Sanctions & Reputational Due Diligence: The M&A Playbook — Three Checks, and Where Each One Stops

Why Sanctions and Reputational Risk Belong in the Deal Model

Financial and legal diligence answer whether a target is worth what the seller is asking and whether its contracts, tax position, and corporate records hold up. They were never designed to answer a different and increasingly decisive question: who actually controls this company, where does its money come from, and what will an acquirer inherit in liability the day after closing. That gap is where sanctions and reputational exposure live.

The cost of getting this wrong has risen sharply. The U.S. Treasury's Office of Foreign Assets Control (OFAC) enforces sanctions on a strict-liability basis, meaning a U.S. acquirer can face civil penalties for dealings with a sanctioned party even without knowing the party was sanctioned. When you acquire a company, you acquire its counterparties, its supply chain, and in many cases its historical conduct. A clean balance sheet does not insulate you from a target that has been routing payments through a sanctioned intermediary or that is ultimately owned, through layered entities, by a designated individual. OFAC's 50 Percent Rule is why a supplier can be blocked without ever appearing on a list — the ownership arithmetic that vendor due diligence investigations exist to resolve, and which an acquirer inherits across the target's whole third-party population.

For private equity and corporate development teams, the practical consequence is that sanctions screening and reputational due diligence cannot be an afterthought bolted onto the closing checklist. They have to be sequenced into the deal timeline early enough that findings can still change the outcome, before the price is anchored and the deal has its own momentum.

The Three Checks, and Where Each One Stops

Reputational due diligence is usually described as one thing and bought as one line item. It is three different investigations. They run on different sources, they answer different questions, and the space between them is where the expensive findings sit. Deal teams routinely commission one, believe they have covered the ground, and are surprised in year two.

Sanctions and watchlist screening asks a binary question: is this party, or anyone above it in its ownership chain, designated? It is fast, it is inexpensive, it is strict-liability territory, and it is the only one of the three where a confirmed finding is usually dispositive. What it cannot do is say anything about conduct no authority has yet recorded. A clean screen evidences an absence of listings, not an absence of risk.

Adverse-media review asks what has been publicly alleged about these people, where, by whom, and whether the allegation went anywhere. Done properly it runs in the target's operating languages rather than English alone, and it distinguishes a regulatory finding from a plaintiff's pleading from a commercially motivated smear. What it cannot reach is the large category of conduct nobody ever wrote about — and in the jurisdictions where the press is weakest, that category is largest.

Character checks are the slowest and the least automatable: the principals' own documented record — prior ventures and how they ended, directorships and disqualifications, litigation they brought as well as litigation brought against them, professional standing and licensing — corroborated, where the stakes justify it, by discreet inquiry with people who have actually dealt with them. This is the layer that most often produces the finding that changes a deal, and the layer most often cut for time. What it cannot do is compel anyone to speak.

Run one of the three alone and the gap is the other two. The argument of this playbook is that they belong in a single scope, sequenced against the deal's own decision gates, rather than bought piecemeal from three providers who never see each other's work.

• Sanctions and watchlist screening — a binary, ownership-aware question with a usually dispositive answer; blind to anything not yet recorded by an authority
• Adverse-media review — what has been alleged, by whom, in which languages, and whether it went anywhere; blind to what was never reported
• Character checks — the principals' own record and the people who have dealt with them; the slowest layer, the one most often cut, and the one that most often changes the deal

What Reputational Due Diligence Actually Covers

Reputational due diligence is a structured investigation into the integrity and risk profile of the people and entities behind a transaction — the three checks above, taken together. It is broader than a sanctions check and narrower than a general background search — one specialized branch of corporate intelligence focused on integrity and reputation. Done properly, it triangulates public records, regulatory filings, litigation databases, adverse media, corporate registries across jurisdictions, and human-source inquiry into a coherent picture of who you are really doing business with.

