Sanctions work starts with a precise question: which rule applies to this person, asset, service, or transaction? A name match alone rarely answers it. You need to establish jurisdiction, identify the relevant restriction, examine ownership and control, and decide what the institution may do next. This guide develops those decisions in three connected parts. First, you will compare sanctions frameworks and the legal consequences they create. Next, you will design and operate controls for customer, counterparty, and transaction exposure. Finally, you will investigate attempts to hide a target, reroute a transaction, or disguise goods and their destination. Each concept is planned around a distinct scenario with enough facts to reach a reasoned outcome.
Sanctions Frameworks and Governance
1. Find the jurisdictional link
Start with the transaction, then mark every place where a person, institution, asset, or service meets a legal system. Record the customer and beneficiary, the branch that acts, each intermediary bank, the currency clearing route, the location of goods, and any property held by the institution. Each link can bring a different rule into the decision. A currency label alone does not describe the full route; confirm which institution will actually clear the payment. Likewise, a beneficiary's address is a fact to investigate, while the role of a UK bank receiving funds is a distinct operational link. Build a short matrix showing the applicable regime, the actor it governs, the restricted conduct, and any authorization. The CGSS handbook places sanctions frameworks within the examined scope; the transaction facts determine which rules matter in a case.
Worked example: A Hong Kong bank instructs a US correspondent to clear a payment to a UK beneficiary bank. The analyst checks the Hong Kong bank's duties, the US correspondent's ability to process the funds, and the UK bank's receipt of them. A clear Hong Kong screening result cannot authorize the US clearing step. The beneficiary's UK address also prompts a UK rule check, with its precise duty depending on the parties and activity.
Watch the distinction: Choosing one regime from the sending bank's location overlooks intermediaries and assets. Map the whole route before deciding which institution can lawfully handle each step.
Reference: [1]
2. From UN measure to local duty
A UN Security Council measure sets an international obligation for states. A bank normally finds its operative duties in the domestic or regional rules that give that measure effect in the jurisdictions relevant to its activity. Separate three questions: what the UN measure addresses, how the relevant jurisdiction implements it, and what the resulting rule requires this institution to do. Implementation can define the covered property, prohibited services, exceptions, administration, and reporting route. A UN name match is therefore a serious lead, but it is not a complete operating instruction. Establish identity first, identify the applicable Canadian measure for a Canadian bank, and read its operative provisions. Also check whether other regimes apply to a particular payment route or branch. Keep the UN and implementing sources in the case record so the legal basis remains traceable.
Worked example: A Canadian bank finds its customer on a UN sanctions list. The analyst confirms the customer's identity, locates the relevant Canadian implementing measure, and tests whether the customer's funds and proposed transaction fall within it. The bank then follows the duties established by the applicable Canadian rule. The UN entry explains why the inquiry began; it does not alone specify the bank's handling or reporting steps.
Watch the distinction: Treating a UN listing as a complete procedure skips the rule that governs the bank. The implementing measure supplies the operative duties for the relevant jurisdiction.
Reference: [1]
3. Read the type of restriction
Identify the legal effect before choosing an operational response. An asset freeze concerns property in which a covered person has an interest and restricts dealings with that property. A broad trade ban can prohibit a class of transactions based on destination or origin, even when no party is listed. Sectoral measures are narrower: they may restrict specified financing, services, goods, or dealings with defined entities. For each measure, extract the covered party, instrument or product, transaction date, maturity or other terms if relevant, and prohibited conduct. Then compare those elements with the proposed activity. A sectoral designation should not automatically turn every payment into blocked property. Conversely, a clean name screen does not clear a prohibited equipment shipment. The decision record should name the measure and the exact element that is, or is not, met.
Worked example: Assume a hypothetical rule bars new covered debt financing for Company A but imposes no asset freeze. A payment for permitted goods, with no loan or covered debt instrument, does not become frozen simply because A is involved. A proposed new loan to A does meet the financing category, so the analyst checks its terms against the hypothetical debt rule and holds the proposal pending that decision.
Watch the distinction: Calling every sanctions restriction a freeze leads to the wrong treatment of funds. Classify the prohibited activity before selecting a hold, refusal, or property action.
Reference: [1]
4. Test the prohibited activity
Translate a rule into elements that can be tested against evidence. Write down the verb, such as supply, finance, import, or provide a service; the covered product or activity; the destination or beneficiary; and any required connection to the jurisdiction. Ask who will perform the action and when. Technical specifications, contracts, shipping documents, and payment purpose can answer different parts of that test. Avoid expanding a narrow goods prohibition to every transaction with the same customer, but do not let a broad invoice label hide covered goods. If one rule does not capture the activity, continue checking other applicable measures. The analysis ends with a reasoned classification: the facts establish each required element, fail a particular element, or leave an element unresolved. Unresolved material facts justify a hold while the analyst obtains evidence.
Worked example: Assume the applicable rule prohibits supplying a named equipment class to Country R. A seller proposes both a shipment of that equipment to R and unrelated software support for a customer there. The shipment meets the stated goods and destination elements and is prohibited under the assumed rule. The software service falls outside that particular goods ban, though the analyst still checks other applicable service restrictions.
Watch the distinction: A customer's connection to a restricted country does not make every activity identical. Match the actual goods or service and destination to each rule's wording.
Reference: [1]
5. Look beyond named targets
A list search answers whether a name appears on the list; it does not settle whether an unlisted entity is restricted. Many regimes also address entities owned or controlled by designated persons, with tests that differ by jurisdiction. Obtain the entity's ownership chain, percentages, voting rights, board appointment rights, and evidence of actual direction. Date those facts because a recent transfer may change the analysis or raise questions about continuing control. Apply the rule for the jurisdiction governing the transaction, rather than a universal percentage. Where interests pass through intermediate companies, document each link and avoid counting the same interest twice. The result may be a restricted entity without its own list entry. Screen the named parties as one control, then perform ownership and control analysis as a separate, evidenced decision.
Worked example: A supplier's exact legal name yields no list hit. Current corporate records identify a designated parent as its owner. The analyst obtains the parent and supplier records, determines the relevant ownership percentage and rights, and applies the rule governing this payment. The absence of a supplier listing cannot close the review; the ownership evidence may independently make dealings with the supplier restricted.
Watch the distinction: A clean entity name is only a clean list result. It cannot override reliable evidence that a designated person owns or controls the entity.
Reference: [1]
6. Apply the US ownership rule
Under OFAC's 50 Percent Rule, an entity is treated as blocked when one or more blocked persons own, directly or indirectly, 50% or more of it in the aggregate, even if the entity itself is unnamed. Add distinct blocked persons' interests in the same entity, taking care not to double count interests that overlap. For an indirect chain, first determine whether an intermediary is itself blocked under the rule; its ownership of a downstream entity then matters as blocked-person ownership. This is not always solved by multiplying every percentage along the chain. Ownership below the threshold does not by itself trigger this rule, although other prohibitions or facts may still matter. Record the owners, percentages, intermediate entities, evidence dates, and arithmetic before instructing operations on any property affected by the US rule.
Worked example: Blocked Person A owns 30% of Firm X and blocked Person B owns another 25%. Their distinct interests total 55%, so X is blocked under the US rule. Separately, A owns 60% of HoldCo, making HoldCo blocked. HoldCo owns 80% of Subsidiary Y, so Y is also blocked through that intermediary. Multiplying 60% by 80% to get 48% misses HoldCo's blocked status.
Watch the distinction: Looking only for a single 50% shareholder misses aggregation. Multiplying through an already blocked intermediary can also give the wrong conclusion about its subsidiary.
Reference: [1]
7. Assess control separately
Ownership and control are distinct questions under UK and EU regimes. A share percentage can answer an ownership test, while voting arrangements, rights to appoint directors, or evidence that a designated person can direct an entity's affairs may answer a control test. Read the test in the particular UK or EU measure and guidance relevant to the transaction; do not substitute OFAC's aggregate 50 Percent Rule. Obtain constitutional documents, shareholder agreements, voting proxies, financing covenants, board records, and evidence of actual decision making. Distinguish a contractual right from a casual business relationship, and assess whether the right is current and enforceable. A small equity stake can coexist with strong control rights. State which control criterion the evidence meets and what uncertainty remains, then apply the consequence prescribed by the governing regime.
Worked example: For a UK-facing payment, a designated person owns 20% of Supplier Q but has a documented, current right to appoint most of its directors. The ownership percentage alone does not resolve the case. The appointment right satisfies the stated UK control criterion in this scenario, so the analyst treats Q under the applicable restriction and records the agreement supporting that conclusion.
