Free Practice Questions for the ACAMS AML Certifications CGSS Exam (2026 Updated)

Sanctions screening standards require that when a hit is produced by the filtering system, the institution must determine whether the alert is a true match or a false positive through a structured escalation and investigation process. The Sanctions and Compliance Domains emphasize that financial institutions must evaluate all relevant identifiers, including entity type, name, ownership, vessel IMO numbers, and additional attributes.

In the case of vessels, sanctions regulations often target vessels by name and ownership, meaning that a vessel with an identical name requires deeper investigation. Authorities such as OFAC, the EU, and the UK regularly designate vessels because of their involvement in sanctioned activities, and vessel names frequently overlap with commercial entities. Therefore, the correct investigative approach is to continue the investigation to determine the true ownership, IMO number, and whether the vessel is the sanctioned party.

Options A, B, and C describe scenarios typically associated with clear mismatches or cases where additional investigation is unnecessary because essential identifiers do not match. However, vessels require continued review due to the regulatory emphasis on vessel ownership, registration, and operational control as determining factors in sanctions risk.

References from Sanctions and Compliance Domains:

Requirements for detailed matching processes in sanctions screening.

Guidance on evaluating entity type, ownership, and identifiers when reviewing alerts.

Rules relating to vessel sanctions, ownership determination, and verification steps.

Procedures for identifying true matches versus false positives in sanctions screening.

UN sanctions are imposed by the UN Security Council as part of its mandate to maintain international peace and security . They are intended to influence behavior, prevent conflict, suppress terrorism, and stabilize global security conditions.

While asset freezes and travel bans are common measures (option D), they are examples , not the fundamental reason for imposing sanctions. Option C describes the overarching purpose.

Dual-use goods are items that can serve both civilian and military or weapons-related applications. Typical dual-use categories include:

• Aerospace and propulsion technologies – used in civilian aircraft but also missile or defense applications.

• Electronics – circuits, sensors, microchips, hardware with potential military, surveillance, or weapons applications.

Luxury goods and food products are not dual-use categories. Precious metals may be highly regulated but are not dual-use under standard export-control classification.

Under OFAC’s 50 Percent Rule , any entity that is owned 50% or more—individually or in aggregate—by one or more Specially Designated Nationals (SDNs) is considered automatically blocked, even if not explicitly listed.

Financial institutions must treat such entities as if they are SDNs. Therefore, the account cannot be opened. Senior management approval cannot override OFAC regulations, and altering ownership to bypass sanctions is prohibited facilitation.

The UK Office of Financial Sanctions Implementation (OFSI) applies the ownership and control test to determine whether an entity is considered owned or controlled by a designated person. Under OFSI rules, a person is deemed to own an entity if they hold, directly or indirectly, more than 50% of the shares or voting rights. This threshold also applies when determining indirect ownership through corporate structures.

Powers such as signing authority or power of attorney do not constitute ownership. The right to appoint or remove the majority of a board may indicate control but not ownership. Any threshold below 50% does not satisfy the OFSI ownership criteria.

References from Sanctions and Compliance Domains:

OFSI ownership threshold requiring more than 50% of shares or voting rights.

Distinction between ownership and other types of influence or authority.

UN sanctions require agreement among multiple countries, making them more difficult to enact than unilateral national sanctions. The UN Security Council must reach consensus, and all five permanent members must avoid using their veto power. Any negative vote by a permanent member blocks the resolution entirely.

This requirement for global political alignment is the primary barrier to rapid sanctions adoption. UN sanctions are neither autonomous nor inherently ineffective, and they do not exist to intervene in domestic affairs but to protect international peace and security under Chapter VII of the UN Charter.

A key sanctions-evasion red flag in trade documents is reluctance or refusal to disclose end-use or end-user information . This may indicate diversion to a sanctioned jurisdiction, entity, or prohibited program (e.g., proliferation).

Expiration dates (D) are irrelevant to sanctions. Payment timing and product suitability (A, B) are normal commercial behaviors and not sanctions red flags.

Sanctions and Compliance Domains specify that when a transaction shows significant sanctions or illicit-trade red flags, a bank must avoid executing the transaction if it risks breaching sanctions restrictions. If the bank identifies discrepancies, counterfeiting indicators, or potential sanctions violations, the transaction must be rejected unless a blocking requirement applies.

Blocking applies only when a sanctioned party or property interest is identified. In this scenario, because there are red flags but no confirmed designated person, the appropriate action is to reject the transaction and file the relevant report with the competent authority.

Banks should not process the transaction and investigate later, nor should they disclose red-flag details to customers. Reporting requirements prohibit tipping-off in such regulatory contexts.

References from Sanctions and Compliance Domains:

Guidance on rejection versus blocking in trade finance risks.

Reporting obligations when red flags indicate possible sanctions exposure.

Prohibition on providing details of internal investigations to customers.

