Dejan Jasnic · Co-founder & Compliance Lead, Trusty · 20+ years anti-fraud & compliance · ACFE Swiss Chapter Board
For years, sanctions compliance has been treated as something that primarily concerns large corporations, financial institutions, or multinational exporters.
In 2026, that assumption is becoming harder to maintain.
Across the EU, enforcement is tightening. What was once a fragmented landscape is moving toward a more consistent and structured approach, particularly following the introduction of Directive (EU) 2024/1226, which requires Member States to criminalise serious violations and circumvention of EU sanctions.
This shift is not only legal. It is practical. And for SMEs, it is becoming increasingly relevant.
From framework to enforcement
Sanctions have long been part of the regulatory environment, particularly in response to geopolitical developments. However, enforcement has historically varied between Member States, both in terms of definitions and penalties.
That is beginning to change.
Directive 2024/1226 introduces a more harmonised approach by requiring countries to define sanctions violations as criminal offences in certain cases and to establish minimum rules on penalties. It also extends liability to legal persons under specific conditions.
The result is a clearer expectation that sanctions rules are not only to be understood, but actively enforced. For businesses, this reduces ambiguity. It also reduces tolerance for informal or inconsistent compliance practices.
Why SMEs are now in scope
Most SMEs are not directly targeted by sanctions legislation. However, they are increasingly exposed through their role in supply chains and business relationships.
Larger companies are under pressure to demonstrate that they are not transacting with sanctioned entities, either directly or indirectly. To do this, they rely on their partners.
This means that SMEs are now expected to:
- provide transparency on ownership and counterparties
- respond to due diligence requests
- demonstrate that basic screening has taken place
These expectations often arise through commercial relationships rather than regulatory enforcement. However, they are directly linked to the same underlying risk.
Sanctions exposure does not only occur at the top of the chain. It can enter through any point.
The practical challenge
In many SMEs, sanctions checks are still handled informally.
A name might be searched online. A quick review might be conducted using publicly available sources. In some cases, checks are performed once during onboarding and not revisited.
This approach creates gaps. Sanctions lists are updated frequently. Designations change, and new risks emerge in response to geopolitical developments. Without a structured process, it becomes difficult to ensure that checks are consistent, up to date, and properly documented.
From a compliance perspective, the issue is not only whether a check was performed, but whether it can be demonstrated. In an environment where enforcement is increasing, documentation becomes as important as the check itself.
What effective sanctions compliance looks like
For SMEs, effective sanctions compliance does not require complex infrastructure. It requires a process that is clear, repeatable, and proportionate to the level of risk.
This means moving away from one-off, informal checks and toward a more structured approach where counterparties are screened in a consistent way, results are recorded, and changes are monitored over time.
It also means recognising that compliance is not a static activity. A counterparty that was low risk at onboarding may become higher risk later. Without ongoing visibility, this change may go unnoticed. The goal is not to eliminate all risk. It is to ensure that reasonable steps have been taken and that those steps can be demonstrated if required.
Making sanctions screening practical
One of the main barriers for SMEs has been cost and complexity. Traditional compliance tools are often designed for large organisations, with pricing models and workflows that do not fit smaller teams.
This is where newer approaches are changing the landscape.
Tools like Trusty QuickScreen360 are designed to make sanctions screening accessible and structured without requiring heavy setup. Counterparties can be screened against global sanctions lists in a consistent way, with results consolidated into a single workflow.
AI-assisted filtering helps reduce noise and limit false positives, making it easier to focus on relevant risks. Each screening produces a timestamped report with source links, allowing businesses to maintain a clear record of what was checked and when.
Screening can also be applied at scale through batch onboarding, and automated alerts help ensure that changes in sanctions status do not go unnoticed over time.
The result is a process that is not only more efficient, but also easier to demonstrate.
Why this matters now
The introduction of Directive 2024/1226 signals a broader shift. Sanctions compliance is moving from a policy requirement to an operational expectation.
For SMEs, this does not mean adopting enterprise-level systems. It means ensuring that basic controls are in place and that they are applied consistently. The ability to show that counterparties have been screened, that results have been reviewed, and that changes are monitored over time is becoming part of normal business practice.
This is particularly relevant when working with larger companies, financial institutions, or international partners.
Conclusion
Sanctions compliance for SMEs is no longer a distant concern. As enforcement becomes more consistent across the EU, expectations are increasing at every level of the supply chain.
The challenge is not complexity, but structure. By moving from informal checks to simple, documented processes, SMEs can reduce risk, respond more effectively to due diligence requests, and operate with greater confidence in a more regulated environment.
Frequently asked questions
It requires Member States to define serious violations and circumvention of EU sanctions as criminal offences in certain cases, sets minimum rules on penalties and extends liability to legal persons under specific conditions.
Larger companies must show that they do not transact with sanctioned entities, directly or indirectly, so they ask their partners for transparency on ownership and counterparties, due diligence responses and proof that basic screening has taken place.
Sanctions lists are updated frequently and designations change, so a counterparty that was low risk at onboarding may become higher risk later. Consistent screening, recorded results and monitoring over time are what can be demonstrated if required.
Screen every counterparty against global sanctions lists in a consistent way, keep a timestamped record with source links, and use alerts so that changes in sanctions status do not go unnoticed.
Related reading: EU Directive 2024/1226 explained, third party screening for SMEs, and PEP screening explained.
THIRD-PARTY RISK SCREENING
QuickScreen360: screen suppliers and partners for compliance risks. Send due diligence requests, assign training and monitor results in one platform.