On 8 October 2026, the US Treasury’s Office of Foreign Assets Control (OFAC) added two Mumbai-based companies, Samudra Marine Services Private Limited and SSPL Solutions Private Limited, to its Specially Designated Nationals (SDN) List. Five Indian nationals were designated in the same action. According to OFAC’s published notice, the designations are Iran-related and sit within a wider action that also lists entities in the UAE, Turkey, Hong Kong, the UK and the Marshall Islands, along with 22 vessels.
For most readers the interesting question is not geopolitical. It is operational: imagine you onboarded a supplier six months ago. It passed legal-entity verification, ownership checks and sanctions screening. Everything was cleared. If that supplier is added to a sanctions list today, how quickly does your compliance team find out, and what happens to the relationship in the meantime?
Watch our 60-second Short on YouTube: Your vendor was clear yesterday. Is it still clear today?
Crest.Digital’s vendor intelligence platform keeps sanctions, ownership and adverse-media signals current across your supplier and distributor base, so changes reach compliance when they happen.
Explore the PlatformWhat OFAC Actually Announced on 8 October
The action targets networks connected to Iranian petroleum and petrochemical trade. OFAC’s notice lists 30 entities, six individuals and 22 vessels under Iran-related authorities, and separately removes two vessels from the list. Among the entities are shipping and ship-management companies in several jurisdictions and, in India, the two Mumbai companies named above.
OFAC also issued an Iran-related general licence, GL EE, titled “Authorizing the Wind Down of Transactions Involving Samudra Marine Services Private Limited.” A wind-down licence is not a clearance. It permits specified transactions for a limited purpose and on specific terms, and anyone relying on it must read the licence text itself. The notice we reviewed did not state an expiry on the web page, so check the linked document.
A note on scope: sanctions applicability depends on jurisdiction, ownership, transaction circumstances and applicable authorisations. This article is information for risk teams, not legal advice, and we have not assessed whether any particular business is affected.
The Re-Screening Gap: Cleared at Onboarding, Listed Later
Most vendor programmes are strong at the front door. Legal-entity verification, ownership review and a sanctions screen happen before the first purchase order. The weakness is what happens next. A sanctions list is a live document, and a supplier’s status can change long after the due-diligence file was closed. Our earlier piece on why sanctions screening has to be continuous, not an onboarding check makes the same point from the control design side.
Three things usually sit behind a late discovery. Static databases: the vendor master is updated when someone changes a record, not when a list changes. Periodic cycles: annual or quarterly re-screening leaves a window in which a listed party can still be paid, shipped to or supplied. No decision trail: even when a potential match is spotted, teams struggle to show who reviewed it, what they concluded and why.
The same pattern shows up in related risks, from distributors who become your sanctions risk to Iran-linked procurement networks and networks that stretch beyond the direct counterparty. Screening the name on the invoice is necessary and rarely sufficient.
Six Practices That Close the Gap
These are the capabilities a risk-based programme should be able to show. We deliver them as a configurable platform and, where useful, as a managed pod: reusable connectors, workflow and evidence trail, with client effort focused on data mapping and policy.
Continuous Sanctions Screening
Detect changes in official sanctions lists and re-screen your whole vendor, distributor and customer base against them as lists update, rather than on a calendar.
Vendor and Distributor Due Diligence
Reassess counterparties throughout the relationship, with the depth of review tied to risk tier, geography and the nature of the transactions.
Beneficial Ownership Verification
Identify relevant ownership and control relationships so that exposure through shareholders or controllers is visible, not just the registered name. See our guide to beneficial ownership verification.
Adverse Media Monitoring
Track emerging reputational and regulatory concerns that often surface before a formal listing. Adverse media monitoring explains how.
Automated Risk Alerts
Flag potential matches for compliance review with enough context, such as the list, the matched attribute and the vendor’s spend and criticality, to triage quickly.
Documented Compliance Decisions
Keep evidence of investigation, escalation and remediation for every alert, including false positives, so you can show what you did and when.
Step six is the one auditors ask about. A potential match that was cleared without a recorded rationale looks the same, in an inspection, as one that was never reviewed. Internal audit can test the process independently, in line with Institute of Internal Auditors expectations of assurance over risk management and compliance.
Crest.Digital is building AI-enabled governance, risk and compliance solutions, including end-to-end vendor risk governance, automated due diligence, sanctions screening, adverse media intelligence and continuous monitoring.
If a Vendor Appears on a Sanctions List: A Response Playbook
Having a plan before an alert arrives matters more than the alert itself. A sensible sequence is below, and it should be agreed with legal counsel in advance.