Watch the distinction: Using the US ownership percentage as a universal safe harbor misses control rights. Test the board and voting evidence under the jurisdiction's own rule.
Reference: [1]
8. Block or reject
The operational distinction turns on whether the institution holds property in which a blocked person has an interest. Under the assumed US framework, blocking means retaining that property under the applicable restrictions and preventing its transfer; rejection means refusing a prohibited transaction when no blocked property interest requires freezing. Start with a confirmed identity and rule, then trace the property interest, account, payment parties, and transaction route. Do not infer a property interest merely because a restricted country appears in an address or reference field. Conversely, routing blocked property back to the sender would be a transfer, not a neutral refusal. Record the amount, currency, owner, location, and decision basis, and route any associated reporting through the institution's applicable process. A different jurisdiction may use different terms and consequences.
Worked example: Assume a US bank holds a payment beneficially owned by a blocked person. It prevents movement of those funds and records them as blocked property. A separate payment to a prohibited geographic destination has no blocked person's property interest under the scenario facts. The bank refuses that transaction under the assumed ban and returns or handles the funds only as the applicable rule permits.
Watch the distinction: Rejecting funds that must be blocked can move restricted property. Blocking every prohibited payment can also misstate the bank's duty when no blocked interest exists.
Reference: [1]
9. Read authorization precisely
An authorization works only within its written scope. First identify whether the legal provision is an exception, a generally available license, or a specific authorization issued to a holder. Then test the proposed parties, goods or services, dates, amounts, payment route, and attached conditions. A related activity is not necessarily authorized: freight, insurance, financing, intermediary fees, and onward transfers may each need their own analysis. Check whether a condition must be satisfied before performance, and retain the evidence demonstrating compliance. If a transaction has multiple legs, classify each leg separately. An authorization under one regime does not waive another regime that applies to a correspondent bank or counterparty. The practical question is whether the exact contemplated conduct fits the exact permission at the time it occurs.
Worked example: A hypothetical license permits medicine exports to Country R during a stated period but expressly excludes financing fees. The seller's qualifying shipment can proceed if its other conditions are met. A bank's proposed financing fee remains outside the permission, even though it supports that shipment. The analyst separates the goods transaction from the fee, checks other applicable regimes, and withholds the fee unless independently authorized.
Watch the distinction: A license for the main shipment is not blanket permission for every associated service. Read exclusions and conditions against each transaction leg.
Reference: [1]
10. Separate primary and secondary exposure
A primary sanctions rule directly governs conduct with the jurisdictional connection specified by that rule, such as a covered person, institution, asset, or transaction route. Secondary sanctions measures can create consequences for certain foreign conduct even when a direct primary prohibition is not established on the stated facts. Keep those analyses separate. Map the parties and payment path for a direct link first. Then identify any secondary measure relevant to the sector, counterparty, or activity and assess its stated criteria without assuming every foreign transaction is covered. This differs from the broader suspicious activity analysis taught in a CAMS study guide: a sanctions decision must identify the particular prohibition or exposure and the conduct that triggers it. Record uncertainty about hidden routes or beneficial parties rather than silently assuming their absence.
Worked example: Two non-US firms agree to a transaction outside the US, and the stated payment route uses no US institution or asset. Those facts alone do not establish a primary US prohibition. The analyst still checks whether a relevant secondary sanctions measure addresses this specific counterparty and activity. If no measure is identified, the case cannot assert secondary exposure merely because the transaction is international.
Watch the distinction: No visible US payment leg does not finish the analysis where a relevant secondary measure may apply. Equally, secondary exposure cannot be presumed without identifying its criteria.
Reference: [1]
11. Resolve overlapping regimes
When several regimes touch one transaction, make a rule matrix rather than searching for one global answer. For each regime, list the regulated actor, covered conduct, restriction, authorization, and operational result. A payment may be permitted for its sender yet unprocessable by an intermediary. Check the actual route, including branches and correspondents, because changing the route can change applicable rules but cannot erase obligations that still attach to parties or property. Compare permissions independently: a license issued in one jurisdiction has no automatic effect under another. Resolve any conflict before release by finding a lawful route and valid authorization, if available, or by declining the activity. The final instruction should tell operations what to hold, block, reject, or release and under which rule, rather than saying only that sanctions were reviewed.
Worked example: A UK branch initiates a payment through a US correspondent. A UK authorization covers the branch's activity, but no US authorization is shown for the correspondent's processing. The UK permission satisfies only the UK side of the matrix. The bank cannot release the payment through the stated US route until the US processing question is resolved; the branch records both conclusions separately.
Watch the distinction: Applying the most permissive regime to the whole chain disregards another institution's duties. Test each actor and transaction step under the rules that govern it.
Reference: [1]
12. Use the rule in force
A sanctions decision is tied to a point in time. Preserve when the list or measure changed, when the institution received and deployed that change, when the customer was screened, and when the transaction would occur. A prior clear result establishes only what was known and tested then. Before release, compare the current parties, ownership, activity, and route with the rule and designation status then in force. If a change occurs while an instruction is queued, rescreen and reassess before movement. For past transactions, use the dates to identify which rule applied to each event and whether a control delay allowed exposure. Versioned lists and a reliable event log make the decision reproducible. Do not apply a later designation retroactively without a legal basis, but do not treat an old clearance as permission for future activity.
Worked example: A customer screened clear on Monday. A relevant designation takes effect Tuesday, and its payment remains queued for Wednesday release. The analyst stops the Wednesday release, confirms the identity and applicable rule using Tuesday's change, and determines the required treatment. Monday's result was accurate for its screening time but cannot clear a payment that has not yet moved.
Watch the distinction: A historical clear screen is not a standing exemption. Recheck a pending transaction against changes effective before the transaction is processed.
Reference: [1]
Building a Sanctions Compliance Program
13. Map inherent exposure
Inherent exposure describes the risk presented by the business before its controls are credited. Map where customers and counterparties operate, which products can move value or goods, the channels used, and every jurisdiction and intermediary in typical flows. A trade finance book needs attention to vessels, goods, end users, and document changes; a domestic retail book may present a different pattern. Count alone is a weak measure because one complex cross-border flow can involve more sanctions touchpoints than many simple domestic payments. Assess likelihood and potential consequence using defined factors, then evaluate how screening, activity rules, holds, and investigations reduce that exposure. Residual risk follows from both the inherent exposure and control effectiveness. The CGSS practice questions can help you rehearse this sequence with transaction facts rather than memorizing a single risk label.
Worked example: A bank has 10,000 domestic retail customers and adds trade finance for some existing clients. Customer count stays at 10,000, but shipments now pass through multiple ports and involve overseas buyers, banks, and end users. The product and route increase inherent exposure. The bank maps those new parties and document stages, then evaluates whether its current screening and goods controls cover them.
Watch the distinction: Holding customer count constant does not hold sanctions exposure constant. Products, routes, counterparties, and goods can change the risk while the customer total stays unchanged.
14. Assign control ownership
A sanctions control needs an operator, an oversight owner, and an independent test of whether it works. The operating team screens or holds activity and carries out authorized instructions. Compliance interprets rules, sets standards, reviews difficult cases, and monitors outcomes. Independent testing challenges the design and actual operation using evidence beyond the team's own assurance. Specify who may release a held transaction, who can override a decision, what approval is required, and how the payment system receives the result. Separation matters because a reviewer who designed or made a decision may overlook the same weakness when testing it. Record handoffs in a responsibility map, including coverage for absences and urgent alerts. Senior management needs findings and remediation ownership, while individual case decisions still require named accountable roles.
Worked example: Operations releases a held payment after compliance approval. Compliance later checks its own approval and calls that the only control test. The bank keeps operations as the release operator and compliance as the second-line decision owner, then assigns a separate testing function to sample holds, approvals, system logs, and released payments. That test can challenge both teams' work.
Watch the distinction: A second look by the original decision maker is useful review, but it does not provide independent assurance over the decision process.
15. Write executable policy
A useful sanctions policy turns legal duties into actions that a payment or relationship team can execute. Define the events that trigger screening or an activity check, the state of a transaction while an alert is unresolved, the evidence needed for a decision, and who can approve release or an exception. Connect those rules to system permissions so a pending alert cannot coexist with automatic release. Specify escalation for uncertain ownership, licenses, and conflicting jurisdictions, plus how the final decision reaches operations. Risk appetite can set stricter business choices, but it cannot authorize conduct prohibited by law. Test the policy against realistic cases: can each participant say who holds the transaction, who investigates, who decides, and who records the outcome? If any answer is missing, the written control is not yet executable.
