Thirty-Day Clean-Up: Post-Acquisition Sanctions Remediation
Harbor Capital closes its acquisition of a UK specialty chemicals distributor on 1 March. Post-close diligence reveals: sanctions screening is a manual check against a PDF of the SDN list downloaded in 2016; the distributor had an Iranian customer paying EUR 1.8 million a year that was terminated two months before closing, with EUR 400,000 of receivables still outstanding; two active customers are registered in Crimea; and a Dubai freight forwarder handles 60% of outbound shipments. There are 3,200 customers and suppliers across 14 countries, no sanctions risk assessment on file, no training records, and no named sanctions owner. The board wants a thirty-day clean-up and asks whether to self-disclose.
1. Set out a 30/60/90-day plan. Justify the sequencing rather than listing controls.
Read the worked answer
Sequence by severity multiplied by reversibility: stop ongoing conduct first, then scope, then build.
Days 0-30 - stop the bleeding. Suspend the two Crimea customers immediately; Crimea is subject to comprehensive territorial restrictions and there is no lawful basis for continuing. Suspend or re-underwrite the Dubai forwarder until its ownership chain and end-use controls are verified - a single intermediary handling 60% of shipments is a concentration risk and a classic diversion point. Freeze new onboarding outside a senior-approved exception process. Re-screen all active customers, suppliers, ship-to parties and logistics providers against OFAC, EU, UK OFSI and UN lists using secondary identifiers, not names alone. Open a file on the EUR 400,000 receivable.
Days 30-60 - scope and document. Written sanctions risk assessment by jurisdiction, product and counterparty type; ownership-look-through procedure; escalation and blocking SOP; policy; training rollout with records.
Days 60-90 - sustain and test. Tooling selection, independent testing, board reporting pack, and a decision on disclosure.
Rationale: a control framework takes months; an ongoing Crimea shipment is a violation every week. You also cannot make a disclosure decision before you know what happened, so scoping must precede it. Document every step now - the contemporaneous record is the mitigation.
2. The board asks whether to self-disclose. What is your recommendation and what must be established first?
Read the worked answer
Recommendation: do not disclose yet, and do not rule it out. Scope first.
A self-disclosure is an admission. A premature or inaccurate one is worse than a late one, because it destroys credibility and is hard to retract.
Establish first, under privilege:
- Jurisdiction. Was there a violation at all? The distributor is a UK company paying in euros. If no US person, no US-origin goods above the de minimis threshold and no USD were involved, US jurisdiction may not attach. UK and EU exposure depends on whether the Iranian customer was designated and whether the goods were within scope.
- Facts. A transaction lookback over a defined period, quantification, identification of who knew what, and preservation of records.
- The receivable. This is a separate question from disclosure. If the payer is now designated, the receivable may be blocked property that must be frozen and reported - an obligation that exists whether or not any past conduct is disclosed.
Then weigh the jurisdictional regimes: UK OFSI operates a discretionary reduction for voluntary disclosure, and OFAC's enforcement guidelines give credit for self-disclosure, cooperation and remediation. Both credit a well-documented investigation. Neither credits a disclosure made before the facts were known.
3. What should the board actually see each quarter? Distinguish metrics that evidence control from metrics that merely look busy.
Read the worked answer
Vanity metrics measure activity. Control metrics measure whether risk is being caught and resolved correctly.
Evidence of control:
- Percentage of the full counterparty population screened against every applicable list, using secondary identifiers, with the date of last complete refresh.
- Ownership look-through coverage: percentage of higher-risk customers where the beneficial ownership chain has been screened, not just the customer.
- Hit disposition quality: independent quality-assurance sample results on closed alerts and the percentage of closures with a documented rationale - not average handling time.
- Escalation rate and the proportion of escalations reversed on review, which reveals whether the first line is over- or under-escalating.
- Aging of open investigations and overdue periodic reviews.
- Independent testing findings, open and closed, with owners and dates.
Governance items for the audit committee specifically: risk-acceptance decisions, any blocked or rejected transactions and the reporting made, whistleblower or staff concerns about pressure to clear alerts, and the resourcing-to-volume ratio for the sanctions team.
What to avoid: number of alerts generated, number of names on the list, training completion alone, and average handling time. A fast average handling time is not an efficiency indicator in this function; it is more often a warning.