So, I asked Gemini:

Assume you are a sanctions officer. What do firms benchmark their programs against? If there is a difference between typical practice and best practice, note it and explain it, if possible, using publicly-available thought leadership sources. List sources

And this was its response:

As a sanctions officer, I view benchmarking not as a “tick-box” exercise to satisfy regulators, but as the primary mechanism to defensibly demonstrate that our program is commensurate with our risk profile.

If we are asked by a regulator (like OFAC or OFSI) to defend a compliance failure, our strongest defense is proving our program aligned with industry standards before the breach occurred.

Here is what we benchmark against, and where the market is moving regarding “typical” versus “best” practice.

1. The Core Benchmarks (The “Must-Haves”)

Every credible program is built on a few foundational documents. These are the standards against which we will be audited.

• The “Gold Standard”: OFAC’s 5 PillarsThe primary benchmark globally is the Department of the Treasury’s “A Framework for OFAC Compliance Commitments” (2019).1 Even non-US firms benchmark against this because of the extraterritorial reach of the USD.2
  • The 5 Pillars: Management Commitment, Risk Assessment, Internal Controls, Testing/Auditing, and Training.³
• Financial & Screening Standards: The Wolfsberg GroupFor screening specifically (the technical engine of our program), we benchmark against the Wolfsberg Guidance on Sanctions Screening.4 This defines what “good” looks like for fuzzy logic, list management, and resolving alerts.
• ISO Standards (ISO 37301)While broader than just sanctions, ISO 37301 (Compliance Management Systems) provides the structural benchmark for how the compliance function is governed and independent.

---

2. Typical Practice vs. Best Practice

This is where the gap exists. “Typical” practice is often compliant on paper but fragile in reality. “Best” practice (often called “Optimized” or “Proactive” in maturity models) is what protects the firm from enforcement actions when things go wrong.

Program Element	Typical Practice (Defensible)	Best Practice (Optimized)
Risk Assessment	Static & Annual. Conducted once a year using a spreadsheet. Focuses heavily on customer geography.	Dynamic & Trigger-Based. Updated continuously based on “trigger events” (e.g., new product launch, M&A, geopolitical shift). Integrates real-time transaction data rather than just policy inputs.
Screening Logic	Rules-Based. Uses standard fuzzy logic (e.g., “Levenshtein distance”) to catch misspellings. High false-positive rates (95%+) are accepted as the cost of doing business.	AI/ML Enhanced. Uses Machine Learning to “learn” from past false positives and auto-close low-risk alerts. Includes Network Analysis to catch not just listed entities, but the shadow networkof shell companies owned by them (addressing the “50% Rule”).
Training	General & Annual. One generic “Sanctions 101” e-learning module assigned to all staff. Completion is tracked by signature.	Role-Specific & Scenario-Based. The trading desk gets different training than HR. Training includes “red flag” scenarios relevant to their specific job function. Effectiveness is measured by post-training testing, not just attendance.
Testing & Audit	Internal Review. The compliance team “self-checks” or Internal Audit does a periodic review every 18-24 months.	Independent Validation. An external third party validates the screening technology (Model Validation) annually to prove the software is actually catching what it claims to catch (e.g., testing against “synthetic” sanction data).
Culture	“Tone from the Top”. The CEO sends an annual email stressing the importance of compliance.	“Echo from the Bottom”. Compliance metrics are tied to executive compensation. There is a documented “safe harbor” for employees to self-report near-misses without fear of retaliation.

3. Key Insight for Leadership

The biggest differentiator right now is Data Lineage.

• Typical practice trusts the screening vendor blindly.
• Best practice demands to know exactly how the list data moves from the UN/OFAC website into the internal screening engine. If there is a “latency” (delay) of 24 hours between a designation and our system update, a Best Practice program has a manual stop-gap control for that window.

Sources

• US Dept. of Treasury: A Framework for OFAC Compliance Commitments (May 2019)⁵
• The Wolfsberg Group: Wolfsberg Guidance on Sanctions Screening (2019)⁶
• Deloitte: Sanctions Compliance Programs: A Maturity Model Approach
• KPMG: OFAC Framework for Sanctions Compliance Programs (Thought Leadership Series)

It’s not a bad start, I guess – just not complete. While I’m neither a lawyer nor have experience as a sanctions officer, I think that, to stay current, you should also be looking at the regulatory expectations that crop up in enforcement actions, the behaviors underlying the sanctions violations (and tied back to the General Factors in the Enforcement Guidelines), and the improvements to compliance programs made by the subjects of enforcement actions. Perhaps it’s just a matter of level of detail… and that seasoned sanctions officers can likely add to this list further.

