Sanctions and restricted countries: what an online store still owns

Sanctions feel like a problem for banks. Then a small online store ships a low-value order to the wrong address, and a regulator asks why its screening missed it. The value of the order is not the point, because sanctions are prohibitions, not thresholds. OFAC’s settlement with Amazon covered about USD 269,000 of mostly low-value retail goods.

This article explains what sanctions screening means for an online store: which lists matter, why blocking a country is harder than it sounds, how FATF lists differ, and what a merchant still owns when a provider screens payments. It states facts, not legal advice, and sanctions change often, so check the official lists before relying on anything here.

What does sanctions screening mean for an online store?

It means checking that you are not selling to, or receiving money from, a listed party or a restricted place. For a store, that covers four things:

• People and companies. Customers, recipients and business buyers checked against official lists.
• Places. Delivery addresses, billing addresses and customer locations checked against restricted territories.
• Owners. A company that is not listed can still be caught through who owns or controls it.
• Goods. Some sanctions restrict particular products, which is a separate check from who is buying.

The basics of how screening works are in our glossary entry on sanctions screening. This article focuses on what a merchant has to do about it.

Which sanctions rules apply to you?

That depends on where you are, who you are and what you touch, not only on where your customers live. A merchant can be subject to more than one regime.

Regime	Who must comply	List	Ownership test
United States (OFAC)	All US persons, including US-incorporated entities and foreign branches; non-US persons can be barred from causing US persons to violate	SDN List and others	50% or more, including in aggregate
European Union	EU nationals, people located in the EU and those doing business there	EU consolidated list; EU Sanctions Map	50% or more; stakes of several listed persons are added together
United Kingdom	Anyone in the UK, and UK nationals and UK entities wherever they operate	UK Sanctions List	More than 50%, or control by other means

Sources: OFAC FAQs, the European Commission and its EU Sanctions Helpdesk, and OFSI’s general guidance of 12 May 2026.

Three details catch merchants out.

The ownership tests differ. OFAC blocks entities owned 50 percent or more, individually or in aggregate, by blocked persons, even if the entity is not listed. The UK test is more than 50%, and OFSI’s guidance says it does not simply add together separate designated persons’ holdings. A company can pass one test and fail another.

The UK list changed. The UK government says the UK Sanctions List has been the only source for all UK designations since 28 January 2026, when the OFSI Consolidated List closed. Tools still pointing at the old list are out of date.

The liability standard is strict. OFAC says it may impose civil penalties generally on a strict liability basis, so a US person can be liable even without knowing it was violating. It treats a risk-based compliance programme and remediation as mitigating factors. In the UK, OFSI says that for breaches on or after 15 June 2022, knowledge or reasonable cause to suspect is no longer part of the test for a breach, and the maximum penalty is the greater of GBP 1,000,000 or 50% of the estimated value involved.

Which countries are restricted?

There is no single list of banned countries, which is the first thing to accept. OFAC says its sanctions can be either comprehensive or selective, and its programme page lists Cuba, Iran, North Korea and Russia-related programmes among dozens of others, many of which target only specific people or sectors. Its enforcement against Amazon also covered Crimea as a sanctioned region. The EU’s Sanctions Map sets out each EU regime and its legal acts.

Programmes change. OFAC’s page shows October 2026 updates to the Iran, North Korea and Cuba programmes. It lists no programme under the name Syria, though it does list one on accountability for Assad and regional stabilisation. Treat any static list, including one in a blog post, as out of date.

Card schemes add their own layer. Visa’s rules say a member must not issue, acquire or conduct any activity using the Visa network in any geography subject to applicable comprehensive sanctions, including those identified by OFAC. So even a merchant that is not itself bound by OFAC can find that its acquirer will not process that traffic.

What can geoblocking do, and what can it not do?

It reduces exposure. It does not end it.

OFAC’s guidance for the virtual currency sector is specific on this. It says companies with strong programmes should be able to use geolocation tools and IP address blocking. In the same passage it says tools are needed to identify IP misattribution, for example by screening against known VPN addresses and spotting improbable logins. It also says that addresses, email details and invoices can show that a person is in a sanctioned jurisdiction, and that companies should consider reviewing that data even if it was collected for another reason. The guidance is written for that sector, but the logic applies to any online business.

