Cashless
Source: Unsplash

It starts with a payment that doesn't go through. No error message, no explanation. Just a transfer stuck in limbo while your supplier on the other side of the world waits, and your working capital quietly evaporates. For many businesses banking with digital-first institutions, this moment is their first encounter with the machinery of international sanctions compliance: a system most never knew existed until it stopped them cold.

Neobanks have fundamentally changed what business banking looks like. Faster onboarding, multi-currency accounts, real-time transfers across borders: the value proposition is clear. But the more international the banking infrastructure, the deeper it sits inside one of the most complex regulatory frameworks in global finance. Understanding how sanctions risk is managed, and where your responsibility as a business client begins, has become essential knowledge for any company operating across borders.

What OFAC Actually Is, and Why It Reaches Further Than You Think

The Office of Foreign Assets Control (OFAC) is a division of the U.S. Department of the Treasury. Its job is to administer and enforce economic and trade sanctions based on U.S. foreign policy and national security goals. In practice, this means maintaining lists of individuals, companies, and entire countries with whom financial transactions are prohibited.

The most well-known is the Specially Designated Nationals (SDN) list: a roster of blocked persons and entities that currently runs to thousands of entries spanning drug traffickers, state-sponsored hackers, oligarchs, and state actors across sanctioned countries including Russia, Iran, North Korea, Cuba, and Syria. When someone is added to the SDN list, their assets held within U.S. jurisdiction are frozen immediately. Any financial institution processing a transaction involving a listed party is obligated to block those funds and report the action to OFAC.

But here is what often surprises businesses: OFAC's reach is not limited to American companies. Any institution that routes transactions through the U.S. financial system, which includes virtually every international wire transfer, falls under its jurisdiction. A neobank headquartered in Hong Kong, Paris, or Singapore that processes dollar-denominated payments is subject to U.S. sanctions law. There is no geographic workaround.

Beyond OFAC, neobanks must simultaneously navigate the UK's Office of Financial Sanctions Implementation (OFSI), the EU's consolidated sanctions framework, and the United Nations Security Council lists. New entries are added to these lists on a near-daily basis, which means a counterparty that was clean yesterday may not be clean today.

The Automation Layer: What Happens When You Press "Send"

When a business initiates a transfer through a neobank, it does not simply travel from one account to another. Before any funds move, an automated screening system runs the transaction details, including names, account numbers, countries, and referenced entities, against a continuously updated database of sanctions lists, politically exposed persons (PEP) registers, and adverse media feeds.

Modern screening tools use a combination of fuzzy logic and machine learning to catch variations in how a sanctioned name might appear. "Mohammad Al-Rashid" and "M. Alrashid" can refer to the same person; an unsophisticated system would miss one. This name-matching challenge is compounded for business accounts, where the screening must extend beyond the direct counterparty to include beneficial owners, meaning the individuals who ultimately control the entity receiving funds, sometimes layered through multiple holding structures across different jurisdictions.

This is where neobanks face a specific structural tension. Their entire growth model is built on speed: rapid onboarding, frictionless transfers, minimal manual intervention. But sanctions compliance, done properly, occasionally demands the opposite. A flagged transaction triggers a human review. An account linked to a potentially sanctioned beneficial owner is placed on hold. These friction points are not system errors. They are the system working as intended.

In 2023, OFAC published 17 enforcement actions representing a record total of 1.5 billion dollars in penalties across the financial sector. The message was unambiguous: enforcement is intensifying, and digital banks are squarely in the crosshairs.

When the System Fails: Real Cases from the Neobank World

The clearest illustrations of what goes wrong come from enforcement actions against institutions that grew faster than their compliance infrastructure could follow.

