Sanctions against Russia are entering a new phase.
More than four years after Russia’s full-scale invasion of Ukraine, governments are continuing to expand their sanctions regimes. But the latest measures from New Zealand, Canada and the US reveal something more significant than simply another round of designations.
The global sanctions environment is changing.
Rather than governments consistently announcing coordinated packages targeting broadly similar individuals, banks and sectors, sanctions are increasingly being used to pursue specific vulnerabilities, supply chains, circumvention networks and enablers.
That creates a new challenge for international businesses. The question is no longer simply whether a customer or supplier appears on a sanctions list.
Companies increasingly need to understand why a person or entity has been sanctioned, which jurisdictions have targeted them, who they are connected to, how goods and money move through their networks, and whether a transaction that is legal in one jurisdiction could create exposure somewhere else.
New Zealand targets cyber actors, propaganda and military support
New Zealand’s latest Russia sanctions package is a good illustration of how sanctions are becoming more targeted and sophisticated.
The government has sanctioned 33 individuals and entities, with a particular focus on malicious cyber actors and those involved in the forced relocation, abduction and re-education of Ukrainian children.
The package also targets people and organisations involved in anti-Ukraine propaganda, Russia’s military-industrial complex, Russian political circles and actors from North Korea and Iran supporting Moscow.
New Zealand says it has now imposed sanctions on more than 2,000 individuals, entities and vessels since its Russia sanctions regime came into force in March 2022.
The significance of the latest designations is not simply their number.
They demonstrate how sanctions are moving beyond the traditional focus on banks, oligarchs and major Russian companies.
Cyber activity, information operations, military supply chains, foreign enablers and the treatment of Ukrainian children are all becoming part of the sanctions picture.
For businesses, this means sanctions risk can emerge from parts of the organisation that may previously have been regarded as relatively remote from sanctions compliance.
A technology company may face risk through its products being diverted to a sanctioned military end user. A professional services firm may encounter a sanctioned individual through a complex corporate structure. A manufacturer may discover that its products are being rerouted through a third country.
The sanctions question is increasingly becoming a supply-chain question.
Canada goes after the military-industrial supply chain
Canada’s latest action reinforces the same trend.
On 10 August, Canada sanctioned Streit Group, a defence manufacturer producing armoured vehicles and other military equipment. Canada said credible reports indicated that vehicles manufactured by the company had been used by the Russian National Guard.
The measure follows similar action by Ukraine in 2023 and the EU and Switzerland in 2025.
Again, the message is important: sanctions authorities are looking beyond Russia itself and towards the companies, manufacturers and intermediaries that can help sustain Russia’s military capability.
This is particularly relevant for companies operating internationally.
A business does not necessarily need a direct Russian customer to face sanctions risk. The risk can sit several steps further down the supply chain.
A distributor in one country may sell to another intermediary. That intermediary may ultimately supply a Russian entity. Components manufactured in one jurisdiction may be incorporated into equipment assembled somewhere else. A seemingly ordinary commercial transaction can therefore become part of a much more complicated sanctions exposure.
The US is taking a different approach
The US Senate has also taken a significant step, approving the Lindsey O Graham Sanctioning Russia Act. The proposed legislation would introduce further sanctions and visa bans against Russian leaders and military figures while creating the possibility of extremely high tariffs on Russian exports and tariffs on countries importing Russian oil and gas. The bill now moves to the House of Representatives.
This is particularly significant because it illustrates another feature of the emerging sanctions environment: the line between sanctions, trade restrictions and broader economic pressure is becoming increasingly blurred.
Traditional sanctions compliance programmes have tended to focus on questions such as: Is the party designated? Is the transaction prohibited? Are funds or assets being made available?
But companies may increasingly need to consider a wider range of measures, including import restrictions, export controls, tariffs, sectoral restrictions and restrictions targeting third-country activity.
Are sanctions becoming less coordinated?
Perhaps the most important development is not what any one country has done, but the differences between them.
Following Russia’s invasion of Ukraine, sanctions policy was characterised by a high degree of coordination between allies. Major packages were frequently announced within a short period of one another and targeted broadly similar sectors, individuals and entities.
That does not mean coordination has disappeared. But the latest measures suggest that sanctions regimes are becoming more differentiated.
New Zealand is targeting cyber actors, propaganda networks and those involved in the forced relocation of Ukrainian children.
Canada is targeting a defence manufacturer connected to Russia’s military-industrial complex.
The US is considering sweeping measures that could also affect countries purchasing Russian energy.
