CGSS Certified Global Sanctions Specialist (ACAMS CGSS) Questions and Answers

The Wolfsberg 2019 Guidance identifies risk assessment as a foundational component of sanctions screening programs. Screening systems, list management, and alert handling must reflect the institution’s assessed sanctions risk exposure.

External audit and reporting are relevant compliance functions but are not listed as fundamental pillars of screening programs in the Wolfsberg framework. Risk management is a broader corporate discipline, while screening specifically starts with a clear sanctions risk assessment.

Effective internal controls for virtual asset service providers include:

• Sanctions screening of users, wallets, and transactions.

• IP blocking/geolocation controls to stop access from sanctioned jurisdictions.

• Keyword screening for wallet names, addresses, or known illicit indicators.

• Reviewing and enforcing end-user agreements, including prohibitions on using the platform for sanctioned activity.

Other options include unnecessary or ineffective controls (downsizing staff, screening employees, or vendor-only screening), which are not aligned with sanctions-control best practices.

When a potential sanctions match is detected, the required first action is to determine whether the alert represents a true match or a false positive. This involves comparing identifiers, reviewing customer documentation, and gathering additional details.

CDD is important but is not the specific required action at the moment of match investigation. The priority is confirming whether the entity is indeed the sanctioned party.

Under the OFAC 50% Rule, an entity must be treated as a Specially Designated National (SDN) — even if not named on the SDN List — when:

One SDN owns 50% or more of the entity, OR

Multiple SDNs collectively own 50% or more of the entity (ownership must be aggregated).

Applying this rule:

A: 98% ownership by a single SDN → Blocked (exceeds 50%).

B: 35% + 15% = 50% aggregate ownership by two SDNs → Blocked (meets 50%).

C: 20% + 25% = 45%, which does not meet the threshold → Not blocked.

D: 12% + 18% + 28% = 58% aggregate ownership by SDNs → Blocked (exceeds 50%).

E: 45% + 3% = 48%, which is below 50% → Not blocked.

F: 10 SDNs × 4% = 40%, which is below 50% → Not blocked.

Thus, only A, B, and D meet or exceed the 50% aggregate ownership requirement defined by OFAC.

Comprehensive sanctions prohibit nearly all exports, imports, services, financial transactions, and business dealings with a specific jurisdiction. These sanctions apply broadly to the entire territory and often include embargoes, trade restrictions, and full financial prohibitions.

Sectoral sanctions apply only to certain industries. Targeted sanctions apply to specific individuals or entities. Thematic sanctions focus on conduct (e.g., cybercrime, human rights abuses).

Sanctions evasion indicators in trade documentation include:

• Multiple amendments designed to obscure the parties involved – a classic red flag indicating concealment of the real counterparty.

• Falsified or tampered shipping documents – used to hide sanctioned routes, ports, or vessels.

• Conflicting end-user documentation – a major warning sign of diversion or concealment of sanctioned recipients.

Cash withdrawals (E) and online payment instructions (F) are AML indicators, but not directly sanctions evasion indicators. Docking at non-sanctioned countries (D) is not suspicious unless used as part of concealment, which is not indicated here.

Sanctions and Compliance Domains outline several misunderstandings commonly held by businesses. One misconception is that any USD transaction automatically triggers US sanctions applicability; while USD transactions may be routed through the US financial system, sanctions analysis depends on transaction content, parties involved, and jurisdictional reach, not solely the currency.

Another misconception is assuming no sanctions risk exists if a party is not listed by name. Sanctions regimes include indirect application through ownership and control rules, sectoral sanctions, activity-based sanctions, and geographic sanctions. Entities may be sanctioned due to association, ownership, or activity even if not individually named.

Statements regarding import/export exposure and MandA due diligence are correct program requirements. US sanctions can still apply to US citizens regardless of where they reside or work.

References from Sanctions and Compliance Domains:

Misconceptions regarding currency and sanctions applicability.

Misunderstandings about named-party sanctions versus ownership/activity-based risks.

Clarification on US person obligations regardless of residence.

Canadian sanctions law requires that Canadian persons ensure all commercial dealings comply with Canadian sanctions regulations, including those concerning Iran. Contracts involving sanctioned countries must incorporate compliance clauses reflecting applicable Canadian law.