It matters because the most damaging facts in a deal are rarely disclosed in the data room. They surface in a former regulator's enforcement file, a foreign court docket, a pattern of dissolved shell entities, or a principal's undisclosed relationship to a politically exposed person. The goal is not to assemble a dossier of trivia; it is to identify the specific facts that would change a reasonable acquirer's view of price, structure, or whether to proceed at all.

The principal users are private equity and venture investors vetting management and co-investors, family offices assessing investments and sensitive matters — up to and including executive protection for their principals — corporate boards evaluating senior appointments and partnerships, law firms managing litigation and client-intake risk, and corporations and insurers screening high-exposure counterparties. What they share is a decision that ties their capital or reputation to someone they cannot fully verify on their own.

It is equally worth being clear about what this is not. It is not a credit report, and it is not an automated, checklist-driven background check governed by consumer-reporting rules. It is an analyst-led assessment that interprets primary-source records in context and tests a counterparty's narrative against them — the difference between confirming that a record exists and understanding what it means for the risk in front of you.

• Sanctions and watchlist exposure across OFAC, UN, EU, and UK regimes, including ownership-based (50 percent rule) exposure
• Ultimate beneficial ownership tracing through layered or offshore entities
• Corruption and FCPA-adjacent risk, including dealings with foreign officials and state-owned enterprises
• Adverse media, regulatory actions, and enforcement history in every operating jurisdiction
• Civil and criminal litigation, judgments, liens, and bankruptcy patterns
• Integrity red flags on principals: undisclosed prior ventures, misrepresented credentials, conflicts of interest

Sequencing Diligence Into the M&A Timeline

The single most common mistake is treating reputational and sanctions diligence as a confirmatory step performed shortly before signing. By then the price is set, the deal team is invested, and adverse findings face institutional resistance. The answer to when it should be done is always the same: before the commitment. In a transaction, a focused reputational pass belongs before a term sheet or exclusivity, while there is still leverage to renegotiate or walk; for an appointment or a partnership, before the offer or agreement is made. The fix is to stage the work in tiers that map to the deal's natural decision gates.

At the indication-of-interest or term-sheet stage, run a fast screening pass on the target entity and its named principals against sanctions lists and major adverse-media sources. This is inexpensive, takes days not weeks, and exists to catch deal-killers before you spend real money. A confirmed sanctions hit or a principal with a serious enforcement history should be known before you sign an LOI, not discovered in week six of exclusivity.

Once exclusivity is granted and confirmatory diligence begins, escalate to enhanced due diligence on the entities and individuals that the screening pass flagged or that carry inherent risk: foreign owners, complex ownership chains, businesses in higher-risk sectors or geographies, and anyone touching government contracts. This is where beneficial-ownership tracing, jurisdiction-by-jurisdiction record retrieval, and discreet source inquiry belong. Reserve the deepest investigative work for the specific risk that the earlier tiers identified, rather than boiling the ocean on every counterparty.

Character checks deserve their own note on timing, because they are the tier most often squeezed. Referencing a management team properly takes weeks, not days, and it cannot be compressed into the final two weeks — which is the argument for starting it at the point the target becomes the likely target, in parallel with commercial diligence rather than after it. For funds backing a team rather than buying an asset this is the whole exercise, and it is set out at length in investigative due diligence for private equity.

• Tier 1 (LOI / term sheet): rapid sanctions and adverse-media screen on target and named principals to surface deal-killers early
• Tier 2 (exclusivity / confirmatory): enhanced diligence on flagged parties, foreign owners, and high-risk counterparties
• Tier 3 (pre-signing): beneficial-ownership verification, source inquiry, and resolution of open red flags that bear on terms
• Running alongside all three: character checks on the principals, started early because referencing cannot be compressed

OFAC and the 50 Percent Rule: Screening Beyond the Named List

Many deal teams screen the target's name and a handful of principals against OFAC's Specially Designated Nationals (SDN) list, get no hits, and consider sanctions diligence complete. That is a serious under-scoping. OFAC's published guidance establishes that an entity is itself blocked if it is owned 50 percent or more, directly or indirectly, by one or more blocked persons, even if that entity does not appear on any list by name.