Amazon shows the other half of the problem. According to OFAC, its screening did not flag address fields containing “Yalta, Krimea”, neither for the city nor for the spelling of Crimea. It failed to flag orders shipped to the Embassy of Iran in third countries, and in several hundred cases it missed correctly spelled names and addresses of listed persons. OFAC’s framework lists the same root cause: failing to account for alternative spellings, such as Habana for Havana or Kuba for Cuba.

Control	What it catches	What it misses
IP blocking	Casual access from a restricted territory	VPN users; customers travelling
Shipping country list	Orders to a blocked country code	City names and spellings typed in free text
Card issuing country	Cards from restricted countries, where a card exists	Cards issued elsewhere; non-card methods
Name screening	Listed people and companies	Companies caught through ownership; goods restrictions

In the EU, geoblocking has a separate legal limit. The Geo-blocking Regulation bars unjustified blocking of EU customers based on nationality or residence. Its Article 3(3) says the ban does not apply where blocking is necessary to comply with a legal requirement in EU law or consistent national law, and the trader must then give a clear and specific explanation. So block what the law requires and explain why, but do not stretch a sanctions reason across the whole EU market.

How are FATF lists different?

They are risk lists, not sanctions lists. The Financial Action Task Force sets anti-money laundering standards and publishes two lists, updated at plenary meetings. As FinCEN reports, the latest statements are dated 30 October 2026.

List	Who is on it	What it asks for
Call for action	Iran, North Korea and Myanmar	Countermeasures for Iran and North Korea; enhanced due diligence for Myanmar
Increased monitoring	Changes at each plenary; Bulgaria, Côte d’Ivoire, the Democratic Republic of the Congo and Monaco were removed on 30 October 2026	Enhanced due diligence not required; firms are encouraged to factor it into risk analysis

FINMA, the Swiss regulator, explains the second list in those terms. A merchant is not usually the addressee of these statements, since the FATF speaks to governments and regulated firms. They still reach you through your providers, whose own policies may restrict or add checks for those countries. Check the current list on the day you decide, because it changes.

What does a merchant still own when a provider screens payments?

More than most merchants assume. Providers have real duties: Visa says members must screen cardholders and merchants at onboarding and on a regular, ongoing basis, disable a true match and must not acquire from sanctioned parties. But a provider screens what it sees, under its own legal duties. That does not move your duties to it.

Area	Provider	Merchant
Screening the merchant itself	Yes	Disclose owners accurately
Screening payment parties	Yes, in its own scope	Know the scope; do not assume it
Screening delivery addresses and recipients	Usually sees little of this	Yes
Restricted goods	No	Yes
Business customers and their owners	Limited	Yes, in proportion to risk
Payouts to sellers and suppliers	In its own scope	Yes, for who you pay

Payouts deserve extra care, since you choose the recipient. Our article on why payouts are harder than payments covers this, and card payouts and bank payouts covers the differences by rail.

What should a merchant’s sanctions checklist include?

OFAC’s framework names five components of a compliance programme: management commitment, risk assessment, internal controls, testing and auditing, and training. For a store, that translates into a short list.

1. Decide which regimes apply to your company, owners, banks and providers. Take advice once, and write it down.
2. Assess your risk: your countries, goods, business customers and payouts.
3. Ask each provider what it screens, against which lists and at which stage, and record the answer.
4. Screen what they cannot see: names on orders, delivery addresses, company buyers and sellers.
5. Normalise address data. Check cities and spelling variants as well as country codes.
6. Combine location signals: IP address, billing address, delivery address and card issuing country.
7. Update lists automatically, and confirm that the UK source is the UK Sanctions List.
8. Set a route for hits: who reviews, who decides, and when legal advice is needed. OFAC says blocked property must be reported within 10 business days.
9. Test it. OFAC says routine testing of automated screening may be appropriate. Try known spellings and real addresses.
10. Keep records of decisions, including false matches.

How does Omno handle restricted markets?

Omno does not serve markets under OFAC sanctions or on the FATF call-for-action list. It is not a bank or acquirer and does not run KYC; each provider onboards the merchant and applies its own checks. For a merchant’s own controls, Omno offers customer blocking, card blocking, shared blacklists and customer rules by tag, and routing rules can use country and currency. The risk controls page lists what is available.