CAMS and CGSS revision notes linked with learning outcomes.

Sector & Product Risks

Banking is inherently more vulnerable than other sectors because it touches all three ML stages. Four specific factors drive this: volume and scale (illicit funds blend into massive daily transaction counts), global reach (cross-border movement exploiting regulatory gaps), complex products (wire transfers, trade finance, correspondent banking), and customer-relationship pressure (relationship managers prioritizing retention over scrutiny).

Private banking and wealth management carries a distinct, testable risk: compensation structures based on assets under management can create a genuine conflict of interest, since relationship managers are financially incentivized to overlook warning signs in high-net-worth relationships. High-risk PBWM products specifically include trust funds, sovereign wealth funds (large sums, cross-border, PEP involvement), and high-value assets like fine art and precious metals. Corporate/investment banking adds its own named risks: front-running, tailgating, churning, and spoofing are all distinct market-manipulation techniques that can mask illicit fund movement.

A real, named case worth knowing: an Estonian bank branch's rapid growth in nonresident customers, combined with controls that didn't scale proportionally, became a systemic AML failure — the exam lesson is that rapid growth in a higher-risk customer segment demands controls that grow with it, not controls sized for the bank's original, smaller customer base.

Predicate Crimes & Financial Crime Types

FATF has designated 21 specific categories of predicate offenses institutions must recognize — from organized crime and terrorism to human trafficking, drug trafficking, arms trafficking, corruption, fraud, counterfeiting, environmental crime, extortion, forgery, and insider trading. Jurisdictions don't always classify these identically; some don't recognize certain forms of exploitation as criminal, which complicates cross-border compliance.

Money laundering requires an underlying predicate offence — the proceeds must come from somewhere. Sanctions evasion itself is treated as a predicate offence too, and can be internal (aided by staff) or external, operating through payment-related methods (stripping identifying information from instructions), trade-related methods (transshipment, false licensing), or ownership-related methods (complex structures, proxies, bearer shares).

Trusts, TCSPs & Legal Arrangements

A trust separates legal ownership (held by trustees, who must be natural persons) from beneficial control. The settlor transfers assets into the trust; trustees manage it for beneficiaries — and critically, the same person can be settlor, trustee, and beneficiary simultaneously, meaning a nominally independent trustee may simply follow the settlor's directions. In many jurisdictions trusts have no registration requirement at all — they're private arrangements with no public record, which FATF has specifically flagged as a concern given how easily such vehicles can be created and dissolved.

A concrete example from the Study Guide: a government official awarded a construction contract can't receive a bribe directly without raising suspicion — so the construction company instead pays an "advisory fee" to a company in another jurisdiction, whose ownership has been settled into a trust benefiting the official and his family. The trust becomes the final layer of secrecy in an otherwise traceable bribery scheme.

ML Stages, Typologies & Red Flags

Placement introduces "dirty money" into the financial system; layering moves it through transactions (transfers to holding companies, false invoices, private loans) to conceal its origin; integration lets the criminal use it to buy goods and services. The three stages don't always happen in strict sequence — sometimes two occur almost simultaneously.

Named techniques worth knowing precisely: structuring/smurfing (splitting large sums into small transactions across accounts to dodge reporting thresholds) and its digital cousin microstructuring; digital asset laundering via mixing services and privacy coins; money muling (recruiting intermediaries, often via job scams, to move funds); TBML (over/under-invoicing, phantom shipments); market-based laundering through securities and derivatives; and commodity-based laundering through gold, diamonds, and art. A real 2019 US case: Yamel Guevara Tamayo recruited 200+ money mules, deliberately structured deposits just under the US$10,000 threshold, then used microstructuring (deposits under US$1,000) — successfully laundering over US$700,000 before banks intervened.

General AML/CFT Concepts

Financial crime's worldwide proceeds are estimated at up to 5% of global GDP — roughly US$2 trillion. Beyond the headline figure, a testable distinction: a regulated entity (banks, MSBs) falls under direct financial-regulator supervision, while an obliged entity is the broader category that also includes nonfinancial sectors (energy, real estate, logistics) expected to run risk assessments and controls even without direct financial-regulator oversight. An entity can be both.

Four specific risk types recur throughout the syllabus: operational risk (failed internal processes/systems), legal risk (penalties, unenforceable contracts), concentration risk (over-exposure to one customer or related group), and reputational risk (hard to quantify, slow to build, fast to lose). Individual accountability is real and scales with seniority — MLROs and BSA officers carry the greatest personal exposure, while first-line staff more often face administrative penalties unless intentional wrongdoing is shown.

Trade-Based Money Laundering

Beyond the classic over/under-invoicing and phantom shipments, the Study Guide lists specific TBML risk indicators worth recognizing precisely: trades booked remotely within a group of related entities; pre-arranged trading creating artificial volumes; third-party instructions adding layers; nonstandard settlement arrangements; uneconomic or irrational trading strategies; unusual patterns like counterparty concentration or flat/neutralizing activity; and misuse of factoring, forfaiting, and supply chain financing.

Three trade finance products are named as particularly exploitable: letters of credit (misused to create fictitious trade transactions), bills of exchange (manipulated to disguise transaction nature), and trade credit insurance (fraudulent claims used to launder money).

Real Estate & High-Value Assets

High-value assets (real estate, fine art, antiquities, luxury goods, precious metals) attract launderers for three reasons named in the Study Guide: substantial worth, potential for value appreciation, and relatively easy transfer of ownership. These assets are especially prominent in private banking and wealth management portfolios.

A specific technique worth knowing precisely: round tripping — moving funds into an offshore financial center (OFC) and back out again with no legitimate economic purpose, often disguised as reinvestment. OFC red flags include complex ownership structures, sudden large fund flows, rapid asset transfers between offshore entities, and PEP involvement — though the Study Guide is explicit that these can be legitimate business practices too, so a clear business rationale (or its absence) is what actually distinguishes risk from normal activity.

Virtual Assets, Crypto & VASPs

The Study Guide names digital asset laundering as a distinct technique: cryptocurrencies, NFTs, and DeFi allow pseudonymous cross-border transfers, with launderers using mixing services and privacy coins for anonymity, then cashing out through VASPs in jurisdictions with weak AML/CFT regulation. Microstructuring — structuring's digital-native cousin — splits illicit crypto proceeds into many small transactions specifically to evade monitoring thresholds.

Terrorist financiers use virtual assets distinctively too: numerous, seemingly unrelated small cryptocurrency deposits, quickly converted to stablecoins or fiat and withdrawn through a VASP in a weakly-regulated jurisdiction — a pattern worth recognizing as its own red flag, separate from money laundering typologies.

Terrorist Financing & NPO Risk

A precise, testable distinction: money laundering's pathway is circular — the launderer expects to regain control of the funds at the end. Terrorist financing's pathway is linear — funds move outward to support terrorist activity with no expectation of return. Terrorist financing can also draw on entirely legitimate sources (business fronts, sympathetic donations) as easily as illegitimate ones (kidnapping, trafficking proceeds), which is why source-of-funds legitimacy alone doesn't rule out TF risk.

The Study Guide names specific movement channels: correspondent banking (nested transactions to unrelated third parties), prepaid cards (minimal KYC, purchasable with stolen credit or cash), cryptocurrencies and stablecoins (numerous small deposits, rapid conversion), and alternative remittance systems (deposits in one jurisdiction, immediate ATM withdrawal in another — a named red flag pattern).

Money Services Businesses & Payment Services

An MSB is defined by function, not label — an entity is an MSB if it holds funds on behalf of another person, covering currency exchange, money transfers, money orders, stored-value products, and bill payment. Payment service providers (PSPs) are a distinct but related category, split into named types: payment aggregators, card issuers, payment processors, payment collectors, mobile wallet providers, alternative payment providers, and cross-border payment providers — each with different offerings and risk profiles.