The practical implication is that sanctions screening has to follow the ownership chain, not just the front-door name. A target that is 60 percent owned by an unlisted holding company that is in turn majority-owned by a designated individual is, for sanctions purposes, a blocked entity. You will not find that by running the operating company's name through a list. You find it by tracing ultimate beneficial ownership through every intervening layer, including offshore vehicles built specifically to obscure it.

This is also why sanctions and reputational diligence are inseparable in cross-border deals. The same investigative work that establishes who really owns a company, the work reputational diligence does anyway, is exactly what you need to apply the 50 percent rule correctly. Treating them as two separate workstreams wastes effort and leaves gaps between them.

What a Hit Actually Means, and How It Gets Resolved

Screening produces hits, and most hits are not findings. A name match against a sanctions list, a watchlist, or a politically-exposed-person database is a candidate for attention, not a conclusion — and the work that turns one into the other is investigative rather than technological. Deal teams that do not plan for this either stall on false positives or, worse, wave them through because the queue is long and the signing date is not moving.

Resolution runs in a fixed order. Establish whether the match is the same person or entity at all, using identifiers rather than names: dates and places of birth, known aliases and transliteration variants, registration numbers rather than trading names. If it is the same party, establish what the record actually says and on what basis, read in the primary source rather than in an aggregator's summary. Then establish what it means for this transaction — because a designated party is a different problem from a relative of a foreign official, which is a different problem again from a decade-old regulatory matter closed without findings.

The politically-exposed-person case derails more timelines than any other, because PEP status is not an allegation of anything. It is a risk classification that calls for enhanced scrutiny of source of wealth and source of funds. What a PEP hit actually means, and how it gets resolved sets out that process step by step, and the same discipline applies to the sanctions and adverse-media queues beside it.

Two habits make the difference in practice. Document the reasoning, not only the outcome: a file that records why a hit was discounted is what protects the acquirer if the same question is asked in three years by a regulator, a correspondent bank, or a buyer of the asset. And escalate on structure rather than on volume — one unresolved question about who sits above the target outranks two hundred cleared name matches.

• Same party? Reconcile identifiers, not names — dates and places of birth, aliases and transliterations, registration numbers rather than trading names
• What does the record say? The basis and date of the designation or action, read in the primary source rather than an aggregator's summary
• What does it mean here? A designation, a PEP classification, and a closed regulatory matter are three different problems with three different responses
• Record the reasoning, not just the verdict — an undocumented discount offers no protection later
• Escalate on structure, not volume — one open ownership question above the target outranks a long queue of cleared name matches

Beneficial Ownership and the Corporate Transparency Act

Knowing the natural persons who ultimately own and control a target has moved from best practice to legal infrastructure. The Corporate Transparency Act directs the Financial Crimes Enforcement Network (FinCEN) to maintain a beneficial-ownership information regime, reflecting a broad policy judgment that anonymous shell ownership facilitates sanctions evasion, money laundering, and fraud. The scope and application of these reporting requirements have evolved, so deal teams should confirm the current state of the rules with counsel rather than rely on a static summary — the position as it stood is set out in the Corporate Transparency Act and beneficial-ownership diligence.

For acquirers, the underlying point is durable regardless of how reporting rules shift: opaque ownership is a risk signal in itself. A target whose cap table runs through nominee directors, bearer-share jurisdictions, or chains of single-purpose entities with no commercial rationale deserves heightened scrutiny, because that structure is the precise mechanism used to hide sanctioned or criminal beneficial owners.

Verifying ownership is rarely a single database lookup. It typically requires retrieving and reconciling corporate registry records across multiple jurisdictions, reading the actual filings rather than trusting an aggregator's summary, and in opaque structures, using human-source inquiry to confirm who exercises real control. This cross-border record work is the core of Fortaris's International and Cross-Border Due Diligence practice.