Worked example: A rule says only to review risky payments. A flagged transfer arrives, and two teams assume the other will stop it. The revised workflow places the payment in a system hold immediately, assigns an analyst to gather evidence, requires named approval for release, and sends the approved action to the queue. A case cannot be closed while the queue remains in a conflicting state.
Watch the distinction: An instruction to 'review' lacks a safe operational state. Define the hold and release authority so an unresolved alert cannot move by default.
16. Follow the product lifecycle
Sanctions exposure changes as a product moves from opening to closure. At onboarding, identify and screen the customer and relevant owners. At issuance or order placement, check beneficiaries, goods, services, and destinations. At amendment, detect new parties, routes, values, or documents rather than relying on the original assessment. At payment and settlement, screen the parties actually present and apply the rule in force then. Closure can still involve returning balances or releasing collateral, both of which may be restricted. Map each stage to its data source, control, owner, and stop point. In trade finance, a letter of credit can be sound at issuance while a substituted beneficiary or altered shipping destination changes the later decision. A control attached only to the first stage leaves the rest of the product exposed.
Worked example: A letter of credit's beneficiary is clear at issuance. Before settlement, an amendment substitutes a different beneficiary. The bank treats the amendment as a new party event, screens the replacement, and keeps settlement held until the result is resolved. The original screening remains evidence for the original beneficiary, but it says nothing about the substituted payee.
Watch the distinction: Treating issuance clearance as permanent ignores later amendments and settlement facts. Check the parties and activity that exist at each consequential stage.
17. Repair source data
A screening engine can compare only the data it receives in usable fields. Check whether the legal name, aliases, birth details, registration number, country, and ownership data are captured, current, and mapped to the intended screening fields. A blank structured name field can produce a clear result even if a name appears in a note the engine never reads. Diagnose the data path before changing fuzzy matching sensitivity: trace the source record, interface transformation, screening input, output, and case display. Measure the affected population and period, repair the mapping, and rescreen records that may have been missed. Data quality controls should flag null fields, unexpected truncation, and stale updates. Threshold tuning addresses match behavior; it cannot recover an identifier that never entered the comparison.
Worked example: A customer's legal name appears in a free-text note, while the screening name field is empty. The engine reports no match. The analyst traces the interface, corrects the mapping, and rescreens customers affected while that mapping operated. If a match now appears, it is investigated. Lowering the engine's match threshold would not have fixed the missing name input.
Watch the distinction: A clear engine result does not validate its input. Inspect source fields and interfaces before concluding that matching sensitivity caused a missed hit.
Reference: [1]
18. Collect ownership evidence
Ownership analysis needs a dated chain, not a single declared percentage. Collect registry extracts, shareholder records, intermediate entity ownership, voting agreements, and supporting customer documents. Show each path from a natural person or designated entity to the customer, distinguishing direct shares, indirect interests, and control rights. For percentage calculations, state whether a path represents an effective economic stake or ownership by an intermediary that becomes restricted under the governing rule. Reconcile conflicting documents and avoid adding the same shares twice. Changes around a designation deserve particular attention because legal title may move while voting or profit rights remain. Once the chain is reliable, apply the jurisdiction's ownership and control tests separately. The record should let another reviewer reproduce the percentages, dates, and legal conclusion without guessing how an intermediate holding was counted.
Worked example: A customer declares Person A's direct 40% holding. A current registry shows a separate 15% of the customer's shares held by a vehicle wholly owned by A. Assuming those are distinct shares, A's direct and indirect economic interests total 55%. The analyst confirms the vehicle chain and dates, then applies the governing jurisdiction's ownership test; the arithmetic alone does not establish every regime's control conclusion.
Watch the distinction: Accepting the declared 40% misses an additional ownership path. Adding percentages without verifying separate shares and intermediate rights can also overstate the result.
Reference: [1]
19. Choose governing lists
List governance begins with legal exposure, not with whichever vendor feed is easiest to buy. Inventory the jurisdictions governing each branch, customer population, payment route, and product. For each, identify the official designations and measures that require name or activity screening. Some restrictions concern countries, goods, financing terms, or ownership and cannot be represented by a simple person-name list. Map each source to the systems and populations that use it, including third parties and payment participants. Record why a list is included or excluded, its source, update method, and owner. A global customer file may need different checks when processed by a US branch than when used only elsewhere. Vendor lists can help distribute data, but their content and timing should be reconciled to the governing official sources.
Worked example: A firm screens its shared customer database only against an EU list, although its US branch processes those customers' payments. The control inventory must add the relevant US measures for the branch's activity and determine which customers and payment parties need those checks. The analyst also maps non-name restrictions into activity controls, since adding a US name list alone would not cover every applicable rule.
Watch the distinction: One broad list is not proof of complete coverage. Match each screening population and transaction type to the regimes and restrictions that actually apply.
20. Govern list updates
A designation update has several distinct times: the legal change, the official source publication, feed receipt, deployment to each engine, and any rescreening completion. Preserve source identifiers and versions at every stage so the institution can identify which rule set screened a particular customer or payment. Monitor failed downloads, parsing errors, delayed interfaces, and engines running different versions. When a gap appears, define the affected time window and population, hold pending activity as appropriate, and rescreen transactions or relationships that may have escaped the new designation. Review released activity against its actual processing time and applicable rule; do not assume every transaction in the window is a hit. Document the cause, affected records, decisions, and fix. A successful feed receipt is only one step; the control works when the updated content reaches decisions.
Worked example: An official designation reaches the institution's source feed at 09:00, but the payment engine deploys it at 14:00. The gap is five hours. The team identifies payments screened and released between 09:00 and 14:00 using engine version and timestamps, then rescreens that population against the new entry. Any true matches receive case review under the applicable rule; the team also repairs the deployment delay.
Watch the distinction: Seeing an update in the feed does not prove the payment engine used it. Track deployment versions and examine activity processed during a delayed update.
Reference: [1]
21. Normalize names carefully
A screening engine compares text, while an investigator decides whether two records describe the same person. That distinction matters when a name moves between scripts. Cyrillic letters can be Romanized in more than one way; given and family names may change order; prefixes, patronymics, and compound surnames may be omitted or split. Build searchable variants while preserving the original script and the source record. Then compare identifiers such as birth date, address, and documents against the alert. Treat a name variant as a reason to review, not as proof of identity. The CGSS handbook excerpt identifies transliteration, Romanization, and naming conventions within customer and third-party screening. In practice, record which transformation produced the match so a reviewer can explain both why it appeared and how it was resolved.
Worked example: A list records the Cyrillic name Иван Петров, Romanized as Ivan Petrov. A customer record says Petrov, Yvan. Reordering the names and accepting the alternate rendering produces an alert. The listed person was born in 1974 and lives at Address A; the customer’s verified birth year is 1992 and address is B. Those conflicts support closing this identity match, with both spellings retained in the case.
Watch the distinction: A different Roman spelling does not clear a person, and a similar spelling does not confirm one. Compare the underlying identifiers after normalization.
Reference: [1]
22. Use fuzzy matching judiciously
Fuzzy matching scores similarity rather than requiring identical strings. It can catch a missing letter, a transposition, or a transliterated variant, but a permissive setting also raises alerts between unrelated people with common names. The useful question is how a proposed setting changes both detection and review volume for the population being screened. Test it on labelled true matches, plausible variants, and known nonmatches; include names from the scripts and naming patterns customers actually use. Separate the score that creates an alert from the evidence needed to close or confirm it. A low score may still matter when a unique document number agrees, while a high name score may collapse under a verified birth-date conflict. Preserve score, matching fields, and rule version so reviewers can reproduce the result.
Worked example: A customer named Mara Ilyin triggers against listed person Maria Ilyin because the given names differ by one letter. Both names are common in the customer population. If birth dates and passport numbers match, investigate a possible alias. Here the listed birth year is 1968, the verified customer year is 1990, and their countries differ. With no linking evidence, document a false positive rather than confirming the name alone.
Watch the distinction: A higher similarity score is not a probability that the customer is listed. It measures text resemblance under a particular matching rule.
