Due to Russia’s invasion of Ukraine, over 400 multinational corporations have left Russia. It’s not only reputational risk at stake, but a complex web of sanctions imposed by the U.S. government as well as a global financial systems blockade that makes operating in Russia difficult, if not impossible — and the list of sanctioned entities and individuals keeps getting longer.

Main Street might feel a relief as the largest businesses in the economy protect their brand and operate. This would be an error. This risk could be an exception for Main Street businesses, however experts warn that small businesses should take simple steps to verify their links with sanctioned Russian individuals and businesses. Otherwise, they may face a worst-case scenario.

As an example, take cybersecurity training provider INE. This is a small business, so it didn’t expect to be in trouble with the sanctions. However, it took a few precautions after sanctions began to hit and was able to identify potential violations that it may have missed. Its path to identifying the problems was not a smooth one. Its founder is married to an ex-government official, Citigroup compliance executive. She mentioned that it was difficult for Wall Street banks and other companies to keep up with all the sanctions and the support of the Treasury Department won’t filter through to the rest of the economy. This insight led INE and Citigroup to compile a client list that was compared to the U.S. Treasury Sanctions Database. INE found it did business with sanctioned banks.

Scott Cederbaum (INE’s chief market officer), said that he found two Russian companies sanctioned at high levels. His wife is a Citi executive. He said, “We were stunned when we discovered it.” It would never have occurred to us to sell to Russian clients.

Treasury Office of Foreign Assets Control websiteThis was the beginning point of the discovery. However, the results led the company to ask questions about the government that they couldn’t provide sufficient answers.

INE was forced to cut all ties immediately with two of its clients who had received IT training services.

Small business owners don’t see the value in visibility and no one is talking about it. Cederbaum explained that she has talked with many people, and they all agree it is not being thought about.

Although Wall Street banks and legal firms work closely with top-tier clients of the bank, smaller businesses may not be able to get as much assistance even though they do have relationships with them. CNBC reached PNC and JP Morgan as well as Wells Fargo, Bank of America, Bank of America (and Goldman Sachs), but they all refused to respond or did not return phone calls.

Silicon Valley Bank is a bank that INE collaborates with. Cederbaum stated that the Bank has been very helpful. A spokeswoman for the Bank said it was advising its clients to get in touch with their legal firms.

Although the likelihood of small businesses having connections to Russian entities that are on sanction lists is low, it is possible for them to be connected in an international digital economy, where they can offer services instantly through the internet.

Although Main Street shouldn’t be afraid, it is not the ultimate goal. The risk of violating sanctions is small but it is better to look into the matter than assume that the company is in good standing. Cederbaum explained that the “specter” exists. Cederbaum stated, “If there is a risk to your business you need to be aware of it.” He advised that any small business dealings with Russia should be done properly. 

Accessing the website is the first thing. sanctions listsThey can be downloaded from the Treasury OFAC Website and searchable.

Doreen Edelman, partner and chair of Lowenstein Sandler’s global trade and national security practice, said there is a big gap between start-ups in technology and smaller companies in general when it comes to compliance. Edelman explained that “it isn’t on their top 10” list. Everybody has a problem now.

There are potential problems beyond OFAC sanctions. Commerce Department export controls, which prohibit export and transfer of goods to Russian entities that appear on the Export Lists, can also cause issues. They may be applied to research or institutions as well. And it doesn’t need to be a physical product — putting data on the web or in the cloud could be a violation based on who can access it. Edelman stated that this is only for general products.

Edelman stated that all items must have an export number. For example, a scientific measuring device. Edelman also said that there is a possibility of the government denying licenses. This includes Russians who work for American companies, such as a machine or software development company. In this case, sharing technology can be considered the same thing as exporting it from the U.S. Edelman stated that a Russian living and working in America is an export to Russia.

Most small businesses will believe that they don’t send anything to the U.S., so sanctions won’t be applied. Companies need to ensure that they screen all relationships, as even U.S.-based companies could have Russian connections. “You are supposed to be screening absolutely everyone you do business with — suppliers, customers and partners. Edelman stated that this is a very strict responsibility and doesn’t really matter if it’s not known. 

All are part of outsourcing partnerships, including financial and fintech firms as well computer services and IT businesses and software development agencies. Eastern Europe has become a popular place for tech outsourcingThere is also a better chance that a Russian investor will be involved or have a parent company.

Andrew Sherman, who is a Seyfarth Shaw partner and specializes in business legal advice, said that “it won’t” be your local florist. 

This can include a company that is partially owned by Russian oligarchs and Russian entities that have operations in foreign countries, which a U.S.-based firm would not be able to see. It is called the issues for the tech sector run to the highest levels of Silicon ValleyBut also for the individual start-ups.

Edelman stated, “You should look overseas for distributors, engineers, programmers, and consultants.” We’re hearing from investors in start-up technology companies that ‘it’s a Cayman Islands business, but who is it owned? If it turns out to be a Russian sovereign wealth fund,  you can’t do business with them,” she said. She said, “It is shocking to everyone that either foreign funds have Russian investors in them or investing entities in countries like Singapore. Or Russian investors are directly in U.S entities.  

Click to find out more information and sign up at CNBC’s Small Business Playbook. here.