The costly sanctions risks hiding in your supply chain

In 432 BC, in what is now modern Greece, the Athenian Empire levied sanctions known as the Megarian Decree against the city of Megara for a range of supposed offenses. The sanctions—believed to be one of the earliest uses of economic influence to affect foreign policy—isolated Megara from trade with its neighbors, weakened its economy, and may have contributed to the start of the 27-year Peloponnesian War between Athens and Megara’s ally, Sparta.

In more recent history, on August 12, 2023, Nasdaq paid a penalty of more than $4 million to the US Department of the Treasury’s Office of Foreign Assets Control (OFAC) to settle sanctions violations incurred by a former overseas subsidiary, Nasdaq OMX Armenia, operator of the Armenian Stock Exchange. 

Nasdaq acquired that business in 2008 as part of its purchase of Swedish exchange operator and markets technology vendor OMX. But in 2012, the US government imposed sanctions against doing business with Iran. By processing and settling payments on behalf of an Armenian subsidiary of Iran’s state-owned Bank Mallat, Nasdaq OMX Armenia committed 151 sanctions violations, which Nasdaq discovered and voluntarily disclosed to OFAC in 2014.

If we harness the power of unstructured data and perhaps combine that with structured data, can we get to a point where some of the opacity is removed?

Kathryn McDonald, Radiant Global Investors

In short, Nasdaq was fined because one of its subsidiaries was doing business with a subsidiary of a sanctioned entity, where the ownership relationships and their obligations may not have been immediately clear. 

Nasdaq is by no means alone: Wells Fargo last year paid a $30 million penalty for sanctions violated by Wachovia, which the bank bought in 2008. Wachovia—and, following the acquisition, Wells Fargo—was supplying a software platform to a European bank that Wachovia “knew or should have known” would be used to conduct trade finance transactions with sanctioned jurisdictions and individuals.

For the most part, governments impose sanctions against often-obscure despotic regimes, states that harbor or sponsor terrorism, or those with appalling human rights records, as a punishment to the country in question and a deterrent to anyone who may—wittingly or unwittingly—be contributing to funding those regimes through trade or investment. Other sanctions may be levied against individuals such as drug dealers or arms dealers, and companies they are affiliated with.

For example, the US government first imposed sanctions against North Korea in 1950, during the Korean War, and against Iran in 1979. But it’s the West’s recent sanctions against Russia for invading Crimea in 2014 and invading Ukraine in 2022 that made sanctions a household term and have the potential for a much larger impact, since flows of money and commodities in and out of Russia were more intertwined with other economies.

“When you talk about Russia, following its invasion of Ukraine, and companies with subsidiaries and suppliers in Russia, then you’re talking about real money, and so that’s where big conglomerates start to feel the pinch,” says Kathryn McDonald, co-founder and head of investments and sustainability at Radiant Global Investors.

The “pinch” she describes is the risk of a company that you are invested in—or deal with as part of your network of partners and suppliers (your supply chain)—or a country where you do business winding up on a sanctions list, and needing to divest that investment, exit the country, or cut ties with a supplier.

Sometimes that’s not as easy as it sounds. Sanctions often incorporate a timeframe—known as “divestment windows”—during which companies that identify an exposure and need to divest, explains Oliver Bodmer, senior product manager for financial information at Swiss data provider and exchange operator SIX Group. A US person or entity wanting to divest sanctioned exposures would need to file with the OFAC and obtain a license to trade in the sanctioned security.

And while there are techniques to performing due diligence on a company’s supply chain to identify potential sources of risk, the possibility of encountering a sanctioned entity or individual within that supply chain amplifies those risks.

“When we think about supply chain risk generally, we think about it in terms of a hierarchy,” McDonald says. “First, country or region; second, industries, such as textiles or manufacturing; third, the complexity of the supply chain. Some supply chains are very simple; some are extremely complex. In some industries, a company may have more than 100 suppliers, while in others you may have only one, but a concentration of risk. And fourth, we look at the dollar amount of the value chain.”

Obviously, she adds, any sanction at a country or company level would change this approach, taking precedent over this hierarchy. But identifying the sanctions exposure among a long list of suppliers—especially if the sanctioned entities or individuals are trying to hide their involvement—is like trying to find a needle in a haystack.