Reference: [1]
23. Weigh secondary identifiers
Secondary identifiers help answer whether a name alert refers to the same person or entity. Start with provenance: a verified passport number usually carries more identity value than an unverified address typed into a form. Birth dates may be incomplete or recorded incorrectly, nationality can change, and addresses may be shared. Company registration numbers are powerful only when paired with the issuing jurisdiction, since formats can repeat across registries. Look for independent agreement or decisive conflict, and explain apparent discrepancies such as an old address or an expired document. Do not count several fields copied from one source as independent corroboration. A decision record should show the list identifiers, customer evidence, reliability of each source, and why the combination supports confirmation, closure, or further inquiry.
Worked example: A customer and listed person share the name Samir Rahman. The listed record has a birth date of 4 June 1971 and passport P4418; verified customer documents show 19 August 1988 and passport Q9073. The identifiers conflict on two relatively strong fields, with no address or relationship link. Close this identity alert, preserve the documents and list version, and reassess if later evidence changes the picture.
Watch the distinction: Do not treat every identifier as an equal vote. Two copied or weak fields cannot automatically outweigh a reliable, unexplained conflict in identity evidence.
Reference: [1]
24. Screen at onboarding
Onboarding creates a window in which a relationship can be established before its sanctions status is settled. Design the workflow so names, aliases, relevant ownership, and intended counterparties are screened before the customer can use a product. Identity verification and sanctions screening answer different questions: a genuine passport proves who applied, but does not establish that the person may transact. An unresolved alert needs an operational state that prevents release while an authorized reviewer gathers identifiers and determines the applicable restriction. Administrative steps, such as collecting documents, can continue if the product workflow permits them; access to funds or services should follow the resolution. Record when the screen ran, what data it used, and who lifted the hold. That sequence prevents a case-tool decision from being disconnected from actual account permissions.
Worked example: A new client passes identity checks, but her name and birth date resemble a listed person under the regime governing the bank. The account record is created to receive documents, with outgoing transfers disabled. A reviewer checks passport details and the list entry, then records either a supported false positive and release or a confirmed match and the required restriction. Identity approval alone never enables payment access.
Watch the distinction: Passing customer identification does not resolve a sanctions alert. The same verified identity may be the very fact that confirms a listed-person match.
Reference: [1]
25. Rescreen changing relationships
An onboarding screen is a decision about a relationship at one point in time. It becomes stale when a list changes or when the customer changes name, ownership, location, or activity. Build two paths: rescreen affected records after relevant list changes, and trigger review when customer data changes. The second path matters for nonlisted entities because a newly designated owner may create a restriction under the governing regime even if the company’s own name remains clear. Capture the effective date and source of each change, then identify transactions that occurred between the change and detection. Rescreening is useful only if it reaches the current legal name, aliases, beneficial owners, and parties the product actually pays. A prior false-positive decision should be reused only while its decisive identifiers remain valid.
Worked example: A customer was clear in January. In April it adopts a new legal name and records a new owner who is designated under the applicable jurisdiction. The bank screens the new name and assesses the owner’s interest and control before another transfer. It also checks payments since the ownership change. January’s clear result covered different facts and cannot authorize April activity.
Watch the distinction: A scheduled name rescreen alone can miss a change in ownership or control. Customer-event triggers must feed the same sanctions decision process.
Reference: [1]
26. Include related parties
A transaction may expose the firm to a restricted party even when its direct customer is clear. Identify who receives money, supplies goods, acts as agent, owns the counterparty, or otherwise holds an interest in the activity. The relevant set depends on the product: a payment brings originator, beneficiary, and banks into view; trade finance may add supplier, carrier, vessel, and end user. Gather each party’s role before applying the governing rule. A listed name in a document is an investigative lead, while a designated payee or owner can affect the transaction directly. For broader financial-crime context, the CFCS study guide can help distinguish party mapping from other investigative questions; the sanctions decision still turns on the applicable measure and the party’s actual interest.
Worked example: A permitted exporter asks a bank to pay a commission to Agent L. The exporter screens clear, but Agent L is designated under the jurisdiction governing this payment. The bank identifies L as the actual payee, holds the commission instruction, and applies that designation’s restriction. It assesses the export separately; the customer’s clear status cannot clear a payment to its agent.
Watch the distinction: Screening the account holder alone does not cover everyone who benefits from a transaction. Map each party’s role before deciding which restrictions apply.
Reference: [1]
27. Parse payment messages
Payment messages contain structured party fields and free text, each with a different evidential role. Originator, beneficiary, and bank fields identify stated participants; remittance and reference fields may describe an invoice, vessel, port, or underlying deal. Parse the whole message, preserve field labels, and avoid turning every string match into a conclusion about ownership of funds. A designated vessel in a reference can indicate a restricted service or trade route, yet the text may also refer to an unrelated past shipment. Resolve it using invoice, bill of lading, and payment purpose. Missing or truncated fields are a data-quality problem, not evidence of a clear transaction. The investigation should identify which record supplied a name, which party that name represents, and which activity the applicable measure restricts.
Worked example: A payment names an unlisted exporter as beneficiary, but the remittance line reads ‘freight for vessel North Star,’ which matches a designated vessel. The analyst holds the transfer and obtains the invoice and shipping documents. If North Star carried the shipment, a service or property-interest question arises under the governing regime. The reference alone does not prove the vessel owns the payment.
Watch the distinction: A match in free text is neither automatically harmless nor automatically a blocked payee. Determine what the referenced name represents in the underlying transaction.
Reference: [1]
28. Screen transaction chains
A transaction can acquire new participants after its first screen. An intermediary may add an ultimate recipient, amend a bank route, or clarify an agent’s role before settlement. Treat each material change as a new decision input: compare the latest instruction with the screened version, extract newly named parties, and screen them under the regimes engaged by the route. Keep the chain of messages so a reviewer can see who introduced a change and when. A clear result for the original beneficiary says nothing about a different ultimate payee. Also distinguish an intermediary bank that processes funds from the person ultimately receiving them; their roles may trigger different restrictions. Settlement controls must consume the current party set and the latest case outcome, or a correct investigation can still end in an improper release.
Worked example: At initiation, the payment names clear Beneficiary A. Before settlement, an intermediary instruction adds Ultimate Payee B, who was absent from the original message. The bank pauses settlement, screens B, and records B’s role and the amended instruction. If B is designated under an applicable regime, the bank applies that restriction. The initial clear screen cannot cover B.
Watch the distinction: Screening once at initiation assumes the party set stays fixed. Reconcile amended instructions before settlement, especially when the ultimate recipient changes.
Reference: [1]
29. Encode activity restrictions
Name screening detects named targets and some related-party risks; it cannot identify a prohibited activity when every party is unlisted. Translate each applicable measure into testable attributes: destination, origin, goods specification, service, financing type, maturity, end use, or sector. The rule must use data available in the workflow and flag missing facts when classification depends on them. A broad product label such as ‘equipment’ is often insufficient; technical specifications and shipping documents may decide whether a goods rule applies. Test the activity, party, jurisdiction, and date together, then consider any authorization or exception within its precise scope. Store the measure and rule version behind the decision so later reviewers can tell whether a transaction was permitted under the rule then in force.
Worked example: Assume a hypothetical rule in the bank’s jurisdiction prohibits exporting Model P pumps to Country R. An invoice names unlisted seller and buyer, but the specification identifies Model P and the delivery address is in R. The activity rule flags the shipment despite clear names. The bank holds the related financing while confirming the model and destination, then applies the stated ban if both facts stand.
Watch the distinction: Clear party names do not make a transaction permissible. Goods, destination, financing, and services restrictions can apply without a listed counterparty.
Reference: [1]
30. Tune with measured outcomes
Threshold tuning changes both workload and the chance of missing a true match. Measure these separately using labelled cases that resemble live names, scripts, aliases, and data errors. For each setting, count true matches detected, true matches missed, and nonmatches alerted. Detection rate is detected true matches divided by all known true matches; alert reduction is the change in total alerts divided by the original alert count. A lower alert count is useful only if the lost detection is understood and addressed, perhaps through better data, additional identifiers, or a separate rule. Validate on cases kept out of the tuning set so a setting is not merely fitted to familiar examples. The CGSS practice questions can reinforce the distinction between a screening score and an evidence-based decision.
Worked example: A current setting produces 800 monthly alerts and detects all 20 known test matches. A proposed setting produces 500 alerts but detects 18. Alert volume falls by 300, or 37.5% of 800; detection falls from 20/20, or 100%, to 18/20, or 90%. The two missed cases require analysis before adoption. The test set does not itself estimate the live miss rate.
