From Sanctions Lists to Asset Freezes: Strengthening North Macedonia’s Financial Response to Terrorism

Targeted financial sanctions are among the most immediate tools available to governments seeking to disrupt terrorist financing. Unlike a criminal prosecution, which may require a lengthy investigation and proof beyond a reasonable doubt, a targeted asset freeze is intended to prevent designated individuals and entities from accessing funds or economic resources as soon as the applicable listing takes effect.

That speed creates both the value and the operational difficulty of the regime.

A country must translate an international designation into domestic legal effect, communicate the change to public authorities and regulated businesses, identify assets owned or controlled by the designated party, prevent further funds from being made available and manage any legitimate exemptions or mistaken matches.

In May 2023, the Organization for Security and Co-operation in Europe and the United Nations Office on Drugs and Crime completed a three-day course in Veles designed to strengthen North Macedonia’s ability to perform those functions.

The programme brought together 22 officials from nine national agencies involved in countering terrorist financing. It focused on the sanctions regime established under United Nations Security Council Resolution 1267, the procedures associated with designation and freezing, and the use of inter-agency cooperation to disrupt terrorist financial networks.

The training represented the final module in a progressive programme delivered jointly by the OSCE and UNODC since 2021. Its wider significance, however, lies in the implementation challenge that followed.

MONEYVAL’s 2023 evaluation found that North Macedonia had created a functioning legal and institutional foundation for targeted financial sanctions, including rapid notification of changes to United Nations lists. It also identified substantial gaps in the practical scope, consistency and understanding of the regime.

A June 2025 follow-up recognised improvements elsewhere in the country’s AML and counter-terrorist-financing framework. Recommendations covering terrorism-related and proliferation-related targeted financial sanctions were not submitted for re-rating and remained partially compliant.

The central lesson is therefore clear: targeted financial sanctions cannot be delivered through a list and a screening system alone. They require a coordinated national operating model capable of turning intelligence and designations into immediate, lawful and evidence-based financial disruption.

Listen the podcast

Watch the video

Why targeted financial sanctions matter now

Terrorist organisations need financial resources to recruit members, maintain communications, arrange travel, purchase equipment, support operatives and sustain their wider infrastructure.

The amounts involved may be small when compared with the proceeds generated by organised crime. A low-cost attack can be financed through ordinary income, personal savings, small donations or funds moved through family and community networks.

This makes terrorist financing difficult to detect using transaction value alone. The money may have a lawful origin and move through accounts that show no obvious connection to criminal activity.

Targeted financial sanctions approach the problem from another direction. Rather than waiting for a transaction to display suspicious characteristics, they prohibit dealings with specific individuals, entities and networks identified through an international or national designation process.

The objective is preventive. Assets must be frozen before they can be moved, converted, concealed or used.

This means the effectiveness of the regime depends heavily on timing. A delay of several hours may allow funds to leave an account, securities to be sold, property to be transferred or another party to take control of the asset.

What targeted financial sanctions actually require

An asset freeze is broader than blocking the balance of a bank account.

The United Nations regime requires states to freeze funds, financial assets and other economic resources belonging to or controlled by designated individuals and entities. It also prohibits funds and economic resources from being made available to them, directly or indirectly.

Economic resources can include property, vehicles, commodities, contractual rights and other assets capable of being used to obtain money, goods or services.

The obligation can extend beyond assets registered in the designated person’s name. A company may be owned or controlled through nominees, relatives, trusts, layered corporate structures or informal arrangements.

Institutions must therefore examine ownership and control rather than limiting their review to exact customer-name matches.

The freeze is also not a confiscation. Ownership does not automatically transfer to the state. The asset is immobilised so that it cannot be accessed or dealt with while the sanctions remain applicable.

This distinction affects record keeping, account administration, customer communication and the treatment of interest or other value generated by the frozen property.

The 1267 sanctions architecture

The United Nations Security Council established the original Resolution 1267 sanctions regime in 1999. It initially concerned the Taliban and later developed into a broader system targeting Al-Qaida, ISIL and associated individuals, groups and entities.

The framework now operates principally through the ISIL and Al-Qaida sanctions regime and a separate regime concerning the Taliban.

The applicable measures include an asset freeze, travel ban and arms embargo. The Security Council committee maintains the relevant list, considers new designation proposals, reviews existing entries and manages exemption and delisting procedures.

