CGSS Study Guide: Sanctions Decisions, Controls, and Evasion Analysis
The Certified Global Sanctions Specialist (CGSS) credential is intended for sanctions compliance, screening, legal, trade compliance, AFC advisory, and regulatory risk professionals. ACAMS describes an exam of 100 questions in 175 minutes, with single-choice and multiple-select questions. Confirm current booking details directly with ACAMS.
This guide follows four areas described by ACAMS: sanctions frameworks and governance, building a sanctions compliance program, detecting and investigating evasion, and sanctions compliance case studies. It emphasizes the jurisdictional facts, evidence, control decisions, and documentation needed to resolve complex scenarios.
How to use the guide
- Identify the applicable authority and prohibition before deciding what action to take.
- Use each mini-case to explain your decision aloud, then test the misconception in its pitfall.
- Practice retrieving the rule, applying it to new facts, and recording why competing actions are weaker.
Syllabus and study allocation
| ACAMS course area | Concepts in this guide | Editorial study priority, not official weighting |
|---|---|---|
| Sanctions frameworks and governance | 1–15 | Establish authority, jurisdiction, prohibition, and accountability. |
| Building a sanctions compliance program | 16–33 | Design screening, escalation, testing, and decision records. |
| Detecting and investigating sanctions evasion | 34–51 | Assess ownership, trade, maritime, and payment evidence. |
| Sanctions compliance case studies | 52–60 | Choose proportionate action and diagnose control failures. |
60 core concepts 1-10
1. Define the sanctions objective before the control
Sanctions frameworks and governance
Sanctions programs pursue different objectives, including asset freezes, restrictions on trade, and limits on specified financing or services. A control works only if it is tied to the activity the applicable measure actually prohibits. Start with the authority, targeted persons or activities, effective date, and relevant jurisdiction. Then map the resulting obligation to customer, payment, trade, and vendor processes. A list match alone does not describe the full legal restriction.
Applied example: A bank receives a payment involving a nonlisted energy company. The analyst checks whether an applicable sectoral measure restricts the financing terms before treating the absence of a name match as clearance.
Common mistake: Treating every sanctions program as a name-screening exercise misses activity-based restrictions. Identify the legal prohibition and transaction facts before choosing the control or disposition.
2. Establish the jurisdictional connection
Sanctions frameworks and governance
A transaction can touch several regimes through parties, location, currency clearing, goods, or services. Build a jurisdiction map before applying a prohibition: identify where each party acts, which institutions process value, where goods originate and travel, and which persons are legally subject to each regime. This separates binding requirements from an institution's broader risk policy. When connections remain uncertain, preserve the facts and seek legal interpretation before releasing an irreversible transaction.
Applied example: A Hong Kong exporter sells equipment to a buyer in a third country, while payment clears through a U.S. bank. The team maps both the trade route and payment chain before assessing applicable restrictions.
Common mistake: Assuming a transaction is governed only by the customer's residence ignores clearing and service connections. Conversely, a foreign rule should not be presented as local law without a jurisdictional basis.
3. Trace UN financial sanctions into applicable law
Sanctions frameworks and governance
A UN Security Council measure may require states to impose targeted financial sanctions, but a firm's operational duties must be identified under the law applicable to its entity and activity. FATF Recommendations 6 and 7 address implementation of specified targeted financial sanctions; they do not supply a universal procedure for every UN trade or services restriction. Record the relevant domestic or regional measure, designation, effective date, licensing route, and reporting process for each operating jurisdiction.
Applied example: Branches in two countries receive the same UN designation through different local measures. The group shares the identity record but maintains separate instructions for each branch's legal disposition and reporting.
Common mistake: Citing a UN resolution or FATF recommendation alone does not establish a branch's specific blocking or reporting procedure.
4. Apply U.S. sanctions by measure and nexus
Sanctions frameworks and governance
OFAC administers U.S. sanctions through different program structures, including blocking and activity restrictions. Determine the relevant U.S. nexus and the precise measure before deciding whether a transaction may proceed. Review designated parties, ownership, goods or services, dates, and any applicable authorization. A sanctions compliance framework helps structure controls, but it is guidance for program design rather than a substitute for the governing regulation and license terms.
Applied example: A non-U.S. bank's dollar payment enters a U.S. correspondent account. The analyst identifies the U.S. processing step and checks the applicable restriction before instructing the correspondent.
Common mistake: A U.S. dollar label alone does not explain the legal outcome. Trace actual processing and applicable rules, then distinguish legal requirements from the bank's stricter internal policy.
5. Read EU restrictions by regulation and member-state process
Sanctions frameworks and governance
EU sanctions often operate through directly applicable regulations, while national authorities handle aspects of licensing, supervision, and enforcement. For an EU-connected case, identify the specific regulation, covered persons and activities, territorial or personal scope, and any competent-authority procedure. Avoid inferring that a shared EU list makes every operational step identical in every member state. Document which legal text and local authority support the chosen action.
Applied example: An EU subsidiary proposes to provide technical assistance on a controlled item. Its reviewer checks the relevant EU restriction and the member state's competent authority process before approving any service.
Common mistake: Treating a consolidated list as the entire EU sanctions rule overlooks trade and services restrictions. A listed-name check cannot replace review of the transaction's regulated activity.
6. Treat UK measures as a separate legal regime
Sanctions frameworks and governance
UK sanctions require their own assessment of designated persons, ownership or control, activities, and licensing. Do not assume an EU or U.S. conclusion automatically determines the UK result, even where targets overlap. Identify the UK person or territorial connection and the measure in force at the decision date. Operational instructions should route potential asset freezes and license questions to staff who can apply the relevant UK requirements.
