Begin with the applicable rules
Sanctions and trade-control obligations depend on the entities, people, locations and transaction involved. IO Limited should assess the restrictions legally applicable to the relevant engagement, including any material contractual requirements.
International sanctions regimes are not interchangeable. In Hong Kong, United Nations sanctions are implemented through local legislation. Other regimes may become relevant through a transaction’s jurisdictional or contractual connections. Conflicting requirements call for legal review.
Parties, ownership and control
Review the contracting parties and, where relevant, their beneficial owners, controllers, intermediaries and payment counterparties. A listed name is only one part of the analysis: applicable ownership and control rules may extend a restriction to an unlisted entity.
Resolve potential matches using reliable identifying details and current authoritative sources. Record the basis for clearing a match or stopping the engagement. Do not publish allegations about a counterparty from an unverified match.
Location, activity and end use
Restrictions can concern a destination, sector, technology, service, end user or end use, even when the direct counterparty is not listed. Assess equipment, software, technical assistance and proposed onward supply where relevant.
Do not restructure a transaction to conceal a restricted party, destination or use. Where an authorisation or licence is needed, confirm its validity and scope before acting.
Hold, clarify, decide
Pause the engagement while a material restriction or uncertainty is unresolved. Escalate to the responsible corporate decision-maker and obtain specialist advice when necessary. A commercial opportunity does not override a legal prohibition.
Record the date and sources of the review, the parties assessed, the conclusion and any conditions. A change in parties, control, destination or applicable measures may require reassessment.
Questions about a review
Use corporate enquiries to clarify a group-level verification request. For an existing service, contact the contracting operating business. Never send passwords or full identity documents through the public form.