Changes to the international list must be implemented without delay.

This creates a significant operational requirement for national authorities. They need reliable processes for receiving list amendments, giving them legal effect, notifying obliged entities and confirming whether assets have been identified.

The regime also allows member states to submit listing proposals. Doing so requires public prosecutors, intelligence bodies, financial intelligence units, law-enforcement agencies and foreign ministries to assemble sufficient identifying and supporting information.

The 2023 OSCE–UNODC training addressed this complete process rather than treating sanctions as a narrow banking obligation.

Resolution 1373 and domestic designation

Resolution 1267 is based on names designated at United Nations level. Resolution 1373, adopted after the attacks of 11 September 2001, requires countries to maintain additional mechanisms for identifying and freezing the assets of people and organisations involved in terrorism.

This can include national designations and action taken in response to requests from other countries.

Domestic designation processes create different evidential and governance questions. Authorities must determine which body may propose a name, which decision-maker approves the designation and what standard of proof applies.

The process should not depend on a prior criminal conviction. Requiring a completed prosecution would undermine the preventive purpose of the measure and could give the subject time to move assets.

At the same time, designation cannot be arbitrary. Authorities require procedures for reviewing evidence, identifying the correct person, managing confidential intelligence and protecting the rights of affected parties.

A national regime must therefore combine speed with legal clarity.

What the 2023 training covered

The course in Veles involved officials from the Public Prosecutor’s Office for Combating Organized Crime and Corruption, Ministry of Internal Affairs, Customs Administration, Financial Police Office, Intelligence Agency and Ministry of Justice.

Participants also came from the Financial Intelligence Office, Agency for National Security and the National Coordinator’s Office for Countering Violent Extremism and Countering Terrorism.

This institutional mix reflects the reality of sanctions implementation.

The intelligence service may identify a threat. The financial intelligence unit may locate related transactions. Customs may detect cash or goods crossing the border. Police may investigate connected individuals, while prosecutors assess the available evidence.

The foreign ministry can be responsible for communications with United Nations bodies, and supervisory authorities must ensure that financial institutions and other obliged entities understand their responsibilities.

A representative of the United Nations Analytical Support and Sanctions Monitoring Team presented the international threat environment, the Monitoring Team’s role and a case study.

Exercises allowed participants to examine how designations could be used as a disruption tool and how information should move between agencies.

The programme’s five-module structure was important. Targeted financial sanctions cannot be mastered through a single presentation. Officials need repeated exercises covering identification, legal procedure, financial analysis, decision-making and operational response.

What MONEYVAL found in North Macedonia

MONEYVAL’s fifth-round evaluation, adopted shortly after the training, found that North Macedonia generally understood its terrorist-financing risks and had functioning inter-agency cooperation.

The country had achieved convictions involving two individuals for financing participation in a foreign army or paramilitary force. MONEYVAL nevertheless concluded that the level of terrorist-financing enforcement did not fully correspond with the country’s threat environment, including risks associated with foreign terrorist fighters and returnees from Syria.

The assessment found that changes to United Nations targeted-financial-sanctions lists received immediate legal effect. The Financial Intelligence Office maintained a consolidated list and used an automated mechanism to notify subscribed obliged entities of amendments.

Those were significant strengths.

However, no assets connected to targeted financial sanctions had been identified and frozen at the time of the evaluation. That outcome did not necessarily prove that designated assets were present in the country, but it limited the evidence that the regime was operating effectively.

MONEYVAL also found uneven understanding across sectors. Banks appeared better positioned to identify and freeze assets than smaller financial institutions and many designated non-financial businesses and professions.

Several obliged entities had been notified late about national designations under Resolution 1373. Supervisors did not always distinguish adequately between terrorism-related sanctions and proliferation-financing sanctions when testing compliance.

Legal deficiencies also affected who was expressly required to freeze assets, the scope of assets covered, the prevention of indirect access to funds and procedures governing delisting, unfreezing and third-party rights.

What changed by 2025

North Macedonia introduced legislative and institutional reforms after the 2023 evaluation. MONEYVAL’s first enhanced follow-up report, adopted in May 2025 and published the following month, upgraded the country’s technical compliance in several areas.