Applied example: A London team services a customer whose parent appears on a foreign list. It checks the UK designation and applicable ownership or control rules before setting the account's legal status.
Common mistake: Using a global list as if every entry has the same effect in the UK can cause both wrongful holds and prohibited dealings. Record the governing regime for each decision.
7. Resolve cross-regime differences explicitly
Sanctions frameworks and governance
One transaction may be permitted under one regime and restricted under another. Create a regime-by-regime decision table showing the connection, prohibition, license or exemption, and required action. Legal permissibility also differs from institutional risk appetite: a firm may decline activity it could lawfully conduct, but that is a policy decision. Escalate conflicts early enough to avoid releasing goods or funds while the analysis remains open.
Applied example: A supplier is listed in one jurisdiction but not another. The group documents which subsidiaries and payment banks are involved, then applies each relevant rule and its group policy.
Common mistake: Choosing the least restrictive regime because another permits the activity ignores the institution's other legal connections. A documented comparison is needed before deciding where execution is possible.
8. Interpret designations and identifiers
Sanctions frameworks and governance
A designation identifies a target under a particular authority and measure; its identifiers support, but do not replace, identity analysis. Capture aliases, dates of birth, addresses, registration numbers, and designation updates with source and effective time. Similar names are clues rather than proof. Conversely, a missing exact name may not remove risk where ownership rules or activity restrictions apply. The analyst should explain which identifiers confirm, weaken, or leave a match unresolved.
Applied example: Two traders share a common name. One has the listed person's registration number and address, while the other has a different incorporation record. The reviewer records the decisive identifiers separately.
Common mistake: Treating a name similarity as conclusive can freeze the wrong party. Dismissing a near match without checking strong identifiers can allow a prohibited transaction to proceed.
9. Separate targeted and activity-based restrictions
Sanctions frameworks and governance
Targeted asset measures focus on designated persons and relevant owned entities, while sectoral or activity-based measures may restrict only specified financing, goods, services, or dealings. The same counterparty can therefore require different decisions across transactions. Parse the operative restriction and test its conditions against the specific product and date. A screening result answers who may be involved; product and transaction review answers what conduct is restricted.
Applied example: A company is subject to a financing restriction but offers an ordinary goods purchase. The team checks the exact measure and payment terms before deciding whether the proposed transaction falls within it.
Common mistake: Equating every sanctions hit with a full asset freeze overstates some measures. Equating a nonblocking measure with no concern misses its specific prohibited activity.
10. Analyze geographic restrictions beyond destination labels
Sanctions frameworks and governance
Geographic measures may cover imports, exports, investment, services, or dealings connected to a territory. Assess origin, destination, transit, beneficial recipients, and the place where services are performed. Customer-provided country codes can be incomplete or misleading when a shipment is rerouted. Match each activity to the actual legal text and any exceptions. This procedure is especially important when trade documents and payment instructions describe different locations.
Applied example: An invoice names a permitted destination, but shipping records show final delivery through a restricted territory. Trade compliance pauses fulfillment and verifies the consignee and end use.
Common mistake: A permitted invoice destination does not establish the final route. Use shipping, customs, and end-user evidence before concluding that a geographic restriction is irrelevant.
60 core concepts 11-20
11. Test licenses against exact conditions
Sanctions frameworks and governance
A license or authorization can permit conduct otherwise restricted, but only within its stated scope, parties, dates, and conditions. Identify whether it is general or specific, who may rely on it, and which transaction steps it covers. Retain the license text and evidence that the case satisfies each condition. If a material fact changes, reassess the authorization before execution. A license does not cure unrelated prohibitions under another applicable regime.
Applied example: A payment team receives a license reference for humanitarian goods. It verifies the goods, payer, payee, timing, and processing banks against the authorization before releasing the transfer.
Common mistake: A license number is not proof that a transaction is authorized. Compare the actual parties and activity with the license conditions, including limits outside the sales contract.
12. Distinguish primary restrictions from secondary exposure
Sanctions frameworks and governance
Some measures apply directly to persons with a defined jurisdictional connection; others can create exposure for certain conduct by persons outside that jurisdiction. Analyze the legal mechanism separately from a firm's commercial decision to avoid risk. Identify the conduct, threshold, and possible consequence in the governing measure. Specialist advice may be needed when the transaction lacks a direct nexus but could still create sanctions exposure.
Applied example: A foreign bank considers financing a transaction with no U.S. processor. The team assesses whether a relevant secondary measure covers the conduct and records a separate commercial risk decision.
Common mistake: Describing every foreign transaction as directly prohibited under U.S. law conflates distinct mechanisms. State the actual legal basis and the consequence that could follow.
13. Assign governance accountability
Sanctions frameworks and governance
Senior management should set the program's direction and resources, while named control owners execute screening, investigations, licensing, reporting, and testing. A responsibility map should show who can stop activity, who provides legal interpretation, and who approves exceptions. Escalation must reach someone with authority before a deadline or settlement event. Review governance when products, jurisdictions, or vendors change, because an old ownership map may leave critical decisions unattended.
Applied example: A new payments product settles in minutes. Management assigns a sanctions decision owner and a stop mechanism before launch, because the prior overnight escalation path cannot act in time.
Common mistake: A policy saying that compliance owns sanctions is too vague for an urgent hold. Define decision rights, backup coverage, and the operational step each role controls.
14. Set risk appetite within legal boundaries
Sanctions frameworks and governance
Risk appetite expresses which lawful activities an institution is willing to conduct and under what controls. It cannot authorize prohibited conduct. Translate appetite into concrete customer, product, geography, and third-party criteria, with a documented route for exceptions. Use the same criteria across comparable cases and revisit them when exposure changes. Distinguish a legal block from a discretionary exit so customers, operations, and auditors understand the decision basis.
