CGSS Certified Global Sanctions Specialist (ACAMS CGSS) Questions and Answers

Sanctions and Compliance Domains provide that a financial institution must not execute a transaction when significant unresolved discrepancies exist, especially in high-risk transshipment regions. When:

• documentation does not match payment details, and

• the customer refuses to provide required information,

the institution cannot proceed. Without clarity, the transaction may involve diversion, routed shipments, or indirect dealings with sanctioned entities.

Rejection is appropriate because blocking only applies when a confirmed sanctions match exists. Reprimanding customers, forcing subpoenas, or engaging mutual legal assistance procedures are not required or appropriate steps in sanctions transaction handling.

References from Sanctions and Compliance Domains:

Requirements to reject a transaction when discrepancies cannot be resolved.

Need for customer cooperation in sanctions investigations.

Standards for handling high-risk transshipment-related alerts.

Sanctions and Compliance Domains emphasize that sanctions screening depends on traceable identifiers, transparent transaction histories, and clear counterparties. Privacy coins and mixers/tumblers significantly obscure blockchain transaction trails.

A tumbler or mixer intentionally blends cryptocurrency from multiple sources, making it extremely difficult to determine the origin of funds, the identities of transacting parties, or any links to sanctioned entities. This creates a high sanctions-related risk because sanctioned actors or jurisdictions may exploit these services to disguise involvement.

Privacy coins alone pose risk due to anonymity, but the mixer/tumbler function specifically disrupts sanctions screening capabilities. Financial institutions and exchanges cannot rely on upstream partners to conduct due diligence.

References from Sanctions and Compliance Domains:

Risks of anonymity-enhancing technologies (AETs) in sanctions compliance.

Screening limitations created by mixers/tumblers and privacy-preserving blockchain tools.

Guidance highlighting elevated sanctions risks in digital asset transactions lacking traceability.

Sanctions and Compliance Domains outline that OFAC has explicitly emphasized the importance of pre- and post-acquisition sanctions due diligence in mergers and acquisitions. OFAC has pursued enforcement actions against companies that failed to conduct adequate sanctions due diligence or did not integrate compliance controls after acquiring foreign subsidiaries.

OFAC’s enforcement history shows cases in which companies inherited violations because they continued business through acquired entities that were already engaged in sanctioned conduct. OFAC clearly identifies failure to conduct sufficient sanctions due diligence as grounds for enforcement. It does not merely “consider” such actions, nor has it issued joint SEC guidance to warn about MandA sanctions risks. OFAC also does not discourage mergers and acquisitions; instead, it stresses compliance integration and strong due diligence.

References from Sanctions and Compliance Domains:

OFAC expectations for sanctions due diligence in mergers and acquisitions.

Enforcement actions taken for failure to conduct adequate pre-acquisition and post-acquisition compliance reviews.

Compliance requirements for inherited liabilities through acquired subsidiaries.

Sanctions and Compliance Domains specify that when a transaction presents multiple risk indicators—such as a high-risk jurisdiction, shell company involvement, and unclear payment purpose—the appropriate response is to seek additional information before releasing or rejecting funds.

Financial institutions are required to conduct deeper review when the transaction indicators suggest possible sanctions exposure, even if the names involved do not appear on sanctions lists. Obtaining supporting documentation helps determine whether the payment involves sanctioned parties, prohibited shipping routes, disguised ownership, or goods subject to restrictions.

Freezing/blocking is only appropriate when the institution has identified a match to a designated party or prohibited conduct. Reporting to authorities must follow a confirmed sanctions nexus, not preliminary suspicion.

References from Sanctions and Compliance Domains:

Requirements to obtain underlying documents when shell companies or high-risk jurisdictions appear in a payment.

Investigation obligations prior to rejecting or blocking a payment.

Risk-based approach to suspicious or unclear maritime/shipping transactions.

Using a shell company to procure goods on behalf of a sanctioned end-user commonly involves concealing the true final destination. Sanctions and Compliance Domains describe this as a primary evasion technique in illicit procurement chains, where shell companies mask the ultimate recipient, shipment routing, and country of origin or destination.

