CGSS Questions and Answers

Sanctions and Compliance Domains outline that references to sanctioned ports, locations, or shipping routes in payment instructions require further investigation. Even when the transaction parties are not located in a sanctioned jurisdiction, involvement of a sanctioned port or movement of prohibited goods can trigger sanctions exposure.

The correct approach is to obtain supporting documents such as shipping documents, invoices, bills of lading, and routing information to confirm whether the shipment, goods, transport path, or third parties have any sanctioned involvement. Approving or rejecting a payment without verification contradicts sanctions screening standards.

References from Sanctions and Compliance Domains:

Requirements to investigate references to sanctioned locations in trade or payment messages.

Guidance on obtaining underlying documents to assess sanctions exposure.

Expectations for verifying goods, ports, and shipment paths.

EU Restrictive Measures apply to all persons and entities within the territory of the EU, including airspace and territorial waters, and to any vessel or aircraft under the jurisdiction of an EU Member State. This establishes that sanctions obligations extend to vessels registered under EU jurisdictions regardless of location.

EU sanctions also apply to all legal persons, entities, and bodies incorporated or constituted under the law of an EU Member State, even when those entities operate entirely outside EU territory. Legal incorporation under EU law creates an ongoing obligation to comply with EU sanctions.

EU ownership by itself does not trigger sanctions applicability, so a non-EU company that is 45% owned by an EU national does not fall under EU Restrictive Measures. Additionally, arrangements such as double-taxation conventions or participation in customs union agreements do not extend the territorial or legal applicability of EU sanctions to non-EU jurisdictions.

References from Sanctions and Compliance Domains:

Territorial applicability of EU sanctions, including vessels and aircraft under Member State jurisdiction.

Applicability to companies incorporated under EU Member State law regardless of geographic operations.

Legal and territorial definitions outlining the scope of EU Restrictive Measures.

OFAC’s 50 Percent Rule requires aggregation of ownership by SDNs and entities owned 50% or more by SDNs.

Ownership breakdown:

• Entity X (SDN) → 30%

• Entity Y (owned 80% by an SDN) → treated as an SDN → contributes 25%

• Total SDN-derived ownership = 30% + 25% = 55%

Since aggregate SDN ownership exceeds 50%, ABC Industries is automatically considered a blocked entity, even though Entity Z is not sanctioned.

Options B and C are incorrect because explicit listing is not required—ownership triggers blocking. Option A is incorrect because one SDN at 30% alone is insufficient, but combined ownership is.

Sanctions and Compliance Domains state that independent testing and auditing must be conducted by a group separate from the sanctions operations and screening management teams. Internal audit is typically the independent function with sufficient technology and control expertise to assess system performance, threshold calibration, governance, and rule sets.

Teams involved in day-to-day operations (investigations, list management, risk assessment) cannot test their own work due to conflicts of interest.

US AML requirements (such as the Customer Due Diligence Rule) define a beneficial owner as an individual who owns 25% or more of a legal entity. OFAC, however, applies the 50% Rule for sanctions due diligence: an entity is considered owned by a sanctioned person if the designated person holds, individually or collectively, 50% or more of the entity.

The AML 25% standard is not used for determining whether an entity is treated as sanctioned; instead, OFAC’s ownership threshold is fixed at 50%. The correct distinction is the difference between AML’s 25% threshold and OFAC’s 50% Rule.

References from Sanctions and Compliance Domains:

Beneficial ownership thresholds under US AML customer due diligence rules.

OFAC’s 50% Rule for sanctions ownership determinations.

Under the OFAC 50% Rule, an entity must be treated as a Specially Designated National (SDN) — even if not named on the SDN List — when:

One SDN owns 50% or more of the entity, OR

Multiple SDNs collectively own 50% or more of the entity (ownership must be aggregated).

Applying this rule:

A: 98% ownership by a single SDN → Blocked (exceeds 50%).

B: 35% + 15% = 50% aggregate ownership by two SDNs → Blocked (meets 50%).

C: 20% + 25% = 45%, which does not meet the threshold → Not blocked.

D: 12% + 18% + 28% = 58% aggregate ownership by SDNs → Blocked (exceeds 50%).

E: 45% + 3% = 48%, which is below 50% → Not blocked.

F: 10 SDNs × 4% = 40%, which is below 50% → Not blocked.

Thus, only A, B, and D meet or exceed the 50% aggregate ownership requirement defined by OFAC.

Sanctions and Compliance Domains state that screening must be applied to all relevant business activities and relationships that can expose an organization to sanctions risk. This includes customers, vendors, intermediaries, distributors, beneficial owners, and any party involved in transactions, supply chains, or service delivery.