Rules concerning wire transfers, group-wide internal controls and transparency of legal arrangements moved from partially compliant to largely compliant.

Overall, 31 of the 40 FATF Recommendations were rated compliant or largely compliant, while nine remained partially compliant.

Recommendations 6 and 7—covering targeted financial sanctions related to terrorism and proliferation financing—remained partially compliant. North Macedonia did not request their reassessment during that follow-up cycle.

This point requires careful interpretation. A technical follow-up report does not assess whether the system has become more effective in practice, and the absence of a re-rating request does not establish that no operational improvements occurred.

It does show that the sanctions framework had not yet received formal recognition as having resolved the material technical deficiencies identified in 2023.

North Macedonia also remained in MONEYVAL’s enhanced follow-up process, requiring continued reporting on its reforms.

Why sanctions implementation fails operationally

The first point of failure is delayed list management.

Authorities and institutions may rely on manual emails, periodic downloads or overnight batch updates. Where the applicable legal requirement is to freeze without delay, a process that waits for the next business day may be inadequate.

The second failure is narrow name screening. A listed person may use aliases, alternative scripts, different dates of birth or transliterated versions of the same name.

The third is weak ownership analysis. A designated individual may control a company while holding no shares directly. An exact-name screening engine will not identify that exposure unless the institution has reliable beneficial ownership and control data.

The fourth is fragmented responsibilities. Compliance may identify a potential match, but operations, legal, customer service and senior management may not know who is authorised to restrict the account.

The fifth is overdependence on banks. Securities firms, insurers, money-service businesses, casinos, estate agents, lawyers and company-service providers can all encounter assets or transactions involving designated parties.

The sixth is inadequate supervision. Publishing guidance does not demonstrate that institutions can implement the rules. Supervisors need to test screening configuration, escalation records, ownership analysis and the speed of simulated freezes.

Screening is only the beginning

Sanctions screening should identify potential exposure, not make the final legal determination.

A possible match may arise because a customer shares a common name with a designated person. The institution must compare available identifiers, including date and place of birth, nationality, address, passport details, aliases and associated entities.

Automatically freezing every weak name match can cause serious harm to innocent customers. Automatically dismissing ambiguous matches can allow a designated party to retain access to funds.

The institution needs a documented triage process proportionate to the quality of the match and the urgency of the risk.

Ownership and control must also be assessed continuously. A company that was not sanctioned at onboarding may later become controlled by a listed person. A shareholder may transfer ownership to a relative while continuing to direct the business.

Transaction monitoring and adverse intelligence can reveal relationships that conventional customer screening misses.

What “without delay” means in practice

The phrase “without delay” is central to targeted financial sanctions.

It means the freeze should take effect sufficiently quickly to prevent the flight or dissipation of assets. It is not the same as processing the case within an institution’s normal investigation timetable.

A resilient institution should have an emergency workflow that operates outside standard business hours. The workflow should identify who may impose an immediate restriction, who confirms the match and which authority must be notified.

The institution should preserve the balance and transaction position at the time of the freeze. It must also prevent outgoing payments, withdrawals, asset transfers and other forms of disposal.

Incoming funds may need to be credited to the frozen account while remaining inaccessible, depending on the applicable regime.

Connected products must be considered together. Restricting a current account while leaving cards, investment portfolios, safe-deposit facilities or related company accounts operational can undermine the measure.

Exemptions, delisting and legal safeguards

Targeted financial sanctions are preventive but not unlimited.

United Nations regimes provide mechanisms for authorised access to funds required for basic expenses, legal services and certain extraordinary costs. Applications must follow the relevant national and international procedures.

There are also processes for removing individuals and entities that no longer meet the listing criteria. The ISIL and Al-Qaida regime includes an Ombudsperson mechanism intended to support fair and transparent delisting review.

Institutions need operational procedures for these safeguards. Frontline staff should not release funds informally because the customer describes an urgent need, but neither should legitimate exemption requests disappear into an internal escalation queue.

Rights belonging to innocent third parties must also be protected. Joint account holders, employees, suppliers and creditors may be affected by a freeze even though they are not designated.

Effective implementation requires legal precision rather than indiscriminate account closure.

The risk of inappropriate de-risking

Terrorist-financing controls can produce unintended consequences when institutions replace risk assessment with broad customer exclusion.

