Managing Sanctions Risk: Identification, Assessment and Mitigation
The risk-management cycle
Sanctions risk management is a continuous cycle: identify exposure, assess it, mitigate it, then monitor and review. Candidates should be able to name each stage and describe outputs. Identification means mapping the institution's touchpoints - customers, beneficial owners, counterparties, intermediaries, goods, vessels, destinations, payment routes and staff. Assessment means scoring likelihood and impact, considering factors such as jurisdiction, sector, product, customer type, ownership complexity and transaction profile. Mitigation means controls proportionate to that residual risk.
Core concepts to know
- Risk appetite: the board-approved tolerance for sanctions risk, expressed qualitatively and, where possible, quantitatively.
- Inherent vs residual risk: inherent risk exists before controls; residual remains after controls. Questions often ask which one a risk assessment measures.
- Risk-based approach: controls should be proportionate to risk, not uniformly maximal; a design that ignores risk differentiation is a common distractor.
- Typologies: evasion methods such as third-party payments, trade-based schemes (mis-invoicing, phantom shipments), use of intermediaries or free-trade zones, and ownership obfuscation through layered entities.
- Escalation and decision-making: who may approve a higher-risk relationship or transaction, and how decisions are documented.
Traps in questions
Watch for answers that confuse inherent with residual risk, treat a risk assessment as a one-off exercise, or treat screening as the whole of sanctions risk management. Another trap: assuming a low-risk customer needs no ongoing monitoring - monitoring intensity should still reflect risk.
Rule of thumb
Controls follow risk, and evidence follows controls. For any scenario, ask: what is the exposure, what control addresses it, and what record proves the control operated? If any of the three is missing, that is the gap the question is testing.