Limiting screening only to customers is inconsistent with sanctions compliance expectations. Excluding vendors, intermediaries, or beneficial owners can expose an organization to significant sanctions violations due to indirect dealings with sanctioned parties. Comprehensive coverage of all business activities is the standard approach in an effective sanctions compliance program.

References from Sanctions and Compliance Domains:

Requirements for comprehensive sanctions screening across all relevant business relationships.

Inclusion of customers, intermediaries, vendors, distributors, and beneficial owners.

Risk-based approach requiring full coverage of business activities to prevent indirect sanctions exposure.

Under OFAC’s 50 Percent Rule, any entity owned 50% or more by one or more SDNs is considered automatically blocked, even if it is not explicitly listed. The jurisdiction of incorporation (e.g., tax haven) does not exempt the entity from OFAC sanctions.

Because the SDN owns the company, the entity is also subject to OFAC prohibitions and cannot transact through the US financial system, including any USD-clearing banks, whether located inside or outside the United States.

Options B, C, and D are incorrect because OFAC sanctions apply regardless of where the company is registered and because USD transactions create a US nexus.

Digital currency providers pose a heightened sanctions risk due to:

• exposure to anonymity-enhancing technologies,

• increased risk of being used for sanctions evasion and illicit finance,

• difficulty tracing the ultimate beneficial owner or origin of funds, and

• vulnerabilities related to mixers, unhosted wallets, and cross-border platforms.

Pharmacies and retail companies generally present lower sanctions risk. Aircraft maintenance companies can pose some risk depending on jurisdictions served, but digital currency firms are consistently recognized as the highest-risk sector for sanctions exposure.

Sanctions and Compliance Domains describe disabling or manipulating the Automatic Identification System (AIS) as a primary deceptive shipping practice used to obscure vessel movements, hide calls at sanctioned ports, and evade detection.

Transshipment may create risk but is not inherently deceptive. Refueling at a prohibited port may violate sanctions but is not a deceptive practice by itself. Chartering a vessel to a single client is a normal commercial arrangement. AIS disabling is a recognized evasion tactic highlighted in global maritime advisories.

EU sanctions apply to:

• All EU nationals,

• All persons within the territory of the EU, including foreign nationals residing or operating within the EU,

• All EU legal entities, regardless of where they operate, and

• Any business conducted within the EU or using EU jurisdictional touchpoints.

EU sanctions do not have general extraterritorial effect. Unlike US sanctions (which can apply based on currency, goods origin, or facilitation), EU sanctions apply within EU territory, including airspace, and to EU persons globally.

EU sanctions do not automatically have a broader scope than US sanctions; in many cases, US sanctions have the broader reach.

Sanctions and Compliance Domains provide that a financial institution must not execute a transaction when significant unresolved discrepancies exist, especially in high-risk transshipment regions. When:

• documentation does not match payment details, and

• the customer refuses to provide required information,

the institution cannot proceed. Without clarity, the transaction may involve diversion, routed shipments, or indirect dealings with sanctioned entities.

Rejection is appropriate because blocking only applies when a confirmed sanctions match exists. Reprimanding customers, forcing subpoenas, or engaging mutual legal assistance procedures are not required or appropriate steps in sanctions transaction handling.

References from Sanctions and Compliance Domains:

Requirements to reject a transaction when discrepancies cannot be resolved.

Need for customer cooperation in sanctions investigations.

Standards for handling high-risk transshipment-related alerts.

Sanctions and Compliance Domains explain that fuzzy logic screening includes phonetic algorithms (e.g., Soundex, Metaphone) to identify variations in the spelling or pronunciation of names. This allows a screening tool to detect near matches and transliteration differences that would not match under exact-match logic.

Inequality lists, big data, and whitelists are not fuzzy matching algorithms. Whitelists are used for reducing false positives, not matching logic.

Sanctions and Compliance Domains state that screening calibration must be tied directly to a financial institution’s sanctions risk assessment, which evaluates products, customer base, geography, delivery channels, and transaction volume. Sensitivity adjustments must be justified by an institution’s assessed sanctions exposure.

Staff levels or training do not determine screening thresholds; these are operational considerations. Management commitment supports governance but does not form the technical basis for calibration decisions.

UN sanctions require agreement among multiple countries, making them more difficult to enact than unilateral national sanctions. The UN Security Council must reach consensus, and all five permanent members must avoid using their veto power. Any negative vote by a permanent member blocks the resolution entirely.

This requirement for global political alignment is the primary barrier to rapid sanctions adoption. UN sanctions are neither autonomous nor inherently ineffective, and they do not exist to intervene in domestic affairs but to protect international peace and security under Chapter VII of the UN Charter.

Sanctions and Compliance Domains state that NGOs are not exempt from sanctions laws. Even humanitarian organizations must ensure that they do not transact through designated banks, sanctioned parties, or sanctioned jurisdictions unless authorized through applicable exemptions or licenses.