Watch the distinction: Fewer alerts are not proof of better screening. Count missed known matches and examine whether the test cases represent the names actually encountered.
Reference: [1]
31. Triage by consequence
Triage orders work by potential consequence while keeping every alert accountable. Consider match strength, whether a payment is about to leave, whether funds may include a restricted interest, and what the applicable measure requires. A strong match attached to an imminent transfer can demand an immediate operational hold even before identity is confirmed. A weaker alert on an inactive account may allow more time to gather identifiers, but it still needs an owner and a deadline set by the firm’s workflow. Separate priority from outcome: urgent does not mean confirmed, and low priority does not mean cleared. Record the reason for ranking and watch for ageing, because a low-priority case can become urgent when the account initiates a payment or new evidence appears.
Worked example: Two alerts arrive at noon. One links a near-exact listed name and matching birth date to a payment due for release now; the other is a common-name similarity on an inactive account with no matching identifiers yet. The payment is held and reviewed first. Both cases remain open with assigned reviewers, and the inactive account is reassessed before any new transaction.
Watch the distinction: Do not equate a strong match with a final sanctions finding. Triage protects the transaction while the investigator confirms identity and the governing rule.
Reference: [1]
32. Confirm a true match
Confirming a true match requires affirmative identity evidence, not merely the absence of conflicts. For a company, compare registration number and jurisdiction, address, aliases, and corporate history; for a person, use reliable documents and biographical details. Ask whether those fields come from independent sources or were copied from the same record. Once identity is established, make a separate legal assessment: which regime applies, what restriction attaches to the identified party, and whether the activity or property is within its scope. This two-stage reasoning avoids declaring a transaction prohibited solely because a record matches. Document the specific identifiers that establish identity, the list entry and version, the applicable measure, and the operational action. If a material identifier remains unexplained, keep the case unresolved rather than forcing a binary conclusion.
Worked example: A customer company and a listed company have the same legal name, registration number in the same jurisdiction, and registered address. Current registry evidence confirms the number belongs to the customer, establishing the identity match. The analyst then reads the applicable designation and the bank’s jurisdictional link before deciding whether to hold, freeze, or otherwise restrict a particular payment.
Watch the distinction: A confirmed identity match is not the entire sanctions decision. The investigator must still establish the applicable jurisdiction, restriction, and transaction interest.
Reference: [1]
33. Close a false positive
A false positive is a supported conclusion that the screened record and the listed record describe different subjects. Record decisive evidence, such as conflicting verified birth dates and passport numbers, rather than a bare ‘clear’ code. Explain source reliability and any remaining similarities. This creates a reusable decision for the same stable facts, but reuse must be bounded: a new alias, changed document, updated list entry, or different customer may remove the basis for closure. Suppression rules should identify exactly which record pair and identifiers they cover, with review when those facts change. Avoid broad name-only whitelists, which can conceal a later true match. Preserve the original alert, evidence, reviewer, time, and action so an independent tester can reconstruct why the transaction was released.
Worked example: The listed person and customer are both named Lina Haddad. The list gives a 1970 birth date and passport A318; verified customer records give a 1994 birth date and passport B802. The analyst records both conflicts, their sources, and the list version, then closes this record pair. A later passport change or updated list identifier triggers fresh review rather than automatic clearance.
Watch the distinction: A false-positive closure is not permanent immunity for a name. Its validity depends on the identifiers and list facts that supported it.
Reference: [1]
34. Control the release decision
An investigative conclusion has value only when the operating system acts on it. Link case states to payment and account permissions: unresolved means hold; a supported false positive may permit release; a confirmed case requires the action dictated by the applicable restriction, which may differ between blocking and rejecting. Define who may authorize each transition and require the queue to receive the final decision before it can move funds. Reconcile case-tool status with the actual payment state, particularly after manual overrides or amended instructions. The audit record should connect case ID, transaction ID, decision maker, time, rule, and downstream action. A ‘possible match’ is not an approval, and a release instruction should not be inferred from silence or a reviewer note.
Worked example: An analyst marks a payment alert ‘possible match,’ but the payment queue still shows ‘approved’ from an earlier routine check. Operations changes the queue to held and records the case ID. After the authorized reviewer resolves identity and the applicable rule, the queue receives an explicit release or restriction instruction. Until then, the approved display cannot justify settlement.
Watch the distinction: Closing an investigation screen does not necessarily change the payment queue. Verify that the authorized decision reached the system that controls funds.
Reference: [1]
35. Account for frozen assets
When the applicable regime requires property to be frozen, the institution must know what property it holds and prevent unauthorized movement. A frozen-asset ledger should identify the owner or interest holder, legal basis, account or custody location, currency, opening balance, and every subsequent credit or permitted movement. Reconcile it with the core account balance so fees, interest, reversals, and currency changes do not silently release value. An additional credit may itself become part of the frozen property, depending on the governing rule; determine that treatment rather than treating the original balance as fixed forever. Keep the operational restriction separate from accounting: a ledger entry describes value, while the account control stops transfer. Any reporting or permitted handling follows the specific jurisdiction’s requirements.
Worked example: Under a hypothetical rule, a bank freezes an account holding 12,000 currency units. The account later earns 300 units of interest, which the rule treats as part of the frozen property. The ledger records 12,000 + 300 = 12,300 frozen units and identifies the interest credit. Operations prevents payout of both principal and interest unless an applicable authorization permits it.
Watch the distinction: Freezing an account does not mean its recorded balance can never change. New credits must be accounted for and their treatment assessed under the governing rule.
Reference: [1]
36. Validate a license claim
A license or authorization is usable only for the conduct it actually covers. Verify its issuing authority and authenticity, holder, counterparties, activity, dates, conditions, and any value limit. Then compare the proposed transaction with prior use under the same authorization. Calculate remaining capacity in the stated currency or units, allowing for any relevant commitments already counted under its terms. Do not assume a license for the shipment also covers every fee, bank, route, or related service. If the transaction exceeds a limit, determine whether a genuinely separable portion may proceed under the license; do not split a single prohibited transaction merely to evade the cap. Keep a usage record linked to each processed transaction so subsequent reviewers can reproduce the remaining balance.
Worked example: Assume a valid hypothetical license permits qualifying transfers up to 80,000 currency units. Verified prior use totals 65,000, leaving 80,000 − 65,000 = 15,000 units. A proposed qualifying transfer is 20,000 units, exceeding the remaining capacity by 5,000. It cannot be processed in full under that license; any partial processing depends on its terms and a genuinely separable instruction.
Watch the distinction: Possession of a license does not authorize every related payment. Match the exact parties, activity, conditions, dates, and unused limit.
Reference: [1]
37. Make required reports
Internal escalation and external reporting serve different purposes. Escalation gets the facts to staff who can decide the restriction and control the asset or transaction; an external report communicates a reportable event to the competent authority under the applicable regime. For a US-facing case involving blocked property, preserve the identity evidence, property details, date of action, and legal basis, then route the matter for applicable OFAC reporting. Determine the actual report type and timing from the governing rule in force; do not substitute a generic case note. A separate suspicious-activity assessment may also arise, but it does not replace sanctions reporting. The CGSS programme covers practical sanctions and programme-management skills across jurisdictions, so always name the jurisdiction before assigning the reporting path.
Worked example: A US-facing bank confirms that funds it holds include a blocked person’s interest. Operations restricts the funds and records their amount, currency, owner, and location. Compliance receives the case and determines the applicable OFAC report and submission requirements. The investigator’s internal note supports that work but is not itself the external report.
Watch the distinction: A case escalation is not automatically a report to the authority. Confirm which external duty the applicable jurisdiction imposes and document completion.
38. Preserve decision evidence
A sanctions decision should be reconstructable by someone who did not handle the case. Preserve the customer and transaction data as screened, the official list entry and version, the matching rule or score, evidence gathered, jurisdictional analysis, approval, and action taken. Time stamps matter because a list or customer record may change between screening and release. Store source documents or stable references with enough context to explain their reliability. A bare result code cannot show whether a reviewer saw the right beneficiary, used the current list, or resolved a decisive identifier. Evidence retention also supports later rescreening, independent testing, and review of a newly discovered control gap. Make records searchable by both case and transaction identifiers so the decision can be traced through operational systems.
Worked example: A payment was released after an alert was closed, but the surviving case record says only ‘clear.’ Reviewers cannot tell whether the customer’s passport differed from the listed person’s or which list version was used. A complete record would retain both identifiers, source dates, list entry, rationale, approver, release time, and payment ID. Without those, the historical decision cannot be reliably reconstructed.