A key structural risk distinction: for PSPs, customer risk is largely indirect (the PSP doesn't directly transact, but must still ensure controls are sound), while partnership risk is typically higher — PSPs depend operationally on banks, card networks, and third-party technology providers, and a partner's weak cybersecurity or compliance controls become the PSP's problem too.

PEPs & Corruption Risk

FATF defines exactly three PEP types worth knowing precisely: foreign PEPs (prominent function in a foreign country), domestic PEPs (prominent function domestically), and international organization PEPs (senior roles like secretary general or executive director). Some institutions apply "once a PEP, always a PEP," reasoning the person may retain influence even after leaving office; others weight current influence and time elapsed since the role ended.

A precise distinction worth holding separately: bribery is a specific act — offering or receiving a benefit to misuse delegated power — while corruption is the broader category encompassing bribery, embezzlement, extortion, graft, and influence peddling. The UK Bribery Act 2010 is notably extraterritorial: it holds UK parent companies liable for bribery by subsidiaries regardless of where in the world the subsidiary operates, and it introduces strict liability for commercial entities unless they can demonstrate adequate anti-bribery safeguards.

Proliferation Financing

Proliferation financing supports the development or acquisition of weapons of mass destruction, often through front companies, dual-use goods trade, and sanctions evasion techniques.

This is the newest and most specialized of the four broad financial-crime categories tested on CAMS (alongside laundering, terrorist financing, and general financial crime), and FATF has steadily increased its emphasis on it, including requiring institutions to identify and assess proliferation-financing risk as part of their overall risk assessment. Dual-use goods — items with both civilian and military applications — are a recurring theme, since their legitimate trade use makes illicit diversion harder to spot.

AML/CFT Standards, Regulations & Cooperation

FATF groups its 40 Recommendations into seven categories: AML/CFT policies and coordination; money laundering and confiscation; terrorist financing and proliferation financing; preventive measures; transparency and beneficial ownership; powers of competent authorities; and international cooperation. Jurisdictions are expected to turn these into binding law, tailored to their own legal system — which is why the same FATF standard can look different from country to country in practice.

In the EU specifically, a testable distinction: a regulation is immediately, directly applicable across all member states, while a directive only sets principles and goals — each country must separately transpose it into domestic law by a deadline. The 2024 "Single Rulebook" combined both approaches (6AMLD as a directive, AMLR as a regulation) specifically to close the fragmentation gaps that caused earlier EU AML failures. Cooperation also happens through public-private partnerships — regulators, FIUs, and institutions sharing typology reports so institutions can proactively search their own client base for a pattern law enforcement has just identified.

FATF Standards & Mutual Evaluations

A mutual evaluation rates a jurisdiction on two components: technical compliance (does the law exist?) and effectiveness, measured through 11 Immediate Outcomes covering risk understanding, international cooperation, supervision, preventive measures, legal-person transparency, financial intelligence use, prosecution, confiscation, and terrorist/proliferation financing controls — each rated low, moderate, substantial, or high. The process runs through seven stages (assessor training → technical review → scoping → on-site visit → draft report → plenary adoption → publication) and takes about 18 months.

Specific, testable criteria trigger grey-list ("Jurisdictions Under Increased Monitoring") or black-list ("High-Risk Jurisdictions Subject to a Call for Action") designation — for example, 20+ non-compliant/partially-compliant technical ratings, or low/moderate effectiveness on 9+ of the 11 Immediate Outcomes. Grey-listing isn't permanent: the UAE was grey-listed in 2022 and successfully removed by 2024 after tightening beneficial-ownership rules, creating a dedicated financial-crime court, and increasing enforcement frequency — a real example of the remediation pathway working.

International Standards & Correspondent Banking

FATF Recommendation 13 requires financial institutions to assess a respondent institution's own AML/CFT controls before establishing a correspondent relationship — understanding its business, reputation, and supervision quality, and obtaining senior management approval before proceeding. The Wolfsberg Group's Financial Crime Principles for Correspondent Banking (first published 2014, periodically updated) set out 11 specific risk indicators institutions should weigh — including jurisdiction, ownership structure, and regulatory compliance history — and call for stricter scrutiny of high-risk relationships such as shell banks or offshore financial centers.

A "nested" relationship occurs when a respondent bank lets other banks access the correspondent relationship through it, multiplying exposure to customers the correspondent never directly vetted. The BCBS's 1988 statement of principles (still foundational today) centers on customer identification, staff training, recordkeeping, and cooperation with law enforcement "to the extent permitted without breaching customer confidentiality" — a balance correspondent relationships test constantly.

Sanctions Screening & Sanctions Evasion

UN sanctions derive their authority from Article 41 of Chapter VII of the UN Charter, and member states are legally obligated to carry out Security Council decisions. The EU calls its sanctions "restrictive measures" — the EU adopts (and can go beyond) UN sanctions via Council Decisions and Regulations, with member states responsible for enforcement. In the US, OFAC administers four distinct sanctions types worth knowing apart: jurisdiction-based (entire countries, e.g., North Korea, Iran, Cuba), list-based (specific individuals/entities on the SDN List), secondary sanctions (targeting non-US persons dealing with sanctioned counterparties), and sectoral sanctions (targeting whole economic sectors like energy or defense rather than named parties).

Enforcement is real and severe — Wells Fargo paid a US$67.8 million Federal Reserve fine in 2023 for a trade-finance platform enabling transactions with sanctioned parties, illustrating that sanctions liability doesn't require intent — insufficient policies and procedures were enough to trigger the penalty.

FIU Cooperation & Financial Intelligence

The Egmont Group, established in 1995, operationalizes FIU-to-FIU cooperation through three governing documents: the Egmont Charter (2013, sets purpose and structure), the Principles for Information Exchange (2013, governs bilateral/multilateral sharing), and Operational Guidance for FIUs (2013, binding operational rules for all members). Its core functions are information sharing, capacity building, collaboration with law enforcement, and standard-setting.

Each jurisdiction's FIU has a distinct name and model worth recognizing: FinCEN is the US FIU; the UKFIU sits within the National Crime Agency; STRO is Singapore's FIU (part of the Singapore Police Force); the Joint Financial Intelligence Unit serves Hong Kong; and Korea's FIU operates under the Financial Services Commission. Despite different institutional homes, the core function is identical everywhere: receive reports, add analytical value, and route actionable intelligence to law enforcement or international counterparts.

Suspicious Activity Reporting & Investigations

Once suspicion is formed, institutions must document the rationale, escalate internally, investigate thoroughly, and file a suspicious activity/transaction report where required — all while preserving confidentiality. A strong SAR/STR narrative follows a specific structure: who is involved, what happened, when, where, why it's suspicious, and how it was carried out.

The investigation should build a documented narrative: what triggered the alert, what was reviewed, why the activity is or isn't suspicious, and what action followed. This documentation matters as much as the filing decision itself. A defensive SAR — filing mainly to protect the institution rather than because the facts support genuine suspicion — is treated as a real problem, not a safe habit: it burdens FIUs and weakens the quality of financial intelligence overall. Filing a SAR also does not automatically require closing the account — that decision is separate, risk-based, and sometimes made in coordination with law enforcement, who may actually prefer the account stay open.

AML/CFT Compliance Program Governance

FinCEN's five pillars anchor every AML program: internal policies and controls; a designated compliance officer; ongoing employee training; independent audit; and CDD. These map onto the three-lines-of-defense model — the first line (front-line, business development, operations) owns day-to-day risk and CDD; the second line (AFC compliance, led by the MLRO/BSA officer) sets policy, monitors, and stays independent from business units; the third line (internal audit) objectively tests whether the first two lines actually work.

Risk governance runs through committees, each with a formal terms-of-reference document: a board risk committee for strategic oversight, an AML governance committee (often second-line led) reviewing alert volumes and SAR trends, a high-risk customer review committee for PEPs and correspondent banks, and sometimes a separate sanctions oversight committee. A key distinction the exam tests: quality control (QC) checks the accuracy of outputs (e.g., is a KYC file complete?), while quality assurance (QA) evaluates whether the underlying process is being followed and is effective. Real enforcement cases (TD Bank's US$1.3B fine, RBC's CA$7.475M fine) both trace back to the same root cause: governance that didn't scale with the business, and policies treated as static rather than living documents.