Applied example: A firm chooses to decline lawful shipping finance involving a high-risk route. The file cites its approved risk appetite, while a separate analysis confirms that no legal prohibition was found.
Common mistake: Calling a policy refusal a sanctions prohibition misstates the law and may lead to wrong reporting. Label the legal conclusion and the firm's discretionary decision separately.
15. Govern regulatory and list changes
Sanctions frameworks and governance
A sanctions change process should capture new designations, amended measures, licenses, and implementation dates from authoritative sources. Assess which customers, transactions, products, and jurisdictions are affected, then update lists, rules, procedures, and staff instructions. Record when the change became effective and when each control was updated. Where timing creates a gap, identify affected activity for review rather than assuming the new list feed covered it.
Applied example: An authority designates a major shipper after the daily list import. Operations pauses relevant pending payments, records the effective time, and rescreens exposed transactions once the update is loaded.
Common mistake: A successful vendor download does not prove the institution applied a legal change on time. Compare source, receipt, deployment, and transaction timestamps to find any gap.
16. Build an exposure-based sanctions risk assessment
Building a sanctions compliance program
Assess inherent exposure across customers, geography, products, delivery channels, and transaction flows before judging control strength. Use actual volumes, counterparties, routing, and service features, not only broad country labels. Then evaluate how screening, due diligence, trade controls, and escalation reduce specific risks. Residual risk should reflect evidence of control performance. Refresh the assessment after material business or regulatory changes and link its findings to a funded action plan.
Applied example: A bank launches cross-border instant payments. Its assessment identifies compressed decision time and limited intermediary data, then funds real-time screening and a settlement stop control.
Common mistake: Calling a business low risk because few alerts occurred confuses detection output with exposure. Weak data or thresholds may be suppressing alerts, so test the underlying controls.
17. Translate risk into layered controls
Building a sanctions compliance program
A useful control map connects each risk to prevention, detection, escalation, and correction. For example, customer screening identifies listed relationships, payment screening checks transaction parties, trade review examines goods and routes, and quality assurance tests decisions. Document where each control operates and what information it needs. Gaps often arise at handoffs, such as a trade change after payment approval. Design triggers that reopen review when material facts change.
Applied example: A shipment's destination changes after initial approval. The workflow sends the amended bill of lading back to trade compliance and prevents payment release until the new route is checked.
Common mistake: Counting controls without mapping the activity they cover creates false assurance. A customer screen cannot detect a restricted end use hidden in a later shipment amendment.
18. Make management commitment observable
Building a sanctions compliance program
Management commitment appears in decision rights, budget, staffing, incentives, and willingness to pause revenue when facts are unresolved. Test it through records: whether high-risk findings receive resources, overdue remediation is challenged, and exceptions receive independent scrutiny. The OFAC framework identifies management commitment as a core element of a U.S. sanctions compliance program. An institution operating elsewhere can use the principle as good practice while applying its own governing law.
Applied example: After repeated screening backlogs, executives approve more reviewers and change launch incentives so sales cannot bypass unresolved alerts. The action is tracked against backlog and error measures.
Common mistake: A signed statement alone does not demonstrate effective commitment. Examine decisions made when compliance costs time or revenue, and whether management fixes known control weaknesses.
19. Write procedures at the decision point
Building a sanctions compliance program
A policy states principles and accountability; a procedure tells staff what to do with a specific alert or transaction. It should identify required data, screening points, evidence standards, escalation thresholds, stop controls, and disposition options. Align the procedure with local law and institutional policy, marking where they differ. Test it with realistic cases, including incomplete data and urgent settlement. If staff must invent a step under pressure, the procedure is incomplete.
Applied example: A reviewer sees a possible match just before cutoff. The procedure specifies the hold mechanism, required identifiers, escalation contact, and record fields, allowing a defensible decision without improvisation.
Common mistake: Copying a global policy into a local workflow may omit reporting or licensing steps. Translate the applicable obligation into an executable instruction for the team handling the activity.
20. Control list provenance and deployment
Building a sanctions compliance program
List management requires an authoritative source, update schedule, version record, and reconciliation between source changes and screening deployment. Record additions, removals, aliases, identifiers, and the time each became active in production. Monitor failed imports and test that a known new entry can generate an alert. A vendor's claim of continuous updates is not evidence that the institution's own screening environment received and applied a change.
Applied example: A list provider sends an update at noon, but the payment engine deploys it at 3 p.m. Compliance identifies payments processed during the gap and reviews them against the new entries.
Common mistake: Treating the vendor feed timestamp as the control timestamp hides deployment failures. Preserve both and test the actual screening engine after material updates.
60 core concepts 21-30
21. Preserve identity data quality
Building a sanctions compliance program
Screening quality depends on the fields entering the engine. Capture full legal names, aliases, registration numbers, dates of birth, addresses, and relevant script or transliteration where available. Normalize predictable formatting differences without discarding distinctive information. Define minimum data standards for onboarding and payments, with a route for missing fields. Poor input can create both missed matches and unnecessary alerts, so measure data completeness as part of control performance.
Applied example: A corporate onboarding record contains only a trading name. The analyst obtains the registered name and company number, then rescreens both names before approving the relationship.
Common mistake: Lowering match thresholds cannot repair missing legal names or identifiers. Improve the source data first, then tune matching against realistic test records.
22. Screen customers at relevant lifecycle events
Building a sanctions compliance program
Customer screening should cover onboarding and material changes such as new owners, directors, names, addresses, or relevant list updates. Decide which associated parties need screening based on legal duties and risk, and keep the relationship map current. A prior clearance is tied to the data and list version used at that time. Rescreening on a meaningful event prevents an old decision from being reused after the facts have changed.
