Sanctions Risk in 2026: Practical Steps for Smaller Firms

The sanctions landscape has always required attention. In 2026, it requires rather more than that.

The US and Israeli strikes on Iran that began on 28 February, and Iran’s ongoing retaliation across the region, have set off a chain of regulatory consequences that will no doubt reverberate for some time. Sanctions designations will be added, amended and extended at pace. Regimes that looked relatively stable are shifting. The window between a geopolitical event and a new name appearing on a consolidated list is getting shorter. For Isle of Man firms doing cross-border business, that is a live compliance challenge.

The temptation, particularly for smaller firms, is to treat sanctions screening as a problem you solved at onboarding. You checked your clients. You got clean results. You moved on. The “one and done” approach, is a common issue the Regulator finds.

The problem is that sanctions lists change and they change often. A client who was perfectly clean in January may not be in March. If you are relying on a manual check done at the start of the relationship, with nothing automated or systematic in place to catch subsequent changes, you have a process that looks like sanctions compliance but does not actually function. That distinction matters enormously.

Firms with good IT solutions have an advantage here. A system that runs regularly against your client database and flags new matches takes the burden off individual staff and creates a defensible audit trail. For firms without that, the alternative is to re-screen the client base each time a new sanctions alert is released. That sounds manageable until you look at what those alerts actually contain. Since the start of the Ukraine conflict, releases have regularly featured material target change lists in the hundreds. Working through that manually against a client book of any size is a significant undertaking, and one that will keep arriving. If your current approach does not have a credible answer to that volume, it is worth reviewing now rather than when even more conflict driven alerts land at 4pm on a Friday afternoon.

Not all sanctions are the same

This is worth pausing on, because it catches people out more often than it should.

Some sanctions are comprehensive. If a jurisdiction or entity is subject to a comprehensive regime, you stop. There is no transaction, no relationship, no workaround. But other sanctions are targeted or conditional, applying only to specific activities, sectors, or transaction types. A client may be connected to a sanctioned jurisdiction without every aspect of your relationship with them being prohibited. The analysis matters.

There is also the question of licences. In some circumstances, a general licence permits activity that would otherwise be prohibited, without you needing to apply for anything. In others, a specific licence is available if you can demonstrate the transaction falls within defined parameters. Isle of Man firms dealing with complex cross-border structures should be aware that “sanctioned” does not always mean “completely off limits,” and equally that assuming a licence applies without checking is not a defence. If you are in any doubt about whether a licence covers your situation, take advice before proceeding. The cost of getting it wrong is significantly higher than the cost of checking.

Staying ahead rather than catching up

The current situation in the Middle East is a useful prompt for a piece of proactive work: mapping your client base against the jurisdictions now under heightened scrutiny. Iran and its regional proxies are the obvious focus at the moment, but the conflict has implications for Lebanon, Yemen, and potentially further afield as positions harden and new designations follow.

Go through your client files and identify any connections to affected jurisdictions, whether through nationality, incorporation, source of funds or beneficial ownership, and document what you find and what you did with it. If you identify elevated risk, consider whether your current monitoring is sufficient. If you find nothing of concern, document that too. A clean result you can evidence is far more useful than a clean result you assumed.

That mapping exercise also has a second use. Once you know where your exposure sits, you have the raw material for targeted risk management across your wider framework. Does your Business Risk Assessment need to be updated to reflect the changed landscape? Should there be a report to the board or senior management? Do client risk assessments for those with connections to affected jurisdictions need to be amended to require a higher level of sign-off? A sanctions review that feeds into your broader risk framework is genuinely useful. One that sits in a folder and goes no further is a missed opportunity.

If you get a hit

Sanctions screening is designed to produce results, and occasionally it will. Knowing what to do when that happens is as important as the screening itself.

If a match is identified, the immediate obligation is to freeze the relevant assets and refrain from dealing with or making funds available to the designated person or entity – unless it is a qualified restriction. In any event, pause all activity and proceed with caution until you are certain you understand what you have. Seek advice.  You are also required to report the match to the relevant authority: in the Isle of Man context, that means the Financial Intelligence Unit. The report should be made promptly, and you should take legal advice if you are uncertain about the scope of the freeze obligation or what you are permitted to do while the matter is under review.

A genuine sanctions hit is relatively rare for most smaller firms. A false positive, where a name on your client list resembles a listed name but is not the same person, is more common. False positives still need to be worked through properly, with documented reasoning that explains why you concluded there was no match. “It didn’t look like them” is not sufficient. Date of birth, nationality, address and other identifying information should be cross-referenced and the conclusion recorded.

The mechanics of handling a hit well are not complicated, but they do need to be in your procedures before you need them, not written in a hurry while you are trying to manage the situation.