Watch the distinction: A final disposition code records the outcome, not the reasoning. Keep the inputs and approval that made the outcome defensible.
Reference: [1]
39. Trace control interfaces
Sanctions controls depend on a chain of systems, not just a matching engine. Map where customer and transaction fields originate, how list updates arrive, what the engine receives, how alerts reach investigators, and how decisions control payment release. At each interface, compare field names, formats, timestamps, record counts, and rejected messages. A beneficiary omitted during transfer cannot be recovered by better fuzzy matching because the engine never sees the name. Likewise, a correct decision in a case tool does not protect funds if the queue fails to receive the hold. Test both normal flows and failures, such as a missing file or a delayed message, and define reconciliation that exposes gaps. Assign an owner to each handoff so an error has a clear investigation path.
Worked example: A list feed updates at 09:00 and the engine imports it correctly. A nightly payment interface, however, drops a newly added ultimate-beneficiary field, so the engine screens only the intermediary. A test message shows the missing field at the interface boundary. The repair maps and validates that field, then checks affected payments; changing the matching threshold would not address the omission.
Watch the distinction: A healthy list feed does not prove complete screening. Verify that every relevant party field reaches the engine and that decisions reach operations.
Reference: [1]
40. Test controls independently
Independent testing asks whether a control was designed for the risk and whether it operated on real cases. Select representative transactions across products, jurisdictions, high-risk routes, amendments, and known data weaknesses. Trace each from source record through screening, alert, decision, and final payment state. Use seeded cases to test whether intended matches trigger, but also inspect production cases for missing fields and improper releases. A repeated failure in the same field points to an interface or validation defect, even if individual reviewers followed the information they received. Quantify the observed exception rate for the sample and state its limits; a targeted sample is not a population estimate. Report root cause, affected period and records, corrective owner, and evidence that the repair works in operation.
Worked example: An independent tester samples 30 high-risk payments. Three lack originator data in the screening input, and all three were released. The observed sample exception rate is 3/30 = 10%; because the sample is targeted, that is not a firm-wide rate. The common missing field points to an input control failure. Testing traces its source, identifies affected payments, and verifies the corrected interface.
Watch the distinction: Three similar failures are not necessarily three independent reviewer mistakes. Follow the data path to find a shared cause before choosing remediation.
Reference: [1]
41. Train for assigned decisions
Training works when each employee can recognize the decision they own and the point at which they must stop. A relationship manager needs to identify an alert, preserve any transaction hold, collect permitted facts, and route the case without deciding whether a listed person is the customer. An investigator needs stronger instruction on identity evidence, applicable restrictions, ownership, and documenting a conclusion. Operations staff need an unambiguous release instruction from an authorized decision maker. Customer contact deserves its own practice: an ordinary service update may be appropriate, while revealing the suspected identity or investigative theory can compromise an inquiry. The CGSS programme covers practical sanctions and programme management across jurisdictions. Effective exercises therefore use the firm's actual handoffs and test what each role does when information remains uncertain.
Worked example: At a UK bank, a payment alert reaches a relationship manager before settlement. She has no authority to clear the match. She keeps the payment on hold, records the client's routine inquiry, and refers the identity evidence to sanctions compliance. She tells the client only that processing requires review, using approved wording. Compliance determines the match and instructs operations on the payment's status.
Watch the distinction: A relationship manager may think transparency requires naming the suspected target. Customer communication and investigative disclosure are different decisions; the manager should use the authorized wording and escalation route.
42. Use metrics to remediate
A sanctions dashboard should reveal where a control fails, not merely count alerts. Separate incoming alerts from unresolved cases, then measure their age against the firm's own processing target and the time remaining before a payment would be released. Compare list publication with deployment time to find update gaps. Review overrides by reason and approver, and examine repeat findings to see whether a prior fix worked. A falling alert count can reflect cleaner data or weaker detection, so pair it with tests using known matches and sampled decisions. Segment measures by product, jurisdiction, and queue; an average can hide a growing urgent backlog. When choosing remediation, identify the failing step first: input quality, staffing, review instructions, system routing, or approval. CGSS practice questions can help rehearse these distinctions through scenarios.
Worked example: A bank receives 200 payment alerts in each of two weeks. Cases older than its internal review target rise from 8 to 26, an increase of 18 cases, or 225% relative to the first week. The stable intake points toward slower resolution, not greater detection. The team checks staffing, handoffs, and case complexity while keeping affected payments held.
Watch the distinction: Lowering match sensitivity might reduce the visible backlog, but it can hide genuine matches. Diagnose why cases age and test detection before changing a screening setting.
Reference: [1]
Detecting and Investigating Sanctions Evasion Techniques
43. Unwind shell-company chains
A shell-company chain can separate the invoice buyer from the person who benefits from the transaction. Start with the legal buyer, then trace each ownership branch through dated registry filings, share registers, and transaction documents. Record each link's percentage and identify whether the same person appears through several intermediaries. Under the US OFAC aggregate ownership rule, interests of blocked persons must be considered together; an unlisted buyer can therefore be blocked through ownership. Other jurisdictions have their own ownership and control tests, so apply the rule governing the transaction rather than assuming one global percentage. Ownership records may also be incomplete or stale. Compare them with signing authority, financing, profit flows, and any recent transfers. A diagram is useful only if every arrow is backed by evidence and its effective date is clear.
Worked example: For a US payment, Buyer Ltd is 30% owned by Hold A and 25% by Hold B. One blocked person owns 100% of each holding company. The two paths give that person 30% plus 25%, or 55%, of Buyer Ltd. Under OFAC's aggregate 50 Percent Rule, the unlisted buyer is treated as blocked. The analyst verifies both ownership paths before instructing the payment team.
Watch the distinction: Seeing two apparently separate holding companies can make each stake look harmless. Trace their ultimate owners and aggregate interests under the applicable rule before clearing the buyer.
Reference: [1]
44. Recognize nominee control
A nominee's name on a register may describe legal title without describing who directs the entity. Test control through the right to appoint or remove directors, voting agreements, powers of attorney, bank mandates, contract approvals, and the destination of profits. Distinguish evidence of influence from a legally relevant control right: one approved invoice may show involvement, while a continuing right to appoint most directors can determine decisions. Interview or documentary explanations should be checked against independent records and dates. In a UK-facing case, evaluate the UK ownership and control criteria directly; the US aggregate ownership rule cannot substitute for them. Keep the nominal owner's role in the record, because it may explain how instructions were carried out even when another person controlled the company. A conclusion should state which facts establish control and which remain allegations.
Worked example: A UK branch reviews a supplier whose registry names an unrelated director. A signed agreement gives a designated person the right to appoint four of five directors, and bank mandates show that person's approval is needed for major payments. Those documented rights support a UK control finding despite the registry entry. The branch holds the transaction and records the governing rule and evidence.
Watch the distinction: A clean director name does not settle control. A separate person may hold enforceable board rights or direct payments, so examine governance documents and actual authority.
Reference: [1]
45. Examine hurried restructuring
Restructuring near a designation date deserves a before-and-after analysis. Build a timeline of the designation, share transfer, payment of consideration, changes to voting rights, board appointments, financing, and continuing profit rights. A signed sale document proves that parties recorded a transfer; it does not alone prove that economic benefit or control moved. Consider whether the buyer had funds, whether the price was actually paid, and whether side agreements let the former owner direct decisions. A genuine transfer can also occur after a designation, so timing is a clue rather than a conclusion. Apply the jurisdiction's rule to the rights at the transaction date, accounting for any restriction on dealing with the shares themselves. Preserve both the earlier and later records because a current register may conceal how the arrangement arose.
Worked example: One day after a UK designation, an owner signs a sale of all shares to a relative. No payment appears in the bank records, and a side agreement lets the designated person cast every board vote. The nominal shareholding changed, but the retained voting authority supports continued control under the stated UK facts. The payment remains held while the agreement's validity and scope are verified.
Watch the distinction: Treating a new shareholder register as conclusive overlooks retained rights. Test the transaction's price, payment, voting arrangements, and effective dates before concluding control ended.