Applied example: A client acquires a new majority owner during an annual review. The bank updates the ownership record and screens the new party before processing a planned financing transaction.
Common mistake: A clean onboarding result is not permanent clearance. Ownership and designations change, so set event triggers that revisit the relationship when the decision facts change.
23. Screen the payment chain, not just the originator
Building a sanctions compliance program
Transaction screening should consider the parties and information available across the payment chain, including originator, beneficiary, intermediaries, banks, and narrative fields where relevant. Map which system sees each field and when it can stop execution. Messages can be incomplete or reformatted between institutions, so uncertainty may require inquiry or escalation. Screening design should reflect the institution's actual role rather than assuming every processor holds identical data.
Applied example: A payment names a clear beneficiary but includes a listed vessel in the remittance details. The processing bank holds the instruction and checks whether the reference reflects a prohibited dealing.
Common mistake: Clearing the named beneficiary alone can miss a restricted intermediary or activity described elsewhere in the message. Review the fields that matter to the applicable measure.
24. Tune fuzzy matching with measured tradeoffs
Building a sanctions compliance program
Fuzzy matching helps detect spelling variants, transliterations, and data-entry errors, but every threshold changes both missed-match and false-alert risk. Test settings against representative positive and negative records, including common names and non-Latin scripts. Compare results by customer and payment channel, then document approved thresholds and changes. Review whether analysts receive enough identifiers to resolve alerts. A single global threshold may behave poorly across very different data sets.
Applied example: A screening team tests a lower name threshold on a sample of Arabic transliterations. It finds more relevant hits but an unmanageable alert increase, so it adds supporting identifier rules.
Common mistake: Maximizing alert volume does not maximize effectiveness. If reviewers cannot investigate the resulting queue, relevant matches may be delayed or closed with weak reasoning.
25. Triage alerts using discriminating evidence
Building a sanctions compliance program
Alert triage should begin with identifiers that distinguish the screened party from the listed target: registration number, birth date, location, role, and reliable aliases. Rank evidence by reliability and explain contradictions. A common name with no corroboration may be resolved quickly; a rare name plus matching registration data needs escalation. Preserve the data snapshot and list entry used, because later updates may change what another reviewer sees.
Applied example: An alert links a vendor to a listed company with a similar name. Different registration numbers and incorporation countries support a false-positive closure, which the analyst records with source documents.
Common mistake: Closing an alert because the name is common is weak when other identifiers match. Conversely, a name match alone cannot override reliable conflicting identity evidence.
26. Define holds, blocks, and rejections precisely
Building a sanctions compliance program
A temporary operational hold preserves the ability to investigate. Blocking or freezing and rejection are legal outcomes whose conditions vary by regime and transaction type. Procedures should distinguish these states, identify who can authorize each, and specify required reporting and recordkeeping under applicable law. The team must also know how to prevent accidental release during inquiry. Document both the legal basis and the operational action taken at each stage.
Applied example: A payment triggers a possible listed-party match. Operations places a temporary hold, compliance confirms the relevant designation, and legal determines the required disposition and reporting step.
Common mistake: Using block as a casual synonym for every pause can trigger the wrong process. A hold buys time for analysis; the final legal action requires a supported conclusion.
27. Administer licenses as controlled exceptions
Building a sanctions compliance program
Maintain a register of licenses and authorizations with covered entities, activities, conditions, expiry dates, and approval owners. Connect each use to a transaction record and test ongoing compliance with conditions. A license should not become a broad customer whitelist, because another payment or product may fall outside its scope. Monitor amendments and revocations, and require renewed review when a party, route, good, or service changes.
Applied example: A customer holds an authorization for specified medical shipments. A later order contains additional equipment, so the bank checks whether the added goods fall within the license before processing payment.
Common mistake: Whitelisting the customer after one authorized transaction converts a narrow exception into blanket permission. Match each proposed use to the authorization's actual conditions.
28. Train by role and decision risk
Building a sanctions compliance program
Training should match the decisions each team makes. Payment operators need hold and escalation steps; trade staff need document and route indicators; investigators need evidence standards; managers need exception and remediation responsibilities. Use local law and current procedures, then test learners with scenarios that expose common errors. Attendance alone is a weak measure. Review mistakes and operational incidents to update training where decisions repeatedly fail.
Applied example: After several trade alerts were dismissed as payment-name issues, compliance gives trade reviewers cases involving end users and shipping changes, then checks whether their dispositions improve.
Common mistake: A generic annual presentation can leave staff unable to act during a live alert. Assess whether each role can execute its specific decision and escalation steps.
29. Use quality assurance to detect decision drift
Building a sanctions compliance program
Quality assurance samples completed work to find inconsistent dispositions, missing evidence, and departures from procedure. Include routine closures and high-risk decisions, and sample across reviewers, teams, and products. Feed findings into coaching and control changes. Track recurring error types rather than only an overall accuracy percentage, since a small number of severe failures can matter more than many harmless documentation defects.
Applied example: A monthly sample shows analysts routinely accept different birth years without checking source reliability. The team updates its evidence guide and resamples the affected alert category.
Common mistake: A high average closure accuracy can conceal rare but serious missed matches. Stratify samples by risk and examine the reason for each material error.
30. Test controls independently
Building a sanctions compliance program
Independent testing evaluates whether the sanctions program works as designed and whether the design covers material exposure. Test the complete path from source list to production screening, alert investigation, legal disposition, reporting, and remediation. Use realistic data and inspect exceptions rather than relying only on management descriptions. Independence means testers can challenge control owners and report findings without having to defend their own prior decisions.
Applied example: A testing team inserts representative listed-party variants into a controlled test environment. It traces whether alerts appear, reach the correct queue, and receive a supported disposition.
