Sanctions risk in accounts payable is real and rising. The UK sanctions regime has expanded materially since 2022. The EU and US regimes are tightening in parallel. Enforcement is now active, with material penalties for inadequate screening. Most mid-market AP teams are still running sanctions controls calibrated for a quieter regulatory environment. The gap between the screening cadence and the regulatory expectation is where the exposure now sits.
What ERPs screen by default
Most enterprise ERPs offer a sanctions screening module or integration. The standard configuration runs three checks.
At onboarding, when a new supplier is added to the vendor master, the supplier's name is screened against the consolidated list. The screen returns a clean pass, a possible match, or a flagged match.
Periodically, usually quarterly, the full vendor master is re-screened. Matches are reviewed and the result is filed.
At payment, where the ERP is configured to do so, the screen runs against the supplier's record before the payment is released. This is the least commonly enabled of the three.
Where this configuration is in place and disciplined, the standard cadence catches the obvious cases. The exposure sits in the cases it does not catch.
The three failure modes
Stale data. The consolidated sanctions list is updated continuously. The ERP screens against the list as it stood at the last refresh. Where the list has updated since the last screen, a supplier added to the list mid-cycle will not be flagged until the next refresh runs. Quarterly screening misses up to twelve weeks of regulatory updates.
Indirect ownership. The supplier itself is not on the sanctions list. The supplier's parent, ultimate beneficial owner or controller is. Where the ERP screens the supplier's legal name only, the indirect link is not caught. This is the dominant failure mode in 2026, because most current enforcement actions involve indirect rather than direct ownership. Beneficial ownership at the speed of AP goes into the operational mechanics.
Beneficial-owner drift. The supplier was clean at onboarding. The beneficial ownership has since changed. The new controller is sanctioned. The vendor master does not reflect the change because the supplier has not been re-screened with current PSC data. The ERP returns a clean pass on stale information.
The cadence question
Pre-onboarding screening is necessary but insufficient. Even with the most rigorous onboarding control, the regulatory list updates faster than the onboarding cycle. Sanctions screening has to be ongoing. This is the same continuous-monitoring case we make for supplier verification more broadly.
The pragmatic minimum is weekly screening on the top 100 suppliers by spend and monthly screening on the long tail, with event-driven re-screening on bank-detail changes, ownership changes, and any material invoice. Anything less leaves exposure that an active enforcement regime can find.
The role of network-level signal sharing
Individual buyer screens miss what cross-buyer signals catch.
Where a supplier becomes sanctioned, the network can flag every buyer of that supplier simultaneously. The time-to-action moves from weeks to hours.
Where indirect ownership creates a sanctions exposure, the network has visibility into the supplier's controller relationships across buyers and can detect the indirect link that any single buyer would miss.
Where beneficial ownership drifts, the network refreshes the supplier record on a cadence that no individual buyer would economically run. The result is current data for every buyer at once.
A control hierarchy
Minimum viable. Pre-onboarding screening against the consolidated list. Quarterly re-screening of the full vendor master. Payment-time screening on supplier records over a threshold value. This will catch the direct-match cases and is the floor below which no AP function should sit.
Improved. Weekly screening on top 100 suppliers, monthly on the rest, event-driven re-screening on bank-detail and ownership changes. Indirect ownership screening on the top 100, run against PSC and equivalent registers. This significantly reduces stale-data and beneficial-owner drift exposure.
Mature. Continuous network-level screening with cross-buyer signal sharing, drawing on the supplier identity graph. Indirect ownership monitored on the full supplier base, not just the top tier. Sanctions flag propagates across buyers in hours rather than weeks.
Compliance posture in 2026
OFSI guidance, FATF expectations and EU regulatory direction are all moving toward continuous monitoring rather than periodic screening. Mid-market firms that maintain only quarterly screening are increasingly out of step with the expectation that data is current. The cost of moving to a continuous model is not large. The cost of an enforcement action against a stale-screening posture is.