So, I asked Gemini:

What considerations should go into the design of a sanctions testing program? List sources and justify your choices

And it replied:

Designing a robust sanctions testing program requires balancing regulatory expectations (effectiveness) with operational reality (efficiency). The goal is to prove that your screening controls are working as intended and are aligned with your institution’s specific risk profile.

Below are the critical design considerations, categorized by the testing lifecycle, followed by authoritative sources and justifications.

1. Key Design Considerations

A. Governance and Scope

• Independence: The testing function (e.g., Internal Audit or an independent third party) must be separate from the function responsible for setting the screening parameters to ensure objectivity.
• Frequency & Triggers: Design the program to test not just annually, but also upon “trigger events” (e.g., new product launches, major system updates, or significant changes to sanctions lists).
• End-to-End Coverage: Testing should not be limited to the software logic. It must cover the entire lifecycle: from data extraction (source systems) to the final disposition of an alert by an analyst.

B. Data Integrity (Inputs)

• Completeness & Lineage: Verify that all relevant data (customer names, counter-parties, vessel names, payment instructions) is actually making it from the source system to the screening engine. Dropped fields are a common failure point.
• Data Quality: Assess the quality of the data being screened. Are there dummy values (e.g., “N/A”, “Unknown”) that might bypass screening logic?
• List Management: Verify that the internal “Block Lists” (e.g., OFAC SDN, EU, UN) are updated timely. Test the “time-to-deployment” gap between a regulator’s update and your system’s update.

C. Screening Logic & Model Validation (Processing)

• Fuzzy Matching & Thresholds: Test the sensitivity of your algorithm.
  • Exact Match: Does it catch “Iran”?
  • Fuzzy Match: Does it catch variations like “Tehran,” “Ir@n,” or specific misspellings?
  • Justification: If the threshold is too high (e.g., 95%), you miss risks. If too low (e.g., 60%), you drown in false positives.
• Good Guy/White Lists: specific attention must be paid to “suppression rules.” Ensure that rules designed to auto-close false positives are not accidentally auto-closing true matches (e.g., a rule to ignore “Cuba, Missouri” must not ignore “Cuba” the country).
• Segmentation: Ensure different business lines (e.g., Trade Finance vs. Retail Banking) have appropriate rules. Trade finance often requires stricter, keyword-based screening compared to retail customer databases.

D. Operational Effectiveness (Outputs)

• Alert Adjudication: Test a sample of “Cleared” alerts to ensure the rationale for discounting them was sound and documented.
• System availability: Verify that the system processes transactions in real-time (if required) without timeouts that could allow a sanctioned transaction to slip through during an outage.

---

2. Sources and Justifications

To defend your program design to regulators or auditors, you should cite the following hierarchy of sources:

1. OFAC (Office of Foreign Assets Control)

• Source Document: A Framework for OFAC Compliance Commitments (2019).
• Justification: This is the primary regulator for US sanctions. OFAC explicitly lists “Testing and Auditing” as one of the five essential components of a compliance program. They emphasize that a failure to test the “effectiveness” of the program is a root cause of many enforcement actions. Using their framework is the best defense against a penalty calculation.

2. The Wolfsberg Group

• Source Document: Wolfsberg Guidance on Sanctions Screening (2019).
• Justification: This represents the global banking industry’s “gold standard” for best practices. It provides specific technical guidance on “fuzzy matching,” data quality, and the limitations of screening that regulators often accept as a reasonable benchmark for commercial feasibility.

3. NYDFS (New York Department of Financial Services)

• Source Document: Part 504 (Transaction Monitoring and Filtering Program Requirements).
• Justification: Even if you are not NY-regulated, Part 504 is widely viewed as the most prescriptive and rigorous standard in the US. It explicitly mandates “end-to-end, pre- and post-implementation testing,” including data mapping and model validation. Adhering to Part 504 standards usually ensures you are over-compliant with federal standards.

4. FFIEC (Federal Financial Institutions Examination Council)

• Source Document: BSA/AML Examination Manual – OFAC Section.
• Justification: This is the “playbook” examiners use when they visit your institution. Designing your testing program to mirror the procedures in this manual ensures you are testing for exactly what the examiners will look for (e.g., validating that the bank processes list updates quickly).

Do you quibble with any of this? It seems like a reasonable starting point…

I initially asked:

Assume you are a sanctions officer. Besides the obvious (countries subject to targeted sanctions only), what sources would you use to assess third parties’ geographic risk? How would those sources help identify low-risk, moderate-risk and high-risk countries?

and got back this response:

As a Sanctions Officer, I operate under the assumption that sanctions lists tell you where the fire is, but geographic risk data tells you where the smoke is blowing.