The EU Blocking Statute does not apply to Canadian entities. Avoiding references to Iran is ineffective and does not eliminate sanctions exposure. USD payments may introduce US sanctions exposure and are not advisable in this context.

A key sanctions-evasion red flag in trade documents is reluctance or refusal to disclose end-use or end-user information. This may indicate diversion to a sanctioned jurisdiction, entity, or prohibited program (e.g., proliferation).

Expiration dates (D) are irrelevant to sanctions. Payment timing and product suitability (A, B) are normal commercial behaviors and not sanctions red flags.

OFAC regulations apply broadly to US persons, which include US citizens, permanent residents, entities organized under US law, and individuals located in the United States. These obligations apply regardless of where the US person is physically located.

Foreign companies, foreign financial institutions, or foreign persons are only obligated under OFAC regulations when a US nexus exists (e.g., US origin goods, US dollars, US-based transactions). US persons, however, must always comply.

Vendor contracts must explicitly require that third-party service providers comply with all applicable sanctions laws and regulations. This ensures the bank’s sanctions exposure is minimized when vendors perform outsourced functions.

Tuning procedures, risk assessments, and alert investigation procedures are internal controls—not contract requirements imposed on vendors.

Red flags for sanctions and AML risk include:

• Privately held companies using institutions outside their jurisdiction of registration, a known structuring and sanctions-evasion indicator.

• Sudden rises in value from high-risk countries without business justification, a classic AML and sanctions red flag indicating possible sanctions circumvention, layering, or illicit value transfer.

Publicly traded entities and regulated firms generally present lower risk due to transparency. Routine SWIFT activity alone is not a red flag.

Data quality reviews focus on errors that negatively impact sanctions screening accuracy, such as:

• Incorrect field placement (e.g., names in address fields), which causes screening failures.

• Default or missing date values, which undermine proper identity matching.

• Duplicate records, which complicate alert resolution and distort screening results.

Use of separate name fields, uppercase text, or cultural naming conventions are not data errors but normal formatting variations.

Under OFAC’s 50 Percent Rule, any entity that is owned 50% or more—individually or in aggregate—by one or more Specially Designated Nationals (SDNs) is considered automatically blocked, even if not explicitly listed.

Financial institutions must treat such entities as if they are SDNs. Therefore, the account cannot be opened. Senior management approval cannot override OFAC regulations, and altering ownership to bypass sanctions is prohibited facilitation.

OFAC guidance clarifies that blocking virtual currency means preventing any access, transfer, or withdrawal of the asset by the sanctioned party. The entity holding the virtual currency must:

Deny access to the wallet or virtual asset, and

Report the blocked property to OFAC in accordance with reporting rules.

Virtual currencies are not “returned” (A), not necessarily moved to a pooled wallet (B), and are not converted to fiat unless authorized (C).

A sound governance framework, according to Sanctions and Compliance Domains, includes:

• Senior management ensuring adequate resources to investigate violations, identify weaknesses, and remediate control gaps.

• Updating the sanctions risk assessment to incorporate findings and root causes from prior incidents.

Human resources actions (A) are not a primary governance function. Reporting based on “lack of penalty” (D) is not a risk-based governance indicator. Zero-tolerance statements (E) do not constitute governance processes and may conflict with risk-based management expectations.

Sanctions and Compliance Domains state that when a potential sanctions match occurs, the first step is to conduct a proper investigation to determine whether the alert is a true match or false positive. This includes obtaining additional identifiers such as addresses, IMO numbers, registration numbers, or corporate details.

Immediate rejection or reporting is only appropriate after confirming a true match. Premature rejection without verification violates due diligence expectations. Closing the customer account is not justified without confirmed sanctions involvement.

“Stripping” refers to removing, altering, or replacing material information from payment messages, invoices, or trade documents to conceal a sanctioned party, vessel, location, or jurisdiction. It is a recognized sanctions evasion technique used by actors seeking to bypass automated screening.

Examples include removing the sanctioned port name, omitting the ultimate consignee, or deleting identifying references.

This is distinct from structuring (option A), price manipulation (B), or dual messaging (C).

Sanctions and Compliance Domains specify that when a transaction presents multiple risk indicators—such as a high-risk jurisdiction, shell company involvement, and unclear payment purpose—the appropriate response is to seek additional information before releasing or rejecting funds.