FCPA-Adjacent Exposure: Inheriting Successor Liability

Anti-corruption risk is one of the few areas where M&A can transfer liability for conduct that occurred entirely before you owned the company. The Foreign Corrupt Practices Act, jointly enforced by the Department of Justice and the Securities and Exchange Commission, reaches improper payments to foreign officials, and acquirers can face successor liability for a target's pre-closing FCPA violations. The DOJ has publicly encouraged thorough pre-acquisition anti-corruption diligence and has, through its enforcement policies, signaled more favorable treatment for acquirers who conduct it, self-disclose issues they uncover, and remediate.

That enforcement posture turns diligence from a defensive cost into a value-protection mechanism. Identifying a target's reliance on third-party agents in high-corruption markets, payments to entities connected to government officials, or unexplained margins on public contracts, before closing, lets you price the risk, restructure the deal, or carve out the liability. Discovering it afterward means inheriting it.

The screening focus here is concrete: the target's interactions with foreign governments and state-owned enterprises, its use of intermediaries, consultants, and customs agents, the integrity of its books around facilitation payments and gifts, and the personal histories of executives who managed government-facing relationships. These are character questions as much as legal ones, and they are best run together.

How Findings Change Deal Terms

Findings are only useful if they translate into deal mechanics. A reputational or sanctions issue rarely produces a binary go/no-go; more often it reshapes the transaction. The deal team's job is to convert what the investigation surfaces into specific, negotiated protections.

A confirmed sanctions nexus or an unresolved beneficial-ownership question that cannot be cleared is one of the few true walk-away findings, because the legal exposure is strict-liability and the regulatory consequences are not negotiable. Most other findings are manageable through structure. A material but quantifiable exposure can be priced into the purchase consideration. A discrete legacy liability can be carved out or addressed through a specific indemnity backed by a larger or longer-surviving escrow. Integrity concerns about a specific executive can be handled through conditions, departures, or governance terms.

Findings also drive the representations and warranties the seller must give and the corresponding coverage in any R&W insurance, where insurers increasingly expect to see that sanctions and anti-corruption diligence was actually performed. The discipline is to document not only what you found but what you reasonably investigated, so that the diligence record itself supports both the negotiated terms and any later regulatory inquiry.

• Walk away: confirmed sanctions exposure or beneficial ownership that cannot be cleared
• Reprice: material, quantifiable exposures folded into purchase consideration
• Ring-fence: specific indemnities, carve-outs, and escrow for discrete legacy liabilities
• Condition: executive departures, governance changes, or remediation as closing conditions
• Insure: tailored reps and warranties supporting R&W coverage, grounded in a documented diligence record

Building a Repeatable Screening Protocol

Funds and corporate development teams that do this well do not reinvent the process for every deal. They operate a standing protocol that defines what gets screened, at which gate, against which sources, and with what escalation triggers. That consistency is what lets a small deal team move quickly without leaving gaps, and it is what an investment committee or a regulator will expect to see evidenced.

A workable protocol specifies the screening universe (target entity, parents, subsidiaries, named principals, key counterparties, and major customers), the source set (sanctions and watchlists, cross-border corporate registries, litigation and adverse media, regulatory enforcement records), and the thresholds that escalate a matter from automated screening to human-led enhanced diligence. It also specifies who reviews findings and how they are documented, because an undocumented screen offers little protection if conduct is later questioned.

The deepest components — beneficial-ownership tracing through opaque structures, discreet source inquiry, and cross-border record retrieval — are typically where in-house teams reach their limits and bring in specialist support. The criteria for testing a provider before appointing one are set out in how to choose a due diligence company. Fortaris is engaged at exactly these points: senior-led investigations where the answer is not in a database and the stakes justify evidentiary rigor. Every engagement is led by a Managing Director with federal investigative and forensic-accounting depth, and the work is nationwide and cross-border by design.

Confidentiality is fundamental to that layer of the protocol, and worth writing into it explicitly. The inquiry is conducted discreetly, its existence is protected, and findings are shared only with the client and those the client authorizes; where the work is commissioned through counsel, it may also be structured to fall within attorney work-product or privilege. The ability to run the work without alerting the subject is often as important to a deal team as what the review finds.