Export controls and sanctions: What Swiss companies should prioritize now

Automated sanctions list checks are the top short-term priority. It became clear during our discussion that the sheer number of lists and data sources makes manual checks practically impossible today. Companies therefore need a robust, automated screening process for customers, suppliers, and other relevant business partners.

However, automation does not mean accepting screening matches without verification. It is intended to reduce routine work and highlight relevant cases. This gives the responsible specialists the necessary leeway to evaluate matches, red flags, and complex business relationships. This is crucial because screening is only the starting point of an effective compliance check.

Export controls begin with a precise understanding of the product – and accurate classification of goods. For example: Companies must be able to reliably assess whether their products are dual-use goods, which technical parameters are critical, and whether a license is required. Machine tools with four- or five-axis positioning, precision pumps, and valves are well-known examples of products that require complex assessments.

Further information on classifying products

The operational question is therefore not just: “Is my customer listed?” Equally important are: “What are we supplying?”, “What are the product's technical characteristics?”, and “Where will it be used?” Based on this, further restrictions and licensing requirements may apply – independent from the business partner review.

Also relevant for Swiss companies in this context: If US products – i.e., goods, software, and technology – are included in the product portfolio, the requirements of the US Export Administration Regulations (EAR) must also be observed.

Further information on the export and re-export of US products

Trade compliance influences strategic business decisions. Companies cannot change production locations, supply chains, and dependencies on short notice. When developments in material costs, tariffs, export controls, and sanctions all come into play simultaneously, they must assess early on which markets they want to serve and what procurement or sales risks may arise as a result.

This task involves senior management, procurement, sales, the supply chain, and local management teams – and the early incorporation of export controls and sanctions law considerations is essential. During the event's discussions, it was emphasized that companies must seek dialogue with their branch locations and, where necessary, with local authorities in order to better understand these developments and prepare courses of action.

Regulations that apply indirectly continue to pose a challenge. Under the BIS Affiliates Rule, for example, a shipment to an unlisted business partner may still be subject to restrictions if that partner is 50% or more owned or controlled by entities subject to certain US restrictions. Such regulations aim to curb sanctions evasion.

Further information about the BIS Affiliates Rule

The discussion highlighted various ownership and equity structures: ownership stakes of 50%, more than 50%, as well as direct, indirect, or cumulative ownership stakes held by multiple sanctioned entities. Therefore, an assessment of ownership and control data is required when the company’s risk profile warrants it.

Long-term projects are particularly challenging. A relationship may appear unremarkable at the time a contract is signed but may change before delivery – for example, due to mergers, acquisitions, and restructurings. Companies must therefore monitor throughout the entire course of the business relationship whether sanctions, ownership, or control risks have changed.

Business-critical suppliers require an in-depth risk assessment and prepared alternatives. During the discussion at the event, a case was described in which a company had identified ownership structures at a key supplier as a risk at an early stage. Before sanctions were later imposed on the entities involved, alternatives, inventory levels, and possible measures had already been reviewed. This enabled the company to act more quickly after the listing and avoid a negative impact on the supply chain.

Conclusion: When a supplier is highly critical, red flags are present, or there is significant dependence on that supplier, a company should conduct a more in-depth review and assess whether alternative sources of supply exist, what inventory is available, and what impact the loss of the supplier would have on customers, production, and distribution.

Trade compliance begins during the business development phase, not just in logistics. The panel discussion outlined potential risks throughout the entire process: during initial customer contact, supplier selection, procurement, product classification, end-use verification, payment, and shipping. Teams from sales, purchasing, finance, and logistics must therefore know when to escalate a case to the compliance team.

A missing or evasive answer to relevant questions can be a red flag. The appropriate response depends on the specific risk. Relevant factors include, among others, the country, business model, product, end use, volume, and significance of the business relationship. Details on the procedure must be documented in the corresponding organizational instructions (Internal Compliance Program, or ICP for short).

View an ICP example case now

There is no single standard level of screening depth that applies to all business relationships. The event's panel of experts emphasized the need for a risk-based approach. When risks are elevated, companies must obtain additional information, verify its plausibility, and document their decisions in a transparent manner. Simple guiding questions can help with this: Who is involved? What is being delivered? Where is it being delivered? What are the goods being used for?

Documentation is not merely a formality. It shows what information the company has obtained, which red flags it has assessed, and what decision it has made. Particularly in the case of complex or long-term transactions, due diligence must be maintained throughout the entire business relationship. Here, too, automation is helpful – i.e., software that documents all screening steps and decisions and provides complete audit trails.

AI can only work reliably and deliver good results if the necessary data is available and accurate. The expert panel identified data quality as a key challenge. Inactive or outdated data, gaps in ERP and CRM systems, and unclear responsibilities weaken risk analyses, decision-making processes, and trade compliance solutions.

AI can quickly evaluate data, identify correlations, and flag inconsistencies or information gaps. However, it cannot reliably substitute missing information from unavailable sources – and existing errors are carried over as is.

Companies must therefore treat data maintenance, clear data accountability, and clean processes as the foundation of their compliance technology.

AI can support and accelerate research, analysis, and documentation, but should not make autonomous approval decisions. The panel participants drew a clear line here: humans must review and evaluate results, and assume responsibility for decisions in the area of export controls and sanctions compliance. This review is part of due diligence.

AI can ease the workload on compliance teams by structuring information, highlighting missing details, or preparing complex cases. This allows subject matter experts to devote more time to more difficult decisions. At the same time, companies must monitor what data they enter into AI applications, where that data is processed, and how confidentiality is maintained. This is particularly important for sensitive products and in the defense sector.

A single export control function cannot manage the risk on its own. Executive management, middle management, sales, procurement, logistics, finance, and local teams must all be involved. Executives must provide the necessary resources, systems, and clear lines of responsibility. Employees must be trained and know when and how to report or escalate an issue.

Discussions among event participants also highlighted the importance of personal collaboration. Policies, ICPs, and online training alone are not enough. Compliance teams must understand the operational processes of other departments, locations, and systems.

Trade compliance cannot and must not be a silo. Regular communication, local points of contact, clear communication channels, and centralized tools help integrate new regulatory requirements into day-to-day operations.