Common mistake: Checking that a procedure exists does not show that the control operates. Follow transactions and alerts through the actual systems, handoffs, and decision records.
60 core concepts 31-40
31. Measure outcomes, capacity, and delay
Building a sanctions compliance program
Useful metrics show alert volumes, aging, override rates, data gaps, list-deployment delays, repeat errors, and remediation progress. Interpret them against exposure and workload. A falling alert count may indicate better tuning, lower activity, or a broken feed; investigate before celebrating it. Set escalation triggers for queues approaching settlement deadlines. Pair numerical trends with file reviews so management sees both scale and decision quality.
Applied example: Payment alerts fall sharply after a software update. The manager compares transaction volume, rule changes, and test hits, discovering that one message field stopped feeding the screening engine.
Common mistake: A low false-positive rate is not inherently good if the engine misses relevant variants. Test missed-match risk and data coverage alongside alert efficiency.
32. Maintain decision data lineage
Building a sanctions compliance program
A defensible sanctions record lets another reviewer reconstruct the facts available at the decision time. Preserve source documents, list version, screening inputs, match scores where meaningful, analyst notes, legal advice references, approvals, and final action timestamps. Control access and retention according to applicable requirements. Data lineage matters when a later designation or enforcement inquiry prompts a lookback: the institution must distinguish what was known then from what became known later.
Applied example: A regulator asks why a payment was released six months earlier. The bank retrieves the message, list snapshot, matching output, supporting identifiers, and approval record from that date.
Common mistake: A final status code without the underlying inputs cannot explain the decision. Keep the evidence and chronology needed to reproduce the analysis, not merely its outcome.
33. Escalate uncertainty before execution
Building a sanctions compliance program
Escalation thresholds should reflect the risk of irreversible action, strength of match, missing facts, and legal complexity. Define who receives the case, the time available, and the interim hold. Give decision makers a structured summary: applicable regime, parties, activity, evidence for and against concern, and unresolved questions. If the missing fact could change legal disposition, seek it before release where feasible and preserve the rationale for any interim action.
Applied example: An urgent payment has a plausible match and missing beneficiary registration data. The analyst holds it, requests the identifier, and sends legal a concise evidence table before cutoff.
Common mistake: Escalation is not simply forwarding an alert screenshot. Without the legal issue, discriminating facts, and deadline, the next reviewer cannot make a reliable decision.
34. Identify beneficial ownership before applying a rule
Detecting and investigating sanctions evasion
Ownership analysis starts with a reliable entity map: legal owners, percentages, intermediate companies, dates, and evidence sources. Then apply the ownership test of the relevant jurisdiction. The FATF Recommendations support transparency of legal-person ownership as an international standard, while a sanctions prohibition must come from the applicable sanctions regime. Separate verified ownership from reported control, nominee arrangements, and unknown interests. An incomplete map can justify inquiry or a hold without proving that an entity is legally blocked.
Applied example: A vendor's registry filing shows two holding companies but no natural owners. The bank requests ownership documents and pauses a high-value payment while testing the relevant sanctions rule.
Common mistake: A beneficial-owner field in a customer file is not the whole ownership chain. Trace intermediate entities and dates before concluding that a sanctions threshold is met.
35. Apply OFAC's aggregate 50 Percent Rule
Detecting and investigating sanctions evasion
Under OFAC's U.S. 50 Percent Rule, an entity owned 50 percent or more in aggregate, directly or indirectly, by one or more blocked persons is treated as blocked even if unnamed on the list. Build the ownership chain and identify blocked owners before calculating. OFAC's guidance requires careful treatment of blocked intermediate entities; multiplying percentages mechanically through every layer can produce the wrong result. Record the calculation, source dates, and U.S. legal scope.
Applied example: Two blocked persons each directly own 25 percent of a supplier. The U.S. reviewer aggregates their interests, identifies a 50 percent holding, and treats the supplier under the applicable OFAC rule.
Common mistake: Looking for a single blocked owner above 50 percent misses aggregation. Applying the U.S. threshold as a universal rule also misstates other regimes' tests.
36. Separate ownership from control
Detecting and investigating sanctions evasion
Control can arise through voting rights, board appointments, financing, or informal direction, but its legal effect depends on the applicable regime. Under OFAC's U.S. ownership rule, control alone below the 50 percent threshold does not automatically make an entity blocked under that rule; other prohibitions or designation risk may still matter. Gather contracts, governance records, and transaction instructions, then state which legal test or risk policy each fact supports.
Applied example: A listed person holds 30 percent of a company and appoints most directors. The team does not assert automatic blocking under the U.S. ownership rule; it evaluates other applicable restrictions and risk.
Common mistake: Using evidence of influence as proof of 50 percent ownership collapses different tests. Document control separately and apply the legal consequence that the relevant regime actually provides.
37. Resolve opaque ownership structures
Detecting and investigating sanctions evasion
Layered companies, trusts, nominees, and rapid transfers can obscure the person who benefits from or directs a transaction. Reconstruct the structure from registries, corporate records, agreements, payment details, and credible customer explanations. Mark each link as verified, asserted, or unknown. Compare transaction dates with ownership changes, because a later filing may not describe the position when a payment occurred. Escalate material gaps according to risk and applicable legal duties.
Applied example: A buyer changes shareholders one week before a restricted shipment. The analyst compares dated filings, sale documents, and payment instructions to determine whether the former owner still directs the purchase.
Common mistake: A recent registry extract is not conclusive evidence about an earlier transaction or a nominee arrangement. Match ownership evidence to the relevant date and decision.