CDD, KYC & Beneficial Ownership

KYC for a natural person starts with a Customer Identification Program (CIP): full legal name, DOB, nationality, address, and a government-issued ID. KYC for a legal person instead verifies registered business name, entity type, registration number, and — critically — the beneficial owners and UBOs behind it. Both then move through CDD (assessing risk, income, source of funds) and, for higher-risk customers, EDD (deeper source-of-wealth verification, more frequent review, senior approval).

A frequently tested distinction: the customer risk assessment (CRA) evaluates one customer's individual risk to decide the right level of due diligence, while the enterprise-wide risk assessment (EWRA) evaluates the institution's overall risk exposure to guide program design and resource allocation — they're related but answer different questions. Control effectiveness itself follows a specific formula: inherent risk − control effectiveness = residual risk. If a PEP's inherent risk is high, applying EDD and enhanced monitoring can bring the residual risk down to medium or low.

Technology, RegTech & AFC Analytics

AFC technology spans the full customer and transaction lifecycle: digital onboarding and identity verification, sanctions/PEP/adverse media screening, transaction monitoring, case management, network analysis, blockchain tracing, and data governance — plus supporting tools like RPA for repetitive tasks and OSINT for investigations.

Before adopting a tool, an institution should assess its current state, identify gaps, and choose build (customization, higher cost), buy-customized, or buy-off-the-shelf (fast, less flexible) based on its actual risk profile — not simply pick the newest or most advanced option. AI/ML can prioritize alerts, detect hidden patterns, and improve screening, but carries real limitations: bias in training data, model drift, weak explainability, and over-reliance by analysts. A parallel run alongside the existing system is the safer way to introduce an AI-based tool. Governance is one of the highest-yield areas here — the institution must be able to explain how a tool works, what data it uses, how it was tested, and who approved changes. Outsourcing to a vendor never outsources accountability.

Data Collection & Preparation

AFC technology is only as good as the data behind it. The Study Guide frames data quality across five dimensions: completeness, accuracy, consistency, timeliness, and validity — weak data on any of these causes false positives, false negatives, missed sanctions matches, and poor risk ratings.

A core distinction tested here is static data (who the customer is expected to be — name, DOB, ownership, source of wealth, collected through KYC) versus observed data (what the customer actually does — transaction behavior, device use, alert history). Data preparation moves through extraction, cleansing, transformation, validation, and loading (ETL), tracked via data lineage — backward lineage traces an output back to its source, forward lineage traces source data into downstream systems. Three related but distinct techniques matter for matching records: entity resolution decides whether multiple records refer to the same person or entity; blocking groups records by shared attributes (name, DOB, device, wallet) purely to make matching more efficient; clustering groups related records to reveal hidden networks like mule rings — but clustering only flags a pattern for investigation, it never proves criminal activity by itself.

Transaction Monitoring & Alert Management

The Study Guide draws a key distinction the exam tests directly: payment screening is preventive — it checks parties, payments, vessels, or goods before or during processing, mainly for sanctions/terrorist-financing/proliferation-financing risk. Transaction monitoring is detective — it reviews behavior after (or near) the transaction to spot patterns inconsistent with the customer's profile. Batch screening sits alongside both: it re-checks existing customers against updated lists to catch anyone who became risky after onboarding.

Scenario coverage must map to the institution's actual risks — products, customers, jurisdictions, typologies. Building a scenario means defining the typology, threshold, time window, and escalation logic, then calibrating and testing it. Turning off alerts because there are too many is treated as a control failure — the correct response is root-cause analysis and proper recalibration, not suppression. Once an alert becomes a case, investigation technology takes over: network analysis connects hidden relationships between accounts, devices, and counterparties; blockchain tracing follows wallet clusters and sanctioned addresses; case management preserves the evidence and audit trail. The guide's own memory line: network analysis connects the dots, case management preserves the proof, reporting completes the regulatory record.

The Purpose and History of Sanctions

Sanctions are political decisions made as part of diplomatic efforts by countries, regional organizations, and international bodies — primarily a foreign policy and security tool, not a criminal-law one. At their core, every sanction is aimed at behavioral change through deterrence, prevention, or punishment; the specific objective (protecting national security, punishing military aggression, discouraging WMD proliferation, disrupting terrorist financing, diminishing a regime's power to commit human rights violations, or targeting corrupt officials) is just that underlying goal applied to a specific situation. Sanctions sit between diplomacy and war — a lower-cost, lower-risk intervention used either instead of military action or while military options are still being evaluated.

The practice is old: one of the first recorded uses dates to 5th-century BCE Athens, which barred citizens of Megara from its markets. The League of Nations (post-WWI) began the shift toward multilateral sanctions — multiple countries acting together — and the UN Charter formally recognized sanctions as a foreign policy tool in 1945. A precise, testable distinction worth holding onto: Counter-Proliferation Financing (CPF) targets WMD-related financing specifically (anchored in UNSCR 1540 and FATF Recommendation 7), while Countering the Financing of Terrorism (CFT) covers targeted financial sanctions, investigation, information sharing, and due diligence aimed at terrorist financing — related concepts, but distinct obligations.

Who Imposes Sanctions: UN, EU, US & UK Regimes

Sanctions come from three levels: multilateral (UN Security Council, binding on all member states), regional (the EU, applicable across member states), and unilateral (a single country acting alone, such as the US, UK, Canada, or Australia). The UN's authority derives from Article 41 of Chapter VII of its Charter; the Security Council's 15 members include five permanent members with veto power (Russia, US, UK, China, France — the "P5"), and at least 9 affirmative votes with no P5 objection are needed to pass a resolution. Once adopted, sanctions are legally binding under Articles 25 and 48, and the UN maintains the Consolidated List of all sanctioned persons and entities — though enforcement itself falls to member states, who must pass their own implementing legislation.

The EU calls its own sanctions "restrictive measures," prepared by the European External Action Service and adopted unanimously under its Common Foreign and Security Policy; it both implements UN sanctions (via Council Decisions/Regulations) and imposes autonomous ones. The US runs the most comprehensive framework globally — sanctions originate from the President (via Executive Orders under IEEPA/TWEA) or Congress (via statute, e.g., CAATSA), and are implemented mainly by OFAC (Treasury), which maintains the SDN List, alongside BIS (Commerce, export controls/EAR) and the State Department. The UK, post-Brexit, runs its own regime under the 2018 Sanctions and Anti-Money Laundering Act (SAMLA), with OFSI (financial sanctions/licensing), the FCA, the Department for Business and Trade, and the Home Office (travel bans) each holding a distinct piece.

US Primary vs. Secondary Sanctions & OFAC

US primary sanctions apply where a "US nexus" exists — a US citizen or permanent resident (wherever located), any entity organized under US law, anyone physically present in the US, or (in some programs, like Iran and Cuba) a non-US entity owned/controlled by a US person. US secondary sanctions are different in kind, not just degree: they target non-US persons for transactions entirely outside the US, with no US nexus at all — used in a limited set of programs (Iran, North Korea, Russia), and made a far more prominent tool after CAATSA in 2017. Because no US connection is required, secondary sanctions don't impose fines for a "violation" the way primary sanctions do; instead, the non-US party risks being cut off from the US financial system or added to the SDN List themselves.

Determining secondary-sanctions exposure turns on whether a non-US person "knowingly" facilitated a "significant transaction" — OFAC weighs factors like transaction size/frequency, whether it fits a pattern, management's awareness, and any connection to a blocked person, explicitly on a case-by-case basis rather than a fixed threshold. OFAC itself sits inside Treasury and administers both targeted programs (e.g., Global Magnitsky, Counter Narcotics Trafficking) and comprehensive country programs (Iran, North Korea) — its core list, the Specially Designated Nationals and Blocked Persons (SDN) List, blocks the named person's assets and generally bars US persons from dealing with them at all.