Reference: [1]
46. Find the true end user
The invoice buyer is not necessarily the person who will use the goods. Trace the order from manufacturer to distributor, consignee, installation site, and operating entity. Compare the stated purpose with the equipment's capability, the buyer's business, service contracts, shipping instructions, and who provides technical requirements. An intermediary may have a sound commercial role, such as stocking and resale, but unexplained routing or instructions from another party can reveal a concealed end user. Under a goods restriction, the critical question may be final destination, end use, or recipient, depending on the rule's wording. Record what is known separately from what is inferred. When evidence conflicts, hold the affected shipment or financing decision while seeking specific documents that can resolve the conflict, such as an end-user statement and installation records.
Worked example: Assume a UK rule bars supplying specified equipment to an end user in Country R. A distributor in Country C buys the equipment but cannot identify an application. Its shipping instruction names a factory in R, and the factory supplied the technical specifications. The factory is the likely end user, so the UK seller cannot clear the order merely because the invoice names the distributor.
Watch the distinction: A distributor's location does not establish final use. Follow shipping, technical, and service evidence to the operating site before applying a destination or end-user restriction.
Reference: [1]
47. Challenge goods descriptions
Goods descriptions can be broad for ordinary commercial reasons, but a vague label is insufficient where a restriction turns on technical features. Compare the invoice with model numbers, specifications, photographs, packing lists, customs classifications, and the manufacturer's product information. A customs code is a useful lead, not a substitute for reading the legal description of controlled goods. Check whether the restriction covers the complete item, a component, associated software, or technical assistance. Then connect that classification to the transaction's jurisdiction and destination. If documents conflict, identify the precise feature that would change the classification and obtain evidence for it. A defensible conclusion records the product version and the source of each characteristic; otherwise a seller could clear a shipment by changing only the invoice wording.
Worked example: Assume a Canadian rule bars exports of pump model PX-7 to Country R. An invoice for a shipment to R says 'industrial parts,' but the packing list and manufacturer's specification both identify PX-7 pumps. The detailed identifiers meet the hypothetical rule's product condition, so the shipment is held. The invoice's broad label does not change what is being exported.
Watch the distinction: A generic invoice label can look reassuring because it lacks a controlled term. Classify the actual item from reliable specifications, then apply the rule's product and destination conditions.
Reference: [1]
48. Verify claimed origin
Origin is a factual and legal question that cannot be settled by a certificate in isolation. First identify what the applicable measure means by origin; shipment from a country and production in that country may be different facts. Reconcile the certificate with manufacturing records, serial numbers, supplier invoices, transport documents, and the seller's production capacity. Check dates and quantities so one certificate is not used to cover unrelated goods. A route through a third country may be legitimate, yet repacking or relabeling there does not by itself establish a different origin. If records conflict, state the unresolved link and preserve the goods decision while obtaining the missing evidence. Avoid turning suspicion into a definitive origin finding: the purpose of the review is to test whether the rule's origin condition is met.
Worked example: Assume an EU-facing transaction is subject to a hypothetical ban on goods originating in Country B. A certificate names Country A, but serial records identify production in B and the seller shows no A production for that batch. Transit through A does not resolve the conflict. The importer holds the transaction and seeks authenticated manufacturing and batch records before deciding origin under the stated rule.
Watch the distinction: A certificate may be genuine yet describe routing or a different batch. Match its goods, dates, and issuer to production evidence before treating origin as established.
Reference: [1]
49. Map transshipment routes
A transshipment point can be part of a legitimate logistics chain or a way to obscure the final destination. Reconstruct the path using purchase orders, bills of lading, container or serial numbers, warehouse releases, onward bookings, and the final consignee. Compare the destination stated at sale with the destination shown in later transport records. Relabeling is relevant when it coincides with changed documents or concealed consignee details, but it does not prove evasion by itself. Apply the restriction to the destination or end user defined in the governing rule, and identify when that destination became known to the parties. A useful case record shows each handoff, who controlled it, and the evidence linking the same goods across legs. That makes a destination conclusion stronger than a simple map of ports.
Worked example: Assume a US exporter may not send specified equipment to Country R under a hypothetical rule. Its order names Country C. The same five serial numbers appear on a shipment into Country D and an onward bill to R after labels change. Those records link the goods to R, so the exporter holds fulfillment and assesses the R restriction despite the original C invoice.
Watch the distinction: Transit through a third country does not automatically change the destination. Follow identifiers and onward documents to determine where the same goods are actually going.
Reference: [1]
50. Assess dual-use end use
Dual-use analysis joins product classification with the proposed use. Determine the item's measurable capabilities and exact model, then compare them with the language of the applicable goods or end-use restriction. Assess who ordered it, where it will be installed, who specified its configuration, and what support the seller must provide. A buyer's broad industry label is weaker than technical requirements tied to a particular facility. Conversely, a sensitive capability does not make every transaction prohibited; the rule may depend on destination, end user, authorization, or a defined use. Separate a red flag from the legal conclusion and seek evidence that tests the specific concern, such as a facility description or installation plan. The decision should show both the product analysis and the transaction facts that activate, or fail to activate, the restriction.
Worked example: Assume an EU-facing rule restricts specified sensors for aerospace testing in Country R. The buyer calls them agricultural supplies, but the model specification matches the covered sensor, the installation address is an R aerospace test site, and the order requests aerospace calibration. These facts meet the hypothetical product, use, and destination conditions. The seller holds the order rather than relying on the buyer's label.
Watch the distinction: A plausible civilian label does not override technical and installation evidence. Equally, capability alone may be insufficient; connect the item and actual use to every condition in the rule.
Reference: [1]
51. Interpret AIS gaps
Automatic Identification System data can show a vessel's reported position, but a missing signal has several possible causes: reception gaps, equipment problems, safety concerns, or deliberate switching off. Plot the last and next reliable positions and ask what movements were physically possible during the gap. Then compare independent evidence such as port schedules, berth records, satellite observations, cargo documents, and later discharge quantities. Time zones and vessel identifiers must be aligned before treating two records as the same event. A gap near a restricted port is an investigative cue, not proof of a port call or prohibited cargo. The legal question remains separate: even a confirmed call must be assessed against the rule applicable to the vessel, cargo, service, and jurisdiction. Document both the evidence and its limits.
Worked example: A tanker disappears from AIS for 18 hours near Country R. Its last position is offshore, and its next report is 40 nautical miles away. That interval permits several routes; it proves no port call. If dated berth records and a cargo receipt identify the same IMO number during the gap, they corroborate a call. The investigator then tests whether the applicable transaction rule restricts it.
Watch the distinction: An AIS gap is neither proof of concealment nor proof of innocence. Check coverage, timing, vessel identity, port records, and cargo evidence before drawing a conclusion.
Reference: [1]
52. Track vessel identity changes
Vessels can change names, flags, managers, and registered owners while remaining the same physical ship. Build an identity timeline around stable identifiers, especially the IMO number where one is assigned, and verify it against vessel particulars and documents. Check whether a list entry names the vessel itself, an owner, or another party, because the restriction may attach in different ways. A new flag or management company does not erase a designation, while an ownership change requires evidence and analysis under the governing rule. Compare bills of lading, port calls, insurance, and registration records by date; stale records can create a false link. The aim is to establish both continuity of the asset and the relevant legal interest at the transaction time. A name-only screen cannot answer either question reliably.
Worked example: Assume a UK measure identifies vessel IMO 9123456. Shipping papers now call it Meridian and show a new flag; earlier records call it Northstar. Both sets show IMO 9123456 and matching dimensions. It is the same vessel for screening purposes, so the bank applies the measure to the proposed service. It verifies the current listing terms before deciding the operational action.
Watch the distinction: A renamed ship is not automatically a new vessel. Follow the stable identifier and dated registration records, then determine exactly which person or asset the applicable restriction covers.
Reference: [1]
53. Examine ship-to-ship transfers
Ship-to-ship transfers break a simple origin-to-destination trail. Reconstruct cargo custody by aligning vessel positions, transfer times, bills of lading, tank measurements, and later discharge records. Record quantities in consistent units and account for any stated measurement tolerance or loss; a numerical balance can show where cargo went, but it cannot identify its origin without source documents. Check whether the receiving vessel mixed cargo from other sources and whether new paperwork describes only the latest leg. Vessel identity, ownership, and any restricted-port calls still require separate analysis. When evidence is incomplete, describe the supported flow and the missing link rather than assigning origin from proximity alone. A case diagram should connect each parcel of cargo to a documented load, transfer, or discharge event.
Worked example: A tanker loads 40,000 barrels, transfers 15,000 barrels at sea, and later discharges 25,000 barrels. Assuming no measured loss or other movement, 15,000 plus 25,000 equals the 40,000 barrels loaded. The balance supports a complete quantity trail. The investigator still needs the receiving vessel's identity, its discharge records, and the original load documents to assess destination and origin.