Consolidation of goods and changes in ownership structure may occur in other schemes but the key deceptive tactic in this question is the concealment of the actual final destination.

Under OFAC’s 50 Percent Rule, any entity that is owned 50% or more—individually or in aggregate—by one or more Specially Designated Nationals (SDNs) is considered automatically blocked, even if not explicitly listed.

Financial institutions must treat such entities as if they are SDNs. Therefore, the account cannot be opened. Senior management approval cannot override OFAC regulations, and altering ownership to bypass sanctions is prohibited facilitation.

Risk-based screening controls include:

• Ensuring sanctions lists are current – list freshness is essential to avoid processing transactions with newly designated parties.

• Using fuzzy logic – captures alternative spellings, transliterations, phonetic differences, and reduces missed true matches.

Stopping all transactions (B) is not risk-based. Adding every country’s sanctions list (C) creates operational noise without regulatory justification. Screening only names (D) ignores other critical fields like addresses, intermediaries, and free-text descriptions.

Sanctions and Compliance Domains state that independent testing and auditing must be conducted by a group separate from the sanctions operations and screening management teams. Internal audit is typically the independent function with sufficient technology and control expertise to assess system performance, threshold calibration, governance, and rule sets.

Teams involved in day-to-day operations (investigations, list management, risk assessment) cannot test their own work due to conflicts of interest.

A key sanctions-evasion red flag in trade documents is reluctance or refusal to disclose end-use or end-user information. This may indicate diversion to a sanctioned jurisdiction, entity, or prohibited program (e.g., proliferation).

Expiration dates (D) are irrelevant to sanctions. Payment timing and product suitability (A, B) are normal commercial behaviors and not sanctions red flags.

Sanctions and Compliance Domains specify that sanctions screening must include all fields that contain names, identifiers, or descriptive information that could reveal a connection to a sanctioned party or jurisdiction. This includes:

• Remitter and beneficiary fields – Core parties to the transaction must always be screened.

• Agents, intermediaries, correspondent banks, and financial institutions – These fields often contain additional parties that may be sanctioned or present sanctions exposure.

• Free text fields – These can include narrative descriptions, vessel names, ports, goods, or locations that may represent sanctions risk.

Currency, value, dates, and internal references do not contain identifiers relevant to sanctions screening and therefore are not required screening fields.

Sanctions and Compliance Domains explain that model validation for sanctions screening systems must include:

• Governance and management oversight, ensuring independent review, escalation paths, and proper control structures.

• Identification and verification of all data sources, ensuring that all required and relevant reference data feeds are included in screening.

• Matching algorithms and thresholds, which require testing, calibration, and validation to ensure accurate detection of potential sanctions matches.

Storage capacity, automation, or multiple administrators are operational considerations but not core components of model validation.

Cigars, particularly those originating from Cuba or other embargoed jurisdictions, fall under both EU and US export sanctions restrictions. Under US OFAC regulations, Cuban-origin goods—including cigars—are strictly prohibited from import, export, resale, or re-export by US persons. EU sanctions may also restrict trade with embargoed or designated jurisdictions.

Textbooks, toys, and art reproductions generally do not fall under export prohibitions unless tied to dual-use concerns or specific jurisdictions, which is not indicated here. Cigars present the most direct and well-established sanctions risk.

When a sham divestment (false or deceptive attempt to hide sanctioned ownership) is suspected, the first step is to conduct sufficient due diligence to confirm whether the organizational restructuring is legitimate.

This may include reviewing ownership documents, corporate registries, control structures, and transaction activity.

Only after confirming the facts should the institution escalate internally, report externally, or terminate the relationship.

Sanctions evasion commonly occurs through:

• Trade finance — manipulating bills of lading, transshipment, falsified documents.

• Correspondent banking — indirect access to the financial system through other banks.

• Shell companies — concealment of ownership, diversion of goods, and masking sanctioned parties.

Corporate, online, and retail banking may have risks but are not primary evasion channels highlighted in sanctions-evasion typologies.