Jurisdictional Reach & Extraterritoriality

Extraterritoriality is a state applying its laws to persons, property, or conduct beyond its own borders. The US is the primary jurisdiction that does this deliberately through its sanctions regimes; the EU considers the practice a violation of international law and does not apply its own restrictive measures extraterritorially — EU sanctions instead require an actual EU nexus (an EU national, an EU-incorporated entity, or activity conducted at least partly within the EU). This asymmetry is exactly what creates blocking regulations: EU/UK law that can prohibit EU/UK persons from complying with certain extraterritorial US sanctions, specifically to protect their own economic interests and foreign policy positions from being overridden by another country's law.

Two named, testable cases capture how this plays out in practice. In Cynergy Bank, a UK bank stopped paying loan interest to a Cyprus-based lender after the lender's ultimate beneficial owner (Russian oligarch Viktor Vekselberg) was designated an SDN — UK courts held that Cynergy was correctly complying with US secondary sanctions, even though Cynergy itself was never a "US person," because the underlying transaction involved an SDN-linked party. In the JCPOA case, when the US withdrew from the Iran nuclear deal in 2018 and reimposed sanctions, the EU stood up INSTEX — a special-purpose vehicle meant to let European exporters keep trading with Iran outside the reach of US secondary sanctions — but it struggled against financial-sector reluctance to risk US exposure and was ultimately liquidated in 2023, a real illustration of how hard blocking mechanisms are to make work in practice.

Sanctions Targets & Facilitation

Everyone is subject to sanctions based on jurisdiction, but not everyone needs a formal sanctions compliance program — that obligation falls on organizations that are directly regulated for sanctions compliance, or whose risk exposure (nature, size, complexity of business) warrants one. Citizens and permanent residents must comply with their home jurisdiction's sanctions wherever they physically are, and separately must comply with the sanctions law of wherever they're physically located — both apply simultaneously, not one or the other. Two real limitations exist on who can be targeted: a country generally cannot sanction its own citizens without violating its own domestic law, and sanctions must respect human rights and humanitarian obligations.

Facilitation is a precisely defined, separately prohibited concept: making a sanctionable activity easier for a third party, even without directly engaging in the underlying transaction yourself — this covers providing personnel, software, technology, goods, services, financing, approvals, guarantees, or even referring a business opportunity to a foreign entity. OFAC prohibits US persons from facilitating; the EU has similar anti-circumvention rules. The named Alfa Laval case shows exactly how this plays out: a Middle East subsidiary of a US company falsified export documents to reroute oil-tank-cleaning equipment to Iran via Dubai, without informing the US parent — OFAC still penalized the responsible subsidiary over US$615,000, more than 30 times the shipment's value, illustrating how facilitation penalties are designed to deter, not merely recover losses.

Types of Sanctions and Embargoes

Sanctions take several forms — financial/economic sanctions, trade sanctions (including arms embargoes and export controls), asset freezes, and travel bans — and separately can be either comprehensive (targeting an entire jurisdiction, like the Iraq sanctions after the 1990 Kuwait invasion, which triggered severe currency inflation and infrastructure collapse alongside their intended effect) or targeted/"smart" (focused on specific individuals to limit collateral damage to the broader population). The 2022 Magnitsky Act case is the textbook targeted-sanctions example: named after a Russian lawyer who died in custody after exposing a US$230 million fraud, the Act lets governments freeze assets and bar entry for human rights violators and corrupt officials specifically, anywhere in the world, without sanctioning their whole country.

Sectoral sanctions sit in between — they don't target a whole country or just named individuals, but a specific economic sector (finance, energy, defense). Russia's 2014 and 2022 sectoral sanctions are the most heavily tested example: a price cap on seaborne oil, bans on aircraft-part exports, mining-sector import restrictions, and — notably — removing designated Russian banks from SWIFT, which blocked their ability to send or receive international payments at all. Asset freezes are their own distinct tool: the Roman Abramovich case shows a freeze can coexist with a targeted license for narrow purposes (his Chelsea Football Club was licensed to keep playing matches and paying players even while his broader assets stayed frozen) — freezing and total prohibition are not the same thing.

Sanctions Exceptions, Exemptions & Licensing

A license is written authorization permitting an activity that sanctions would otherwise prohibit — and there are two distinct types. A general license (called a derogation in the EU) authorizes a whole category of transactions for any qualifying person, with no individual application needed — typically covering humanitarian aid, legal services, or basic needs. A specific license is granted case-by-case, only after a written application demonstrating the activity meets the program's criteria, and approval is never guaranteed — OFAC can take months, and some categories carry a standing policy of denial. Both types come with real limits: a license authorizes only the specific activity and amount described, never unrestricted dealings with a sanctioned party, and a bank that helps move licensed funds still bears its own compliance obligations for enhanced monitoring, separate from the customer's own license.

The named Syria Property Ltd. case shows this concretely: a UK real estate firm's accounts were frozen once its Syrian parent became a designated entity, and even after obtaining a license to resume basic operating payments (payroll, utilities, insurance), the bank was still expected to actively monitor every withdrawal for license-scope compliance — obtaining a license doesn't end an institution's own due diligence duty. On the humanitarian side, the Study Guide's Taliban/Afghanistan example shows how narrow "general license" language really is: OFAC's General License 19 permitted education-related humanitarian transfers into Afghanistan, but explicitly did not authorize payments to any blocked person beyond specific categories like taxes, fees, or permits — a license's precise wording, not its general humanitarian purpose, defines what's actually allowed.

Delisting

Delisting removes an entity, individual, or item from a sanctions list, and can happen for several distinct reasons: genuine behavior change (ending terrorism support, complying with an agreement), correcting an error (the person was listed by mistake), positive diplomatic developments, humanitarian necessity, or simple goodwill. Outside of automatic delisting on death or an entity's legal dissolution, every delisting decision is made case-by-case by the body that imposed the original sanction — at the UN, that means petitioning the Focal Point for Delisting (or, for ISIL/Al-Qaida-linked listings specifically, the Office of the Ombudsperson); the EU General Court hears direct challenges only for autonomous EU sanctions; the UK allows a ministerial review under SAMLA Section 23; and OFAC handles US petitions directly. A real, testable risk: jurisdictions can disagree — the EU delisting someone while OFAC keeps them listed creates a genuine legal and operational conflict, not just an administrative inconvenience.

Delisting does not end an institution's compliance obligations — this is the exam's most heavily tested angle. The GlobalTrade Corp. case shows the correct response: once a wrongly-sanctioned customer was cleared and delisted, the compliance officer still had to refresh KYC information, reassess (typically lower) the customer's risk rating, document the entire episode, notify internal stakeholders across risk/legal/relationship management, and recalibrate transaction-monitoring thresholds to match the new profile — delisting triggers a review, it doesn't close the file. Financial institutions may also choose to apply enhanced due diligence for a defined period after delisting, purely as a precaution against illicit activity resuming post-delisting.

Consequences of Noncompliance

Sanctions violations generally carry strict liability — an individual or organization can be held liable even without knowledge or intent to violate, and even where a genuinely risk-based compliance program was in place. For individuals, consequences range far beyond fines: frozen assets, blocked banking access, travel restrictions, criminal penalties (in the US, up to US$1 million and 20 years' imprisonment for willful violations), and lasting reputational and social damage. The Mikhail Fridman case shows how narrow post-sanctions life becomes even for a billionaire: UK courts limited him to roughly £760,000/year in living expenses and specific security costs, rejecting his request for materially more — sanctions relief for personal maintenance is licensed narrowly, not restored to pre-sanctions normalcy.

