Secondary Sanctions: Not the Target, Still Exposed

TL;DR: Secondary sanctions let Washington sanction a company that has never touched the U.S. financial system, by threatening the bank or refinery that helped a sanctioned party instead of the party itself. An April 2026 Treasury action against a Chinese refinery and dozens of shipping firms shows the mechanism working exactly as designed,[^1][^2] and most compliance programs outside the U.S. and EU still screen only against primary sanctions lists.

Key takeaways:

• On April 24, 2026, the U.S. Treasury designated Hengli Petrochemical, China's second-largest teapot refinery, along with roughly forty shipping firms and vessels, for buying and moving Iranian oil.[^1]
• Since February 2025, OFAC has sanctioned more than 1,000 Iran-related persons, vessels and aircraft under the same campaign, none of which required the designated party to hold a U.S. account or dollar exposure.[^1]
• China buys roughly 90 percent of Iran's sanctioned oil exports, and Treasury has said it is prepared to sanction the foreign banks that clear those payments, not only the refineries that buy the oil.[^2]
• Executive Order 14114, signed December 22, 2023, lets OFAC block any foreign financial institution that processes a "significant transaction" for a Russia-designated entity, whether or not that bank ever handles dollars.[^3]
• Shandong Yulong Petrochemical was designated separately by the EU on October 23, 2025 and the UK on October 15, 2025 for buying Russian oil, proof that a company can face several sanctions regimes at once without operating inside any of them.[^4]

On April 24, 2026, the U.S. Treasury put a name on its Iran sanctions campaign: Hengli Petrochemical, a refinery in Dalian that had never opened a correspondent account in New York, never shipped a barrel through a U.S. port, and never signed a contract governed by U.S. law.[^1] Treasury sanctioned it anyway, alongside close to forty shipping companies moving Iranian crude through what it calls the shadow fleet.[^1] None of them needed a U.S. nexus. That is the entire design of secondary sanctions: reach the party Washington cannot otherwise touch by threatening the market access it cannot afford to lose.

How Secondary Sanctions Reach a Company With No U.S. Address

Primary sanctions block a designated person's access to U.S. jurisdiction directly: their assets, their banks, their contracts. Secondary sanctions work differently, targeting a third party for continuing to do business with someone already designated.

• The exposure sits in the transaction, not the company. Hengli was not designated for anything it did inside the United States. It was designated for buying Iranian crude, an act successive administrations have defined as sanctionable regardless of where the buyer sits.[^1][^2]
• The threat is market access, not asset freezing. A Chinese refinery with no U.S. assets cannot have those assets frozen. What it can lose is the ability of any bank connected to the U.S. financial system to clear payments on its behalf, which for a firm trading internationally priced commodities is close to existential.[^2]
• The financial institution carries the sharpest version of the risk. Executive Order 14114 does not require a foreign bank to have touched a dollar. It requires only that the bank process a "significant transaction" for a person already on the Specially Designated Nationals list tied to Russia's military-industrial base.[^3]
• Scale keeps expanding under the same authority. OFAC has added more than 1,000 Iran-related designations since February 2025 under one campaign, and the Russia-focused EO 14114 has run in parallel since December 2023, so the pool of parties a third company could unknowingly transact with keeps growing.[^1][^3]
• Multiple regimes can reach the same company for different reasons. Shandong Yulong Petrochemical was sanctioned by the EU on October 23, 2025 and the UK eight days earlier, both for buying Russian oil, neither designation routed through Washington at all.[^4]

The Financial Institution Is the Real Target

The pattern across the 2025 to 2026 Iran and Russia campaigns is that Washington rarely expects the direct sanctions target to change its behavior. Hengli's economics depend on discounted Iranian crude it can only obtain by continuing to buy it; there is no clean exit that preserves its margin.[^1][^2] What the campaign is actually built to move is the layer of banks, insurers and shipping intermediaries that make the purchase possible, because those parties have something to lose that the refinery itself does not: standing inside a financial system a Chinese teapot refinery was never part of in the first place. That is a geostrategic calculation about who has something to lose, not a legal technicality. Sanction the chokepoint the target cannot route around, not the target itself.

This is also why a compliance function built only to screen counterparties against the Specially Designated Nationals list keeps missing the exposure. The refinery a company sells steel-cutting equipment to, or the shipping insurer it reinsures, may never appear on a sanctions list right up until the day it does, and by then the transaction that created the exposure has already happened. Secondary sanctions do not punish a relationship after the fact so much as they retroactively define which relationships were live risk all along, which is a different failure mode from the ownership-chain exposure covered in Sanctions Risk Beyond the Screening List.

Building a Compliance Program for Exposure You Don't Control

• Screen the counterparty's counterparties, not only the counterparty. A shipping firm's exposure to a shadow-fleet vessel matters more than the firm's own sanctions status on the day a contract was signed.[^1]
• Track designation authority separately by regime. A company clean under OFAC can already be listed by the EU or UK, as Yulong shows, so a single-list screen understates exposure for any firm operating across jurisdictions.[^4]
• Assume banking relationships are the fastest-moving variable. A correspondent bank can decide to de-risk a client well before any government designation, simply because Executive Order 14114 makes the bank's own exposure a function of its client's conduct.[^3]
• Do not treat the absence of a U.S. or EU presence as a reason to deprioritize screening. This sits inside the broader category of geopolitical risk that a compliance program built around jurisdictional nexus was never designed to catch, and the 2025 to 2026 campaigns show the designated party's location is close to irrelevant to whether a designation lands.
• Revisit the screen on a cycle shorter than the annual review. More than 1,000 Iran-related designations landed in fourteen months,[^1] the same latency problem covered from the tracking side in The Geopolitical Sanctions Gap; a counterparty list checked once a year is stale for most of that year.

This exposure sits closest to financial services compliance functions today, though the same screening gap reaches any company paying a counterparty that pays a counterparty Treasury has not yet named.

Fortius Intel note: A sanctions screen that stops at "does this counterparty have a U.S. or EU address" is answering the wrong question. The right question is whether the counterparty's own counterparties do, because that is where Treasury and its European counterparts have been aiming since at least December 2023.

Sourced from U.S. Department of the Treasury press releases, EU and UK sanctions designation records via OpenSanctions, and law firm analysis of Executive Order 14114's implementing mechanism.

Footnotes