CGSC cheat sheet

Sanctions are typically imposed as asset freezes (funds and economic resources), travel bans, sectoral restrictions, and trade/arms embargoes; each requires a different control set.

An asset freeze prohibits making funds or economic resources available, directly or indirectly, to or for the benefit of a designated person; ownership and control tests extend liability to non-listed entities.

The 50 percent rule (US OFAC): an entity owned 50% or more in aggregate, directly or indirectly, by one or more blocked persons is itself treated as blocked even if not separately listed.

EU and UK ownership tests are qualitative ('owned or controlled'), so a minority stake plus control indicators (board control, veto rights, shareholding agreements) can still trigger freezing obligations.

Strict liability regimes (e.g., US civil sanctions) mean intent is not required for a violation; penalties attach to the prohibited act, not to knowledge of the designation.

Risk-based approach: risk = likelihood x impact, assessed across customer, product, channel, geography, and transaction type; higher-risk factors require enhanced due diligence and escalation.

Indirect dealing risk arises through intermediaries, agents, freight forwarders, and beneficial ownership chains; screening only the immediate counterparty leaves residual exposure.

Sectoral sanctions (e.g., restrictions on certain debt, equity, or technology) differ from full blocking: specific transactions are prohibited while the counterparty is not frozen.

A sanctions nexus exists where any element (party, goods origin, destination, vessel, currency, or payment route) touches a sanctioned jurisdiction, person, or sector.

Five core OFAC-aligned elements: management commitment, risk assessment, internal controls, testing and audit, and training; a sixth is often added as recordkeeping.

Screening controls must cover customers, beneficial owners, directors, counterparties, vessels, and payment messages; fuzzy matching generates false positives that require documented adjudication.

Escalation and blocking/rejecting procedures: suspected matches are frozen or rejected, reported to the regulator within prescribed timelines, and logged for audit.

Recordkeeping obligations typically require retention of screening results, due diligence, and transaction records for a defined period (commonly 5-10 years depending on jurisdiction).

Voluntary self-disclosure of apparent violations is a mitigating factor in penalty calculations under most regulators' enforcement guidelines.

Training must be role-specific and refreshed on a defined cycle; effectiveness is measured through testing, not attendance alone.

Independent testing (internal audit or external review) validates design and operating effectiveness of controls and should be risk-prioritised.

Governance requires a designated sanctions officer or committee with clear authority, board-level oversight, and a documented policy approved at senior level.

A sanctions programme must be dynamic: it is updated when lists change, when the risk assessment changes, and after control failures or regulatory guidance updates.