Sectoral sanctions target specific sectors of a foreign country ' s economy , such as defense, energy, mining, or financial services. These sanctions apply to persons or entities operating within those sectors and often restrict specific types of transactions (e.g., certain financing or technology transfers).

Comprehensive sanctions cover entire jurisdictions. Individual or corporate sanctions apply to specific persons or companies but are not sector-based.

INSTEX was established by EU member states as an operational mechanism designed to facilitate limited and compliant trade with Iran after the re-imposition of U.S. secondary sanctions in 2018. According to the Sanctions and Compliance Domains, INSTEX is categorized as a special purpose vehicle, created specifically to permit trade transactions without reliance on traditional cross-border payment routes exposed to U.S. sanctions risk.

Special purpose vehicles are defined within sanctions frameworks as structured entities created to conduct or support specific categories of trade or payments where direct financial transfers are restricted or exposed to sanctions risk. INSTEX was designed to match European exporters and importers with Iranian counterparts through a barter-style internal clearing arrangement, avoiding external USD payment flows.

It is not a general license, nor is it a blocking statute. It also does not constitute sanctions evasion because it was formally established, publicly announced, and structured within EU legal parameters. Its purpose was to ensure compliance while maintaining limited humanitarian and permitted trade channels.

References from Sanctions and Compliance Domains:

Definitions and characteristics of special purpose vehicles in sanctions environments.

Description of EU mechanisms facilitating compliant trade with sanctioned jurisdictions.

Distinction between SPVs, blocking statutes, and licensing frameworks.

Regulatory context regarding INSTEX as an EU-created structured trade mechanism.

Transshipment and intermediary hubs present sanctions risks because they obscure the true origin, destination, and end-user of goods. High-risk jurisdictions use intermediary shipping points to bypass controls, hide diversion routes, and disguise connections to sanctioned countries or entities.

Documentation may be incomplete, manipulated, or replaced during transshipment, making the true jurisdiction unclear —the core risk.

Risk-based screening controls include:

• Ensuring sanctions lists are current – list freshness is essential to avoid processing transactions with newly designated parties.

• Using fuzzy logic – captures alternative spellings, transliterations, phonetic differences, and reduces missed true matches.

Stopping all transactions (B) is not risk-based. Adding every country’s sanctions list (C) creates operational noise without regulatory justification. Screening only names (D) ignores other critical fields like addresses, intermediaries, and free-text descriptions.

OFAC regulations require that blocked funds must be placed into an interest-bearing account , held separately, and reported to OFAC. This does not require preauthorization from OFAC.

However, no debits or credits may occur without OFAC authorization, including:

• settling standing bills or checks (A),

• charging interest or loan/corporate card fees (C),

• deducting credit-card service charges (B).

Only OFAC can authorize movement or use of blocked property.

Sanctions and Compliance Domains state that independent testing and auditing must be conducted by a group separate from the sanctions operations and screening management teams. Internal audit is typically the independent function with sufficient technology and control expertise to assess system performance, threshold calibration, governance, and rule sets.

Teams involved in day-to-day operations (investigations, list management, risk assessment) cannot test their own work due to conflicts of interest.

Sanctions and Compliance Domains emphasize the importance of identity, residency, location indicators, and digital footprints when assessing potential sanctions violations.

Dual residency in a sanctioned country may trigger sanctions exposure because residency can determine jurisdictional reach. Likewise, IP addresses reveal the customer’s actual geographic location during transactions and are critical in identifying hidden connections to sanctioned jurisdictions.

Transaction size thresholds, routine salary information, or transfers within non-sanctioned countries do not directly indicate sanctions violations.

EU sanctions require financial institutions to immediately freeze the funds or economic resources of designated persons and promptly report the freeze to the competent national authority . Reporting is mandatory to ensure oversight and enforcement.

Banks must not transfer frozen funds, and they must not freeze accounts of family members unless those individuals are also designated or otherwise meet ownership/control criteria. Institutions also do not notify the customer directly, as doing so may undermine regulatory requirements.

An effective export compliance program must include formalized and documented screening procedures , including payment screening, trade documentation screening, and counterparty checks. This ensures compliance with sanctions, export restrictions, and embargo requirements.

Freight forwarders may assist but do not replace internal compliance responsibilities. Boycott-related terms must be avoided, and collecting vouchers is not an export controls safeguard.

Transliteration is defined as converting writing from one script into another while preserving pronunciation as closely as possible. In sanctions screening, transliteration is important because sanctioned parties may appear in multiple scripts (e.g., Cyrillic, Arabic, Mandarin) and the automated screening system must recognize these variations.

While option B focuses specifically on converting non-Latin scripts into Latin, sanctions screening requires a broader definition that applies to any script-to-script conversion relevant to matching names globally. Thus, the correct definition is the general conversion of text from one script into another.

References from Sanctions and Compliance Domains:

Definition of transliteration in sanctions screening and name-matching methodologies.

Need for script conversion to support accurate detection of sanctioned parties across language systems.