Know Your Supplier

“In financial investment decisions, supply chain is very important—such as, how much does the company you’re invested in rely on imports from China or less stable suppliers?” says Gary Kotovets, chief data and analytics officer at business information provider Dun & Bradstreet. “The area that’s growing rapidly is Know Your Customer and also Know Your Supplier. That means you must know all your suppliers, and their suppliers.”

The area that’s growing rapidly is Know Your Customer and also Know Your Supplier. That means you must know all your suppliers, and their suppliers

Gary Kotovets, Dun & Bradstreet

Here's a hypothetical example of that complexity: A fund manager wants to invest in a US-based electric vehicle manufacturer. Its manufacturing plant is in the US, its employees are all US residents, and it only sells to US customers. But where do all the components used to build the car come from? Who supplies the metal, the nuts and bolts, the dials and dashboards, or the stereo system? And who supplies the lithium battery (probably China, the world’s largest manufacturer of lithium batteries), and where was that lithium mined (probably Chile, Australia, or China)?

The US has not sanctioned China as a country, but has sanctioned officials of its ruling party, as well as companies seen to be supporting Russia’s war on Ukraine. So, to ensure that the fund manager’s investment in a US company is risk-free from the impact of any sanctions—in this case, perhaps, the auto manufacturer’s share price dropping after being fined for dealing with a sanctioned or sanction-related company, or being unable to meet demand because of a supply chain interruption resulting from cutting ties with a sanctioned entity—they need to perform in-depth research on its supply chain, and identify links between the companies involved and any company or individual invested in them who may be subject to sanctions.

SIX Group has been providing its Sanctioned Securities Monitoring service, a dataset of financial instruments linked to sanctioned domiciles or individuals since 2014, when Russia invaded Crimea.

“Since the introduction of the Sanctioned Securities Monitoring service in 2014, we’ve grown the service. Now, we have 1,500 sources of data worldwide, and we normalize all that data. We find the tainted companies and all securities linked to them,” Bodmer says. “We read the sanctions regulation, translate it into business requirements, and we can even, for example, define an approach based on domicile and sector codes, and communicate that to clients before publishing the data downstream.”

Not every sanction is relevant to financial markets—for example, a travel ban on an oligarch—so SIX wouldn’t include that detail. Conversely, if clients think SIX’s determinations are too conservative, they can define their own compliance rules.

A key data source for SIX is the former Bureau van Dijk Orbis data service, now owned by Moody’s, which has a database of 400 million entities and 200 million beneficial owners. Crucially, a “beneficial owner” is an individual or organization that ultimately controls a company, fund, or trust, even though their ownership may not be immediately apparent, and may be done via a series of minority holdings or indirect ownership—say, via a stake owned by another company controlled by the same individual or a middleman acting on that individual’s behalf.

Incentives for opacity

Now, just because a company’s ownership is opaque doesn’t mean it’s doing anything illegal. But it may be cause for suspicion—especially if there’s the slightest chance that opacity may be hiding the involvement of a sanctioned individual or regime that leaves funds who have invested in that company, or banks who have loaned the company money, exposed to potential fines.

One reason for continued opacity, McDonald says, is that many manufacturers view their supply chain as a source of competitive advantage. In other words, if you’ve discovered a supplier that can provide what you need cheaper, at higher quality, and more reliably than those used by your competitors, you may want to keep that information to yourself.

In addition, once privately held companies begin to appear in a supply chain, it becomes significantly less transparent than a supply chain of publicly traded companies that are obliged to report certain disclosures.

That’s why vendors supplying this kind of information gather as much information as possible on publicly traded and privately held companies, and try to establish where links exist between them. For example, Dun & Bradstreet has a database of around 300 million beneficial owners, and has mapped around 35 billion relationships between suppliers and customers, down to—in some cases—the 10^th link in a supply chain, Kotovets says.

In addition, firms and vendors need to monitor foreign-language news and company information, because information about an obscure overseas company may only be available in its local language, says Jim Tousignant, CEO of New York-based Fintech Studios, which uses AI to identify and articulate linkages between companies and individuals to pinpoint potential sources of risk.

