Small businesses could face unexpected challenges due to Russian sanctions.

• This week, unprecedented sanctions against Russian businesses, banks, and individuals have intensified, increasing the likelihood that companies may violate U.S. Treasury Office of Foreign Assets Control regulations and export restrictions if they are not cautious.
• Small and medium-sized firms should also review their client and distribution lists, not just the largest multinational corporations.
• Although most on Main Street may not discover sanctions violations in their records, it is crucial to establish a basic sanctions compliance policy, which may involve some tedious procedures but need not be expensive.

The invasion of Ukraine by Russia has led to the departure of over 400 multinational corporations, as they face reputational risk and a range of sanctions imposed by the U.S. government, including a global financial systems blockade, making it challenging to operate in Russia. The list of sanctioned entities and individuals continues to grow.

Small businesses should not assume that being small and local is better than being big and global in the current economic climate. Instead, they need to take basic steps to investigate their own potential links to sanctioned Russian businesses and individuals to avoid the potential for an avoidable worst-case scenario.

INE, a mid-sized cybersecurity training firm, was caught off guard by sanctions and discovered potential violations by taking basic precautions. Its path to uncovering the issues was coincidental, as one of its founders is married to a former government official and Citigroup compliance executive. She mentioned the challenges of staying on top of sanctions for companies outside of Wall Street banks and the lack of support from the Treasury Department. INE then ran its client list against the U.S. Treasury sanctions database and discovered that it was doing business with sanctioned banking entities.

According to Scott Cederbaum, INE's chief marketing officer, two Russian businesses were sanctioned at the highest levels. He was shocked when he discovered this, as he did not expect to sell to Russian clients.

The discovery began on the Treasury’s Office of Foreign Assets Control website, but the results prompted questions that the firm couldn't fully answer from the government.

The IT training services provided by INE were abruptly terminated for two clients.

No one is talking about or thinking about a small business, according to Cederbaum.

Small businesses may not receive the same level of assistance from legal firms and Wall Street banks as their top-tier clients, despite having banking relationships. When CNBC reached out to PNC, JP Morgan, Wells Fargo, Bank of America, and Goldman Sachs, none of them responded or commented on the matter.

Silicon Valley Bank, a client of INE, advised its clients to contact their law firms, according to a spokeswoman.

The risk of a small business having ties to Russian entities on sanctions lists is low, but in a global digital economy where services are offered instantly through the internet and technology talent is sourced globally, the risk is present.

It is not the objective to instill fear on Main Street, and the risk of violating sanctions may be minimal, but it is better to investigate than assume a business is safe. As Cederbaum stated, "The specter is there. If you have any risk of Russian ties, at least perform due diligence."

Sanctions safety steps for small business

Experts suggest that taking preventative measures can be effective in avoiding harsh consequences for small businesses that violate sanctions. While the government may not excuse breaking the law based solely on business size, it may be more understanding of violations if the business can demonstrate that it took steps to investigate and had protocols in place to prevent violations. Documented efforts to comply, even if they were ultimately unsuccessful, can also be taken into account by the government.

First, download the searchable and downloadable sanctions lists from the Treasury OFAC website and then run the database against a client list.

Doreen Edelman, a partner and chair of Lowenstein Sandler's global trade and national security practice, stated that there is a significant difference between start-ups in technology and smaller companies in general when it comes to compliance. Typically, compliance is not a top priority for these companies, according to Edelman. However, she noted that this has changed, and now everyone is facing compliance issues.

The potential issues are not limited to OFAC sanctions, but also Commerce Department export controls that prohibit export or transfer of products to Russian entities on export lists, and can be interpreted broadly to include researchers or research institutions. Additionally, putting data on the web or in the cloud could be a violation based on who can access it. "And that's just general products," Edelman said.

If a product has an export classification number, such as a scientific measurement device, all products need a license in almost every category. Additionally, any Russian foreign nationals working for U.S. firms, such as at a software or machine development company, are considered an export to Russia. Therefore, sharing any technology with them can be deemed the same as sending it out of the U.S. "A Russian working for you living in the U.S. is an export to Russia," Edelman said.

Edelman advised businesses to screen every relationship they have with suppliers, customers, and partners, as it is a strict liability and doesn't matter if they didn't know they were dealing with Russian entities. Most small companies assume they are not sending anything out of the U.S., so they believe sanctions do not apply to them. However, this is a misconception, and businesses need to be vigilant in their screening processes.