The objectives may overlap, but the mechanisms, targets and timing might not.
The compliance burden could be getting heavier
Sanctions are powerful partly because of their collective reach. But when different jurisdictions take different approaches, businesses operating across borders can find themselves having to comply with multiple overlapping and sometimes divergent, regimes.
A transaction could therefore be permitted under one country’s sanctions regime, but prohibited under another. That creates a difficult practical question for multinational businesses: which rules apply to us?
The answer may depend on where the company is incorporated, where employees are located, where the transaction takes place, which currencies and banks are involved, where goods are manufactured, where they are shipped and which subsidiaries or counterparties are involved.
For companies with US connections, for example, US sanctions exposure can be particularly important even when the underlying transaction appears to take place outside the United States.
The result is a sanctions environment in which a simple global policy of “we don’t do business with sanctioned countries” is increasingly inadequate.
Sanctions evasion is becoming the real battleground
The other major shift is the growing importance of circumvention. Once obvious Russian targets have been sanctioned, pressure naturally moves towards the networks that allow sanctioned individuals and entities to continue accessing money, goods, technology and services.
That means regulators are increasingly interested in how transactions happen, not just who is involved.
A company should therefore be asking questions such as: Who ultimately owns the customer? Who ultimately controls it? Where are the goods actually going? Why has the customer suddenly changed its shipping route? Why is a previously straightforward transaction now being conducted through a third country? Why has an intermediary been inserted into the transaction? Why is a customer suddenly requesting products or services that do not appear consistent with its normal business?
None of these factors automatically proves sanctions evasion. But they can be important warning signs.
What should companies do now?
The new environment requires a shift from list-based compliance to risk-based sanctions compliance.
Screening remains essential. Companies must continue to identify designated individuals and entities and ensure that their systems are updated promptly when sanctions lists change.
But screening alone is not enough.
1. Map your real sanctions exposure
Companies should identify all the jurisdictions whose sanctions regimes could apply to their business.
That means looking beyond the location of the head office.
Consider subsidiaries, branches, employees, customers, suppliers, banks, payment routes, currencies, shipping destinations and ownership structures.
The objective should be to understand where sanctions exposure could arise across the entire business model.
2. Look beyond the immediate customer
Know-your-customer processes need to extend beyond the name appearing on the contract.
Businesses should understand beneficial ownership and control and consider whether a customer or supplier is connected to sanctioned parties through corporate structures, intermediaries or other relationships.
For higher-risk transactions, that may require enhanced due diligence rather than simply relying on an automated screening result.
3. Understand your supply chain
The latest measures demonstrate why sanctions compliance cannot sit solely with the legal or compliance department.
Procurement, logistics, sales, finance and operations may all encounter sanctions risks.
Companies should understand where goods originate, where they are going and who ultimately receives or uses them.
Particular attention should be given to unusual routing through third countries, newly established intermediaries and transactions involving jurisdictions that could be used for sanctions circumvention.
4. Monitor geopolitical developments
Sanctions programmes need to be dynamic.
The pace of change means that a policy reviewed once a year may quickly become outdated.
Businesses should have a process for monitoring developments across relevant jurisdictions and assessing what those changes mean for their own customers, suppliers and transactions.
This is particularly important when jurisdictions are taking different approaches to the same geopolitical issue.
5. Train staff on the risks they actually face
Generic sanctions training is unlikely to be enough.
A salesperson needs to understand different warning signs from those faced by a finance employee. Procurement staff need to understand supply-chain risks. Staff involved in international payments need to understand why payment routes and counterparties matter.
Employees should know what to do when something does not look right — who to escalate to, what information to record and whether the transaction needs to be paused.
They should not be expected to conduct their own sanctions investigation.
6. Test your controls
A sanctions policy can look excellent on paper and still fail in practice.
Businesses should test whether sanctions lists are updated promptly, whether screening systems identify relevant matches, whether alerts are investigated consistently and whether escalation procedures actually work.
Testing should also consider more complicated scenarios, including indirect ownership, third-country intermediaries and potential circumvention.
A new sanctions environment requires a new mindset
The latest measures from New Zealand, Canada and the US illustrate where sanctions policy is heading.
Sanctions are becoming more targeted. They are reaching further into supply chains. They are increasingly focused on enablers and circumvention. They are being applied to cyber actors, technology providers, defence manufacturers and third-country supporters.
And perhaps most importantly, different governments may pursue similar geopolitical objectives through increasingly different legal and economic mechanisms.