For example, S&P Global uses FinTech Studios to deliver market intelligence reports to clients of its ThinkFolio investment management platform (acquired as part of S&P’s purchase of IHS Markit), while one major bank uses the vendor to identify potential areas of risk from investments, including areas such as ESG factors, forced labor, or sanctions.

“We analyze every public company. We track more than 12 million companies, people, and sectors—public and private,” Tousignant says. “And if you think it’s hard to track public companies in a foreign language, it’s 10 times harder to do that with private companies.”

The ethical element

The good news, McDonald says, is that many firms are looking to be fully transparent and to be able to guarantee a sanctions-free supply chain, because they understand that risk in a supply chain can be a big deal—not only in terms of financial penalties and risk of interrupted supply, but also the reputational risks.

And those aren’t the only kinds of risk associated with a questionable supply chain: Companies using coerced labor tend to also be associated with organized crime, cyber crime, and money laundering, McDonald notes. “So, even if you as a company don’t care about the plight of these people … there’s a massive risk of opening yourself up to a criminal element that permeates this underworld of forced labor,” she says.

If you think it’s hard to track public companies in a foreign language, it’s 10 times harder to do that with private companies

Jim Tousignant, Fintech Studios

Many of these issues beyond the written letter of a government sanctions list bleed into the ESG space. And whether or not financial firms and corporations consider those factors from an ESG perspective when making investments or choosing suppliers, the effort put into monitoring ESG claims and performance can translate to a broader window into a company’s integrity and potential risks.

“Right now, people look at supply chains and see a tangled and elaborate mess. But if we harness the power of unstructured data and perhaps combine that with structured data, can we get to a point where some of the opacity is removed? If you pair the power of AI with an expert analyst, that can be very powerful,” she says. “All of these things should help us understand supply chains better and be able to say with greater certainty that a specific company or product does not have exposure to undesirable places or practices.”

The element of deliberate concealment—the fact that bad actors, such as subjects of sanctions and those involved in illegal or dubious practices tend to hide their involvement adds another layer of complexity: Once you’ve unraveled a supply chain, how can you be sure the companies and people in that chain are who and what they claim to be?

“Clients use us to understand the relationships between corporations and branches of a corporate tree, such as franchises, and corporate constructs that have been created. Your ability to understand that ‘global ultimate’ is very important to your ability to detect fraud,” says Dun & Bradstreet’s Kotovets. “And we verify that supply chain by going on-site to make sure they are what they say they are.”

This is not lost on Eric Weitzman, a 29-year veteran of FactSet Research Systems, who until recently served as head of regulatory content and ESG, and whose title is now head of entity intelligence, an expanded role that covers corporate structures and supply chains, recognizing the close ties between these data elements and the need to seamlessly integrate them to be able to see the full spectrum of risks.

“Sanctioned entities have weaved their way into supply chains,” often using middlemen to avoid detection, Weitzman says. Other times, they don’t need to actively conceal their involvement; they just need to remain invisible. “Sanctions lists may only name the main entity. So, a government may sanction an entity but not explicitly sanction all its subsidiaries.” And if a sanctioned entity or person remains a minority investor in a company, their involvement may evade detection, and the company—while still at risk of their tainting influence—may go unsanctioned.

In 2014, FactSet acquired a small data vendor called Revere Data, which had developed a detailed hierarchy of companies and industry sectors, and then used that hierarchy to develop a product detailing a company’s supply chain and its revenues that hinged on specific components and suppliers within that supply chain, connected by a unique identifier. 

In addition, FactSet now uses that data to map company fundamental data, ESG data, and sanctions information to companies and securities. The vendor can also map elements of that metadata, such as the location of a company and its subsidiaries or suppliers, to potential physical or geopolitical risks, such as the risk of disruption from a tsunami or earthquake, or being located in a country at risk of political instability, or perhaps terror attacks or invasion by sanctioned countries or organizations.

Ultimately, it’s a company’s decision how much of this data to utilize, and where to invest, outside of explicitly sanctioned entities. Whether or not companies go beyond sanctions lists in their analysis of companies and look at ethical factors—which may, indeed, lead to sanctions at a future date—may be more of a moral decision, but it’s a risk assessment that all companies should consider, says SIX’s Bodmer. 

“You never know exactly what sanctions are coming … but of course, we know there are hotspots. And you could argue that in the first place, you should never invest in something that’s likely to be sanctioned.”