Following the FCA’s recent publication, Sanctions Systems and Controls: Our Firms, Our Findings, which highlights both good practice and common weaknesses identified across regulated firms, it is clear that sanctions risk assessments are becoming an increasingly important area of regulatory focus.

One of the recurring themes within the FCA’s findings is that firms must understand their specific sanctions exposure and implement controls that are proportionate to the risks they face. Generic assessments and template-driven approaches are unlikely to provide firms with the level of understanding expected by regulators.

With that in mind, we have created this practical guide to help insurance intermediaries develop a sanctions risk assessment that is tailored to their business, their customers, their products and the jurisdictions in which they operate.

The objective is not to create a longer document. The objective is to create a risk assessment that genuinely reflects the risks within your business and can be understood by the very people responsible for managing them.

The FCA’s full report can be found here: https:/www.fca.org.uk/publications/good-and-poor-practice/sanctions-systems-and-controls-our-firms-our-findings

The Problem with Most Sanctions Risk Assessments

Ask to see the sanctions risk assessments of ten insurance intermediaries and there is a good chance you will find ten very similar documents.

The terminology may differ. The branding may differ. The conclusions often do not.

Many firms rely on generic templates which fail to reflect the actual risks within their business. This creates a significant problem.

The sanctions risks faced by a local personal lines broker arranging motor and household insurance are very different to those faced by a commercial broker arranging international marine, aviation or trade-related insurance.

Yet many firms assess both businesses in exactly the same way.

That is not a risk-based approach, it is a template-based approach.

A meaningful sanctions risk assessment should explain how sanctions risks apply specifically to your products, customers, delivery methods, business model and where business is delivered geographically.

Why A Sanctions Risk Assessment Matters

Many insurance intermediaries assume sanctions only affect banks and payment providers. That assumption can create significant vulnerabilities.

Sanctions exposure can arise through:

• Policyholders
• Beneficial owners
• Corporate clients
• Directors and shareholders
• Insured assets
• Overseas operations
• Claims beneficiaries
• Premium finance arrangements
• Introducers and third parties

Even where an intermediary is not handling client funds, they may still facilitate transactions involving sanctioned individuals, entities or jurisdictions.

The FCA expects firms to understand their sanctions exposure and implement proportionate controls to manage those risks.

Step 1 – Understand Your Business Before Assessing Risk

Before assigning any risk scores, you first need to truly understand exactly how your business operates.

Ask:

What Type of Insurance Business Do We Conduct?

Examples include:

• Personal Lines Insurance
• Household Insurance
• Motor Insurance
• Travel Insurance
• Commercial Insurance
• Professional Indemnity Insurance
• Directors & Officers Insurance
• Cyber Insurance
• Marine Insurance
• Aviation Insurance
• Trade Credit Insurance

Not all insurance products create the same sanctions exposure.

For example:

A household insurance policy for a UK resident typically presents lower sanctions risk than a marine insurance placement involving international cargo movements.

Who Are Your Customers?

Consider:

• Private individuals
• Sole traders
• SMEs
• Corporate entities
• High-net-worth individuals
• Property investors
• International businesses
• Multinational organisations

Customer complexity should directly influence sanctions risk scoring.

How Do Customers Reach You?

Consider:

• Face-to-face meetings
• Telephone sales
• Online applications
• Introducer relationships
• Affinity partnerships
• Corporate referral arrangements

The further removed a firm becomes from direct customer interaction, the greater the reliance on effective sanctions screening and due diligence.

Where are your customers and where are the risks?

Consider:

• Is your customer based in one jurisdiction or multiple
• Where does the risk reside if more than one location list them

Understanding these points influences the sanctions risk, it also may expose the firm to jurisdictions they may need to additionally consider, as some jurisdictions have sanctions against people and entities that others don’t.

What currencies are involved in the risk?

Regardless of the jurisdiction of the firm the client and the risk, the involvement with a particular currency can also breach sanctions if that county has a specific sanction against that individual/entity.

Step 2 – Identify Your Inherent Sanctions Risks

Inherent risk is the level of risk that exists before controls are applied. This is where firms should focus on exposure rather than mitigation.

Customer Risk

Examples include:

• Foreign nationals
• Overseas companies
• Complex ownership structures
• PEPs
• High-net-worth clients
• Trust arrangements
• International group companies

Questions to ask:

• Do we understand who ultimately owns the customer?
• Could there be hidden sanctioned parties?
• Do we verify beneficial ownership where appropriate?

Product Risk

Certain insurance products naturally carry higher sanctions exposure.

Examples include:

Lower Risk

• Household insurance
• Personal motor insurance
• Standard protection products

Medium Risk

• Commercial combined insurance
• Professional indemnity insurance
• Cyber insurance

Higher Risk

• Marine insurance
• Aviation insurance
• Trade credit insurance
• International liability programmes

The greater the international element, the greater the potential sanctions exposure.

Geographic Risk

One of the most important areas of assessment.

Consider exposure to:

• Sanctioned jurisdictions
• High-risk jurisdictions
• Countries subject to trade restrictions
• Countries associated with sanctions circumvention

Exposure may arise through:

• Policyholders
• Beneficial owners
• Overseas operations
• Supply chains
• Insured assets

The client’s address alone rarely tells the full story.

Claims Risk

Insurance firms often overlook claims activity when assessing sanctions risk.

Questions to consider:

• Who ultimately receives claim payments?
• Could a sanctioned party benefit?
• Are overseas beneficiaries involved?
• Are there international loss locations?

