CGSS Sample Questions Answers

Enhanced due diligence is required when trade transactions involve jurisdictions near sanctioned countries due to the increased risk of transshipment, diversion, and sanctions evasion.

Sanctions and Compliance Domains highlight two core focus areas:

• verifying the identities and ultimate beneficial owners of all involved parties, and

• validating the shipment details, including routing, goods description, and movement patterns.

These elements are critical where geographic proximity raises sanctions exposure. While reviewing commercial terms and pricing may be part of general trade finance due diligence, the primary sanctions-specific EDD requirements focus on beneficial ownership and shipment details.

References from Sanctions and Compliance Domains:

Enhanced due diligence expectations for trade involving high-risk regions.

Requirements to verify UBOs to detect potential sanctioned ownership.

Importance of shipment route verification to detect diversion to sanctioned jurisdictions.

Internal controls are a core pillar of OFAC’s Compliance Framework. They ensure that the organization implements compliance activities on time, maintains documented procedures and processes, and reduces the risks identified in its OFAC risk assessment. The framework specifies that controls must be documented, tested, and capable of identifying, escalating, and addressing sanctions-related issues.

Selecting watch lists for sanctions screening requires understanding geographic exposure, including customer locations, jurisdictions in which products/services are offered, and locations of trading partners. Sanctions programs vary by region (e.g., OFAC, EU, UN, UK), so geographic impact is essential.

Transaction size, withdrawal patterns, and relationship length are AML considerations but are not primary factors for selecting sanctions watch lists.

When a potential sanctions match is detected, the required first action is to determine whether the alert represents a true match or a false positive. This involves comparing identifiers, reviewing customer documentation, and gathering additional details.

CDD is important but is not the specific required action at the moment of match investigation. The priority is confirming whether the entity is indeed the sanctioned party.

The Wolfsberg 2019 Guidance identifies risk assessment as a foundational component of sanctions screening programs. Screening systems, list management, and alert handling must reflect the institution’s assessed sanctions risk exposure.

External audit and reporting are relevant compliance functions but are not listed as fundamental pillars of screening programs in the Wolfsberg framework. Risk management is a broader corporate discipline, while screening specifically starts with a clear sanctions risk assessment.

Sanctions and Compliance Domains explain:

• Tipping-off is prohibited, as it may alert a customer that they are under investigation, impairing regulatory or law-enforcement action. Institutions must implement controls to prevent it.

• Notification, however, refers to permitted communication — such as informing a customer that their funds were frozen — when required or allowed by law (e.g., EU asset-freeze requirements), without revealing investigative details.

Tipping-off and notification serve entirely different purposes. Regulatory frameworks explicitly warn entities against tipping-off but do allow certain forms of notification that comply with legal obligations.

EU best practices allow processing of payments that fall under permitted exemptions such as basic needs and reasonable living expenses. These may include essential subscriptions such as newspapers or communication services, provided proper authorization or notification is followed.

Salary payments generally require strict conditions and may not be allowed directly for designated persons. Taxi rides and luxury purchases are not considered basic or essential needs and cannot be processed.

Sanctions apply primarily to persons and entities within the jurisdiction of the issuing authority. For example:

• US sanctions apply to US persons, entities organized under US law, and persons physically located in the US.

• EU sanctions apply to EU nationals, persons within EU territory, and EU-incorporated entities.

Sanctions are not automatically global unless other jurisdictions adopt similar measures. International financial institutions must comply only when they operate within relevant jurisdictions.

Sanctions evasion indicators in trade documentation include:

• Multiple amendments designed to obscure the parties involved – a classic red flag indicating concealment of the real counterparty.

• Falsified or tampered shipping documents – used to hide sanctioned routes, ports, or vessels.

• Conflicting end-user documentation – a major warning sign of diversion or concealment of sanctioned recipients.

Cash withdrawals (E) and online payment instructions (F) are AML indicators, but not directly sanctions evasion indicators. Docking at non-sanctioned countries (D) is not suspicious unless used as part of concealment, which is not indicated here.

Cigars, particularly those originating from Cuba or other embargoed jurisdictions, fall under both EU and US export sanctions restrictions. Under US OFAC regulations, Cuban-origin goods—including cigars—are strictly prohibited from import, export, resale, or re-export by US persons. EU sanctions may also restrict trade with embargoed or designated jurisdictions.

Textbooks, toys, and art reproductions generally do not fall under export prohibitions unless tied to dual-use concerns or specific jurisdictions, which is not indicated here. Cigars present the most direct and well-established sanctions risk.

The Wolfsberg Guidance on Sanctions Screening emphasizes data quality as the most important factor when developing or maintaining a screening system. High-quality, accurate, complete, and consistently structured data is essential to ensure proper matching, reduce false positives, and avoid missed true matches.

Even with strong IT capabilities or defined risk appetite, a screening system will fail if the underlying data is incomplete or inaccurate.

