I recently went through the official press releases (US Department of Justice, US Treasury, Dutch Public Prosecution Service) behind some of the largest sanctions and anti-money laundering cases: BNP Paribas ($8.9736 billion, 2014), Binance (over $4 billion, 2023), Danske Bank ($2 billion forfeiture, 2022), TD Bank (over $1.8 billion, 2024), HSBC ($1.256 billion forfeiture plus $665 million, 2012) and ABN AMRO (EUR 480 million, 2021).
Several of those cases involved deliberate conduct, so this is not about "a CRM setting would have saved them". But the same control gaps show up again and again, and most of them map directly onto how we manage contacts in a CRM. Here is a practical checklist.
1. Make sure every company record is screenable
Screening fails silently when data is messy. For each company record, check you have:
- Legal name (not just the trading name or "ACME - Milan office")
- Country in a dedicated field, ideally ISO code
- Registration number or VAT ID where you have it
- Website domain, which helps disambiguate similar names
Tip: create a view or filter for companies with an empty country field. That is usually your biggest blind spot.
2. Do not treat onboarding as the only check
In the TD Bank case, the DOJ says no new monitoring scenarios were added for years. In smaller companies the equivalent is a check done once when the deal closed. Sanctions lists, insolvency status and news change constantly.
- Add a "Last compliance check" date property on companies.
- Build a filter: active customers or suppliers where that date is older than 30 days (or your policy period).
- Make re-checking a recurring workflow, not a one-time task.
3. Revisit risk ratings
HSBC rated Mexico as its lowest risk category for years; ABN AMRO put millions of clients in the lowest tier without adequate analysis. If you use a risk property in your CRM:
- Store who set it and when.
- Trigger a review when key fields change (country, ownership, industry, deal size).
- Never let "low risk" be the default value for new records.
4. Cover suppliers too, not just customers
Many teams only keep customers in the CRM. Sanctions and insolvency risk sits equally on the supply side. If suppliers live in a separate system, at least sync the basics (name, country, ID) so they can be checked with the same process.
5. Check the people, not only the companies
Politically exposed persons (PEPs) and sanctioned individuals often appear as directors or contacts. Keep contacts associated with their companies and include key contacts in your checks.
6. Route alerts to where people work
An alert in a separate inbox gets ignored. Use a task, a deal or company note, or a notification to the account owner when something changes, and require a recorded outcome (cleared, escalated, offboarded).
7. Keep evidence
When authorities look back, they ask what you checked and when. For every check, record:
- date and time
- which lists or sources were used
- the result
- who reviewed it and what they decided
A simple timeline note or custom object is enough. What matters is that it exists and is consistent.
8. Run a baseline on your whole database
Before building workflows, export all companies and contacts once and run them against EU, US, UK and UN sanctions lists, PEP data, insolvency and adverse news. You will quickly see how much cleanup is needed and where the real exposure is.
Hope this is useful. Happy to compare notes on how others structure their compliance properties and workflows.
General information, not legal advice.
(We work on this problem at Unicorn Intelligence.)