For organizations, strict liability means an entity can be penalized even when a subsidiary acted without the parent's knowledge — this is exactly what happened in the Oleg Deripaska/Rusal case, where sanctions on Rusal (tied to Deripaska's ownership) disrupted the entire global aluminum industry before OFAC lifted them once Deripaska's ownership stake dropped below 50%. Successor liability extends this further: an acquiring company inherits the sanctions-violation history of whatever it acquires, including subsidiaries — due diligence on a target's own past violations is not optional. Critically, self-reporting and remediation genuinely reduce penalties: OFAC's own enforcement framework weighs voluntary self-disclosure, cooperation, and remedial action (firing responsible staff, strengthening controls) as mitigating factors — the Study Guide's own worked scenario treats "take remedial action and self-report" as the textbook-correct response to discovering an accidental violation, not "confirm the vendor is liable instead."

Types of Sanctions Risk: Operational, Legal, Concentration & Reputational

Four risk types recur across the whole sanctions curriculum. Operational risk is loss from failed internal processes, people, or systems — human error causes most of it, but natural disasters, ransomware, and inadequate screening-software updates are named contributors too. Legal risk is the possibility of criminal penalties, lawsuits, or unenforceable contracts causing harm; the Arab Bank Plc. case is the anchor example — a US jury found the bank liable in 2014 for knowingly facilitating payments connected to Hamas, brought under the Anti-Terrorism Act by nearly 600 private plaintiffs (not a regulator), and even though the case was later dismissed on a technicality, the bank still lost its US operations and other banking relationships — legal risk can materialize as private litigation entirely separate from any regulatory enforcement action.

Concentration risk comes from over-exposure to a single customer, sector, or jurisdiction — the Fortum case shows this precisely: the Nordic energy company had over €6 billion concentrated in Russia through one subsidiary, and when Russia seized that subsidiary in 2023, Fortum recorded a €1.7 billion loss — roughly 20% of its total equity — from a single geographic/sector concentration. Reputational risk is the hardest to quantify but the fastest to materialize: the Clarita National Bank case shows how it compounds — a first sanctions-and-AML enforcement action (US$100 million in fines) was followed by a second media leak revealing further undisclosed violations, triggering depositor withdrawals, termination of correspondent banking relationships in three countries, a collapsed acquisition deal, and even the loss of a sports sponsorship — reputational damage from a compliance failure regularly extends well beyond the institution's direct banking relationships.

Sanctions Risk Assessment

Every sanctions program starts with a risk appetite statement — the level of financial crime risk an organization will accept, set and periodically reviewed by the board, then allocated down to business units as specific risk limits. From there, a risk-based approach rates four categories of inherent risk — customer, jurisdiction, product, and channel — before any controls are applied. The exam's key formula: inherent risk − control effectiveness = residual risk. Controls fall into three types (preventive, like CDD and recordkeeping; detective, like SAR filing; corrective, like exiting a relationship), built on five components — control environment, risk assessment, control activities, information/communication, and monitoring.

A high-quality sanctions risk assessment takes a genuinely holistic view — clients, products, supply chain, intermediaries, counterparties, transactions, and geography — not just the customer relationship in isolation. The Study Guide names concrete good practices (size-appropriate scope, documented methodology, both qualitative and quantitative analysis, consistent methodology across cycles, up-to-date due diligence) against equally concrete common failings (omitting third parties, working from outdated records, poor understanding of requirements). Risk assessments should be refreshed not just on a schedule but whenever the risk environment changes — new sanctions, or root causes uncovered by a violation.

Sanctions Risk by Sector and Business Line

Risk profiles differ meaningfully by business line. Retail banking is exposed through its sheer diversity of products and customers — cross-border transfers and virtual currency use are named vulnerabilities, and red flags include inconsistencies between a customer's stated purpose and their actual jurisdictional footprint. Commercial and investment banking risk centers on complex ownership structures and intermediaries (special purpose vehicles in particular) that obscure who actually controls a counterparty — debt/equity financing restrictions (e.g., US sanctions barring certain Russian or Venezuelan entities from raising new capital) are a specifically named concern here.

Wealth management and private banking carries elevated risk because professional intermediaries — accountants, lawyers, art dealers — can be exploited to move assets discreetly through nontransparent structures; named red flags include shell companies used for wire transfers, sudden unexplained account growth, and attempted transactions with SWIFT-excluded institutions. Correspondent banking is structurally exposed because the correspondent bank cannot directly perform due diligence on the respondent's own customers — it must rely entirely on the respondent's own controls, a genuine, structural blind spot rather than a mere administrative gap.

Sanctions Compliance Program Framework & Three Lines of Defense

A robust sanctions compliance program (SCP) rests on the same three lines of defense model used across AFC generally. The first line (front-line/business) implements policies and performs day-to-day CDD. The second line (AFC compliance, led by the sanctions compliance officer) sets policy, monitors, and must stay independent from business incentives — specifically barred from being compensated on a share of business profits, to avoid a conflict of interest. The third line (internal audit) independently tests whether the first two lines' controls actually work, reporting directly to the board's audit committee. The Fraser Corporation case shows what happens when this is skipped: a mid-sized tech company unknowingly dealt with a sanctioned supplier, triggering public backlash and regulatory scrutiny — its remediation was a full enterprise-wide risk assessment across all four inherent risk categories (customer, jurisdiction, product, channel), followed by properly resourcing the SCP itself.

The sanctions compliance officer (SCO) role is defined precisely: they must have a reputation for integrity, deep technical knowledge of global sanctions regimes, and — critically — sufficient time and authority to act independently. Their responsibilities span establishing the risk-assessment framework, keeping AFC policies current with regulatory change, monitoring control effectiveness, serving as the regulator/FIU contact point, and ensuring regular staff training. A single person can hold the SCO role alongside other senior AFC compliance titles — the exam doesn't require a dedicated headcount, but does require the independence and authority regardless of title.

Sanctions Due Diligence & KYC Across the Customer Lifecycle

KYC operates across the full customer lifecycle — onboarding, ongoing monitoring, and offboarding — and is genuinely distinct from transaction monitoring (detective, reviewing activity after it happens) versus screening (preventive, checking names/payments/adverse media/PEP status both before onboarding and continuously afterward). The real Etoile Finance Groupe / Banque Etoile SA OFAC case shows what happens when the underlying data itself fails: a Lebanese branch processed US$15.6 million for entities 50%+ owned by SDN-listed terrorists, not because the screening software was faulty, but because beneficial-ownership records existed only on paper — never digitized, so they were structurally invisible to automated screening. The fix wasn't a new vendor or retraining alone; it was digitizing the underlying KYC records so ownership data could actually reach the screening system.

The InsureCo Limited case reinforces a separate lesson: its EU subsidiary, InsureCo Europe, issued Cuba travel insurance that violated no EU sanctions — but as a foreign subsidiary of a US parent, its US nexus made this a US sanctions violation regardless. Effective KYC research follows a four-step model — Assess (what you know and don't), Explore (fill the gaps), Organize (structure what matters), Present (document for every audience: regulators, law enforcement, internal monitoring staff, auditors) — and the steps loop, since organizing often reveals you need to explore further. Two hard boundaries apply throughout: never "tip off" a customer that they're under investigation (a criminal offense in many jurisdictions, though confirming public information like sanctions-list status is not tipping off), and data privacy laws like GDPR impose strict retention, consent, and cross-border transfer rules on everything collected.

Customer Identification & Enhanced Due Diligence

Three levels of due diligence apply by risk: simplified (SDD) for genuinely low-risk customers, standard (CDD) for most customers, and enhanced (EDD) for high-risk ones — requiring deeper source-of-wealth/funds verification and PEP-connection assessment. Basic identification differs by customer type: a natural person needs name, address, date of birth, and a tax/national ID number; a legal person needs company name, address, place of incorporation, and a government-issued ID number. The Alisher Uspanov case is the exam's anchor for name-matching judgment: a near-miss against OFAC's SDN entry for "Alisher Usmanov" (different spelling, different birth year, different address) was correctly investigated, correctly ruled a non-match — but the bank still declined the account for an unrelated reason (Uzbekistan being a high-risk jurisdiction) and still reported its findings to OFAC even after concluding there was no true match.