Most modern sanctions violations do not happen directly with a sanctioned country (e.g., Iran or Russia); they happen through a “clean” third country that serves as a transshipment hub or financial conduit.

To assess this “shadow risk,” I rely on five specific data sources outside of the standard sanctions lists. Here is how I use them to build a Low/Moderate/High risk model.

1. The Financial Backbone: FATF Lists

The Financial Action Task Force (FATF) identifies jurisdictions with weak anti-money laundering (AML) and counter-terrorist financing (CFT) controls.

• Source: FATF “High-Risk Jurisdictions subject to a Call for Action” (Black List) and “Jurisdictions under Increased Monitoring” (Grey List).
• The Logic: If a country cannot police money laundering, it cannot police sanctions evasion. Sanctions evaders flock to these jurisdictions to wash funds.
• Risk Classification:
  • High Risk: FATF Black List (e.g., Myanmar). Treat as functionally sanctioned.
  • Moderate Risk: FATF Grey List (e.g., South Africa, Vietnam). Requires Enhanced Due Diligence (EDD) to verify source of funds.
  • Low Risk: FATF Member countries with compliant Mutual Evaluation Reports.

2. The Corruption Proxy: Transparency International (CPI)

Corruption is the grease that moves sanctioned goods across borders. Customs officials in highly corrupt regimes can be bribed to falsify End-User Certificates (EUCs) or ignore “ghost shipments.”

• Source: Transparency International Corruption Perceptions Index (CPI).
• The Logic: There is a direct correlation between low CPI scores and high diversion risk. A “clean” country on paper with a CPI score below 30 is a high-risk jurisdiction for export controls.
• Risk Classification:
  • High Risk: CPI Score < 30 (e.g., Turkmenistan, Venezuela). Assumption of government complicity in illicit trade.
  • Moderate Risk: CPI Score 30–50. Frequent facilitation payments but not necessarily state-sponsored evasion.
  • Low Risk: CPI Score > 60. Strong rule of law.

3. The Diversion Hubs: BIS & Trade Data

The US Bureau of Industry and Security (BIS) and the EU publish alerts on “Transshipment Hubs”—countries that are friendly allies but are used by adversaries to bypass sanctions.

• Source: BIS “Common High Priority Items” Alerts, FinCEN Joint Alerts, and trade flow data (e.g., Import/Export spikes).
• The Logic: If a country’s imports of semiconductors increased by 400% immediately after Russia invaded Ukraine, that country is a diversion hub.
• Risk Classification:
  • High Risk: Known transshipment hubs for dual-use goods (e.g., Turkey, UAE, Kyrgyzstan, Kazakhstan, Armenia). Note: These are often “friendly” nations, making them dangerous blind spots.
  • Moderate Risk: Major logistics hubs with high volume but strong enforcement (e.g., Singapore, Hong Kong—though Hong Kong risk is rising).
  • Low Risk: Countries with strict export control alignment (e.g., UK, Japan, Australia).

4. The Ownership Veil: Tax & Secrecy Indices

Sanctioned entities use shell companies to hide ownership. We need to know which countries make it easy to hide the “Ultimate Beneficial Owner” (UBO).

• Source: Tax Justice Network’s Financial Secrecy Index or the EU List of Non-Cooperative Jurisdictions for Tax Purposes.
• The Logic: If a jurisdiction allows bearer shares or does not maintain a public corporate registry, we cannot verify the 50% Rule (ownership by sanctioned parties).
• Risk Classification:
  • High Risk: Jurisdictions with high secrecy scores and no public registry (e.g., certain Caribbean offshore centers).
  • Moderate Risk: Jurisdictions with registries but limited access/validation.
  • Low Risk: Jurisdictions with fully transparent, searchable UBO registries (e.g., most EU member states).

5. The Future Indicator: Human Rights Reports

Sanctions are increasingly thematic (e.g., Global Magnitsky Act). Today’s human rights violator is tomorrow’s SDN (Specially Designated National).

• Source: US State Department Country Reports on Human Rights Practices or Freedom House “Freedom in the World” Reports.
• The Logic: Doing business with state-owned enterprises in authoritarian regimes carries a high risk of future designation.
• Risk Classification:
  • High Risk: “Not Free” status with reports of forced labor (e.g., Xinjiang region relevance).
  • Moderate Risk: “Partly Free” with civil unrest.
  • Low Risk: “Free” with stable democratic institutions.

---

Summary: The Risk Matrix

As your Sanctions Officer, I would combine these sources into a weighted score to automate our third-party risk assessment.

