Sanctions Compliance Program Design and Governance
The five components
OFAC's compliance framework identifies five essential elements: management commitment, a risk assessment, internal controls, testing and auditing, and training. Examiners test whether each exists, is documented, and is tailored - not whether a policy binder exists.
Design logic
Start from a documented, refreshed risk assessment covering customers, products, services, channels, geographies and counterparties. Feed it into a written policy and procedures, a named sanctions compliance officer with authority and resources, an escalation path, and defined risk appetite. Controls include screening, transaction monitoring, due diligence on ownership and control, payment filtering, licence management, and blocked/rejected property reporting. Testing must be independent of the control owners - self-assessment is not testing. Training must be role-tailored, tracked, and refreshed.
Governance evidence matters: board or committee minutes, MI showing escalation volumes and dispositions, resourcing decisions, audit plans, remediation logs. A three-lines-of-defence model (business, compliance, internal audit) is the common structure.
Traps
- Treating screening as the whole program; it is one control.
- Copy-pasting a peer's risk assessment instead of calibrating to actual exposure.
- Conflating AML and sanctions risk assessments - they overlap but are not the same.
- Ignoring third parties, agents, distributors and M&A targets.
- No recordkeeping or retention discipline, so controls cannot be evidenced.
Rule of thumb
If a regulator asks you to demonstrate a control, you must be able to produce a dated artefact - risk assessment, screening rule documentation, hit-disposition rationale, training log, testing report, escalation minute. No artefact means, in practice, no control.
Worked example
A mid-size bank maps higher-risk trade finance clients, sets enhanced ownership due diligence for them, documents screening threshold tuning, and has internal audit test hit disposition quarterly. The loop - assess, control, test, train, refine - is what earns credit.