The Borrower X case shows EDD escalation done right: open-source intelligence suggested a loan applicant was a special-purpose vehicle for an OFAC-listed Indonesian oil firm — evidence the bank couldn't fully confirm, so it triggered EDD (verifying incorporation documents, cross-checking business location against the suspected parent) rather than either dismissing the tip or rejecting outright on unconfirmed suspicion; only after EDD confirmed high sanctions exposure was the customer rejected. The MarcoPolo Ltd. case extends this to ongoing monitoring: a trade-finance client was correctly EDD-rated at onboarding (30%-sanctioned major shareholder), passed initial checks — but four months later, a new counterparty with no offices, one employee, and a Russian national with a defense-industry background triggered a SAR filing and a full onboarding review. EDD isn't a one-time gate; it's triggered again whenever new counterparties or new information appear.

Beneficial Ownership: Identification & Risk

A beneficial owner is whoever has ultimate control over an account's funds — through ownership or other means — and most jurisdictions require identifying anyone owning 25%+ of a legal entity (as low as 10% for high-risk customers), per FATF Recommendations 24 and 25. Critically, an ultimate beneficial owner (UBO) is always a natural person, never another legal entity — regulators require tracing through however many corporate layers exist until you reach an actual human being, precisely because legal entities can be formed, restructured, and dissolved quickly while a human behind them cannot simply disappear. Where no UBO can genuinely be identified through ownership or control, most jurisdictions require recording a senior managing official instead — but an inability to identify any UBO at all is itself a red flag worth investigating on its own.

Legal arrangements like trusts are a named, higher-risk structure precisely because settlor, trustee, and beneficiary can legally be the same person in some jurisdictions — letting someone conceal their own beneficial ownership behind an apparently independent structure. The real Oligarch case shows this exploited deliberately: a sanctioned Russian oligarch, anticipating designation, had a professional service provider shift beneficiary status on his trust from himself to his own children — while the underlying holding structure (11 offshore companies, interest-free loans with no repayment obligation) had no legitimate business purpose beyond moving assets out of reach of seizure. Shell and shelf companies carry similar risk — the Hidden Ltd. case shows a Panama company opened one month after Russia's invasion, funded by a US$10 million "loan" from another opaque entity, ultimately traced (via a yacht's public ownership history) back to a sanctioned Russian oligarch using a young front-man as the declared owner.

Calculating Beneficial Ownership: The 50% Rules

Ownership has two distinct prongs: the ownership prong (formal, percentage-based) and the control prong (who actually directs the entity — directors, officers, or anyone exercising dominant influence) — and these can be different people entirely. For AML purposes, indirect ownership is calculated by multiplying stakes down each ownership chain (person owns 40% of a company that owns 30% of the target = 12% indirect stake) against a standard 25% threshold. For sanctions purposes, the math is different and stricter: each level of ownership is assessed separately, not multiplied — meaning a sanctioned person's company at any level in the chain can taint the entity below it even if their diluted indirect percentage would fall well under any AML threshold.

The OFAC 50% Rule considers only ownership (not control): if a sanctions target owns 50%+ of an entity, directly or in aggregate with other sanctioned owners, that entity is automatically sanctioned even without being individually listed — the Lion Corporation example shows two SDNs owning 39% and 16% respectively (55% combined) sanctioning the whole company, even though the non-sanctioned majority shareholder holds the remaining 45%. The EU and UK 50% rules differ in two ways: they consider both ownership and control, and their aggregate-ownership rule (EU: 50%+ combined; UK: more than 50%) now applies across all EU sanctions programs since mid-2024, not just the original Russia-specific regulation. The Turkish company case shows this timing distinction mattering in practice: identical ownership by two sanctioned nationals triggered an immediate US freeze (aggregate rule always applied under OFAC) but would only have triggered an EU freeze after the mid-2024 rule expansion. The Mr. Anderson case shows the ownership-vs-control distinction directly: a trust where he's merely the settlor escaped US sanctions (OFAC: ownership only) but was sanctioned under EU/UK rules (control: settlor + family connection to the protector/beneficiary counts as de facto control).

Sanctions Screening Policy, Lists & False Positives

Screening — checking names, payments, and adverse media against official lists — runs at three points: onboarding, ongoing (batch), and at time of payment. Lists split into mandatory (UN, EU, US, host-country — binding, must be screened) and supplementary (negative news, evasion-pattern lists — a discretionary risk-reduction extra). Trade-specific lists live separately with the US Bureau of Industry and Security: the Entity List imposes extra licensing requirements, the Denied Persons List bans exporting to a party entirely, and the Consolidated Screening List combines multiple export-control lists for one-stop screening — a genuinely important distinction, since the Entity List and DPL trigger different consequences for the same-looking alert.

Fuzzy logic lets a screening system catch misspellings, transliteration differences, and phonetic variants (e.g., "Katherine Navel" vs. "Catherine Naval") that an exact-match system would miss — but every fuzzy match is inherently a partial match requiring human judgment to resolve. A genuine false positive is when a filter (human or system) raises an alert that turns out to be nothing — common, unavoidable "noise" that must still be understood and documented before being cleared, never dismissed reflexively. The Study Guide's own worked scenario (the unnamed yacht "Serena") shows the correct escalation instinct: an ambiguous payment tied to a possibly-sanctioned yacht owner should trigger a request for information from the remitting bank first — not an immediate breach report (premature without confirmation) and not direct contact with a non-customer third party (inappropriate outreach).

Screening Process: Payments, SWIFT & Trade Activity

Screening produces four possible outcomes: target match (stop the transaction, review all related activity), escalate (needs more research), false positive (clear and document), and false negative (usually human input error — a genuinely dangerous outcome since it means a real match was missed). Payment screening happens ex-ante — before the transaction completes — as opposed to transaction monitoring's ex-post review; SWIFT is the dominant messaging network, and the shift to the ISO 20022 standard matters because its richer, more structured data fields materially improve screening accuracy compared to the older ISO 15022 format.

Trade activity screening extends beyond the buyer and seller to the vessel itself (name, registration, ownership, recent voyage history), the shipping company, routes, ports of call, and supporting documents (letters of credit, bills of lading, certificates of origin). The Study Guide's own "Unusual Transactions" case shows the red-flag pattern precisely: a company with a stable US$1 million letter-of-credit pattern suddenly shifted to multiple smaller purchases (~30% of normal size) from new sellers near high-risk jurisdictions, several paid in cash advance — a combination of behavior-pattern deviation, unusual seller geography, and payment-method shift, none alone conclusive but together a clear trigger for enhanced due diligence. Separately, dual-use goods (civilian/military applications — lasers, sensors, certain chemicals) are governed by control regimes like the Wassenaar Arrangement and the Missile Technology Control Regime; evasion tactics include fictitious end-users, re-export through a third jurisdiction, and vague cargo descriptions like "spare parts" to avoid extra scrutiny.

Sanctions Screening Technology & Analytics

Automated screening tools (ASTs) use weighted algorithms — down-weighting "noisy" words like "of" and "the," giving surnames more weight than forenames, and applying fuzzy logic for spelling variants — to generate ranked potential matches. Calibration matters enormously: the Study Guide's own worked scenario shows a vendor's software update silently resetting the name-match threshold from 90% to 70% and switching country-matching from "customer's jurisdiction only" to "global," tripling alert volume overnight with mostly-unrelated hits. The correct response was neither to keep working through the backlog unquestioned, nor to rush-clear the extra alerts, nor to escalate straight to senior management — it was to review the threshold change directly with the vendor and immediate supervisor, since an unexplained volume spike signals a system malfunction, not increased risk.

