Sanctions Compliance Programme Elements
The programme framework
A sanctions compliance programme is a set of interdependent elements, commonly grouped as: senior management commitment, risk assessment, internal controls (policies and procedures), training, audit/testing, and recordkeeping/reporting. Candidates should be able to describe each element and explain how it interacts with the others - for example, a risk assessment should drive policy design and training content, and audit should test whether controls actually operate.
Elements to understand
- Governance and commitment: board and senior management ownership, a designated sanctions officer, clear escalation paths and a documented risk appetite.
- Policies and procedures: screening (customer, counterparty, payment, trade), escalation and blocking/rejection handling, onboarding and due diligence standards, and procedures for new products and jurisdictions.
- Screening controls: name and entity screening, ownership and control analysis, list-update handling, and management of false positives (tuning and documentation).
- Training: role-based, risk-based, refreshed periodically and tracked for completion.
- Independent testing and audit: periodic review of control effectiveness, with findings tracked to remediation.
- Recordkeeping and reporting: retaining evidence of decisions, screening results and escalations; making required regulatory reports or disclosures.
Traps in questions
Common distractors: treating training as a one-off induction event; assuming screening software alone constitutes a programme; confusing independent testing with self-assessment by the business line; and answers that omit escalation or recordkeeping entirely. Another trap is a policy that exists but is not applied consistently - effectiveness, not existence, is what questions probe.
Rule of thumb
A control that is not documented, tested and refreshed is not a control - it is an intention. When a scenario describes a programme element, ask whether it is designed, implemented, and independently verified.