Claims activity can create sanctions exposure long after a policy is initially placed.

Introducer Risk

Many intermediaries rely on introducers such as:

• Other brokers
• Professional introducers
• Trade associations
• Affinity groups
• Overseas partners

Ask:

Can we demonstrate appropriate sanctions controls across these relationships?

Step 3 – Assess Existing Controls

Once risks have been identified, assess the controls currently in place.

Sanctions Screening

Do you screen:

• Individual customers?
• Corporate customers?
• Directors?
• Beneficial owners?
• Claims beneficiaries?
• Connected parties?

And importantly:

How frequently?

Moreover, if you choose not to screen any of these document why.

Ongoing Monitoring

Sanctions risks evolve constantly.

Consider:

• Automated rescreening
• Trigger event reviews
• Periodic reviews
• Real-time sanctions updates

A customer who was not sanctioned at policy inception may become sanctioned during the policy term.

Does your solution to sanctions offer the types of review points you designate?

Beneficial Ownership Verification

For corporate customers:

• Do you identify ownership structures?
• Do you understand ultimate beneficial ownership?
• Do you verify directors and shareholders?

This becomes increasingly important in commercial insurance placements.

Escalation Procedures

If a sanctions match occurs:

• Who investigates?
• Who makes the decision?
• What documentation is required?
• When should external reporting occur?

Firms should be able to demonstrate a clear decision-making process.

Step 4 – Calculate Residual Risk

Residual risk is the level of risk remaining after controls are applied.

For example:

International Commercial Insurance Client

Inherent Risk:
High

Reason:
Overseas operations, complex ownership structures and international exposure.

Controls:
Sanctions screening, beneficial ownership checks, enhanced due diligence and ongoing monitoring.

Residual Risk:
Medium

Controls reduce risk.

They do not eliminate it.

Step 5 – Document The Reasoning

This is often the weakest area of many risk assessments.

Poor Example:

Product Risk – Medium

Better Example:

Product Risk is assessed as Medium because the firm predominantly arranges commercial insurance for UK-based SMEs. Whilst most customers operate domestically, occasional international exposures and complex corporate ownership structures increase sanctions risk. Enhanced due diligence and sanctions screening controls are applied where appropriate.

The score matters.

The rationale matters more, it demonstrates true ownership of the problem and a deep understanding of the risk the business carries, regulators want to see this.

Step 6 – Ensure Senior Management Oversight

Senior management should be able to explain:

• The firm’s sanctions exposure
• The methodology used
• Key risks identified
• Controls implemented
• Residual risk ratings

A sanctions risk assessment should be actively owned by the business.

Not simply filed away for regulatory purposes.

Step 7 – Review When Risks Change

Sanctions risks can change rapidly.

Review your assessment when:

• New products are launched
• Overseas business expands
• New introducers are onboarded
• Regulatory requirements change
• Geopolitical events occur
• New sanctions regimes are introduced

A static risk assessment quickly becomes outdated.

Questions Every Insurance Intermediary Should Ask

Before approving your sanctions risk assessment, ask:

• Does this genuinely reflect our business model?
• Have we assessed sanctions separately from AML?
• Have we considered product-specific sanctions risks?
• Have we assessed claims-related sanctions exposure?
• Have we considered beneficial ownership risks?
• Have we documented our reasoning?
• Could we justify every score to the FCA?

If not, the assessment may require further work.

Avoid Creating a Sanctions Silo

One of the most common mistakes firms make is treating the sanctions risk assessment as a document that belongs exclusively to senior management or compliance.

While senior management should retain ownership and accountability, they should not become the sole custodians of sanctions risk knowledge.

In practice, frontline staff are often far better placed to identify potential sanctions concerns than senior management.

They are the people:

• Speaking to customers
• Reviewing documentation
• Receiving enquiries
• Understanding customer behaviour
• Identifying inconsistencies and unusual activity

The challenge arises when sanctions risks are documented at board level but never communicated to the people interacting with customers every day. This creates a dangerous disconnect.

Senior management understand the risks but rarely interact directly with customers.

Frontline staff interact with customers constantly but may not understand the risks.

As a result, the people who can see the warning signs do not always recognise them, whilst those who understand the risks never see the warning signs.

A well-designed sanctions framework should ensure that relevant risks identified within the sanctions risk assessment are translated into practical guidance, procedures and training for customer-facing staff.

The objective is not for every employee to become a sanctions specialist.

The objective is to ensure employees understand:

• What risks are relevant to the business
• What warning signs to look for
• When to escalate concerns
• Who to report concerns to

The most effective sanctions controls are rarely found solely within policies or board reports, they are embedded processes that ever member of the firm just follows without thinking twice.

Final Thoughts

The strongest sanctions risk assessments are not built from templates.

They are built from understanding.

A meaningful sanctions risk assessment should explain:

• Where exposure exists
• Why exposure exists
• What controls mitigate those risks
• Whether those controls are effective
• What level of residual risk remains
• But above all every member of the firm understands and takes ownership of the task

For insurance intermediaries, sanctions exposure is often more complex than many firms initially realise.

The firms best positioned to manage that risk are not necessarily those with the largest compliance teams. They are the firms that truly understand how sanctions risks apply to their own customers, products and business activities.

Because effective sanctions compliance starts with understanding your exposure, not simply documenting it.

They are found in organisations where risk awareness is embedded throughout the business and where every employee understands the role they play in identifying and managing sanctions exposure.