Beyond matching, modern AFC technology adds real capability: AI/machine learning reduces false positives versus purely rule-based systems by learning patterns rather than following fixed rules, though this comes at some cost to explainability. Robotic process automation (RPA) frees compliance staff from repetitive tasks for higher-risk analysis — but the Study Guide is explicit that GDPR prohibits fully automated decisions determining an individual's fate, meaning RPA can support a customer accept/reject decision but cannot make it alone. Network analysis maps shared identifiers (addresses, phone numbers, device IDs, IP addresses) across a customer base to reveal hidden connections — multiple customers sharing one address can indicate an organized group; multiple accounts funneling into one account can indicate a money-mule network. Proper data mapping (which payment-message field maps to which screening check) and ETL governance (extract, transform, load) are what keep all of this technology accurate — misconfigured field mapping, like screening a bank-identifier-code field against an entire sanctions list instead of just sanctioned BIC codes, is a named cause of excess false positives.

Ownership Concealment: Names, Restructuring & Proxies

Detection ultimately depends on the customer relationship — knowing who a customer really is, and knowing your own employees too. Know Your Employee (KYE) matters because evasion can be internal (an employee overriding controls or whitelisting a blocked party) as well as external; the "four eyes" dual-control principle (two people independently verifying key actions) is the named defense. The real EuroCapital Alliance Bank (ECAB) OFAC case shows detection failing despite the data already existing: ECAB had KYC records clearly showing sanctioned-jurisdiction addresses, but its automated screening simply never flagged them — compliance only found the accounts during a routine periodic review, after ~300 transactions worth US$3 million had already processed. ECAB also missed that its biggest client's sanctioned oligarch owner divested 45% of his 75% stake to his wife on the very day of his designation — a still-controlling transfer, not a genuine exit.

Three distinct concealment vehicles matter: a shell company exists mostly on paper with no real operations; a front company has genuine physical operations (a car wash, a restaurant) that shield illicit activity behind a legitimate-looking business; a proxy is a person — often a relative, associate, or nominee director — standing in for the real owner. Financial criminals also conceal ownership through name variation (spelling changes, reordered names, generic institutional names like "Foreign Trade Bank" that don't obviously signal DPRK ties) and ownership restructuring — either sham divestments to associates who let the original owner keep real control, or deliberate dilution below the 50% aggregate-ownership threshold. The real SOGAZ case shows the latter precisely: after Bank Rossiya was sanctioned in 2014, it reduced its indirect stake in SOGAZ from 51% to 48.5% just before the sanction took effect — and reduced it further to 32.3% specifically after OFAC introduced the aggregate-ownership rule, keeping combined sanctioned ownership at 44.8%, just under the 50% threshold.

Trade-Based Evasion: Concealment, Dual-Use Goods & Transshipment

Trade-based evasion typically works by concealing an end-user's true identity — falsifying buyer/seller names, routing through an intermediary jurisdiction for re-export, or falsifying an end-user certificate for controlled goods. Dual-use goods (civilian and military application) are frequently repackaged inside unregulated items — the Study Guide's own example is a missile-guidance sensor hidden inside a coffee maker — precisely because smaller, less-recognizable components are easiest to disguise this way. Transshipment (routing goods through an intermediate stop before final delivery) is often legitimate, but becomes evasion when used to switch cargo, obscure the true routing, or move goods through weakly-regulated jurisdictions. The real ACE/Iran case shows the full pattern: a Turkish "straw buyer" company with no trade history bought dual-use pressure transducers from a US manufacturer, claimed a Middle East freight-forwarder as the destination, then relabeled the shipment as "consumer electronics" for onward air/sea transit to Iran — layering a straw buyer, transshipment, and document falsification together.

The real Mutassim Gaddafi case (Bank of Valletta, Malta) shows front/shell company misuse at scale: the sanctioned son of Libya's former dictator used an alias and shell companies set up by a complicit local auditor to accumulate at least €60 million, ultimately spent on hotels, travel, and shopping — a court ultimately ordered ~€90 million returned to Libya. The MaxStar case shows how document inconsistencies reveal evasion even without a smoking-gun confession: a UAE trading company's sudden luxury-goods deal with a Kazakhstan buyer showed a 30%-below-market unit price, triple the normal shipping cost, a Russian carrier, and a Kazakhstan delivery address paired with a Russian-registered receiving party — none alone conclusive, but together enough to trigger investigation that confirmed MaxStar was a front for a Russian reseller.

Maritime Evasion & the Russian Oil Price Cap

Vessels are required to broadcast their location via AIS (Automatic Identification System) transponders. Two distinct evasion techniques exploit this: loitering (turning off the AIS entirely to hide in a high-risk area) and spoofing (continuing to transmit AIS data while manipulating it — altering the reported jurisdiction, route, or vessel identity, sometimes projecting a decoy vessel's location). Not every AIS gap is illicit — poor signal coverage or genuine security concerns near piracy zones are legitimate reasons — but red flags include scattered tracking lines, proximity to high-risk jurisdictions when the signal drops, and two vessels broadcasting the same AIS number. The real Jacoby Carrier case shows this precisely: a Mauritius-flagged vessel's AIS went dark for 36 hours near Japan, then reactivated broadcasting a different registration (Singapore instead of Mauritius) — satellite imagery later showed 10-15 unaccounted-for containers added mid-voyage from unmarked vessels, confirming a cargo swap with North Korea-linked ships.

The Russian oil price cap — a joint G-7/EU/Australia policy limiting the sale price of Russian crude — shows how sanctions evasion adapts to price-based (not just party-based) restrictions. OFAC's advisory flagged vague, unbroken-down pricing information on trade documents as a key red flag, since circumvention typically works by inflating intermediate costs (shipping, freight, insurance) that sit outside the capped price, or by falsely certifying Russian-origin oil as coming from elsewhere. A safe harbor — legal protection from liability — is available to service providers who apply genuine risk-based due diligence, including real scrutiny of a customer's self-attestations rather than accepting them automatically.

Payment Evasion: Stripping & U-Turn Payments

Stripping is the intentional removal or alteration of identifying information from a payment message specifically to defeat automated sanctions screening — motivations range from profit and business-relationship preservation to bribery or even political sympathy with a sanctioned party. It splits into internal stripping (an employee alters the message) and external stripping (a customer or third party does) — though the Study Guide notes that reported violations are rarely purely external, since an insider is almost always needed somewhere in the chain. The real Kenya correspondent bank case shows collusion in action: a Sudanese bank routed a payment through a bribed Kenyan correspondent, which replaced the Sudanese bank's own identifying details with those of a "respectable" Kenyan institution before forwarding to a US correspondent — the scheme was only caught when the beneficiary bank's own due diligence cross-checked the payment against the customer's supporting documents and found the discrepancy.

U-turn payments route a US-dollar transaction that both originates and ends outside the US through the US financial system via offshore banks — legal under a limited pre-2008 OFAC exemption for Iran-related transactions, revoked in 2008, but still exploited afterward by banks that stripped identifying terms to keep the payments flowing undetected. The real Société Générale case is the largest documented example: from 2003-2013, SG's Paris operations split payment instructions into two separate SWIFT messages — a full-detail MT103 sent directly to the sanctioned beneficiary's bank, and a stripped MT202 (with Iranian/Sudanese identifying details removed) sent to its own US branch — a deliberate architecture to keep the US branch technically "blind" to what it was really processing. The New York DFS fined SG US$325 million, tracing the root cause to no centralized sanctions function and policies that barely addressed US sanctions at all.

Payment Evasion: SWIFT Manipulation, Nested Accounts & Crypto Risk

SWIFT messages come in specific formats: MT103 (single-customer credit transfer, with named fields for originator and beneficiary), MT202 (bank-to-bank transfer, historically vulnerable since its limited fields let key identifying information be omitted), and MT202 COV (introduced specifically to close that gap — its "sequence B" field must match the underlying MT103's originator/beneficiary data exactly). Message separation — sending an MT103 direct to the beneficiary while sending a stripped MT202 to an intermediary — was a real evasion technique before MT202 COV made it far harder; the shift to the richer ISO 20022/MX format aims to close remaining gaps further.

