New Secondary Sanctions Liabilities Under the 2026 Russia-Iran Bill

S.5025 is not just another bank-sanctions story. In the Senate-passed framework now moving through an unsettled House path, the practical change is that secondary-sanctions risk branches into at least four operational lanes: shadow-fleet logistics and insurance, financial messaging systems, U.S. depository and broker-dealer processing, and professional-services or other gatekeeper exposure. The House could still pass the bill under suspension, amend it, or run into a veto fight after President Trump reportedly demanded additional Iran tariff language on July 29, 2026.[1] The enrolled S.5025 text also was not directly retrieved from Congress.gov for this analysis, so the section references here rely on the cited bill analysis and secondary reporting. That uncertainty matters. It does not make the controls irrelevant.

This article is a compliance-risk map, not legal advice. The point is to identify the hinge between each statutory mechanism and the red flags a screening program can test before final enactment. For the broader compliance implications of the Graham Russia sanctions bill, see How the Graham Russia Sanctions Bill Changes Compliance Risk. The narrower question here is where a non-bank employee, outside counsel, underwriter, freight forwarder, vessel agent, or payments operator could approve something that used to look adjacent to sanctions risk and now may sit inside it.

The Four Mechanisms Compliance Teams Should Map First

The table deliberately separates mechanisms that are often collapsed into the phrase "secondary sanctions." A vessel trigger is not the same as a payment-message trigger. A flat U.S. processing prohibition is not the same as a case-by-case sanctions exposure for a non-U.S. facilitator. A useful compliance memo should preserve those distinctions, because each one sends the reviewer to different data: IMO numbers, insurance certificates, payment-message fields, broker-dealer settlement instructions, or engagement-letter facts.

Shadow-Fleet Risk Is Where the Perimeter Widens Fastest

The shadow-fleet provisions deserve the longest look because they connect four things that often sit in different parts of a company: vessel screening, sanctions-list monitoring, insurance verification, and port-state documentation. Section 102(c), as described by FDD Action, treats designations by the UK, EU, G7, or any Five Eyes member as prima facie evidence that a vessel belongs to Russia's shadow fleet.[2] That is not a small drafting choice. It means the U.S. sanctions analysis may begin with an allied designation rather than waiting for a separate U.S. listing.

For a logistics or insurance team, the screening implication is concrete. A vessel can no longer be cleared only against U.S. sanctions lists and a current customer file. The review should capture allied designations, vessel identifiers, recent ownership or management changes, flag changes, routing behavior, and the documents used to prove coverage. If the bill is enacted in materially similar form, a UK or EU designation may become more than a foreign-policy signal; it may be the evidentiary starting point for U.S. secondary-sanctions action.

The Atlantic Council's early-July 2026 figure of 137 million barrels of Russian crude floating in storage explains why the enforcement pressure naturally migrates from the seller to the transport chain.[3] Floating storage requires vessels, crewing, management, insurance, cargo documentation, port services, and often multiple layers of brokering. The compliance risk is not limited to the party buying crude. It reaches the service provider that treats the transaction as a marine-service file instead of a sanctions file.

The bill analysis also describes incorporation of the Shadow Fleet Sanctions Act architecture, including vessel identification, insurance verification, and port-state controls.[2] Those are not decorative compliance concepts. They identify where the evidence will be found. If a vessel is suspected of moving Russian oil outside permitted channels, investigators will not only ask whether the charterer knew the seller. They will ask who insured the voyage, who accepted the certificate, who handled port entry, who supplied bunkers, who reviewed the bill of lading, and who ignored an allied designation that was already public.