When a sham divestment (false or deceptive attempt to hide sanctioned ownership) is suspected, the first step is to conduct sufficient due diligence to confirm whether the organizational restructuring is legitimate.

This may include reviewing ownership documents, corporate registries, control structures, and transaction activity.

Only after confirming the facts should the institution escalate internally, report externally, or terminate the relationship.

OFAC authorizes certain legal services through general licenses to ensure compliance with US legal obligations, including constitutional and state requirements, while ensuring such legal assistance does not facilitate prohibited transactions. These licenses allow sanctioned individuals to obtain representation for permitted matters such as contesting designations or defending legal actions.

Sanctions and Compliance Domains specify that correspondent banking relationships require a comprehensive assessment of the respondent bank’s sanctions risk exposure. Relevant factors include:

• Licensing authorities – Banks licensed in jurisdictions with weak sanctions controls, inadequate supervision, or misaligned regulatory frameworks pose heightened risk. Regulatory oversight directly influences sanctions compliance effectiveness.

• Location of operations – Geographies influence exposure to sanctioned countries, transshipment risks, proliferation financing threats, and proximity to high-risk jurisdictions. Geographic expansion may introduce new sanctions obligations and monitoring requirements.

• Products and services offered – Certain products (e.g., trade finance, cross-border payments, payable-through accounts) carry inherently higher sanctions risk. As respondent banks expand their service offerings, the correspondent institution must reassess associated risks.

The registration number is not relevant to sanctions exposure. Bank representatives may factor into KYC but are not core sanctions-risk elements. The respondent’s customers’ business activity is considered indirectly through the respondent bank’s controls and risk profile, but primary assessment focuses on the bank’s licensing, geography, and product set.

Under the UN Charter, all United Nations member states are obligated to accept and carry out decisions of the UN Security Council. Sanctions and Compliance Domains emphasize that UN Security Council Resolutions issued under Chapter VII are binding on all UN members, not just Security Council members or targeted states.

Only member states have this obligation. Permanent membership or targeted status does not change the scope of obligation.

References from Sanctions and Compliance Domains:

UN Charter obligations for all Member States to implement Security Council Resolutions.

Binding nature of Chapter VII resolutions across all UN members.

The Wolfsberg 2019 Guidance identifies risk assessment as a foundational component of sanctions screening programs. Screening systems, list management, and alert handling must reflect the institution’s assessed sanctions risk exposure.

External audit and reporting are relevant compliance functions but are not listed as fundamental pillars of screening programs in the Wolfsberg framework. Risk management is a broader corporate discipline, while screening specifically starts with a clear sanctions risk assessment.

Sanctions apply primarily to persons and entities within the jurisdiction of the issuing authority . For example:

• US sanctions apply to US persons, entities organized under US law, and persons physically located in the US.

• EU sanctions apply to EU nationals, persons within EU territory, and EU-incorporated entities.

Sanctions are not automatically global unless other jurisdictions adopt similar measures. International financial institutions must comply only when they operate within relevant jurisdictions.

The Wolfsberg Guidance identifies that effective sanctions screening depends on high-quality, risk-relevant reference data. Institutions must regularly review and remove outdated or irrelevant data to avoid generating unnecessary alerts and ensure screening outputs remain meaningful. Maintaining accurate and current data reduces noise and increases the productivity of alerts.

The Guidance also emphasizes that institutions may use “good guy lists” to reduce false positives, but these lists must be maintained in a controlled way to ensure they do not unintentionally suppress alerts that could indicate sanctions risk. Proper governance must accompany good-guy lists so that risk-relevant entities are not excluded from screening.

The Guidance does not support reducing thresholds to generate more alerts, nor does it promote removing low-risk parties without structured criteria. It also does not recommend manual jurisdiction-specific screening as a method of improving alert quality.

References from Sanctions and Compliance Domains:

Wolfsberg principles on management of reference data for sanctions screening.

Guidance on proper use and governance of “good guy lists.”

Recommendations for ensuring alerts remain relevant, accurate, and risk-based.

Sanctions evasion indicators in trade documentation include:

• Multiple amendments designed to obscure the parties involved – a classic red flag indicating concealment of the real counterparty.

• Falsified or tampered shipping documents – used to hide sanctioned routes, ports, or vessels.

• Conflicting end-user documentation – a major warning sign of diversion or concealment of sanctioned recipients.

Cash withdrawals (E) and online payment instructions (F) are AML indicators, but not directly sanctions evasion indicators. Docking at non-sanctioned countries (D) is not suspicious unless used as part of concealment, which is not indicated here.

The EU Blocking Regulation prevents EU persons and companies from complying with certain foreign extraterritorial sanctions, specifically those identified in its Annex. These are primarily US secondary sanctions. The Regulation is designed to protect EU entities from the extraterritorial application of non-EU sanctions. It does not prohibit compliance with EU sanctions or dual-use laws. Only the specific foreign sanctions laws listed in the Annex are prohibited for compliance.