Sanctions Compliance: When The Law Meets The Reality Of Immobilized Assets

Billions in Russian reserves remain immobilized, Iranian oil revenues are chased through complex shipping networks, and banks are fined for missing red flags that investigators say were “in plain sight”. In 2026, sanctions compliance is no longer a back-office checklist, it is a frontline risk function where legal texts collide with operational reality, and where a single misstep can freeze funds, stall deals, and trigger reputational damage that outlasts the sanctions themselves.

Frozen money, moving targets, and daily decisions

Sanctions look clean on paper, yet they turn messy the moment a payment hits a correspondent bank or an asset manager realises an account holder has become a “designated person” overnight. The scale is not theoretical. Western jurisdictions have immobilised hundreds of billions in Russian state-related assets since 2022, including roughly €200 billion in reserves held in the EU, according to European officials, while the US and allies have simultaneously widened restrictions on sectors ranging from defense to high-tech components. That is the macro picture, but compliance officers and in-house lawyers live in the micro: a delayed wire, a blocked securities transfer, a vessel whose beneficial owner just changed, a customer who now appears on an updated list, and a business team asking, “Can we still deliver?”

The key difficulty is that “freeze” is not a single operational act. It can involve blocking funds, prohibiting making funds available, immobilising securities, suspending corporate actions, and stopping the provision of services tied to the asset, and those obligations differ across regimes and even across agencies within the same legal system. The EU’s asset-freeze rules, for example, hinge on preventing any use, transfer, alteration, movement, or access that would enable dealing with the asset, while also prohibiting making funds or economic resources available, directly or indirectly, to designated persons. The US approach under OFAC typically frames the obligation as “blocking” property and interests in property, with specific triggers based on ownership thresholds and control, and with strict liability in many enforcement contexts, which means intent is not always required for a violation.

Operationally, the “reality of immobilised assets” shows up in places that are easy to underestimate: pending corporate actions on shares, margin calls, coupon payments, escrow arrangements, receivables in trade finance, and even intangible assets such as software licences and cloud services. Banks and market infrastructures have learned, sometimes painfully, that a freeze can ripple across chain-of-custody systems, custodians, sub-custodians, and central securities depositories. This is why internal playbooks increasingly map not only who is sanctioned, but what the firm actually touches, how it touches it, and what must stop at each point of the process.

For readers trying to understand how these situations unfold in practice, the most common flashpoint is what compliance teams call “caught-in-the-middle” property: assets that are not obviously owned by a sanctioned person at first glance, yet become reportable, blockable, or immobilised once ownership, control, or benefit is traced. That is where a deeper look at frozen assets under sanctions becomes less of a niche topic, and more of a necessary lens on how rules translate into real-world friction, especially when multiple jurisdictions claim authority over the same transaction chain.

Ownership, control, and the 50% trap

Ask a sanctions lawyer what keeps clients awake, and you will often hear one word: ownership. Sanctions regimes increasingly rely on “ownership and control” concepts to prevent designated persons from hiding behind corporate layers, relatives, nominees, and offshore vehicles. In the US, OFAC’s so-called 50 Percent Rule is central: if one or more blocked persons own, in aggregate, 50% or more of an entity, that entity is treated as blocked even if it is not named on a list. The EU also captures indirect ownership and control, though the legal mechanics and the evidentiary expectations can differ, and national competent authorities may interpret grey zones differently.

The trap is that corporate reality rarely presents a neat cap table. Ownership can be split across multiple sanctioned and non-sanctioned parties, trusts and foundations can obscure beneficiaries, and control can exist without majority equity through voting agreements, board appointment rights, golden shares, or decisive influence over management. Compliance teams therefore face two simultaneous burdens: build a defensible view of who ultimately owns or controls the entity, and do so quickly enough to stop prohibited dealings before a transaction settles. That urgency matters because sanctions enforcement frequently focuses on “causing” violations and on failures to act promptly once a trigger is known or should have been known.

Data quality is the second part of the problem. Corporate registries vary in transparency, beneficial ownership databases are incomplete in many jurisdictions, and public sources can lag behind reality by months. Even where data exists, it may not be standardised across languages and scripts, which complicates screening, and creates false negatives when names are transliterated inconsistently. The result is an uncomfortable truth: firms often have to make high-stakes decisions with imperfect information, then show regulators that they took reasonable steps, documented assumptions, escalated appropriately, and corrected course as new facts emerged.

