Syria sanctions easing: business risk and compliance in a post-Assad landscape

The fall of the Assad regime in December 2024 has led to significant changes to international sanctions against Syria, sparking interest among businesses and investors who see opportunity in Syria’s reconstruction.

US President Donald Trump made a surprise announcement during his Middle East visit in May about restoring relations with Syria and lifting sanctions to give Syria “an opportunity for greatness”. The next month, an Executive Order was implemented by the US Treasury’s Office of Foreign Assets Control (OFAC), removing hundreds of individuals and entities from the List of Specially Designated Nationals and Blocked Persons (SDN list). The UK and EU have also taken significant steps to suspend, and in some cases lift, sanctions against Syria.

These are powerful signals to international companies, some of whom are rapidly making plans. Early movers include sectors supporting key infrastructure development such as energy, transport, port operations, logistics and telecommunications, and others are sure to follow.

A ‘green light’ for business in Syria?

Whilst the geopolitical moves appear to give a ‘green light’, the reality is more complex and nuanced. If anything, these recent changes should be seen as ‘an amber light’ at best, recognizing that a number of grey areas have been created. For companies entering the new Syrian market, careful assessment of risks and implementation of proactive mitigation measures, such as enhanced due diligence, will be necessary to avoid storing up future legal and compliance problems.

Although Syria has just begun its recovery, the region remains geopolitically volatile and sanctions targeting individuals and entities tied to the Assad regime, human rights abuses, terrorism, and narcotics trafficking remain very much alive. Those who continue to be sanctioned, and the persons connected to them, are likely to remain embedded in the economy of the country for some time to come, meaning that enforcement actions and related risks will persist for many years.

In addition, while the US, UK and EU have been moving in broadly the same direction and pace, it is not guaranteed that they will remain in lockstep going forward. Companies may find that a legal transaction in one jurisdiction remains prohibited in others. Such disparities create uncertainty and risk and typically lead to companies being forced to calibrate their compliance programmes to the most stringent set of regulations to avoid potential penalties. This divergence creates significant compliance complexity and an uneven playing field for international businesses.

What can companies do?

As companies look to take advantage of the ‘amber light’ and engage in Syria, there will be many actions that risk and compliance teams will be considering to ensure that risks are being appropriately managed. Each organization’s efforts will necessarily be different and fact specific. However, there are three thoughts we can offer on how risk mitigation plans might be directed and framed:

1. Clearly define your risk appetite

Entering (or re-entering) an environment that is fraught with risk demands a rigorous definition of red lines (i.e., prohibited activities) and legitimate opportunities, and these must be clearly understood by those dealing with them. It is therefore crucial for businesses to grasp the residual key regulatory risks associated with sanctions, export controls, AML/CTF, and bribery and corruption, and how to balance the pursuit of potential investment rewards with the prevention of unacceptable losses (e.g., breaching sanctions or anti-bribery regulations).  

In such a rapidly evolving and volatile regulatory landscape – where rules can differ across jurisdictions – it can be difficult to identify early warning signs of crossing a red line. Therefore, senior management and board members should focus on defining their risk appetite and ensure it is effectively communicated and truly understood by all personnel and relevant external stakeholders to embed appropriate risk-taking. In doing so, they should:

• ‍‍obtain input from relevant stakeholders, such as risk and compliance functions and heads of departments.
• review existing risk materials, including risk registers and risk assessments, to understand the risks facing the business that might hinder it from achieving its objectives.
• ensure that these risk materials are up-to-date and reflect current objectives and operational environment. If not, then the risk assessment should be updated before setting the risk appetite (see following section).
• draft a risk appetite statement that reflects the company’s current environment and commercial objectives, and clearly outlines (i) the maximum level of risk it can take, (ii) the level of risk it is willing to take, and (iii) any acceptable deviations from this target.

Throughout this process, it is important to consider and document how the decision on risk appetite has been reached and what steps will be taken to monitor and review the risk appetite to ensure it keeps up-to-date with any internal and / or external changes.

2. Act on a robust risk assessment

The previous ban on dealings with a Syrian nexus was straightforward. Now, the focus must shift to understanding how to mitigate engagement risk in a more nuanced environment.  

Gaining a clear understanding of new risks is crucial for ensuring that compliance programs accurately reflect the current landscape and that appropriate measures are in place. It is critical that the views and experiences of front-line personnel are taken into account (e.g. business growth / sales, channel / distributor management or procurement). The risk assessment should identify gaps that lead to:

• ‍‍designing or redesigning procedures and internal controls (especially those related to approvals and record-keeping, where enhanced controls should be considered),
• establishing an effective escalation process,
• ensuring adequate resourcing to handle an anticipated increase in escalations and manual reviews, and
• reassessing training and communication needs across all three lines of defence.

3. Enhanced due diligence

The complex, layered nature of risk, combined with overlapping enforcement priorities – such as those recently highlighted by the US DOJ – means that potential red flags might be several layers removed from direct identification through standard name screening. Consequently, all interactions with agents, distributors or any other third party must be underpinned by enhanced due diligence, supported by local intelligence where necessary. It is crucial to map beneficial ownership and identify any links to sanctioned entities, especially in sectors anticipated to see rapid engagement, such as oil & gas and construction. This proactive approach is essential for avoiding potentially significant penalties.

Move fast but move smart

New opportunities in a market with a lengthy list of needs may be enticing, but it is crucial not to let enthusiasm outrun robust controls. The bottom line is that the Syrian environment is better described as “transitional” than fully “post-sanctions”. This means businesses must navigate a landscape demanding more nuance and questions, where a comprehensive and dynamic risk mitigation strategy – encompassing updated risk appetites, enhanced due diligence and refreshed compliance programs – is vital.