The Problem With Most Sanctions Risk Assessments

Ask to see the sanctions risk assessment of ten mortgage firms and there is a good chance you will see the same document repeated ten times.

The wording changes slightly.

The branding changes.

The logo changes.

The risks rarely do.

This is one of the biggest weaknesses we see across the industry.

Many firms have sanctions risk assessments because they know they should have one.

Far fewer firms have sanctions risk assessments that genuinely reflect their business.

The reality is that a mortgage adviser operating from a single office in Yorkshire advising local employed clients faces very different sanctions risks to a firm advising foreign nationals, expatriates, property investors and overseas clients.

Yet many assessments score both firms exactly the same.

That is not a risk-based approach.

It is a template-based approach.

And regulators are becoming increasingly focused on the difference.

Why A Sanctions Risk Assessment Matters

Many firms assume sanctions only affect banks.

That is a dangerous assumption.

Sanctions exposure can arise through:

• Clients
• Beneficial owners
• Introducers
• Source of funds
• Source of wealth
• Connected parties
• Property transactions
• Corporate ownership structures

A mortgage adviser may never directly transfer funds.

However, they may still become involved in a transaction connected to a sanctioned individual, entity or source of funds.

The FCA expects firms to identify and assess sanctions risks relevant to their business activities and implement controls proportionate to those risks.

Step 1 – Understand Your Firm Before Assessing Risk

A sanctions risk assessment should start with understanding your actual business model.

Before assigning any scores, ask:

What type of mortgage business do we conduct?

For example:

• Residential mortgages
• Buy-to-let mortgages
• Commercial lending
• Bridging finance
• Development finance
• Expat mortgages
• Overseas property lending

Each product creates different sanctions exposures.

A straightforward UK residential mortgage may present relatively limited sanctions exposure.

A complex commercial property transaction involving multiple entities and overseas connections may present considerably higher risk.

Who Are Your Clients?

Consider:

• UK employed individuals
• Self-employed customers
• Company directors
• Property investors
• Overseas nationals
• Expatriates
• High-net-worth individuals

The client base should directly influence sanctions risk scoring.

For example:

A firm advising overseas investors purchasing UK property may face higher sanctions exposure than a firm dealing solely with local first-time buyers.

How Do You Operate?

Consider:

• Face-to-face meetings
• Remote advice
• Video calls
• Introducer networks
• Estate agent referrals
• Online enquiries

The further removed a firm becomes from direct client interaction, the more important robust sanctions screening and due diligence become.

Step 2 – Identify Your Inherent Sanctions Risks

Inherent risk means the level of risk before controls are applied.

This is where firms should focus on exposure rather than mitigation.

Common sanctions risks for mortgage advisers include:

Customer Risk

Examples include:

• Clients residing overseas
• Clients with connections to sanctioned jurisdictions
• Politically Exposed Persons (PEPs)
• Complex ownership structures
• Trust arrangements
• Foreign income sources

Questions to ask:

• Do we advise non-UK residents?
• Do we deal with foreign nationals?
• Do we verify beneficial ownership sufficiently?

Geographic Risk

This is often one of the most overlooked areas.

Consider exposure to:

• High-risk jurisdictions
• Sanctioned countries
• Countries with weak financial crime controls
• Countries known for sanctions circumvention activity

The risk is not limited to where the client lives.

It may involve:

• Source of funds
• Source of wealth
• Business interests
• Property ownership
• Corporate structures

Product Risk

Certain products naturally create greater complexity.

Examples include:

• Commercial mortgages
• Property investment lending
• Bridging finance
• Development finance
• High-value transactions

The greater the complexity, the greater the likelihood that enhanced sanctions checks may be required.

Introducer Risk

Many mortgage firms rely heavily on:

• Estate agents
• Property developers
• Accountants
• Solicitors
• Overseas introducers

Ask yourself:

How much reliance are we placing on third parties?

Can we evidence our own sanctions checks?

Step 3 – Assess Your Existing Controls

Once risks are identified, assess the controls that mitigate those risks.

The FCA has repeatedly highlighted that firms must be able to demonstrate effective sanctions controls rather than simply relying on policies alone.

Examples include:

Sanctions Screening

Do you screen:

• Customers?
• Beneficial owners?
• Directors?
• Connected parties?
• Guarantors?

And importantly:

How frequently?

Many firms only screen at onboarding.

That may not be sufficient.

Ongoing Monitoring

Ask:

• Do we rescreen existing customers?
• Are sanctions lists updated automatically?
• Do we conduct event-driven reviews?

A client who was not sanctioned yesterday may become sanctioned tomorrow.

Source Of Funds Checks

Consider:

• Property sales
• Savings accumulation
• Gifts
• Overseas transfers
• Business income

Sanctions risks often emerge during source of funds reviews rather than identity verification.

Escalation Procedures

What happens when a sanctions alert is identified?

Can staff explain:

• Who reviews alerts?
• Who makes decisions?
• When external reporting is required?
• When accounts or relationships should be paused?

Step 4 – Calculate Residual Risk

Residual risk is the level of risk remaining after controls are applied.

This is where firms often become overly optimistic.

Example:

Overseas Property Investor Clients

Inherent Risk:
High

Reason:
Cross-border activity, overseas funds and increased sanctions exposure.

Controls:
Sanctions screening, source of funds checks, enhanced due diligence and management oversight.

Residual Risk:
Medium

The controls reduce the risk.

They do not eliminate it.

Step 5 – Document The Reasoning

This is arguably the most important section.

A score without explanation is difficult to justify.

Poor Example:

Geographic Risk – Medium

Better Example:

Geographic Risk is assessed as Medium because the firm primarily advises UK-based clients. However, the business occasionally advises foreign nationals and clients with overseas income sources. Sanctions screening and enhanced due diligence controls are applied where international exposure is identified.

The regulator wants evidence that firms understand why a risk exists and how they reached their conclusions.

Step 6 – Ensure Senior Management Oversight

The FCA has repeatedly identified weaknesses where senior management were unable to demonstrate sufficient oversight of sanctions risks.

Ask:

• Has the assessment been reviewed?
• Has it been challenged?
• Has it been approved?
• Can senior management explain the scoring methodology?

A sanctions risk assessment should never become a document that sits untouched in a compliance folder.

Step 7 – Review When Risks Change

Many firms only review sanctions risk assessments annually.

In reality, sanctions risks can change overnight.

Triggers for review may include:

• New sanctions regimes
• Geopolitical events
• Expansion into new markets
• New introducer relationships
• Overseas client growth
• New product lines

The sanctions landscape evolves rapidly.

Your assessment should evolve with it.

Questions Every Mortgage Firm Should Ask

Before approving your sanctions risk assessment, ask:

• Does this reflect our actual business?
• Could we justify every score to the FCA?
• Have we considered sanctions separately from AML?
• Have we assessed customer, geographic and product risks individually?
• Have we documented our reasoning?
• Have we assessed whether our screening controls are proportionate to our exposure?
• Would a regulator understand why we reached our conclusions?

If the answer is no, the assessment probably requires further work.

Final Thoughts

The strongest sanctions risk assessments are not the longest.

They are the ones that clearly demonstrate understanding.

A good sanctions risk assessment should explain:

• Where exposure exists
• Why it exists
• What controls are in place
• Whether those controls are effective
• What level of risk remains

Because the purpose of a sanctions risk assessment is not simply to prove that a document exists.

It is to demonstrate that the firm genuinely understands its exposure to sanctions risk and has taken proportionate steps to manage it.

And that is exactly what regulators increasingly expect to see.