Recent enforcement patterns underline how costly a misread can be. OFAC and other agencies have repeatedly highlighted inadequate ownership due diligence, weak escalation when red flags emerged, and failures to integrate sanctions controls into mergers and acquisitions. Penalties in major cases have reached into the tens and hundreds of millions of dollars over the past decade, and while not every action involves asset-freeze breaches, the message is consistent: sanctions compliance must match the complexity of modern corporate structures, and “we didn’t know” is rarely a complete defence. The practical consequence is that more firms now treat beneficial ownership analysis as a living process, not a one-time onboarding step.

Licences, exceptions, and the bottleneck effect

Can a frozen asset ever move again? Sometimes yes, but the path runs through licences, exceptions, and narrow authorisations, and that is where legal nuance meets operational bottlenecks. Sanctions regimes are not absolute bans; they often include humanitarian carve-outs, wind-down provisions, and licensing mechanisms designed to reduce unintended harm. Yet, applying those tools at scale is slow, resource-intensive, and, in practice, uneven across jurisdictions.

In the EU, authorisations may be granted by national competent authorities, and the criteria can vary by country, timeline, and risk appetite, even when the underlying regulation is the same. In the US, OFAC issues general licences that apply broadly, and specific licences tailored to individual circumstances. The UK’s Office of Financial Sanctions Implementation plays a similar role, with its own guidance and expectations. For a multinational firm, that means parallel processes, different templates, different reporting requirements, and a constant need to align legal advice with the actual systems that will execute the authorised activity, whether that is releasing funds, paying legal fees, or completing a wind-down sale.

The bottleneck effect is often felt first by banks, payment firms, and custodians, because they sit at the choke points of the financial system, and they are expected to stop transactions instantly. When a licence arrives, those same institutions must be confident that every condition is met, that the scope is interpreted correctly, and that downstream parties will not re-route value to a prohibited recipient. Any ambiguity can lead to over-compliance, where firms refuse lawful activity because the risk feels asymmetric, and where customers experience frozen accounts, delayed salaries, or blocked trade flows even when an exception might apply.

Humanitarian channels illustrate the tension. Policymakers have expanded exemptions in some contexts to facilitate food, medicine, and humanitarian assistance, and the UN has debated broader frameworks to limit unintended consequences. Still, NGOs and suppliers regularly report payment disruptions linked to de-risking and to cautious correspondent banks, and that friction can persist even after clarifying guidance is published. For compliance teams, the lesson is pragmatic: licences are not a “get out of jail free” card, they are a controlled corridor, and building the internal capability to use that corridor, quickly and safely, is now a competitive necessity in industries exposed to high-risk geographies.

From checklists to intelligence-led compliance

Sanctions compliance used to mean screening names and updating lists. That era is over. Enforcement agencies increasingly expect firms to detect evasion tactics, identify indirect exposure, and integrate sanctions risk into broader financial crime frameworks, and they are explicit about what “good” looks like: risk-based controls, senior oversight, auditability, and the ability to learn from mistakes.

The evasion playbook has evolved fast. Investigators have documented the use of layered intermediaries, reflagged vessels, ship-to-ship transfers, opaque commodity trading chains, and payments routed through third countries, and they have also warned about dual-use goods, microelectronics, and services that can support restricted sectors. That complexity pushes compliance into an intelligence-led model, combining traditional screening with network analysis, trade data, shipping intelligence, open-source research, and strong know-your-customer and know-your-supplier discipline. It also forces companies outside finance, including manufacturers, logistics firms, insurers, and tech providers, to treat sanctions as a core operational risk rather than a legal footnote.

Technology helps, but it does not replace judgement. Automated screening can reduce false positives, and graph tools can surface hidden connections, yet the most consequential decisions still require humans: is this entity controlled by a designated person, does this shipment present diversion risk, are we “making funds available” by providing a service, are we dealing with an asset that should be immobilised, and do we have a licensing route? Regulators frequently criticise firms that rely on tools without governance, training, and escalation pathways, and they reward, implicitly, those that can demonstrate a coherent control environment from the boardroom to the front line.

The strategic shift is visible in budgets and staffing. Large financial institutions now maintain dedicated sanctions advisory teams, separate from broader AML units, and many corporates have built export controls and sanctions functions that sit closer to procurement and supply chain, because risk signals often appear there first. Training has become more scenario-based, focusing on ownership structures, indirect dealings, and real transaction flows, and internal audits increasingly test whether freezes are executed correctly, reported within deadlines, and maintained without leakage through fees, interest, or ancillary services.

What to do before the next freeze

Plan for immobilisation, not just screening. Build a playbook for freezes, reporting, licensing, and customer communication, then budget for ownership data, legal review, and system changes. When exposure is likely, reserve time for licensing and wind-downs, and check whether any national aid or sector support schemes apply to disrupted trade.