Five Steps When a Counterparty Is Designated
- Confirm the match. Verify the listing against identifiers such as registered name, address and ownership, to separate a true match from a similar name.
- Pause and assess. Hold new orders and payments while legal and compliance review exposure, including open contracts, goods in transit and receivables.
- Check ownership and linkages. Look at who owns or controls the vendor and which other counterparties share owners, addresses or directors.
- Read any licence carefully. A wind-down authorisation, where issued, has specific terms and scope. Do not treat it as permission to continue business as usual.
- Document and report. Record the decision, the evidence and the escalation path, and complete any regulatory reporting your jurisdiction requires.
The ownership step is where networks reveal themselves. Our articles on ultimate-controller sanctions exposure and indirect exposure through the supplier network set out how to extend the review beyond the name that appears in your vendor master.
Why This Matters Beyond Mumbai
Indian manufacturers, exporters, banks, procurement teams and businesses operating in the Middle East have an obvious reason to watch this action. But the lesson travels. Any enterprise that buys from, sells through or finances counterparties in trade corridors linked to sanctioned networks, from shipping and ship management to chemicals and commodities, faces the same question about how current its counterparty data is. The Financial Action Task Force has long stressed a risk-based approach to counterparties, and supervisors such as the Reserve Bank of India expect regulated entities to maintain effective controls over customers, vendors and outsourced relationships. For the banking angle, see our piece on continuous vendor monitoring in BFSI.
Other regimes publish their own lists, with their own scope and licensing. A programme that depends on one list, or on one annual run, will always be a step behind the combined picture. Our primer on what continuous vendor monitoring means explains the operating model.
Where Agentic AI Helps, and Where People Decide
Re-screening a large vendor and distributor base against changing lists is exactly the kind of repetitive, high-volume work that agentic AI workflows do well. AI agents can watch list updates, re-run matches, enrich a potential hit with ownership and adverse-media context, draft the case summary, and track remediation until it closes. Human-in-the-loop governance remains essential: compliance officers confirm matches, decide on holds and own the response, and every step leaves an audit trail.
Your Turn: How Often Do You Re-Screen Your Vendor and Distributor Database?
- Continuously: We re-screen automatically as lists change.
- Periodically: We re-screen quarterly, half-yearly or annually.
- Only at onboarding: Existing vendors are not routinely re-screened.
Tell us how your organisation handles it in the comments when you share this article on LinkedIn.
Crest Perspective
Financial crime compliance and third-party risk are converging: the vendor as a financial crime vector is now a live regulatory concern. Correspondent banks, payment intermediaries, and cross-border logistics providers are assessed not just for operational risk but for their exposure to sanctions-designated entities in their own supply chains. The compliance question is no longer only whether your vendor is clean — it is whether their vendors are clean.
Frequently Asked Questions
According to OFAC’s recent actions notice dated 8 October 2026, Samudra Marine Services Private Limited and SSPL Solutions Private Limited, both based in Mumbai, were added to the SDN List under Iran-related authorities. Five Indian nationals were also designated as part of a wider action targeting networks connected to Iranian petroleum trade. OFAC separately issued General License EE authorising specified wind-down transactions involving Samudra Marine Services. Readers should consult OFAC’s notice and licence text for exact terms.
A supplier that is clear at onboarding can be designated later, because sanctions lists change continuously. A one-time screen only reflects the position on the day it was run. Continuous screening re-checks the existing vendor base whenever lists update, so compliance learns of a change when it happens rather than at the next annual review, and can pause activity and assess exposure promptly.
Confirm that the listing is a true match, pause new orders and payments while legal and compliance assess exposure, review ownership and related counterparties, and read any licence or authorisation carefully, since wind-down licences are limited in scope. Document the evidence, the decision and any escalation or regulatory reporting. Agree this playbook with legal counsel before an alert occurs.
It can. Applicability depends on jurisdiction, ownership, the transaction circumstances and applicable authorisations, so each business needs its own assessment. Indian banks, exporters, manufacturers and companies trading in the Middle East often have counterparties, currencies or financing arrangements that create a US nexus or contractual obligations that reference sanctions lists, which is why many programmes screen against OFAC alongside other lists.
A solid programme combines continuous screening against official lists, risk-based due diligence on vendors and distributors, beneficial ownership verification, adverse media monitoring, automated alerts routed to compliance for review, and documented decisions with an audit trail. Agentic AI can automate the repetitive matching and enrichment, while human reviewers confirm matches and decide on actions.