Because the legal obligation is not to engage in commerce with a sanctioned person.This is a fantastic point.
Apple has several requirements before you can publish an App. One of them is getting a DUNS number for your business.
So why isn’t the government going after Dun & Bradstreet? Shouldn’t they be checking to see if the entity requesting a number is sanctioned?
I’m betting that once a company has a valid DUNS number then Apple goes on to the usual vetting process (like Apps not abiding by App Store rules) and spends less time checking if a company is sanctioned.
Apple needs to double-check companies, but I think D&B bears primarily responsibility for issuing a DUNS to a sanctioned company.
Also, D&B may be at risk to Apple and other companies if they were the sanctions search vendor and failed in their vetting. This is as it should be: Best results are achieved if companies are responsible for their own sanctions compliance and then can assert secondary contract actions against vendors that fail to perform.