How to Review Sanctions Screening and Export-Licence Warranties

An ops lead at an 18-person UK SaaS is about to treat Clause 15 as boilerplate because sales said every US vendor has a standard export warranty. The hidden risk on this paper is a one-sided Customer warrant with unnamed lists, no ownership-or-control limb, production in US-East, and a mid-term kill that keeps the prepaid £28k under Friday pressure.

In September 2026, Sol — Ops; they are the customer on this paper — has Finance’s yes on a US analytics SaaS. Annual commit £28k, prepaid. The MSA — a master services agreement, the frame vendors hang order forms on — Clause 15.1: “Customer warrants that it is not a sanctioned person and will comply with all export-control and sanctions laws.” No list named. No “owned or controlled.”

Clause 4.3 hosts production in US-East. Clause 15.3: if Customer becomes a Restricted Party, Vendor may terminate at once; prepaid Fees are non-refundable. Nothing says what happens if Vendor or a 51% shareholder is designated. AE Slack: “Standard export warranty.” DocuSign is Friday. If the fight is insurance, indemnity, SLA or price, that is a different hunt — the vendor contract red-flags checklist.

Typical mistake: treating unnamed lists as “we’re a UK company, OFAC is their problem.” A live login after a mid-term designation can be the breach — and “not a sanctioned person” misses the 51% shareholder. From 9am on 28 January 2026 the UK Sanctions List is the only UK designations source; the OFSI Consolidated List closed.

Disclaimer: Checkory provides AI support, not legal advice. Consult a qualified lawyer for binding decisions.

Which lists does the warranty actually name — UK, EU, UN, OFAC?

Write the four list names the warranty actually uses, or write lists unnamed. UK, EU, UN and OFAC are different lists. From 9am on 28 January 2026 the UK Sanctions List is the only UK designations source. Do not treat the closed OFSI Consolidated List as live.

Freeze the packet — the exact file set you will sign. Copy the UK Sanctions List (FCDO), the EU consolidated list, the UN Security Council list, and OFAC SDN — or write “lists: unnamed.” The paper’s words are England and Wales. UKSL designations under SAMLA 2018 run UK-wide; do not invent an England-and-Wales list. Do: write the four names. Don’t: screen a closed OFSI file. For example, Sol’s Clause 15.1 names none of them.

What does ownership-or-control catch that a named entity misses?

A listed 51% shareholder can freeze an unlisted company. Circle whether the warranty covers persons who own or control the party, not only the named Customer. If Clause 15.1 is only “Customer is not a sanctioned person,” write O&C missing.

The UK ownership-or-control test (updated 13 April 2026) still freezes an entity owned or controlled by a designated person even if that entity is not named: more than 50% of shares or voting rights; appoint or remove a majority of the board; or it is reasonable to expect the designated person could, if they chose, run the entity’s affairs. OFAC FAQ 398 is US structure — 50% or more ownership in the aggregate, not control — useful if US-East creates a US nexus, not Sol’s English statute. Do: circle an O&C limb. Don’t: treat a company-name screen as enough.

Why does software and technical data count as an export?

Software and technical data sit on dual-use lists next to goods. Electronic transfer — email, file, video, overseas cloud access — can need a licence. Hosting region is not the whole test. Who downloads or accesses from where is.

ECJU: dual-use includes goods, software (D) and technology (E). Controlled dual-use exports from Great Britain need a licence; Northern Ireland follows Windsor Framework / EU dual-use rules for extra-EU moves. Exporting without the correct licence can mean a fine and/or imprisonment up to 10 years.

Cloud colour (22 March 2021, structure): destination is the intended recipient’s location, not the rack. The Dual-Use OGEL (NTE 2026/14, 25 June 2026) is a licence route, not a skip. EU Article 12g is a goods no-re-export clause — fence it, then leave. Do: write region plus who may access from where. Don’t: treat US-East SaaS as goods-only.

When to demand suspend-and-unwind if a party is designated mid-term?

A live SaaS login after a mid-term designation can be the breach. Write notice, suspend, a licence path, wind-down, and what happens to prepaid fees. Vendor-only kill with prepaid non-refundable, and silence if Vendor is designated, is a fail.

On 26 May 2026 OFSI imposed £1,000,920.59 on Sabre Global Technologies Limited (notice 17 June 2026). After Ural Airlines was designated on 19 May 2022, SGTL kept GDS software live until 6 December 2022. OFSI treated continued access as making an economic resource available — not a forecast of Sol’s bill. Clause 15.3 lets Vendor kill Customer and keep the £28k, with no Vendor-side designation line. If someone says “that’s force majeure,” that hunt is the force majeure first-pass review. Do write suspend, licence, unwind and prepaid credit both ways; don’t leave Vendor’s designation silent.

How do you tell a Customer-only warrant from mutual screening?

Circle whether each party warrants it is not a designated person and not owned or controlled by one. Customer-only “you warrant we are clean” leaves Vendor’s parent unsaid. Do not accept “every US vendor has this” as a reason the lists stay unnamed.

In practice, a mutual form says “Each Party” plus owners and controllers, with notice if either side is designated. Sol’s Clause 15.1 is Customer-only; 15.3 is a Vendor kill. Do: demand mutual warranties and mutual notice. Don’t: treat a US-vendor default as the log.

Mutual, suspend, or escalate

Mutual only if the log shows named lists, an ownership-or-control limb, software-as-export allocated, and a two-way suspend-unwind with prepaid credit. Suspend if lists are unnamed, O&C is missing, or unwind is vendor-only. Escalate a grey-zone owner, dual-use classification, or a party already designated.

Success bar before Friday: fill the log and point to one sentence that would pause the call. “Standard export warranty” is not that sentence if lists are unnamed, O&C is missing, and there is no mid-term unwind. Spend counsel — a qualified lawyer, not the chatbot — on those three holes. Optional first-pass — a first machine pass that extracts clauses before a human reads every page — at document analysis, then a human opens every High flag — a high-severity extract a human must verify — plus the unnamed-list sentence. Do not treat the heading as a green light.