CGSS common mistakes
CGSS · Understand the traps and how to avoid them.
Applying OFAC-style concepts such as 'facilitation' or 'dealing' to a question that names the EU, UK, or UN regime without checking that regime's actual legal definitions and prohibitions.
Candidates study sanctions as one general body of law and memorize U.S. terminology, then reuse it when the question is testing a different jurisdiction.
What to do instead
Build a comparison table of key defined terms and prohibitions for each regime tested. On every question, first anchor to the named legal instrument and ask whether that regime uses the same concept, a narrower concept, or no equivalent.
Treating a general license as something that must be applied for and approved, or treating a specific license as automatically available to any similarly situated party.
The terms sound interchangeable, and candidates remember 'license' without distinguishing publication-based authorization from case-specific written authorization.
What to do instead
Memorize the operational distinction: a general license authorizes a defined category of activity by publication and requires no application, while a specific license is issued in writing to a particular person for particular activity and is not transferable. Check conditions and expiration in every scenario.
Applying U.S. sanctions to a non-U.S. person without first identifying a U.S. nexus, or refusing to apply them when a nexus such as USD clearing, U.S.-origin goods, or a U.S.-person employee is present.
Candidates either overgeneralize U.S. reach or focus only on the actor's nationality and miss payment, goods, technology, and ownership touchpoints.
What to do instead
Use a fixed nexus checklist for every scenario: actor status, nationality and location, goods/technology origin, currency and correspondent bank, ownership and control, and any U.S.-person involvement. Then apply the named regime only to the touchpoints it reaches.
Conflating SDN List blocking with sectoral or SSI-type targeted prohibitions, such as saying every transaction with an SSI-listed entity is prohibited or ignoring the 50 percent ownership rule for a blocked entity.
The lists look similar in screening outputs, and candidates memorize list names rather than the scope of each program's prohibitions.
What to do instead
For each listing, identify the program, the type of restriction, and whether the entity's property is blocked or only certain transactions are restricted. Separately apply ownership aggregation and control analysis using the applicable regime's rule.
Describing a sanctions compliance program as 'adopt a policy, screen customers, and train staff' without a documented risk assessment, independent testing, or senior-management accountability.
Candidates memorize the five pillars as labels but do not sequence them or explain how the program is tailored to the institution's risk profile.
What to do instead
Structure answers around the full program lifecycle: risk assessment, senior commitment and governance, written policies and procedures, controls including screening and due diligence, training, independent testing, and documentation. Explain how each element is calibrated to identified risks.
Assigning sanctions screening and escalation solely to an AML analyst or the legal department without defining board-level ownership, clear escalation paths, or three-lines-of-defense responsibilities.
Candidates treat sanctions as a subset of AML and overlook governance failures that regulators cite in enforcement actions.
What to do instead
Define sanctions-specific ownership at senior management and board level, document escalation thresholds, and allocate responsibilities across business units, compliance, and internal audit. Include sanctions risk in management information and board reporting.
Clearing a screening alert as a false positive because the name is not an exact match, without checking date of birth, country, address, identifier numbers, or transliteration variants, and without documenting the rationale.
Candidates misunderstand fuzzy matching and assume exact-name logic is sufficient, or they over-suppress alerts to reduce volume.
What to do instead
Require secondary-identifier analysis before closure, test match thresholds, document the disposition rationale, and treat name-only matches as insufficient. Use a risk-based escalation path for close or partial matches.
Screening only the customer's legal name and failing to screen beneficial owners, parent companies, directors, counterparties, vessels, aircraft, or wallet addresses where relevant.
Candidates take a list-centric view of screening and forget that ownership, control, and transaction parties can create exposure even when the customer is not listed.
What to do instead
Map all relevant parties and assets into the screening universe, apply ownership and control analysis, and include ongoing monitoring for changes in ownership, counterparties, and payment routes.
Treating third-country intermediaries, shell companies, altered invoices, unusual logistics routes, or repeated near-threshold payments as ordinary commercial risk rather than potential sanctions-evasion indicators.
Candidates focus on matching names against lists and do not study evasion typologies or red-flag indicators.
What to do instead
Map specific red flags to controls: enhanced due diligence, ownership transparency, trade-document scrutiny, payment-route analysis, and escalation. Use scenario-based training and document why an indicator was or was not resolved.
Advising a client to wait until an internal investigation is complete before considering a voluntary self-disclosure, or assuming disclosure automatically guarantees leniency, while missing recordkeeping and reporting deadlines.
Candidates conflate investigation best practice with enforcement strategy and do not distinguish mitigating factors from aggravating factors in agency frameworks.
What to do instead
Know the relevant agency's disclosure framework, timing expectations, and recordkeeping rules. Preserve records immediately, assess whether disclosure is appropriate, remediate, and document the decision. Treat disclosure as a potential mitigating factor, not a guaranteed outcome.