Technology industry risk

While physical product chains may be easier to monitor, software companies must take precautions to ensure that no restricted parties are accessing their websites. Russia has a large population of technology professionals in Moscow and St. Petersburg, with expertise in areas such as graphic design, web development, and marketing.

Cederbaum stated that companies selling goods and services into Russia are not considering it, as there are only a few customers in the country.

The Treasury Department has found that having any associated entity as a client is a violation of its sections, and the largest banks in Russia, which are sanctioned, have many subsidiaries operating across various business types, including web development and cyber products.

Cederbaum stated that the current situation represents uncharted territory in terms of OFAC sections and digital connections with countries, particularly with Russia.

Edelman advised that in addition to screening client lists against government sanctions databases, geolocation blocks on web platforms can prevent restricted parties in certain areas from accessing online services. According to Edelman, payment received for services is not the only restriction on doing business with certain clients. Providing access to software on a website is sufficient.

All companies in the financial services, fintech, computer services, and IT sectors, as well as software development firms, engage in outsourcing relationships. Eastern Europe has emerged as a preferred destination for tech outsourcing, increasing the likelihood of encountering a Russian investor or parent company.

Andrew Sherman, a business law specialist at Seyfarth Shaw, stated that it is unlikely to be the local flower shop.

The problems faced by the tech industry range from the top-tier companies in Silicon Valley to the smallest start-ups.

Edelman advised looking at distributors, consultants, programmers, and engineers overseas for start-up tech companies. Investors often ask about the ownership of Cayman Islands companies, especially if they are Russian sovereign wealth funds. It is surprising how many foreign funds with Russian investors, investing entities in places like Singapore, or Russian investors directly are in U.S. entities. To do business with them, it is necessary to pierce the veil a few levels.

Treasury has made it easier to identify violations

Recently, the government has simplified the process of conducting due diligence on companies by allowing them to access OFAC's website for screening sanctioned entities. However, the process can still be challenging due to the additional lists from the Treasury, Commerce, and Postal Service.

Edelman stated that there are numerous lists, including those sanctioned by the US, UK, and EU, that involve businesses operating in those markets. For instance, software commonly used today may need to screen against a total of 60 lists. However, she advised starting with a screen of a company's relationships against the consolidated OFAC list, which also includes Customs and Commerce data.

Experts advise that even if a company unintentionally violates global trade regulations, it is crucial to have a compliance program in place. Companies that demonstrate a policy and conduct regular screenings may be less likely to face severe penalties. Edelman emphasized that these sanctions serve as a reason to establish a compliance program. For firms that have a policy but have not actively managed it, a three-year gap in screenings may not be sufficient to convince OFAC of their compliance efforts.

Edelman emphasized that the number of violations is based on each transaction, regardless of the size of the business or self-disclosure. He stated that if a firm commits a violation that costs $1 each time, one thousand times, it is still considered a thousand violations. Edelman advised companies to make disclosures and show they are trying to be compliant, as this can lead to a notification letter instead of a fine. However, he cautioned against having a problem in the first place.

It is advisable for firms operating in Europe to examine their business relationships against sanctions lists, according to Sherman.

Sherman advised asking questions if you're developing software, shipping monthly, and making wire transfers to Eastern bloc countries or former members of the USSR.

It would be ironic for small firms to unintentionally find themselves on the wrong side of the U.S. government due to the current situation.

Small to medium-sized businesses in Russia may not have significant interest or holders, but they want to be seen as standing with Ukraine. Entrepreneurs relate to the Davids in this David and Goliath story. While the chance of compliance is low, at around 1% to 2%, making an effort will go a long way. It is not like 20 years ago, and with a few Google searches and emails, businesses can pack in a compliance file and be prepared for any questions.

Edelman stated that the process need not be expensive and that taking simple steps, such as preparing a sanctions compliance policy document, can demonstrate that a business is aware of the risk and has taken basic measures.

Cederbaum stated that every business in the county must make an effort to comply, regardless of the likelihood of success. It is better to err on the side of caution. Our company, which has two clients out of 150,000 individuals and businesses working with us, could have easily violated sanctions.

Click here to learn more and sign up for CNBC's Small Business Playbook event.