Sanctions and Compliance Domains explain:

• Tipping-off is prohibited, as it may alert a customer that they are under investigation, impairing regulatory or law-enforcement action. Institutions must implement controls to prevent it.

• Notification, however, refers to permitted communication — such as informing a customer that their funds were frozen — when required or allowed by law (e.g., EU asset-freeze requirements), without revealing investigative details.

Tipping-off and notification serve entirely different purposes. Regulatory frameworks explicitly warn entities against tipping-off but do allow certain forms of notification that comply with legal obligations.

Sanctions and Compliance Domains emphasize the importance of identity, residency, location indicators, and digital footprints when assessing potential sanctions violations.

Dual residency in a sanctioned country may trigger sanctions exposure because residency can determine jurisdictional reach. Likewise, IP addresses reveal the customer’s actual geographic location during transactions and are critical in identifying hidden connections to sanctioned jurisdictions.

Transaction size thresholds, routine salary information, or transfers within non-sanctioned countries do not directly indicate sanctions violations.

EU Restrictive Measures apply to all persons and entities within the territory of the EU, including airspace and territorial waters, and to any vessel or aircraft under the jurisdiction of an EU Member State. This establishes that sanctions obligations extend to vessels registered under EU jurisdictions regardless of location.

EU sanctions also apply to all legal persons, entities, and bodies incorporated or constituted under the law of an EU Member State, even when those entities operate entirely outside EU territory. Legal incorporation under EU law creates an ongoing obligation to comply with EU sanctions.

EU ownership by itself does not trigger sanctions applicability, so a non-EU company that is 45% owned by an EU national does not fall under EU Restrictive Measures. Additionally, arrangements such as double-taxation conventions or participation in customs union agreements do not extend the territorial or legal applicability of EU sanctions to non-EU jurisdictions.

References from Sanctions and Compliance Domains:

Territorial applicability of EU sanctions, including vessels and aircraft under Member State jurisdiction.

Applicability to companies incorporated under EU Member State law regardless of geographic operations.

Legal and territorial definitions outlining the scope of EU Restrictive Measures.

A comprehensive sanctions framework requires well-designed operational controls, including thorough training for staff responsible for alert review and sanctions decision-making. Sanctions and Compliance Domains specify that personnel involved in alert clearing must receive appropriate training to ensure awareness of regulatory expectations, sanctions typologies, and escalation procedures.

Additionally, the framework must include robust screening controls supported by documented strategy, governance, list-management processes, alert management rules, and ongoing testing. These elements form core requirements of sanctions compliance programs.

Management information reports are restricted to need-to-know distribution, and reliance on “best-efforts” is not compliant. Institutions must implement structured, risk-based controls, not minimal-effort approaches.

Enhanced due diligence is required when trade transactions involve jurisdictions near sanctioned countries due to the increased risk of transshipment, diversion, and sanctions evasion.

Sanctions and Compliance Domains highlight two core focus areas:

• verifying the identities and ultimate beneficial owners of all involved parties, and

• validating the shipment details, including routing, goods description, and movement patterns.

These elements are critical where geographic proximity raises sanctions exposure. While reviewing commercial terms and pricing may be part of general trade finance due diligence, the primary sanctions-specific EDD requirements focus on beneficial ownership and shipment details.

References from Sanctions and Compliance Domains:

Enhanced due diligence expectations for trade involving high-risk regions.

Requirements to verify UBOs to detect potential sanctioned ownership.

Importance of shipment route verification to detect diversion to sanctioned jurisdictions.

Sanctions evasion indicators in trade documentation include:

• Multiple amendments designed to obscure the parties involved – a classic red flag indicating concealment of the real counterparty.

• Falsified or tampered shipping documents – used to hide sanctioned routes, ports, or vessels.

• Conflicting end-user documentation – a major warning sign of diversion or concealment of sanctioned recipients.

Cash withdrawals (E) and online payment instructions (F) are AML indicators, but not directly sanctions evasion indicators. Docking at non-sanctioned countries (D) is not suspicious unless used as part of concealment, which is not indicated here.