Watch the distinction: Balanced quantities do not prove lawful origin or final destination. They show accounting consistency; cargo documents and custody evidence must establish where each parcel came from and went.
Reference: [1]
54. Reconcile trade and payment flows
A trade payment should make commercial sense against the underlying shipment. Match the contract, invoice, buyer, payer, beneficiary, goods, quantity, shipping record, and payment references. Several third-party payers may reflect legitimate group treasury or financing arrangements, but unexplained payers can conceal a restricted interest. Calculate whether payments reconcile to the invoice and note currency conversion, fees, and partial deliveries before treating a difference as suspicious. Then ask who owes the debt, who supplied the funds, and whether any payer acts for a restricted party. A numerical match is only one check: the fact that amounts add up does not establish that the funding parties are authorized. Record each explanation with evidence, such as treasury agreements or loan documents, and assess the rule governing the actual parties and activity.
Worked example: A Canadian bank reviews a $90,000 invoice for one shipment. Three unrelated firms each pay $30,000 and cite that invoice. Their payments total $90,000, leaving no amount difference, but the buyer's contract names none of them. The bank requests the funding basis and screens the actual payers before release. An exact total does not explain why those firms funded the buyer.
Watch the distinction: Matching the invoice total can create false comfort. Reconcile identities and funding authority as well as amounts; an unexplained third party may be the important sanctions link.
Reference: [1]
55. Trace nested banking
Nested banking arises when a respondent bank gives another institution access to its correspondent account. The correspondent may see a familiar respondent on the account while the underlying payment originates with a nested bank and its customer. Trace the message fields and contractual relationships to identify each institution, originator, beneficiary, and any ultimate party. Determine what information the correspondent actually received; absence of a name in a field is not evidence that no underlying party exists. Screening and investigation should follow the payment chain, then apply the restriction to the relevant person, property interest, or activity. A respondent's clean status does not clear its customers, yet a mention of a restricted party must be confirmed before deciding to block or reject. Escalate missing transparency as a control issue alongside the transaction decision.
Worked example: A US correspondent receives a payment through Respondent Bank A. The message identifies Nested Bank B as the originator's bank and a company matching a blocked person as the underlying customer. The correspondent holds the payment, verifies the company's identity and property interest, and applies the US rule. Bank A's clean screening result does not resolve the customer's status.
Watch the distinction: Screening only the named respondent can miss the person whose payment it carries. Inspect available underlying-party data and resolve identity before issuing a block, rejection, or release instruction.
Reference: [1]
56. Link digital-asset wallets
A blockchain address is an endpoint, not a verified human identity. Start with the exact address and chain, then trace transactions using hashes, amounts, timestamps, and token contracts. Label the provenance of wallet attribution: an official identifier, exchange record, customer disclosure, and analytics inference carry different evidentiary weight. An intermediate address may be controlled by an exchange, service, or another user, so a transaction path does not prove common ownership. Also distinguish receipt of value from a continuing property interest under the applicable sanctions rule. Exchange account records, withdrawal instructions, and device or account evidence can connect an address to a person more directly. Record forks, swaps, fees, and pooled wallets that complicate a simple path. The result should state what the ledger proves and what off-chain evidence remains necessary.
Worked example: A UK exchange sees 5 tokens move from an address attributed to a designated person through two wallets to a customer's deposit address. Transaction hashes confirm the path and amount, but neither intermediate wallet's controller is known. The exchange holds the affected deposit for review, seeks account and service records, and assesses whether the designated person's property interest persists under the applicable UK rule.
Watch the distinction: A traced path is not an identity certificate. Intermediary services can move value for different users, so establish wallet control and the relevant property interest separately.
Reference: [1]
57. Investigate chain-hopping
Chain-hopping changes the ledger on which value appears, often through a bridge or swap. Trace the deposit transaction into the service, identify the service's output mechanism, and match the destination transaction by time, amount, token type, and bridge records. Calculate fees and exchange rates explicitly; similar amounts alone can mislead when a service pools transactions. A one-to-one wrapped token may preserve a clear value trail, while a market swap introduces price movement and slippage. Even a strong trail of value does not prove that the same person controlled both wallets or that a blocked person's property interest continued through every step. Investigators therefore pair on-chain analysis with service logs, customer account records, and the governing sanctions rule. State uncertainty where pooled liquidity prevents a unique transaction match.
Worked example: Assume a bridge issues one output token for each input token after a fixed fee. Ten tokens enter from Wallet A; 9.8 tokens reach Wallet B, and the recorded fee is 0.2 token. The arithmetic reconciles: 9.8 plus 0.2 equals 10. Timing and bridge records support a value link, but they do not identify Wallet B's controller.
Watch the distinction: A near-equal amount after a bridge does not prove common wallet ownership. Account records and service mechanics are needed, especially when pooled transactions allow several possible outputs.
Reference: [1]
58. Test location inconsistencies
Location evidence should be evaluated as a pattern, not as a single IP address. An IP may reflect a virtual private network, mobile routing, travel, or a shared corporate gateway. Compare repeated logins with device history, shipping and billing addresses, service calls, delivery confirmation, and the place where the service is actually used. Align timestamps and distinguish an employee's travel from a customer's operating location. The restriction may concern residence, physical supply, destination, or use, so identify the legal location condition before interpreting the data. Independent sources that point to the same place increase confidence; copied customer statements do not provide independent corroboration. If the pattern suggests a restricted location, hold the relevant transaction or service decision while seeking targeted evidence. Document plausible alternative explanations and why they do or do not fit.
Worked example: Assume a Canadian rule bars providing a specified service in Country R. A customer claims to operate only in Country A. Over a month, repeated device logins originate near R, deliveries reach an R office, and service calls request support for equipment there. Together they support use in R, so the provider holds new service pending verification. One VPN login alone would not establish that result.
Watch the distinction: Treating one IP location as the customer's location ignores network masking and travel. Seek independent operational evidence and connect it to the rule's precise location condition.
Reference: [1]
59. Corroborate external evidence
External sources differ in reliability because they answer different questions. A registry may show recorded shareholding at a particular date, while a voting agreement may show control that the registry does not display. Shipping data can establish a route, but not automatically who owned the cargo. Public reporting can supply leads, yet an undated allegation needs verification. For each item, record its author or issuer, date, underlying basis, and whether it is independent of other evidence. Check whether later events superseded it and whether the document covers the same legal entity. When sources conflict, identify the exact proposition at issue, such as ownership on the payment date, and seek the evidence that resolves it. The certified fraud examiner study guide offers a related treatment of corroborating investigative evidence.
Worked example: A UK bank finds an undated article alleging that a designated person owns Supplier Ltd. A current registry lists two other shareholders, while a signed voting agreement gives the designated person power to appoint most directors. The registry weakens the ownership allegation but does not answer control. The bank verifies the agreement's date and continuing force, then assesses the UK control rule.
Watch the distinction: Choosing the newest document automatically can miss rights recorded elsewhere. Compare what each source actually proves, its date, and whether independent evidence supports the same proposition.
Reference: [1]
60. Conclude without tipping off
An investigation should end with a decision record that separates established facts, reasonable inferences, and unresolved questions. Confirm the identity match with identifiers, identify the applicable jurisdiction and restriction, and explain how ownership, control, property, or activity brings the transaction within its scope. Then give operations a clear instruction to hold, block, reject, or release as the rule and evidence require. Uncertainty about one issue need not erase a strong finding on another; the case can preserve a hold while an end-user question is investigated. Escalation should identify what evidence is still needed and who can authorize the next action. Customer communication is a separate controlled decision. Some notices may be permitted or required, but revealing a suspected target or investigative detail without authority can undermine the inquiry.
Worked example: A UK bank confirms that a payment beneficiary matches a designated company by name and registration number. A signed agreement also shows designated control of the invoice buyer, but the goods' final user is unknown. The bank keeps the payment held under the applicable rule, records the confirmed links, and escalates the end-user question. Its customer response says the payment is under review without disclosing the investigative details.
Watch the distinction: Waiting for every unknown to be resolved can leave a payment exposed despite a decisive restriction. Record what is proven, maintain the appropriate control, and investigate the remaining question.
Reference: [1]
Official references and further reading
- Current indexed English CGSS candidate handbook excerpts
- Current CGSS programme excerpt
- Current CGSS course-content and format excerpt