What to Add to Vessel and Insurance Screening

• Screen vessel name and IMO number against U.S. lists and relevant allied designations, not only the current customer name.
• Capture beneficial owner, commercial manager, technical manager, charterer, and insurer as separate fields rather than treating the vessel as a single counterparty.
• Escalate recent flag changes, ownership transfers, management substitutions, AIS gaps, or routing patterns inconsistent with the stated voyage.
• Verify insurance certificates against the named insurer or P&I club where feasible, especially when documentation is supplied through brokers or intermediaries.
• Keep the evidence trail: the list checked, date checked, vessel identifier used, documents reviewed, and assumption made if the final statutory text is still pending.

The final point is not administrative neatness. If Section 102(c)'s allied-designation logic survives, a reviewer who cannot show which lists were checked will have a difficult time explaining why a vessel was treated as clean. The burden may not formally shift in every scenario, but the file will either show a disciplined threshold analysis or it will show a clearance built around absence of a U.S. hit.

Financial Messaging Is a Separate Exposure Point

Section 110 matters because it addresses international financial messaging systems that provide services to sanctioned Russian financial institutions.[2] That is a different pressure point from classic correspondent-account restrictions. The relevant question is not only whether a bank processed funds. It is whether a messaging infrastructure enabled sanctioned Russian financial institutions to communicate payment instructions, settlement details, or transaction data through an alternative rail.

For banks and payment operations teams, the practical control is to stop treating message routing as background plumbing. Payment-message fields, intermediary institution references, beneficiary-bank identifiers, and free-text payment purposes may reveal exposure even when the visible customer is not Russian. A fintech or treasury team using a non-U.S. messaging provider should know whether that provider services sanctioned Russian financial institutions and whether the provider's own controls can produce auditable evidence.

This is also where outside counsel and consultants can create a bad file quickly. A narrow answer to "Is the customer sanctioned?" may miss the actual Section 110 issue. The better intake question is: what messaging system, bank chain, and payment instructions are required for the transaction to occur, and do any of those nodes serve sanctioned Russian financial institutions?

Section 105 Leaves Less Room for Materiality Arguments

Section 105 is narrower in actor coverage but sharper in consequence. FDD Action describes it as a flat prohibition on any U.S. depository institution or registered broker-dealer processing transfers to or from the Russian government, with no de minimis exception.[2] The covered actors are familiar. The operational risk is the false comfort of low value, routine processing, or a transaction type that does not look like trade finance.

A no-de-minimis rule changes review habits. Small transfers, refunds, fees, securities proceeds, custody-related payments, and settlement instructions need the same Russian-government screen as larger transactions. Broker-dealers should be especially careful with settlement and custody workflows where the sanctions review may be less visible than in a wire-transfer queue. A transfer can be operationally minor and legally prohibited at the same time.

Why Non-Bank Gatekeepers Should Not Wait for Final Text

The case for preparation does not rest only on S.5025. OFAC's recent enforcement posture already points toward non-bank gatekeepers. A Paul Weiss analysis published by Corporate Compliance Insights counted 14 public OFAC enforcement actions in 2025 totaling $266 million and described an enforcement focus that includes private equity, real estate, and attorneys.[4] That data point should be handled carefully: it is a practitioner analysis, not an OFAC statistical release. But it is still useful because it names the kinds of actors that often consider themselves adjacent to sanctions decisions rather than central to them.

Private equity exposure may appear in portfolio-company oversight, acquisition diligence, exit planning, and management-service arrangements. Real estate exposure may appear through beneficial ownership, financing, lease payments, or asset transfers. Attorney exposure may appear through entity formation, transaction structuring, settlement drafting, escrow arrangements, diligence memoranda, or advice that isolates the legal work from the movement of funds, goods, or vessels. None of those examples requires treating lawyers or investors as banks. They require recognizing that sanctions enforcement often follows the person who made the transaction possible.

The same logic applies to insurers and logistics intermediaries. An underwriter renewing marine coverage, a broker arranging cargo movement, or a consultant coordinating documentation may not touch the payment. But if the statutory trigger is shadow-fleet facilitation, insurance verification, port-state control, or service to a sanctioned financial institution through messaging infrastructure, the absence of a bank role is not a complete answer.