OFAC guidance clarifies that blocking virtual currency means preventing any access, transfer, or withdrawal of the asset by the sanctioned party. The entity holding the virtual currency must:

Deny access to the wallet or virtual asset, and

Report the blocked property to OFAC in accordance with reporting rules.

Virtual currencies are not “returned” (A), not necessarily moved to a pooled wallet (B), and are not converted to fiat unless authorized (C).

Sanctions investigations rely primarily on the factual evidence contained in transaction activity and on authoritative, government-issued sanctions lists. Transaction details provide information on counterparties, payment paths, goods, and purpose. Official blocked-person lists such as OFAC, EU, UN, and national export-control lists provide the authoritative basis for sanctions matching. News, social media, and internal correspondence may supplement context but are not primary sources.

OFAC regulations require that blocked funds must be placed into an interest-bearing account, held separately, and reported to OFAC. This does not require preauthorization from OFAC.

However, no debits or credits may occur without OFAC authorization, including:

• settling standing bills or checks (A),

• charging interest or loan/corporate card fees (C),

• deducting credit-card service charges (B).

Only OFAC can authorize movement or use of blocked property.

Transliteration is defined as converting writing from one script into another while preserving pronunciation as closely as possible. In sanctions screening, transliteration is important because sanctioned parties may appear in multiple scripts (e.g., Cyrillic, Arabic, Mandarin) and the automated screening system must recognize these variations.

While option B focuses specifically on converting non-Latin scripts into Latin, sanctions screening requires a broader definition that applies to any script-to-script conversion relevant to matching names globally. Thus, the correct definition is the general conversion of text from one script into another.

References from Sanctions and Compliance Domains:

Definition of transliteration in sanctions screening and name-matching methodologies.

Need for script conversion to support accurate detection of sanctioned parties across language systems.

Within sanctions compliance programs, one of the core components identified as essential for effective management of sanctions risks is audit and testing. The Sanctions and Compliance Domains describe that sanctions programs require independent review, periodic testing, and validation to assess whether internal controls, screening systems, and escalation processes operate effectively. Audit and testing units provide the independent assurance needed to detect program weaknesses, evaluate the adequacy of controls, and confirm compliance with regulatory requirements.

Sanctions frameworks emphasize that the ability to identify deficiencies, monitor adherence to procedures, evaluate risk-control effectiveness, and ensure continuous improvement is fundamental to maintaining a sound sanctions compliance environment. Audit and testing functions are responsible for reviewing the design and effectiveness of sanctions policies, validating the performance of screening tools, and ensuring corrective action is taken where deficiencies are found. For this reason, the function is identified as critical for managing sanctions risks across financial institutions and regulated entities.

References from Sanctions and Compliance Domains:

Requirements for independent auditing and testing as a core component of an effective sanctions compliance program.

Expectations for regular review of sanctions controls, screening performance, and risk assessment processes.

Emphasis on independent validation to ensure ongoing compliance with regulatory obligations and to detect gaps in sanctions controls.

Dual-use goods are items that can serve both civilian and military or weapons-related applications. Typical dual-use categories include:

• Aerospace and propulsion technologies – used in civilian aircraft but also missile or defense applications.

• Electronics – circuits, sensors, microchips, hardware with potential military, surveillance, or weapons applications.

Luxury goods and food products are not dual-use categories. Precious metals may be highly regulated but are not dual-use under standard export-control classification.

Sanctions screening standards require that when a hit is produced by the filtering system, the institution must determine whether the alert is a true match or a false positive through a structured escalation and investigation process. The Sanctions and Compliance Domains emphasize that financial institutions must evaluate all relevant identifiers, including entity type, name, ownership, vessel IMO numbers, and additional attributes.

In the case of vessels, sanctions regulations often target vessels by name and ownership, meaning that a vessel with an identical name requires deeper investigation. Authorities such as OFAC, the EU, and the UK regularly designate vessels because of their involvement in sanctioned activities, and vessel names frequently overlap with commercial entities. Therefore, the correct investigative approach is to continue the investigation to determine the true ownership, IMO number, and whether the vessel is the sanctioned party.

Options A, B, and C describe scenarios typically associated with clear mismatches or cases where additional investigation is unnecessary because essential identifiers do not match. However, vessels require continued review due to the regulatory emphasis on vessel ownership, registration, and operational control as determining factors in sanctions risk.

References from Sanctions and Compliance Domains:

Requirements for detailed matching processes in sanctions screening.

Guidance on evaluating entity type, ownership, and identifiers when reviewing alerts.

Rules relating to vessel sanctions, ownership determination, and verification steps.

Procedures for identifying true matches versus false positives in sanctions screening.

EU sanctions require financial institutions to immediately freeze the funds or economic resources of designated persons and promptly report the freeze to the competent national authority. Reporting is mandatory to ensure oversight and enforcement.

Banks must not transfer frozen funds, and they must not freeze accounts of family members unless those individuals are also designated or otherwise meet ownership/control criteria. Institutions also do not notify the customer directly, as doing so may undermine regulatory requirements.