Financial institutions are required to conduct deeper review when the transaction indicators suggest possible sanctions exposure, even if the names involved do not appear on sanctions lists. Obtaining supporting documentation helps determine whether the payment involves sanctioned parties, prohibited shipping routes, disguised ownership, or goods subject to restrictions.

Freezing/blocking is only appropriate when the institution has identified a match to a designated party or prohibited conduct. Reporting to authorities must follow a confirmed sanctions nexus, not preliminary suspicion.

References from Sanctions and Compliance Domains:

Requirements to obtain underlying documents when shell companies or high-risk jurisdictions appear in a payment.

Investigation obligations prior to rejecting or blocking a payment.

Risk-based approach to suspicious or unclear maritime/shipping transactions.

Transshipment and intermediary hubs present sanctions risks because they obscure the true origin, destination, and end-user of goods. High-risk jurisdictions use intermediary shipping points to bypass controls, hide diversion routes, and disguise connections to sanctioned countries or entities.

Documentation may be incomplete, manipulated, or replaced during transshipment, making the true jurisdiction unclear—the core risk.

Sanctions and Compliance Domains state that institutions may notify the customer that their funds have been blocked or frozen, provided the notification does not reveal internal compliance processes or compromise legal obligations.

The customer may also be directed to the competent authority (such as OFAC or a national sanctions regulator) to seek guidance or licensing relief.

There is no blanket prohibition against notifying the customer; however, the institution must provide factual notification without offering legal advice or operational details.

Sanctions and Compliance Domains explain that model validation for sanctions screening systems must include:

• Governance and management oversight, ensuring independent review, escalation paths, and proper control structures.

• Identification and verification of all data sources, ensuring that all required and relevant reference data feeds are included in screening.

• Matching algorithms and thresholds, which require testing, calibration, and validation to ensure accurate detection of potential sanctions matches.

Storage capacity, automation, or multiple administrators are operational considerations but not core components of model validation.

OFAC authorizes certain legal services through general licenses to ensure compliance with US legal obligations, including constitutional and state requirements, while ensuring such legal assistance does not facilitate prohibited transactions. These licenses allow sanctioned individuals to obtain representation for permitted matters such as contesting designations or defending legal actions.

Sanctions and Compliance Domains state that NGOs are not exempt from sanctions laws. Even humanitarian organizations must ensure that they do not transact through designated banks, sanctioned parties, or sanctioned jurisdictions unless authorized through applicable exemptions or licenses.

Furthermore, NGOs can be indirectly affected by sanctions when engaging in international work, especially when the banking sector of a target region is designated. Therefore, they may continue operating, but must fully consider sanctions exposure, including the involvement of designated banks.

Statements that NGOs are automatically exempt are factually incorrect. Compliance depends on the sanctions program, jurisdiction, and licensing conditions.

Selecting watch lists for sanctions screening requires understanding geographic exposure, including customer locations, jurisdictions in which products/services are offered, and locations of trading partners. Sanctions programs vary by region (e.g., OFAC, EU, UN, UK), so geographic impact is essential.

Transaction size, withdrawal patterns, and relationship length are AML considerations but are not primary factors for selecting sanctions watch lists.

A historical review or lookback is warranted when previously unidentified data elements, missing reference data, or newly discovered customer attributes are detected that may have impacted earlier screening results. Sanctions and Compliance Domains explain that such scenarios indicate that past alerts may not have been correctly generated or evaluated, necessitating a retrospective review.

Routine list updates or daily refreshes do not automatically trigger lookbacks. New sanctions programs may require enhanced forward-looking monitoring, but only missing or newly uncovered data affecting past screening results justify a historical lookback.

Under the UN Charter, all United Nations member states are obligated to accept and carry out decisions of the UN Security Council. Sanctions and Compliance Domains emphasize that UN Security Council Resolutions issued under Chapter VII are binding on all UN members, not just Security Council members or targeted states.

Only member states have this obligation. Permanent membership or targeted status does not change the scope of obligation.

References from Sanctions and Compliance Domains:

UN Charter obligations for all Member States to implement Security Council Resolutions.

Binding nature of Chapter VII resolutions across all UN members.