Nested accounts occur when a correspondent bank unknowingly serves a respondent's own customers — "a customer's customer" — losing visibility into who's really transacting. The real Halkbank case (Turkey's second-largest state bank) shows nested accounts used at massive scale: senior executives ran ~US$20 billion through nested accounts held in the names of Iranian state entities, disguised as food/medicine purchases to exploit OFAC's humanitarian exception — while senior management knew the transactions weren't actually humanitarian. Downstream services compound this risk further: a correspondent's own respondent can itself act as a correspondent for other banks, multiplying the upstream bank's exposure to parties it never directly vetted. On cryptoasset risk, the real BitCab case (a US-based Iran-linked payments platform) shows crypto's supposed anonymity failing in practice — US investigators traced the platform's operator through a linked US bank account, a VASP account funded with fiat currency, and an IP address, ultimately tracing over US$10 million moved to Iran despite the platform's own marketing claims of untraceability.

Investigating a Sanctions Breach: Sources & Leading an Investigation

When an alert reaches case level, the handoff itself matters — the investigator needs a complete package (what triggered the alert, supporting documents, account records) since the regulatory filing clock is already running. Investigation sources split into internal (KYC/transaction-monitoring escalations, internal hotlines, relationship-manager referrals) and external (adverse media, customer complaints, lawsuits, subpoenas, FIU requests, regulator recommendations). The real Faisal Nadeem case shows a properly escalated near-match: an analyst couldn't fully validate a potential SDN match using open sources alone, so escalated rather than guessing — the investigator who took over then requested additional information from both the ordering institution and the internal relationship manager before deciding the case's outcome, rather than closing it on incomplete data.

Leading an investigation well requires securing senior management's genuine commitment (not just sign-off), allocating resources by actual expertise, staying within legal boundaries, and documenting everything as you go. The four research steps (Assess, Explore, Organize, Present) apply directly here, and — critically — primary sources (government-issued legal documents, official watchlists like the SDN list, and an organization's own KYC records) are distinguished from secondary sources (corporate registries, third-party databases, media — not all equally reliable, and social media specifically flagged as manipulable and unreliable on its own). Communication with law enforcement or regulators must go through a designated contact (typically the MLRO/chief compliance officer), be formally documented even after an informal phone call, and follow the organization's own engagement protocols. The real Partial Match case (UK) shows this discipline: an MLRO filed a partial-match report to the FIU via the goAML system within the bank's own 24-hour internal deadline despite incomplete identifying data, froze the account pending guidance, then formally unfroze it only after the FIU's explicit instruction a week later — every step documented for audit.

Investigation Conclusion, Documentation & Self-Reporting

When existing sources run out, a Request for Information (RFI) is the next step — but it should be specific, targeted, and sent only after exhausting standard internal/external options first, per the Study Guide's own guidance to "not waste others' time." The real Golden Sun case shows this precisely: after KYC review found a near-match with genuinely ambiguous data (partial date-of-birth match, no company registration number on file), the investigator issued a targeted RFI asking specifically for the registration number and ownership disclosure — not a vague, open-ended request. Concluding an investigation requires weighing whether sufficient evidence exists for legal action versus whether all reasonable sources have been exhausted without result; premature conclusion is a real, named risk when records are missing, witnesses are unavailable, a lead proves inaccurate, or the customer simply exits.

The real AgriTech case shows a well-documented conclusion: a Spanish bank traced a payment from a Belarusian agricultural company to its chairman's EU sanctions designation via open-source and media research alone (company website, news photos with Belarus's president) — sufficient to reject the payment even without a formal ownership registry confirmation. Self-reporting a confirmed breach follows jurisdiction-specific processes (OFAC's online/PDF forms, OFSI's Compliance Reporting Form, Hong Kong's JFIU filings) and is genuinely weighted favorably in enforcement outcomes. The Loan Application case shows this in practice: a bank discovered post-onboarding that an SDN's ownership stake had grown from 30% to 53% — crossing the 50% threshold — and self-reported to OFAC with full documentation rather than waiting to be caught. The US Real Estate case shows a genuinely important related principle: file a SAR even without enough evidence to confirm an actual sanctions breach — the bank in that case couldn't verify a Russian oligarch's ownership of a real estate buyer, but filed anyway given the circumstantial evidence, correctly treating suspicion (not certainty) as the SAR-filing threshold.

Identifying, Freezing & Managing Frozen Assets

An asset freeze restricts access without changing ownership — the sanctioned party still legally owns the funds, but the institution cannot deal with them (move, alter, transfer, or use them to obtain anything) and generally must not make funds or resources available to the designated person even indirectly. "Assets" span both funds (cash, securities, letters of credit) and economic resources (real estate, vehicles, art, intellectual property — anything usable to obtain funds, goods, or services). Freezing must happen immediately to prevent asset flight (moving assets to another jurisdiction) or asset dissipation (spending/misallocating to escape obligations) — though jurisdictions differ on the exact trigger: the UK's standard is "reasonable cause to suspect," a genuinely lower bar than requiring certainty.

The real REPO Task Force case (G-7, European Commission, Australia, responding to Russia's invasion of Ukraine) shows freezing at massive coordinated scale: over 2,500 Russia-related SDN designations added in 2022-2023 alone, and roughly US$300 billion in Russian Central Bank assets frozen — a genuinely unprecedented multilateral action. The real OFSI case shows the correct operational sequence: a UK bank confirmed a DRC-program match, placed the customer's funds in a designated account, notified OFSI immediately, conducted EDD to find other connected sanctioned parties, and retained all records for five years — including submitting the required annual "Frozen Asset In-Year" return. Reporting timelines vary meaningfully by jurisdiction: the EU requires reporting "without delay," the UK "as soon as reasonably possible," and the US (OFAC) allows 10 business days — a genuinely testable distinction, not just a formality.

Managing Controls: Customer Exit, Account Maintenance & Ongoing Monitoring

De-risking — exiting a customer relationship that falls outside risk appetite — can be full (terminate everything) or partial (close specific accounts/products while retaining the broader relationship). The real Krandlehoff case shows partial de-risking done well: a bank kept its longstanding, profitable relationship with a maritime supplies company while fully exiting only its UAE subsidiary, which had sold export-controlled dual-use tape through a reseller with suspected sanctioned-entity ties — placing the retained parent relationship under enhanced monitoring rather than treating the whole relationship as tainted by one subsidiary's exposure. After filing a SAR, an institution isn't automatically required to close the account — the real Industrial Corporation case shows the alternative: a thorough investigation found no actual evidence of DPRK-linked sanctions evasion despite an alert, so the bank retained the customer but upgraded their risk rating and moved them to quarterly (not annual) relationship review — a proportionate response to genuine uncertainty rather than an overreaction or a dismissal.

Preventing an exited customer from simply reopening elsewhere requires a maintained internal blacklist plus genuine vigilance for identity variation (different address, using a family member's details, a related-but-differently-named entity). The real Allstone Ventures case shows this working as intended twice: the bank first caught Allstone attempting to reopen under a related company at the same office suite, blacklisted that too — then, in a later audit period, caught a *third* related entity ("Swirl Time," controlled by the same beneficial owner per KYC records) attempting to open an account, and correctly declined and blacklisted it as well. Ongoing transaction monitoring refreshes customer profiles on a risk-based schedule (low-risk customers reviewed as infrequently as every 3-4 years in permissive jurisdictions; high-risk customers annually or more often) — but specific trigger events (a SAR filing, a business-model change) refresh the schedule regardless of the standard cycle. The real sanctions-related intermediary case shows why this matters: a US$20 million crude-oil deal looked entirely legitimate (known US buyer, standard volume, apparently clean intermediary and supplier) until an *unrelated* SDN designation at the bank's own Middle East branch revealed the Hong Kong intermediary had been receiving disguised "revolving credit" transfers from that same designated party — the connection only surfaced because the bank proactively conducted a lookback review after the unrelated designation, not because the original transaction itself looked suspicious.