The U.S. Sanctions Landscape

Five authorities, one perimeter.

Click any agency below to read what it requires of a German or Baltic operator. The U.S. sanctions architecture is plural — Treasury freezes, Commerce classifies, State licenses defense items, Justice prosecutes, Treasury's FIU watches the financial flows.

A company in Germany, Estonia, Latvia, or Lithuania does not automatically owe direct compliance with every U.S. sanctions rule in every purely European transaction. U.S. law becomes mandatory the moment there is a U.S. nexus — a U.S. person, a U.S. affiliate, a U.S. bank, USD clearing, U.S.-origin goods, U.S. software, U.S. technology, U.S. cloud services, U.S. financing, or re-export of items subject to U.S. export control.

U.S. sanctions reach the EU through five doors.

A German or Baltic company is not "covered" by U.S. sanctions in the abstract. It is covered when one of these triggers fires.

The first compliance question is jurisdictional. U.S. measures bind a non-U.S. company where the transaction touches U.S. jurisdiction — and a transaction can touch it through paperwork, a bank, an employee, a piece of code, or a single screw of U.S.-origin content above the de minimis threshold. The five doors below cover virtually every realistic exposure.

Secondary sanctions are the harder case. They can reach non-U.S. persons for "significant transactions" with sanctioned persons, sectors or activities — most actively today against Russia, Iran and North Korea, and against foreign financial institutions supporting Russia's military-industrial base under Executive Order 14024. There is no direct U.S. nexus required for a secondary-sanctions designation; only commercial gravity and political will.

Four duties, ordered by severity.

Tap a duty to read its scope and the operational triggers that should make it bite. OFAC enforces civil violations on a strict-liability basis — knowledge and intent are not required.

Seven surfaces, one programme.

Click each row to expand. Every commercial function carries a sanctions surface — onboarding, master data, shipping, payments, M&A, distributors, and people inside the company.

Five focal points, one rolling perimeter.

Hover or tap each card to focus. Russia and Belarus dominate operational risk in 2026; the others remain critical legal-review triggers, especially where the EU and U.S. positions diverge.

The PRC point deserves restating. China is not subject to comprehensive U.S. sanctions. The risk is not "China business" as such — it is specific counterparties, controlled technology, military or surveillance end uses, Russia re-export, Xinjiang/forced-labour exposure, and Entity List parties. Treasury's 2024 Russia-evasion actions included PRC-based dual-use exporters.

Don't apply U.S. rules mechanically.

A German or Baltic company must comply directly with EU and national sanctions. Where a U.S. rule is extraterritorial and no direct U.S. nexus exists, the EU Blocking Statute may prohibit compliance. Legal review is required before refusing, exiting, or terminating business solely because of U.S. sanctions.

EU sanctions breaches and circumvention have been harmonized under Directive (EU) 2024/1226 — routing goods through third countries to sanctioned destinations, concealing designated persons' ownership, and using false information to hide an ultimate beneficiary are now criminal offences across the Union.

National enforcement remains plural. In Germany, BAFA handles goods, technical assistance and economic resources; the Bundesbank handles funds, financial resources and financial assistance; the new Central Office for Sanctions Enforcement (ZfS) covers gaps. In Latvia, public-sector and procurement contexts must observe OFAC sanctions in PPP and procurement, refusing direct or indirect dealings with sanctioned persons. In Estonia, the International Sanctions Act renders any transaction violating international sanctions void. In Lithuania, financial-market supervision can impose special measures where sanctions touch a participant, owner or controller.

The conflict-of-laws issue is real. The EU Blocking Statute can prohibit EU operators from complying with certain specified extraterritorial foreign sanctions laws, nullify foreign judgments based on those laws, and allow recovery of damages. A blanket "we apply U.S. rules everywhere" policy is therefore not safe — it can itself be a violation.

OFAC's framework names these five components as the floor for an effective sanctions compliance program. An effective program is treated favourably in enforcement and may mitigate civil monetary penalties.

Seven indicators, one perimeter.

U.S. and allied enforcement now centres on circumvention. Click each indicator to read it; the radar visualises their relative weight in current OFAC, BIS and FinCEN practice.

A transaction, scored against U.S. nexus.

Compose a hypothetical transaction below. The simulator returns a risk tier and the prescribed control response — the same logic a working U.S. sanctions team should apply.

Seven steps, in this order.

Click each step. The order matters: jurisdiction precedes ownership precedes goods precedes routing precedes payment. Every step that releases a transaction must be documented; every step that stops one must be reported where required.

Thirty days, ninety, then forever.

Click each item to mark it complete. The bar tracks programme maturity end-to-end.

Twelve questions. One programme.

A board or senior management team should be able to answer all twelve in the affirmative. Tap each row to mark it answered — the gaps are the programme's next month of work.

If the answer cannot be confidently documented, the transaction should be stopped, escalated, and — where legally required — reported. That is the entire programme, in a sentence.