Sanctions compliance used to be a bank problem. It is now a general business problem: exporters, trading houses, software companies, logistics providers — anyone with international counterparties, payments or goods that cross borders. Mid-sized companies hear "risk-based approach" and are tempted to read it as "less". That is not what it means. Risk-based means you have consciously decided where your exposure sits, put controls there, and can show your reasoning.
In Switzerland, sanctions measures are enacted under the Embargo Act and administered primarily by SECO; foreign regimes can reach your business as well, through currencies, ownership structures or contract terms. What follows stays at framework level deliberately — which measures apply to a given transaction always depends on the facts.
Know who you actually deal with
Screening a name is pointless if you do not know whose name to screen. The foundation of any sanctions programme is counterparty identification: the legal entity behind the brand, and who owns and controls it. Sanctions restrictions typically attach through ownership and control, so the shareholder you never looked at can matter more than the party on the invoice.
How deep you go is the risk-based part. For a domestic office-supplies vendor, confirming the entity is enough. For a distributor in a sensitive market, or an agent who touches your money, you want the ownership chain — and a contractual duty to tell you when it changes.
Screen at onboarding — and on change
There are two moments that matter: when a counterparty enters your world, and when something changes. Onboarding screening belongs before the contract is signed or the first delivery leaves, not after. Change-driven screening is triggered from three directions: the lists change (regimes move quickly), the counterparty changes (new owners, new management, new domicile), or the transaction changes (a new destination, a new product line, an unusual payment route or request to invoice a different entity).
A once-a-year batch run misses all three. It creates the feeling of a control without the substance of one. Trigger-based re-screening is both more effective and, for most mid-sized companies, cheaper.
Build an escalation path someone owns
A screening hit is not a decision — it is a question. Most hits are false positives, and the twin dangers are treating everything as noise and freezing everything in panic. What prevents both is a defined path: who assesses a hit, against which information, who may clear it, who must be involved when a match looks real — typically management and legal counsel — and what happens to the transaction in the meantime.
The person who owns this path needs two things that are often forgotten: the authority to stop a transaction without being overruled by sales, and a way to reach outside help quickly when a real match surfaces. Whether a given situation requires freezing, reporting or unwinding depends entirely on the facts — which is precisely why the path to competent advice must exist before it is needed.
Document what you did and why
If a question ever comes — from a bank, an auditor, a customer or an authority — the answer will be your records: what you screened, when, what came back, and why you proceeded or declined. Diligence that is not documented is, from the outside, indistinguishable from no diligence at all.
This does not require heavy tooling. It requires consistency: a record per counterparty of the checks run and the decisions taken, kept where the next person can find it. The discipline of writing down "cleared because—" also quietly improves the decisions themselves.
Proportionate is a judgment, not a shortcut
A risk-based programme for a mid-sized company can be genuinely light: a tiered view of counterparties, screening wired into onboarding and triggered by change, one owned escalation path, and a consistent record. What it cannot be is improvised. The companies that end up in difficulty are rarely the ones that made a considered judgment that proved wrong; they are the ones that never made a judgment at all.
Much of the work is structured reading at scale — counterparty files, ownership documents, transaction patterns — which is exactly what systems do well, with a lawyer deciding the cases that are genuinely close. If you are unsure whether your current setup would stand up to the question "show us your reasoning", that is a conversation worth having early, and we are happy to have it with you.