Why Governance Holds the Key to Smarter Sanctions Risk

Financial institutions will not keep pace with rapidly evolving sanctions risks by continually adding new controls.

Instead, they need an integrated non-financial risk framework built on strong governance, consistent data, and enterprise-wide ownership, a senior risk executive at a major Nordic bank's UK branch has argued.

That approach, he said, offers organizations the best opportunity to identify emerging threats, respond consistently across jurisdictions, and avoid creating new vulnerabilities as geopolitical risks continue to evolve.

The speaker told delegates at CeFPro’s 2026 Risk Evolve conference that sanctions have become significantly more complex over the past few years, driven by geopolitical instability, fragmented regulatory regimes, and increasingly sophisticated attempts to evade controls.

What once involved monitoring relatively stable sanctions programs has evolved into an environment where firms may need to react to policy changes almost overnight.

"The world is a bit of a mess at the moment," the executive said.

Rather than asking, "What's the next jurisdictional issue that might happen?", organizations are increasingly forced to ask, "What happened last night?" or "What's going to happen later this week?"

He pointed to the rapid expansion of unilateral sanctions regimes alongside differing national interpretations of ownership, control, and reporting obligations.

These variations create significant operational challenges for internationally active financial institutions, particularly where clients, products, currencies, and counterparties span multiple jurisdictions.

The result is an environment where sanctions cannot be managed in isolation but instead touch almost every aspect of non-financial risk.

That growing complexity extends well beyond sanctions screening.

Trade finance, customer due diligence, shipping activity, beneficial ownership, proliferation financing, fraud, terrorist financing, and third-party dependencies increasingly overlap, requiring organizations to move away from siloed thinking.

"If you only approach it by saying, 'Is this sanctions?', that's the wrong thing," the risk manager said. "We've got something. What is it? You've got to go the other way round."

Data quality emerged as another recurring theme throughout the presentation. As sanctions requirements evolve, institutions are collecting more customer information and introducing additional control points.

However, fragmented systems and inconsistent data standards threaten to undermine those efforts, particularly as organizations increasingly deploy artificial intelligence and advanced analytics.

Referencing earlier discussions from the conference, the executive warned that poor data quality does more than create isolated mistakes.

"If it's wrong, it's an accelerator for errors," he said, arguing that structured, consistent data has become fundamental to effective risk management across the enterprise.

The presentation repeatedly returned to governance as the foundation upon which every other control depends.

Rather than advocating wholesale organizational change, the speaker encouraged firms to strengthen existing governance structures by clearly defining risk appetite, documenting responsibilities, standardizing risk assessment methodologies, and establishing consistent reporting across jurisdictions.