rather than all dealings.

That made screening a rules problem as well as a matching problem. The question was no longer only whether a party was listed. It was which restrictions applied to this type of transaction, in this currency, through this booking entity, with this counterparty. Answering it consistently required the rules to be written down in structured form: the jurisdiction, the targeted party or sector, the restricted activity, the exceptions and the effective dates. A booking-entity view of which regimes applied to each part of the group was the starting point. Organizations should check with counsel, since applying these rules to specific facts is a legal judgment.

Smaller institutions faced a narrower version. Most community banks and credit unions had little direct exposure to Russian parties. They still had to apply list changes promptly through their screening vendor, review the extra alerts with care, and watch for indirect exposure through correspondent relationships or business customers with international trade. For them, the practical priority was vendor oversight: how quickly the vendor loaded each change, and whether it covered ownership as well as names.

With hindsight

The Russia program grew into one of the largest sanctions regimes ever, with thousands of designations across the United States, the EU and the UK. Attention shifted from direct exposure to evasion through third countries, front companies and trade in restricted goods. In December 2023, a US executive order authorized secondary sanctions on foreign financial institutions that facilitate significant transactions for Russia’s military-industrial base, which pushed screening and due diligence obligations further into global banking. Enforcement actions in later years often cited failures to identify ownership and control or to detect evasion patterns. By this point in 2026, ownership data, entity resolution and rules that screening systems can apply are treated as core sanctions infrastructure at larger institutions. Many smaller firms still depend on vendors whose ownership coverage they have never tested. The early weeks of 2022 showed why that matters: a list is only as useful as the data it is matched against.