38. Recognize front-company patterns
Detecting and investigating sanctions evasion
A front company may present ordinary registration details while acting for a restricted party. Look for converging facts: shared addresses or staff, unexplained funding, unusual margins, abrupt activity changes, and instructions from someone outside the contract. No single feature proves evasion. Test whether the company has a credible commercial function and who controls the goods or payment. Record alternative explanations and seek targeted evidence that would distinguish them.
Applied example: A newly formed distributor orders specialized equipment, pays from an unrelated company, and asks for delivery near a restricted border. The investigator checks funding, end user, and logistics records.
Common mistake: Calling every new company a front company overstates weak evidence. Combine corporate, payment, and trade facts, then identify the specific uncertainty requiring escalation.
39. Trace trade diversion through end use and route
Detecting and investigating sanctions evasion
Trade diversion often changes apparent destination, intermediary, or end user while preserving the restricted final purpose. Compare purchase orders, invoices, shipping documents, customs data, and customer communications for consistency. Assess whether the intermediary has capacity and a commercial reason to buy the goods. A transit country alone is not proof of diversion, but routing changes combined with hidden end use warrant investigation. Coordinate with export-control specialists where goods restrictions apply.
Applied example: A reseller with no industrial customers orders components suited to a restricted end user and reroutes delivery after approval. Trade compliance requests end-user evidence before shipment.
Common mistake: Treating the declared destination as the final end use ignores onward movement. Equally, assuming every transshipment is illicit ignores legitimate logistics; examine the whole pattern.
40. Assess dual-use goods with technical evidence
Detecting and investigating sanctions evasion
Dual-use goods can serve civilian and restricted applications. Review technical specifications, classification, quantity, buyer capability, end-user statement, and route rather than relying on a broad product label. Sanctions and export-control requirements may be separate, so identify each applicable rule and the team responsible for interpretation. If the item or intended use is unclear, hold the decision until a qualified technical assessment addresses the relevant control criteria.
Applied example: A distributor describes sensors as general laboratory supplies, but their specifications match a controlled application. The reviewer obtains product classification and end-use evidence before approving export support.
Common mistake: A civilian marketing description does not establish unrestricted status. Technical specifications and intended use determine whether a trade or export restriction may apply.
60 core concepts 41-50
41. Investigate maritime identity and behavior
Detecting and investigating sanctions evasion
Maritime evasion analysis should connect vessel identity, ownership, flag, route, cargo, and voyage timing. Names and flags can change; a stable vessel identifier helps trace continuity, while tracking gaps require context. Compare port calls, bills of lading, insurance, and counterparties before drawing conclusions. A period without tracking data is an indicator to examine, not standalone proof of illicit transfer. Decisions should reflect the relevant sanctions measure and available corroboration.
Applied example: A tanker changes its name and flag shortly before a high-risk voyage. The analyst uses its stable identifier and shipping documents to examine whether cargo or counterparties create a prohibited connection.
Common mistake: Treating every tracking gap as sanctions evasion creates false certainty. Corroborate timing, location, cargo, and commercial records before making a legal or risk decision.
42. Evaluate ship-to-ship transfer risk
Detecting and investigating sanctions evasion
Ship-to-ship transfers can serve legitimate logistics but may obscure cargo origin or destination. Examine the vessels involved, transfer location and date, cargo records, subsequent port calls, and changes in documentation. Compare the declared transaction with the physical movement and any restricted-party links. The strongest cases combine inconsistent paperwork with corroborating route or ownership evidence. Preserve uncertainty where vessel-tracking data is incomplete or commercially plausible explanations remain.
Applied example: Oil documents name a direct voyage, while vessel records show a midroute transfer to another tanker. The trade team requests cargo and charter records before financing the shipment.
Common mistake: A transfer at sea is not itself a violation. The question is whether the transfer conceals a prohibited origin, party, or activity under the applicable regime.
43. Trace payment-chain roles and information loss
Detecting and investigating sanctions evasion
A payment can involve originators, beneficiaries, intermediaries, correspondents, and agents whose names appear in different messages or systems. Reconstruct who instructed, funded, processed, and received value. Compare message fields with invoices and account records, especially where a payment is repaired or resubmitted. Missing information may reflect format limits or deliberate omission; test both possibilities. The institution's legal duties depend on its role and jurisdictional connection.
Applied example: A rejected transfer returns with a shortened beneficiary name and a new intermediary bank. The investigator compares both messages and underlying invoice before allowing another processing attempt.
Common mistake: Assuming the latest payment message contains the whole transaction history can hide changed parties. Preserve earlier versions and explain each material amendment.
44. Assess correspondent-banking exposure
Detecting and investigating sanctions evasion
A correspondent may process a respondent bank's payments without holding full files for the respondent's customers. Assess the respondent's business, corridors, message quality, and ability to supply underlying-party information. Define which transaction fields the correspondent screens and how it handles missing or changed information. The respondent's screening may be relevant evidence, but the correspondent must assess its own role and applicable obligations from the data and activity it handles.
Applied example: A correspondent sees repeated payments through a high-risk corridor with shortened beneficiary names. It compares message versions, requests the underlying party details, and decides whether processing can continue under its procedures.
Common mistake: A respondent's general screening attestation does not establish that a particular intermediary, beneficiary, or transaction was checked.
45. Detect deliberate identity variation
Detecting and investigating sanctions evasion
Evasion can exploit spelling changes, aliases, abbreviations, different scripts, and reordered names. Compare the altered name with stable identifiers, addresses, account links, and transaction context. Ask whether the variation is normal transliteration or a change that removes a known alert. Review repeat submissions and staff edits for a pattern. A technical match score is useful evidence, but the investigator must explain identity using the full record.
Applied example: A vendor resubmits a payment with one letter changed after an alert. The reviewer links the unchanged account, address, and invoice to the earlier submission and escalates the pattern.