Vendor contracts must explicitly require that third-party service providers comply with all applicable sanctions laws and regulations. This ensures the bank’s sanctions exposure is minimized when vendors perform outsourced functions.

Tuning procedures, risk assessments, and alert investigation procedures are internal controls—not contract requirements imposed on vendors.

Within sanctions compliance programs, one of the core components identified as essential for effective management of sanctions risks is audit and testing. The Sanctions and Compliance Domains describe that sanctions programs require independent review, periodic testing, and validation to assess whether internal controls, screening systems, and escalation processes operate effectively. Audit and testing units provide the independent assurance needed to detect program weaknesses, evaluate the adequacy of controls, and confirm compliance with regulatory requirements.

Sanctions frameworks emphasize that the ability to identify deficiencies, monitor adherence to procedures, evaluate risk-control effectiveness, and ensure continuous improvement is fundamental to maintaining a sound sanctions compliance environment. Audit and testing functions are responsible for reviewing the design and effectiveness of sanctions policies, validating the performance of screening tools, and ensuring corrective action is taken where deficiencies are found. For this reason, the function is identified as critical for managing sanctions risks across financial institutions and regulated entities.

References from Sanctions and Compliance Domains:

Requirements for independent auditing and testing as a core component of an effective sanctions compliance program.

Expectations for regular review of sanctions controls, screening performance, and risk assessment processes.

Emphasis on independent validation to ensure ongoing compliance with regulatory obligations and to detect gaps in sanctions controls.

OFAC has designated:

• Hackers and cyber actors involved in cryptocurrency theft.

• Cryptocurrency exchanges facilitating illicit transactions or supporting sanctioned jurisdictions.

• Mixers (tumblers) known to anonymize blockchain transactions and facilitate laundering and sanctions evasion.

Software developers (D) are generally not designated unless directly linked to illicit activity. Credit unions and central banks are not typical OFAC digital-asset designations.

Sanctions and Compliance Domains state that NGOs are not exempt from sanctions laws. Even humanitarian organizations must ensure that they do not transact through designated banks, sanctioned parties, or sanctioned jurisdictions unless authorized through applicable exemptions or licenses.

Furthermore, NGOs can be indirectly affected by sanctions when engaging in international work, especially when the banking sector of a target region is designated. Therefore, they may continue operating, but must fully consider sanctions exposure, including the involvement of designated banks.

Statements that NGOs are automatically exempt are factually incorrect. Compliance depends on the sanctions program, jurisdiction, and licensing conditions.

Under the OFAC 50% Rule, an entity must be treated as a Specially Designated National (SDN) — even if not named on the SDN List — when:

One SDN owns 50% or more of the entity, OR

Multiple SDNs collectively own 50% or more of the entity (ownership must be aggregated).

Applying this rule:

A: 98% ownership by a single SDN → Blocked (exceeds 50%).

B: 35% + 15% = 50% aggregate ownership by two SDNs → Blocked (meets 50%).

C: 20% + 25% = 45%, which does not meet the threshold → Not blocked.

D: 12% + 18% + 28% = 58% aggregate ownership by SDNs → Blocked (exceeds 50%).

E: 45% + 3% = 48%, which is below 50% → Not blocked.

F: 10 SDNs × 4% = 40%, which is below 50% → Not blocked.

Thus, only A, B, and D meet or exceed the 50% aggregate ownership requirement defined by OFAC.

Sanctions investigations rely primarily on the factual evidence contained in transaction activity and on authoritative, government-issued sanctions lists. Transaction details provide information on counterparties, payment paths, goods, and purpose. Official blocked-person lists such as OFAC, EU, UN, and national export-control lists provide the authoritative basis for sanctions matching. News, social media, and internal correspondence may supplement context but are not primary sources.

When a potential sanctions match is detected, the required first action is to determine whether the alert represents a true match or a false positive. This involves comparing identifiers, reviewing customer documentation, and gathering additional details.

CDD is important but is not the specific required action at the moment of match investigation. The priority is confirming whether the entity is indeed the sanctioned party.