Furthermore, NGOs can be indirectly affected by sanctions when engaging in international work, especially when the banking sector of a target region is designated. Therefore, they may continue operating, but must fully consider sanctions exposure, including the involvement of designated banks.

Statements that NGOs are automatically exempt are factually incorrect. Compliance depends on the sanctions program, jurisdiction, and licensing conditions.

A comprehensive sanctions framework requires well-designed operational controls, including thorough training for staff responsible for alert review and sanctions decision-making. Sanctions and Compliance Domains specify that personnel involved in alert clearing must receive appropriate training to ensure awareness of regulatory expectations, sanctions typologies, and escalation procedures.

Additionally, the framework must include robust screening controls supported by documented strategy, governance, list-management processes, alert management rules, and ongoing testing. These elements form core requirements of sanctions compliance programs.

Management information reports are restricted to need-to-know distribution, and reliance on “best-efforts” is not compliant. Institutions must implement structured, risk-based controls, not minimal-effort approaches.

Enhanced due diligence is required when trade transactions involve jurisdictions near sanctioned countries due to the increased risk of transshipment, diversion, and sanctions evasion.

Sanctions and Compliance Domains highlight two core focus areas:

• verifying the identities and ultimate beneficial owners of all involved parties, and

• validating the shipment details, including routing, goods description, and movement patterns.

These elements are critical where geographic proximity raises sanctions exposure. While reviewing commercial terms and pricing may be part of general trade finance due diligence, the primary sanctions-specific EDD requirements focus on beneficial ownership and shipment details.

References from Sanctions and Compliance Domains:

Enhanced due diligence expectations for trade involving high-risk regions.

Requirements to verify UBOs to detect potential sanctioned ownership.

Importance of shipment route verification to detect diversion to sanctioned jurisdictions.

UN sanctions are imposed by the UN Security Council as part of its mandate to maintain international peace and security. They are intended to influence behavior, prevent conflict, suppress terrorism, and stabilize global security conditions.

While asset freezes and travel bans are common measures (option D), they are examples, not the fundamental reason for imposing sanctions. Option C describes the overarching purpose.

OFAC has designated:

• Hackers and cyber actors involved in cryptocurrency theft.

• Cryptocurrency exchanges facilitating illicit transactions or supporting sanctioned jurisdictions.

• Mixers (tumblers) known to anonymize blockchain transactions and facilitate laundering and sanctions evasion.

Software developers (D) are generally not designated unless directly linked to illicit activity. Credit unions and central banks are not typical OFAC digital-asset designations.

Essential elements of a sanctions compliance program include:

• Senior management commitment,

• Testing and auditing, and

• Training.

These elements are identified as core pillars within sanctions frameworks such as OFAC’s Compliance Commitments. They ensure appropriate oversight, periodic validation of controls, and staff competency.

PEP identification and loss prevention relate to AML and fraud programs, not core sanctions program design. De-centralized functions may create inconsistency and are not recognized as essential elements.

Sanctions and Compliance Domains explain that model validation for sanctions screening systems must include:

• Governance and management oversight, ensuring independent review, escalation paths, and proper control structures.

• Identification and verification of all data sources, ensuring that all required and relevant reference data feeds are included in screening.

• Matching algorithms and thresholds, which require testing, calibration, and validation to ensure accurate detection of potential sanctions matches.

Storage capacity, automation, or multiple administrators are operational considerations but not core components of model validation.

Sanctions and Compliance Domains explain:

• Tipping-off is prohibited, as it may alert a customer that they are under investigation, impairing regulatory or law-enforcement action. Institutions must implement controls to prevent it.

• Notification, however, refers to permitted communication — such as informing a customer that their funds were frozen — when required or allowed by law (e.g., EU asset-freeze requirements), without revealing investigative details.

Tipping-off and notification serve entirely different purposes. Regulatory frameworks explicitly warn entities against tipping-off but do allow certain forms of notification that comply with legal obligations.

Sanctions and Compliance Domains emphasize the importance of identity, residency, location indicators, and digital footprints when assessing potential sanctions violations.

Dual residency in a sanctioned country may trigger sanctions exposure because residency can determine jurisdictional reach. Likewise, IP addresses reveal the customer’s actual geographic location during transactions and are critical in identifying hidden connections to sanctioned jurisdictions.

Transaction size thresholds, routine salary information, or transfers within non-sanctioned countries do not directly indicate sanctions violations.

Artificial intelligence (AI) enhances sanctions screening by improving:

• name-matching accuracy,

• pattern recognition,

• reduction of false positives, and

• detection of complex sanctions-evasion typologies.

AI can analyze large volumes of data in real time and identify subtle risk indicators which traditional systems may miss.

Cryptocurrency mining tools and anonymizing tools hinder compliance, while tuning adjusts system thresholds but is not a standalone technology.