The Geopolitical Sanctions Gap: Why Periodic Trade Compliance Reviews Miss What Real-Time Tracking Catches

TL;DR: OFAC's October 22, 2025 sanctions on Rosneft and Lukoil gave companies with existing exposure one 30-day wind-down window, and the SDN list itself carries no fixed update schedule, a gap no quarterly compliance review can close.

Key takeaways:

• OFAC designated Rosneft and Lukoil on October 22, 2025, giving companies with existing contracts until 12:01 a.m. Eastern on November 21, 2025, to wind down exposure under General Licenses 126 through 128.
• IMG Academy paid $1.72 million in February 2026 to settle 89 apparent sanctions violations after billing tuition to two SDN-listed parents whose names matched the sanctions list directly.
• OFAC added sanctions on more than 1,300 individuals and entities in 2025, roughly 3.5 new designations a day, with no published update calendar.
• The UK, US, and EU each acted on Russia sanctions within three weeks of each other in spring 2026: 85 UK entities on May 11, a narrow US license on April 29, updated EU guidance in May, three regimes on three timetables.

On October 22, 2025, the Treasury's Office of Foreign Assets Control designated Rosneft and Lukoil, Russia's two largest oil companies, cutting off a counterparty category that years of trading, insurance, and banking relationships were built around. Companies with contracts already in place got one month: General Licenses 126 through 128 expired at 12:01 a.m. Eastern on November 21, 2025, after which any wind-down payments had to move into blocked accounts. A firm running sanctions checks on a quarterly cycle had no chance of catching this before the clock started.[^1]

Geostrategic Sanctions Exposure and the Failure of Periodic Review

Periodic review assumes sanctions lists move on a schedule a compliance calendar can absorb. They do not. OFAC states plainly that the SDN list updates "as necessary and appropriate," with no predetermined timetable.[^5] A company checking counterparties once a quarter is, on average, checking a list that has already changed several times since the last review.

• No fixed calendar. OFAC's own guidance confirms SDN list changes happen on no set schedule, so a review cadence built around a fiscal quarter is a guess, not a control.[^5]
• Volume without warning. OFAC updates the SDN list multiple times in a typical week, and any one of those entries can turn an existing counterparty into a prohibited one overnight.[^5]
• A gap basic screening would have closed. IMG Academy's settlement covered 89 apparent violations between 2018 and 2025; OFAC's release states minimal due diligence, at any point, would have caught it, since the counterparties' names matched the SDN list directly.[^2]
• The scale of enforcement. OFAC brought 14 public enforcement actions in 2025, with total penalties and settlements exceeding $265 million.[^3] A single case against a US venture capital firm accounted for $215,988,868 of that, after it kept servicing a sanctioned client three years past his designation.[^6]

Geostrategic Compliance Across Regimes That Do Not Move Together

The problem compounds once a company operates across borders, because no two sanctions regimes update on the same clock. In spring 2026, the UK, US, and EU each acted on Russia-related sanctions within three weeks of one another, on three different timetables. The UK sanctioned 85 individuals and entities on May 11, 2026, extending its target list to the writers, translators and video makers behind Kremlin information operations.[^4] The US Treasury issued General License 131E on April 29, 2026, authorising negotiations, due diligence and conditional contracts for the sale of Lukoil International through May 30, 2026, while stopping short of authorising the sale itself and excluding any transfer of funds into Russia.[^7] The EU updated its asset-freeze guidance on May 6, 2026 to confirm that a freeze covers all rights attached to shares, voting rights included.[^8] A team tracking only one of these three regimes would have missed two of three changes that spring, all addressing the same underlying geopolitical risk.

What Real-Time Geostrategic Compliance Actually Requires

A real-time process treats each regulatory list as a live feed, not a document to re-download once a quarter. That means checking OFAC's SDN list, the UK's consolidated list, the EU's Official Journal amendments, and the BIS Entity List against the existing counterparty book on the day each one changes, not on the next audit cycle. General license expiration dates need the same treatment: a license valid today and void at 12:01 a.m. next month is a compliance deadline, not a footnote.

Cross-referencing matters as much as speed. IMG Academy's counterparties would have failed a basic name check against the SDN list at any point over four years.¹ The failure there was not a slow process. It was no process. A working system needs both: continuous ingestion of the regimes that apply to a company's footprint, and a standing rule that every counterparty, new or existing, gets checked against all of them.

Fortius Intel note: The gap this piece describes is a data-currency problem before it is anything else. Fortius Intel's Intelligence Brief draws on OFAC's SDN list, the EU Official Journal, the Federal Register, the BIS Entity List, and DDTC's debarred parties list as named inputs, because no compliance team should have to reconcile five separately updated lists by hand to answer one question: is this counterparty still clean today.

This piece draws on OFAC's Specially Designated Nationals List FAQ, primary OFAC enforcement releases and general licenses, UK and EU sanctions announcements from May 2026, and enforcement summaries from Sullivan & Cromwell, Freshfields Bruckhaus Deringer, and Sidley Austin covering 2025-2026 US sanctions enforcement.

---

Footnotes

Footnotes

1. U.S. Department of the Treasury, Office of Foreign Assets Control, "OFAC Settles with IMG Academy, LLC," enforcement release, February 12, 2026. https://ofac.treasury.gov/recent-actions/20260212 (retrieved 21 August 2026). Source for: the 89 apparent violations, and OFAC's finding that minimal due diligence at any point would have identified the counterparties as listed persons. ↩