Non-profit organisations, diaspora communities, humanitarian operators and customers sending money to conflict-affected regions may face additional scrutiny because of the environments in which they operate.

Higher exposure can justify enhanced due diligence. It does not justify assuming that every transaction is connected to terrorism.

North Macedonia’s MONEYVAL assessment called for risk-based supervision of non-profit organisations exposed to possible terrorist-financing abuse without obstructing legitimate activity.

This balance is essential. Wholesale de-risking can push transactions into cash, informal transfer channels or unregulated service providers, reducing the visibility available to authorities.

The stronger approach is to understand the organisation’s governance, beneficiaries, delivery channels, geographic exposure and controls over partners.

The connection with proliferation financing

Although the 2023 course focused primarily on countering terrorist financing, MONEYVAL also assessed North Macedonia’s ability to implement targeted sanctions related to weapons proliferation.

The two regimes share core operational requirements: current lists, immediate legal effect, asset freezing, ownership analysis, inter-agency coordination and effective private-sector communication.

Proliferation-financing cases can be particularly complex because they may involve legitimate-looking trade, front companies, intermediaries, shipping networks and dual-use goods.

A transaction may not directly involve a designated name. The risk may emerge from control, end use, trade routes or a network of companies acting on behalf of a sanctioned programme.

Institutions should therefore avoid building separate, disconnected processes for every regime. A common sanctions infrastructure can support list management and escalation, while specialist analysis addresses the different legal tests and typologies.

What an evidence-led sanctions response looks like

The response begins with the designation or credible potential match.

Analysts should preserve the screening result, customer information, account balances, ownership records and recent transaction activity.

The institution must establish whether the customer is the listed person or whether an entity is owned or controlled by a designated party. This may require corporate records, intelligence, contractual arrangements and evidence of decision-making authority.

Connected customers and products should be identified. Transactions involving relatives, associates, employees or commonly controlled companies may indicate indirect access to funds.

The legal team should confirm the applicable measure, effective time, reporting obligation and available exemptions.

Where a match is rejected, the rationale and identifiers used should be recorded. Where it is confirmed, the institution should document the exact assets restricted and the notifications made to competent authorities.

The process must be reproducible. A regulator or investigator should be able to determine what the institution knew, when it knew it and what action followed.

What a resilient control stack looks like

The first layer is automated, authoritative list ingestion with clear evidence of when each amendment entered the institution’s screening environment.

The second is effective screening across customers, beneficial owners, directors, counterparties, payments and other relevant parties.

The third is ownership-and-control analysis capable of identifying exposure beyond the named listed party.

The fourth is a twenty-four-hour escalation process with predefined authority to impose immediate restrictions.

The fifth is coordinated asset discovery across deposits, payments, investments, insurance, property and connected legal entities.

The sixth is documented reporting to the financial intelligence unit, sanctions authority or other competent body.

The seventh is controlled management of exemptions, false positives, delisting and third-party claims.

The eighth is risk-based supervision and testing. Authorities should use realistic simulations to determine whether an institution can detect a new designation and freeze relevant assets without delay.

Finally, lessons from investigations, sanctions changes and supervisory findings should be incorporated into training, screening rules and national guidance.

What this means for financial crime leaders

The OSCE–UNODC course demonstrated the importance of bringing prosecutors, intelligence services, police, customs, financial investigators and policy authorities into the same operational framework.

The later MONEYVAL findings demonstrate why that cooperation must extend into the private sector and produce testable results.

Financial crime leaders should ask whether their institutions can identify indirect ownership, resolve ambiguous matches and restrict every connected product before funds can leave.

They should also understand that a sanctions alert is not equivalent to a suspicious-transaction alert. One may create an immediate legal prohibition, while the other initiates an investigation and possible regulatory report.

North Macedonia’s progress shows that technical reform is possible. Its continuing partially compliant ratings demonstrate that targeted financial sanctions remain one of the most demanding areas of AML, CFT and counter-proliferation-financing control.

Training creates knowledge, but operational readiness depends on law, technology, authority, communication and repeated testing.

The effectiveness of a sanctions regime is ultimately determined at the moment a new name appears, an asset is located and officials or institutions must act. A system that can make the correct decision immediately—while preserving evidence and protecting legitimate rights—turns an international designation into meaningful financial disruption.