Russia Sanctions Have Gone Digital. How Can Businesses Stay Safe?

As the war in Ukraine persists without a ceasefire deal, Western countries are intensifying efforts to pressure Russia. The EU is advancing plans to phase out all Russian gas imports, U.S. lawmakers are pushing for new sanctions and, in late April, the U.K. introduced new trade restrictions aimed at undermining Russia’s industrial and military capabilities.

Those U.K. measures, notably, underscored an evolution in sanctions strategy. Rather than targeting just physical goods, they extended to restrict intangible domains—technology services, cloud-based tools and software.

The shift reflects a growing recognition of just how reliant modern military and industrial power is on digital infrastructure. And it will challenge businesses to shift their compliance approaches, too.

The U.K.’s newest targets:

• the provision, availability, and transfer of technology used in energy production, advanced manufacturing, and industrial applications. The measures also prohibit the provision of technical assistance, brokering services and financing arrangements related to the targeted tech.
• sector-specific software, including business enterprise software (such as programs for managing customer relationships), industrial design software, and oil and gas exploration or production tools. The restrictions here extend to access, updates, upgrades, technical support and consultancy services.
• chemicals, electronics, plastics, metals, and certain categories of machinery.
• helium and synthetic diamonds processed in third countries. These commodities are seen as significant sources of revenue for Russia, and new import restrictions on them represent a coordinated effort to close its revenue-generating loopholes.

Backdrop: The U.K. already had banned the provision of IT consultancy services to Russia, in 2022, but this new focus on software, technology transfers and processed imports mirrors developments in the EU. The U.S., for its part, implemented restrictions in September on IT consultancy and design services; cloud-based services; and enterprise management, design and manufacturing software. 

As jurisdictions align here, businesses should avoid treating their sanctions programs as isolated obligations. Plot out an integrated compliance approach instead.

How to do it:

• Review product and service exposure: Businesses—especially those in manufacturing, tech, industrial goods and energy—should start by conducting detailed product- and service-mapping exercises to assess whether any of their goods, technologies or related services fall under the updated restrictions. This includes evaluating digital and intangible transfers that may have flown under the radar previously.
• Update internal controls: Update compliance systems and controls to reflect the expanded lists, and ensure cross-functional awareness of the changes. This includes training for employees in research and development, IT, customer support and sales.
• Record-keeping: Maintain clear records of compliance decisions, due-diligence processes and risk assessments. Doing so will also help demonstrate a good-faith approach to compliance in the event of regulatory inquiries or enforcement action.

The bottom line: The U.K.’s restrictions reinforce a recent trend of sanctions convergence among key allies, and they reinforce a key point, too: Sanctions compliance is no longer just about what’s being shipped. It’s also about what’s downloaded, shared or accessed across borders. Legal, tech and commercial teams will have to work together to navigate the risks.