Common mistake: A changed spelling does not always mean deception; transliteration can vary legitimately. Focus on stable identifiers and the sequence of submissions before attributing intent.
46. Interpret geographic red flags in context
Detecting and investigating sanctions evasion
A high-risk route, border location, or unusual transit point may indicate diversion, but geography is most useful when connected to the goods, buyer, and commercial explanation. Compare the stated route with transport records and normal routes for the product. Investigate sudden changes after a compliance inquiry. Avoid treating a country-risk label as a substitute for a legal test. Record what the location adds to the case and what remains unproven.
Applied example: A shipment changes from a direct route to a border warehouse after the buyer is questioned about end use. The analyst seeks warehouse and onward-delivery records before approving finance.
Common mistake: A risky location is a lead, not proof of a prohibited destination. Conversely, a permitted transit point cannot erase evidence of a restricted final recipient.
47. Distinguish false positives from true matches
Detecting and investigating sanctions evasion
A false positive is an alert resolved as a different person or entity; a true match links the subject to the designated target. Build both conclusions from reliable identifiers and the applicable list record. An unresolved alert is a separate state, particularly when data is missing or contradictory. Document why evidence is sufficient, not merely the final label. This distinction matters because an incorrect true match can harm a lawful party, while an incorrect false positive can permit restricted activity.
Applied example: A customer's name and city match a designation, but its company number and incorporation date differ. The analyst verifies the documents and records a supported false-positive decision.
Common mistake: Forcing every alert into true or false before obtaining key identifiers hides uncertainty. Keep the case on hold and seek discriminating evidence when the legal outcome could change.
48. Build an investigation chronology
Detecting and investigating sanctions evasion
A chronology ties designations, ownership changes, orders, shipments, payment attempts, and internal decisions to their effective dates. It helps distinguish conduct that occurred before a restriction from later conduct and reveals efforts to change routes or names after an alert. Use source timestamps and note their time zones. A clear timeline also shows whether controls operated when needed and which transactions belong in a potential lookback.
Applied example: A supplier was designated between contract signing and payment. The investigator places both events, shipment milestones, and list deployment on one timeline before determining the next action.
Common mistake: Assessing only the contract date can miss later prohibited performance. Evaluate each relevant transaction step against the rule effective at that time.
49. Seek evidence that can change the decision
Detecting and investigating sanctions evasion
An efficient investigation lists competing explanations and requests evidence that separates them. If the issue is identity, seek a registration number or birth date; if it is end use, seek delivery and installation records; if it is ownership, seek dated shareholder documents. Prioritize evidence by reliability and independence. Avoid gathering large volumes of irrelevant material while a transaction deadline approaches. State which fact would trigger release, continued hold, or legal escalation.
Applied example: A distributor says a restricted-looking shipment is for domestic use. The analyst requests a named end user and delivery address, then checks whether those documents match the route.
Common mistake: More documents do not automatically reduce uncertainty. Ask for evidence tied to the disputed fact and evaluate whether its source could be influenced by the counterparty.
50. Combine indicators without double-counting
Detecting and investigating sanctions evasion
Several red flags may reflect one underlying fact. A new company, thin website, and short trading history all describe limited operating history; counting them as three independent signals exaggerates the case. Group related indicators, identify independent corroboration, and test innocent explanations. Escalation can still be justified by a serious unresolved risk. The final narrative should explain how the evidence changes the likelihood of evasion and what legal question remains.
Applied example: A buyer's recent incorporation and sparse website are one concern. An unrelated payer and altered delivery route add separate concerns, so the investigator seeks funding and end-user evidence.
Common mistake: A long checklist is not a strong case if every item repeats the same weak fact. Weight independent, reliable evidence and state the remaining uncertainty.
60 core concepts 51-60
51. Scope a historical lookback
Detecting and investigating sanctions evasion
Define a lookback by the control failure, affected systems and fields, transactions, and the period when the underlying restriction applied. An alias added to a list today may identify a person designated earlier, so the alias update date alone is not necessarily the first relevant transaction date. Validate historical data completeness and test whether the same failure affected other names or products. Record why cases were included or excluded and expand the review if evidence reveals a broader gap.
Applied example: A missed alias is discovered in payment screening. The team establishes when the person was designated, when the alias was known or usable in its data, and which historical message fields can be searched before setting the review period.
Common mistake: Starting at the alias publication date can omit earlier payments involving an already designated person. Match the review boundary to the legal measure and the actual control failure.
52. Frame a case around the decisive question
Sanctions compliance case studies
Complex cases often contain many suspicious facts, but the decision turns on a narrower issue: applicable authority, identity, ownership, restricted activity, or license coverage. State that question first, then sort facts into established, disputed, and irrelevant categories. Identify the immediate action needed to preserve options while evidence is gathered. This method prevents an attractive red flag from distracting the team from the legal condition that determines the outcome.
Applied example: A shipment involves a risky route, a similar-name buyer, and unusual payment terms. The team first resolves whether the buyer is the designated entity, then assesses the route and financing restriction.
Common mistake: Treating the most dramatic fact as the decisive fact can produce the wrong action. Tie each fact to a specific prohibition or risk decision.
53. Diagnose the root cause of a failure
Sanctions compliance case studies
An enforcement or internal case may reveal a missed match, but remediation depends on why it was missed. Trace data capture, list ingestion, rules, analyst decision, escalation, and management oversight. Separate the initiating error from conditions that allowed it to persist. Use transaction samples and system evidence rather than relying only on interviews. A root-cause finding should predict where else the same failure could occur and guide a targeted lookback.
Applied example: A listed party's payment passed because a message field was never screened. The review tests all products using that field and corrects the integration, not only the single alert.
Common mistake: Calling every failure human error can conceal a broken workflow or poor data feed. Examine the control path before choosing training as the remedy.
