A recurring question in sanctions training is how much due diligence is enough. It typically arises in practical situations where the available information is incomplete and the next step is not obvious, often reflecting uncertainty about regulatory expectations.

The question is understandable, but it can be misleading. It implies a defined threshold that, once reached, allows the issue to be considered resolved. In practice, sanctions compliance rarely works in that way. The question that most people want to have answered is “when can I safely stop my research?”

Most organisations have policies and systems in place. Screening tools return results, resulting in further checks and additional information. Seen this way, due diligence can appear cumulative, as something that can be built up until a defined point of completion is reached. The difficulty is that the question is usually not whether more checks are possible, but what the information already available tells you.

From checking to judgement

At some point, the issue stops being about gathering more data and becomes a matter of interpretation and judgement.

In practice, situations rarely present themselves as clearly-defined sanctions problems. A counterparty may screen cleanly but sit within a higher‑risk context. Information may be partial or inconsistent but any additional checks may reduce uncertainty without eliminating it.

The response is often to continue looking for more information and decisions are deferred while the position is clarified. Although viewed as a process issue, this is in substance a decision about how much uncertainty is acceptable.

The risk on both sides

The risk in stopping too early is clear: relevant issues may be missed and activity may proceed on the basis of an incomplete understanding. When the stakes are high “it will probably be OK” is not a good basis for a decision.

The less visible risk is in continuing indefinitely. Effort is spent pursuing marginal information, decisions are delayed, and the process itself becomes a substitute for judgement, often at real cost to the business. A business that is not confident in dealing with its customers is a business doomed to failure.

What due diligence actually requires

Due diligence is not about eliminating every conceivable risk. It is about exercising due diligence in its original sense: applying care, attention and reasoned consideration to the issue at hand.

The objective is not certainty, but a point at which a decision to proceed, decline or escalate can be justified.

This is also how enforcement authorities approach the question. An investigator reviewing a file is not looking for perfection, but for evidence of how the situation was understood and why a particular course of action was taken. All major sanctions regulators, in their own way, recognize that due diligence undertaken in good faith with a sensible rationale attuned to the risk profile of the business concerned will go a long way to get you out of trouble should something go wrong. But you have to show your workings.

“The objective is not to eliminate every conceivable risk, but to reach a point where a decision can be justified.”

Being able to show it afterwards

This makes record‑keeping central. It is not enough to carry out checks; it is necessary to document what was considered, what was concluded, and why.

The aim is that a third party, returning to the file at a later stage, can follow the logic of the decision without needing to fill gaps or make assumptions.

This can be particularly challenging for smaller organisations. Where exposure to sanctions issues is less frequent, it is harder to develop an instinct for what constitutes a reasonable level of enquiry. The tendency may be either to rely too heavily on system outputs or to continue investigating without a clear stopping point. This is when external help can be invaluable.

Conclusion

The appropriate level of due diligence is not fixed in advance. It emerges from the circumstances, the information available, and the judgement applied at the time.

It should be considered in the context of your business size, and how inherently exposed to sanctions risk that business is. Risk assessment and policies will get you so far, but these are no substitute for critical analysis and good judgement. The question of how much is enough therefore has no definitive answer. What matters is recognising when further enquiry is unlikely to change the assessment, and being able to explain clearly how that point was reached.