CGSC common mistakes
CGSC · Understand the traps and how to avoid them.
Treating 'strict liability' as if intent or knowledge must be proven before a breach is established, and answering questions as though a genuine mistake is a defence.
Candidates conflate criminal intent concepts from general law with the civil/regulatory strict-liability architecture of most sanctions regimes, where breach occurs regardless of intent.
What to do instead
Before answering, classify the question: if it asks whether a breach occurred, apply strict liability (act + prohibited person/activity). Reserve intent/knowledge analysis for questions about penalties, enforcement discretion, or criminal offences.
Applying a single jurisdiction's rules (e.g., only US OFAC or only UK/EU) to a scenario that spans multiple regimes, and missing the overlapping or extra-territorial obligation.
Candidates learn one regime deeply and default to it, overlooking that the same transaction can trigger obligations under several regimes simultaneously (e.g., secondary sanctions, EU blocking statutes).
What to do instead
For every scenario, first list which jurisdictions touch the transaction (parties' nationality, currency, goods origin, entity ownership). Then assess each regime separately before concluding.
Confusing asset freeze with other restrictive measures, e.g., stating that a frozen account's funds are confiscated, or that a listed person cannot be given humanitarian goods under any circumstance.
Candidates blur the legal effect of an asset freeze (funds remain owned but unusable without licence) with confiscation, and forget that licences/derogations can authorise otherwise-prohibited dealings.
What to do instead
Memorise the definitional triad: freeze = no dealing without authorisation; prohibition = activity banned; licence/derogation = lawful exception. Check whether the question asks about the default rule or an authorised exception.
Assuming 50% ownership rules are uniform across regimes and applying an aggregate/control test where the regime uses a strict 50%-or-more ownership test (or vice versa).
Different regimes use different thresholds and tests (ownership vs control, aggregation vs individual holding), and candidates apply the rule they learned first.
What to do instead
Anchor on the specific regime named in the question. For ownership questions, state the regime's threshold and test explicitly in your reasoning before selecting an answer.
Screening only the direct counterparty and not the ownership chain, beneficial owners, or associated parties, leading to missed exposure.
Candidates focus on the named party in the prompt and overlook that sanctions exposure often arises through indirect ownership or control by a designated person.
What to do instead
In every screening scenario, map the full ownership/control chain and screen each layer. If the prompt gives ownership percentages, compute the effective holding before answering.
Designing or evaluating a compliance programme as a checklist of policies without linking each element to risk assessment and demonstrable effectiveness.
Candidates treat programme elements as a tick-box list and answer 'we have a policy' rather than showing how the element is risk-based, implemented, and tested.
What to do instead
For every programme-element question, articulate the risk-based rationale, the control, and the evidence of effectiveness (testing, monitoring, audit). Frame answers around 'how do you know it works'.
Placing sanctions screening solely within transaction monitoring or solely within onboarding, rather than as a continuous, event-driven process across the customer lifecycle.
Candidates associate screening with a single touchpoint and miss ongoing obligations triggered by list updates, ownership changes, and new relationships.
What to do instead
When asked where screening sits, describe lifecycle coverage: onboarding, ongoing/perpetual screening against updated lists, re-screening on trigger events, and payment screening.
Treating escalation and reporting as optional or as a single step, omitting the decision to block/reject, freeze, and report to the competent authority within the required timeframe.
Candidates focus on detection and under-specify the response chain, and they confuse internal escalation with external regulatory reporting.
What to do instead
Memorise the response sequence: detect → escalate internally → hold/block or reject → freeze where applicable → report to the authority → document. State which step each answer addresses.
Assuming training and record-keeping are administrative afterthoughts rather than evidence-bearing controls that regulators test, and failing to specify frequency, audience, and content tailored to risk.
Candidates deprioritise 'soft' controls and give generic answers that do not address risk-based tailoring or retention periods.
What to do instead
For training questions, specify risk-based frequency, role-specific content, and testing/attestation. For record-keeping, state what must be retained, for how long, and why it evidences compliance.
Confusing the roles of the three lines of defence, e.g., assigning independent testing to the front office or treating compliance as the sole owner of sanctions risk.
Candidates blur accountability and oversight, and answer that 'compliance is responsible' rather than identifying business ownership and independent assurance.
What to do instead
Map each activity to its line: first line (business) owns and applies controls; second line (compliance) sets framework and advises; third line (audit) provides independent testing. Attribute responsibility accordingly in every answer.