54. Design remediation that can be verified
Sanctions compliance case studies
A remediation plan should state the failed control, corrective action, owner, deadline, interim safeguard, and evidence of completion. Validate effectiveness with transactions or test cases after the change goes live. If the issue affects earlier activity, pair the fix with a scoped lookback. Management should track overdue items and residual risk. Closing an action because software was installed is premature if the new workflow has not been shown to work.
Applied example: After missed vessel alerts, a firm adds stable vessel identifiers to screening, temporarily reviews maritime payments manually, and tests recent transactions after deployment.
Common mistake: A policy rewrite is not enough when the failure was technical. Match the remedy to the cause and verify operation using realistic cases.
55. Control third-party dependencies
Sanctions compliance case studies
Screening vendors, agents, distributors, and other partners can create exposure when their data, decisions, or conduct affect the institution's transaction. Define what the institution relies on, what evidence it receives, and how it tests performance. Contracts and attestations help allocate duties but do not establish that a control works. Use risk-based monitoring and escalation for material changes, especially when a third party selects counterparties or changes routes.
Applied example: A logistics agent chooses substitute carriers without prior notice. The exporter adds a carrier-approval step and checks whether earlier substitutions involved restricted vessels.
Common mistake: An agent's statement that it complies with sanctions does not reveal which lists, parties, or routes it checked. Verify the activity that creates the exposure.
56. Integrate acquired businesses without a control gap
Sanctions compliance case studies
An acquisition can introduce customer files, legacy transactions, vendors, and products that were screened under different rules. Before integration, map applicable jurisdictions, list sources, data quality, alert backlogs, and transaction stop points. Set interim controls where systems cannot be combined immediately. Reconcile legacy decisions when the acquiring firm's legal or policy exposure differs. Record assumptions so integration deadlines do not silently become sanctions risk acceptance.
Applied example: A bank acquires a trade finance portfolio with incomplete end-user fields. It restricts new high-risk shipments, gathers missing data, and rescreens relevant parties before full integration.
Common mistake: Connecting the acquired customer database to a screening engine does not resolve missing ownership or trade data. Assess the inherited control design and decision records.
57. Test what technology actually establishes
Sanctions compliance case studies
Screening scores and network links are leads whose meaning depends on source data, model rules, and the date of each record. A shared service address may connect unrelated companies, while an exact registration number can outweigh a low name score. When software or data changes, test representative positive and negative cases, compare output with prior behavior, and examine whether any population stopped reaching review. Escalate case evidence that contradicts a model result and retain the underlying records used for the decision.
Applied example: After a model update, a low-scored beneficiary shares a company number with a listed entity. The case owner stops the payment for identity review while the control team tests whether the update suppressed other similar alerts.
Common mistake: A score or graph edge is not a legal finding. Resolve the underlying identity or ownership fact and investigate material changes in detection performance.
58. Evaluate disclosure and reporting duties
Sanctions compliance case studies
A suspected violation may create reporting, recordkeeping, or voluntary disclosure questions that differ by jurisdiction. Preserve the facts, dates, transactions, and internal chronology, then obtain legal analysis of any mandatory duty and available disclosure route. Separate confirmed breaches from unresolved allegations. A decision to disclose should consider accuracy, scope, and continuing remediation; it should not delay immediate steps needed to prevent further prohibited activity.
Applied example: A lookback identifies three payments involving a possibly blocked entity. The institution holds related activity, verifies ownership on the payment dates, and seeks legal advice on applicable reporting.
Common mistake: Calling every potential match a reportable violation can misstate the evidence. Waiting for perfect certainty before preserving records or stopping repeat activity is equally unsound.
59. Choose proportionate action in a mixed-regime case
Sanctions compliance case studies
A cross-border transaction can expose different group entities to different legal duties. Create one shared fact record, then map each sale, service, shipment, financing, and payment step to the entity performing it and the regime that may govern it. A lawful sale for one entity does not settle whether another may finance or process it. Identify the decision owner for each step, pause any irreversible action while a material legal question remains, and record policy refusals separately from legal prohibitions.
Applied example: A subsidiary may sell equipment under its local rules, but the proposed financing passes through a bank subject to another restriction. The group assesses the sale and financing separately before committing to delivery.
Common mistake: A single groupwide yes or no conceals which entity faces which restriction. State the legal and operational decision for each transaction step.
60. Write a defensible final decision record
Sanctions compliance case studies
A strong case record states the question, applicable regime, material facts, evidence sources, unresolved limits, decision, approver, and action taken. It explains why plausible alternatives were rejected and distinguishes legal requirements from institutional policy. Record timing and any follow-up condition, such as license confirmation or later rescreening. The purpose is reproducibility: a qualified reviewer should be able to understand the decision without relying on the analyst's memory.
Applied example: A reviewer releases a held payment after confirming a different registration number and no restricted activity. The file retains both identities, source records, legal scope, approval, and release time.
Common mistake: Writing cleared without reasoning leaves no way to test a later challenge. State the decisive evidence and the specific rule or policy applied.
Six-session study plan
Official references
The linked ACAMS, FATF, and OFAC materials support the specific points cited. FATF recommendations are international standards, while enforceable duties depend on the applicable law. OFAC guidance concerns U.S. sanctions. The study allocations below are editorial priorities, not verified official exam weights.
- ACAMS CGSS Certification
- FATF Recommendations
- OFAC: Entities Owned by Blocked Persons (50 Percent Rule)
- OFAC: A Framework for Compliance Commitments
- UK OFSI financial sanctions general guidance
- UN Security Council consolidated sanctions list
- Council of the EU: restrictive measures and sanctions
- ACAMS CGSS candidate handbook and examination blueprint