Starling Bank, a UK challenger bank that expanded rapidly to several million customers, was fined 29 million pounds by the Financial Conduct Authority in September 2024. The FCA described its financial crime controls as "shockingly lax." Investigators found that Starling's automated screening system had been misconfigured: it was only checking customers against a subset of entries on the UK's consolidated sanctions list, specifically those linked to individuals known to reside in or have ties to the UK, rather than the full list. When Starling eventually reran its entire customer base against the complete list, it generated 48,000 alerts in a single pass. That is not a compliance gap. It is a compliance failure at scale.

Revolut, Europe's most valuable fintech, faced its own reckoning. In April 2025, Lithuania's central bank, which oversees Revolut's European banking operations, issued the company a 3.5 million euro fine, the largest AML-related penalty in the country's history. Regulators found that Revolut had failed to adequately monitor customer relationships and transactions over time, resulting in the bank not consistently identifying suspicious activity. The fine followed earlier scrutiny from the UK's FCA and came despite Revolut having invested heavily in compliance infrastructure.

N26, Germany's leading digital bank, was fined 9.2 million euros by BaFin in May 2024 for failures in suspicious activity reporting.

What these cases share is a common structural problem: compliance systems designed for one scale of operations, deployed at a very different and much larger one. Growth outpaced oversight, and regulators took note.

Shared Responsibility: What Business Clients Must Understand

There is a widespread misconception that sanctions compliance is purely the bank's problem. It is not. The moment a business opens an account or initiates a transaction, it enters into an implicit compliance relationship with its financial institution, and its own obligations are more substantial than most clients realise.

The Know Your Customer (KYC) process at onboarding is not bureaucratic inconvenience. It is the mechanism through which a business communicates to its bank who it is, who owns it, and who it does business with. When that information is incomplete, outdated, or incorrect, the institution's ability to screen accurately is compromised from the start. If a beneficial owner structure changes, for instance when a new investor joins a holding company, and the bank is not informed, the business has created a compliance risk it may eventually be held accountable for.

Business clients operating in higher-risk industries or geographies, such as import/export, commodities, financial services, and cross-border logistics, should expect enhanced due diligence questions. Providing thorough documentation upfront is not only faster; it signals to compliance teams that the business understands the environment it operates in.

This dynamic has shaped how the most responsible neobanks approach their business banking relationships. Rather than treating compliance as a checkpoint at onboarding, they conduct ongoing monitoring of both transaction behaviour and client profiles over time. Teams like those at Statrys, a Hong Kong-based business account provider serving companies across Asia, approach this as a genuine operational discipline: the quality of client information directly determines the quality of the compliance outcome for both parties.

Asset Freezes: What Happens When a Client Is Designated

An asset freeze is not a temporary inconvenience. When OFAC or a comparable authority designates an entity, any financial institution holding assets on their behalf is legally required to freeze those funds, often immediately and without advance notice to the account holder. The institution cannot release the funds, process outgoing payments, or in many cases even confirm to the client why the account is restricted.

For businesses that have a supplier, investor, or subsidiary that becomes subject to designation, the downstream effects can be severe. Payments to that entity are blocked. Payments from that entity to the business may also be blocked or subject to investigation. In some cases, businesses themselves become subject to scrutiny simply through association.

The practical implication is clear: supplier vetting and counterparty due diligence are no longer just procurement concerns. They are compliance responsibilities.

The Road Ahead

Sanctions environments are not static. The coordinated response to Russia's invasion of Ukraine produced one of the fastest-moving designation environments in OFAC history, with thousands of new entries across multiple lists, updated sometimes within hours of geopolitical developments. Financial institutions, and their business clients, must be able to respond at the same pace.

For businesses choosing a banking partner for international operations, the right question is not only how fast they can process transfers. It is how robust their compliance infrastructure is, and how transparent they are when something flags. A neobank that can give clear, honest answers to both questions is one that has built its systems for the world as it actually operates, not merely as it was three years ago.

The payment that doesn't go through is not always a problem. Sometimes it is the system doing exactly what it was built to do.

***

This article is for informational purposes only and does not constitute legal or financial advice. Businesses with specific questions about sanctions compliance should consult a qualified legal professional.