UN sanctions are imposed by the UN Security Council as part of its mandate to maintain international peace and security. They are intended to influence behavior, prevent conflict, suppress terrorism, and stabilize global security conditions.

While asset freezes and travel bans are common measures (option D), they are examples, not the fundamental reason for imposing sanctions. Option C describes the overarching purpose.

Sanctions and Compliance Domains specify that when a transaction presents multiple risk indicators—such as a high-risk jurisdiction, shell company involvement, and unclear payment purpose—the appropriate response is to seek additional information before releasing or rejecting funds.

Financial institutions are required to conduct deeper review when the transaction indicators suggest possible sanctions exposure, even if the names involved do not appear on sanctions lists. Obtaining supporting documentation helps determine whether the payment involves sanctioned parties, prohibited shipping routes, disguised ownership, or goods subject to restrictions.

Freezing/blocking is only appropriate when the institution has identified a match to a designated party or prohibited conduct. Reporting to authorities must follow a confirmed sanctions nexus, not preliminary suspicion.

References from Sanctions and Compliance Domains:

Requirements to obtain underlying documents when shell companies or high-risk jurisdictions appear in a payment.

Investigation obligations prior to rejecting or blocking a payment.

Risk-based approach to suspicious or unclear maritime/shipping transactions.

Under the UN Charter, all United Nations member states are obligated to accept and carry out decisions of the UN Security Council. Sanctions and Compliance Domains emphasize that UN Security Council Resolutions issued under Chapter VII are binding on all UN members, not just Security Council members or targeted states.

Only member states have this obligation. Permanent membership or targeted status does not change the scope of obligation.

References from Sanctions and Compliance Domains:

UN Charter obligations for all Member States to implement Security Council Resolutions.

Binding nature of Chapter VII resolutions across all UN members.

Sanctions and Compliance Domains outline several misunderstandings commonly held by businesses. One misconception is that any USD transaction automatically triggers US sanctions applicability; while USD transactions may be routed through the US financial system, sanctions analysis depends on transaction content, parties involved, and jurisdictional reach, not solely the currency.

Another misconception is assuming no sanctions risk exists if a party is not listed by name. Sanctions regimes include indirect application through ownership and control rules, sectoral sanctions, activity-based sanctions, and geographic sanctions. Entities may be sanctioned due to association, ownership, or activity even if not individually named.

Statements regarding import/export exposure and MandA due diligence are correct program requirements. US sanctions can still apply to US citizens regardless of where they reside or work.

References from Sanctions and Compliance Domains:

Misconceptions regarding currency and sanctions applicability.

Misunderstandings about named-party sanctions versus ownership/activity-based risks.

Clarification on US person obligations regardless of residence.

Digital currency providers pose a heightened sanctions risk due to:

• exposure to anonymity-enhancing technologies,

• increased risk of being used for sanctions evasion and illicit finance,

• difficulty tracing the ultimate beneficial owner or origin of funds, and

• vulnerabilities related to mixers, unhosted wallets, and cross-border platforms.

Pharmacies and retail companies generally present lower sanctions risk. Aircraft maintenance companies can pose some risk depending on jurisdictions served, but digital currency firms are consistently recognized as the highest-risk sector for sanctions exposure.

Sanctions and Compliance Domains specify that when a transaction shows significant sanctions or illicit-trade red flags, a bank must avoid executing the transaction if it risks breaching sanctions restrictions. If the bank identifies discrepancies, counterfeiting indicators, or potential sanctions violations, the transaction must be rejected unless a blocking requirement applies.

Blocking applies only when a sanctioned party or property interest is identified. In this scenario, because there are red flags but no confirmed designated person, the appropriate action is to reject the transaction and file the relevant report with the competent authority.

Banks should not process the transaction and investigate later, nor should they disclose red-flag details to customers. Reporting requirements prohibit tipping-off in such regulatory contexts.

References from Sanctions and Compliance Domains:

Guidance on rejection versus blocking in trade finance risks.

Reporting obligations when red flags indicate possible sanctions exposure.

Prohibition on providing details of internal investigations to customers.

Under OFAC’s 50 Percent Rule, any entity that is owned 50% or more—individually or in aggregate—by one or more Specially Designated Nationals (SDNs) is considered automatically blocked, even if not explicitly listed.

Financial institutions must treat such entities as if they are SDNs. Therefore, the account cannot be opened. Senior management approval cannot override OFAC regulations, and altering ownership to bypass sanctions is prohibited facilitation.

OFAC has designated:

• Hackers and cyber actors involved in cryptocurrency theft.

• Cryptocurrency exchanges facilitating illicit transactions or supporting sanctioned jurisdictions.

• Mixers (tumblers) known to anonymize blockchain transactions and facilitate laundering and sanctions evasion.

Software developers (D) are generally not designated unless directly linked to illicit activity. Credit unions and central banks are not typical OFAC digital-asset designations.