For readers comparing this to OFAC risk in ransomware payments, the common lesson is not that every sanctions problem is the same. It is that OFAC can focus on facilitation, process failures, and gatekeeper blind spots even when the underlying business team frames the matter as urgent operations. See Ransomware Negotiation Triggers Four Distinct Legal Liabilities for that enforcement posture in a different setting.

Professional-Services Intake Should Ask Operational Questions

A sanctions intake form that asks only for client name, jurisdiction, and beneficial owner is not enough for this bill's risk profile. The professional adviser needs to know what the engagement will enable. Will a vessel be chartered, insured, classified, sold, renamed, or reflagged? Will payment instructions run through a non-U.S. messaging system? Will a U.S. broker-dealer or depository institution process any transfer to or from a Russian-government counterparty? Will the work product help a client document compliance with a price-cap or allied-sanctions regime?

The engagement file should also separate legal conclusions from factual assumptions. If counsel clears a matter because no U.S.-designated person appears, but the vessel has an EU designation or the insurer cannot be verified, the file should say that. If the advice assumes the Senate-passed text rather than enacted law, the file should say that too. Conditional advice is defensible when it is candid about its conditions.

Waivers and Jurisdictional Conflict Do Not Remove the Need to Screen

Section 115(b), as summarized by FDD Action, permits case-by-case relief through a waiver process that requires a written national-interest certification to six congressional committees.[2] That is useful for understanding the safety valve, but it should not be mistaken for an operational control. A waiver process that creates a written record is transparent, reviewable, and politically visible. It is not a reason for a private company to approve a transaction first and sort out the legal theory later.

The same caution applies to expected jurisdictional conflict. A Senate committee's reported movement toward protecting U.S. companies from foreign judgment enforcement tied to sanctions compliance signals that Congress expects collisions between U.S. sanctions duties and foreign legal consequences. On the present record, that point should be treated as contextual rather than as a documented holding. In practice, it means compliance files should record not only the U.S. sanctions basis for a decision but also the foreign-law conflict assumptions sent to counsel.

A Working Control Map for Q3 2026

The useful near-term exercise is not to predict the final House vote. It is to test whether the business can identify the data needed for each likely trigger. If the enacted bill changes section numbers, a good control map can be updated. If the company never collected the vessel, insurer, messaging, or Russian-government counterparty data in the first place, there is little to update.

• Logistics teams should map vessel identifiers, ownership, management, flag, routing, cargo, port calls, and allied-designation status before approving services.
• Insurance teams should verify marine coverage documents, named assureds, brokers, vessels, voyage details, and any price-cap or shadow-fleet representations.
• Financial institutions and fintechs should identify payment-message systems, intermediary banks, sanctioned Russian financial institution exposure, and Russian-government transfer risk.
• Broker-dealers should apply Russian-government screening to settlement, custody, proceeds, refunds, and other transfers regardless of value.
• Law firms and other advisers should add operational questions to intake, preserve assumptions, and require escalation when the work product enables transport, insurance, payments, ownership changes, or sanctions documentation.

S.5025 may still change procedurally, and section-by-section mapping should be checked against any enacted text. The Senate-passed framework already points to the controls non-bank firms should test now: vessel and counterparty screening, insurance documentation, payment-message exposure, U.S. depository and broker-dealer transfer rules, and professional-services intake. Prepare the screens, document the assumptions, and update the map if Congress changes the final mechanism.

References

1. Revised Russia Sanctions Bill Gains Senate Supermajority, but House Path Remains Unsettled — Washington Trade & Tariff Letter
2. Myths vs. Facts on the Sanctioning Russia Act of 2026 — FDD Action — July 27, 2026
3. What the latest US sanctions bill means for Russia—and for China, India, and Iran — Atlantic Council
4. The State of OFAC Sanctions Enforcement in 2025-26 — Corporate Compliance Insights / Paul Weiss