Risk Level	Indicators (Composite)	Action Required
High Risk	FATF Grey/Black List OR CPI < 30 ORKnown Transshipment Hub	Compliance Veto. Transaction requires C-level approval and verified End-User Certificate.
Moderate Risk	CPI 30–50 OR Tax Haven OR Political Instability	Enhanced Due Diligence. Must obtain full ownership structure (UBO) and negative news screening.
Low Risk	FATF Member, CPI > 60, Strong Export Controls	Standard Screening. Automated list matching only.

But I also knew there were other data sources, perhaps less frequently used – so I asked Gemini whether or not they should be included in the model. The first one that came to mind was the OECD country risk data, honestly. Ultimately, we got a more complete model:

Here is the consolidated Comprehensive Geographic Risk Framework.

This framework integrates financial crime data (FATF, TI) with macro-political indices (OECD, World Bank, EIU) to create a “Defense in Depth” model. It moves beyond simple sanctions list matching to identify the underlying environmental risks—corruption, authoritarianism, and lack of rule of law—that enable sanctions evasion.

Part 1: The Consolidated Source List

We use these nine authoritative sources to triangularize risk. No single source is sufficient; together, they cover the full spectrum of compliance and commercial risk.

A. The “Hard” Legal & Financial Gates

1. Sanctions Lists (OFAC/UK/EU/UN): The absolute legal baseline. (Target: Sanctioned Jurisdictions)
2. FATF Lists (Financial Action Task Force): The global standard for Money Laundering/Terrorist Financing controls. (Target: Illicit Finance Hubs)
3. BIS & Trade Data: Alerts on transshipment hubs and dual-use goods diversion. (Target: Sanctions Evasion Routes)

B. The “Soft” Environmental Indicators

4. Transparency International (TI) CPI: Measures public sector corruption. (Target: Bribery & Facilitation)

5. OECD Country Risk Classifications: Assesses country credit risk and likelihood of sovereign payment default. (Target: Economic Stability)

6. World Bank Worldwide Governance Indicators (WGI): Specifically “Rule of Law” and “Political Stability.” (Target: Legal Enforceability)

7. EIU Democracy Index: Classifies regime types from Democracy to Authoritarian. (Target: Future Sanctions Risk)

8. Human Freedom Index (Cato/Fraser): Measures economic and personal liberty. (Target: Business Environment/Capital Controls)

9. Tax Justice Network / EU Tax Lists: Identifies secrecy jurisdictions. (Target: Hidden Ownership/Shell Companies)

---

Part 2: The Integrated Risk Model

This model applies a “Weakest Link” logic (also known as “The Worst Score Wins”). If a country flags as “High Risk” on any primary trigger, the entire jurisdiction is treated as High Risk, regardless of how well it scores on other metrics.

Risk Classification	Primary Triggers (Automatic Classification)	Secondary Indicators (Aggravating Factors)	Operational Restrictions
PROHIBITED (The Black List)	Sanctions: Embargoed Countries (Iran, Cuba, North Korea, Syria, etc.) FATF: Black List (High-Risk Jurisdictions)	N/A	No Trade. Immediate exit. Block all transactions.
HIGH RISK (The Red Zone)	FATF: Grey List (Jurisdictions under increased monitoring) TI CPI: Score < 30 OECD Risk: 6 or 7	EIU: “Authoritarian Regime” Tax: Non-Cooperative / High Secrecy Score BIS: Known Transshipment Hub	Executive Veto Required. Requires C-Level approval, verified End-Use Certificates (EUC), and independent audit rights.
MODERATE RISK (The Amber Zone)	TI CPI: Score 30–50 OECD Risk: 3 to 5 World Bank WGI: Bottom 50th Percentile	EIU: “Hybrid Regime” or “Flawed Democracy” Human Freedom:Bottom Quartile (Economic Freedom)	Enhanced Due Diligence (EDD). Mandatory “look-back” on partners, ownership (UBO) verification, and negative news screening.
LOW RISK (The Green Zone)	FATF: Member / Compliant TI CPI: Score > 60 OECD Risk: 0 to 2	EIU: “Full Democracy” World Bank WGI: Top 25th Percentile	Standard Screening. Automated watch-list screening only. Business as usual.

---

Part 3: Methodology & Threshold Derivation

You asked specifically how we determined the “cut-off” points for High, Medium, and Low risk. These thresholds are not arbitrary; they are derived from statistical correlations with financial crime and industry benchmarks for “risk appetite.”

1. Why is the Transparency International (TI) Cut-off at 30?

• The Derivation: The TI CPI scales from 0 (Highly Corrupt) to 100 (Very Clean).
• The Logic: In the FCPA (Foreign Corrupt Practices Act) compliance community, a score below 30 is widely viewed as the threshold for “Systemic Corruption.”
  • < 30 (High Risk): Corruption is institutionalized. You likely cannot do business without paying a bribe (e.g., to clear customs or get a permit). This creates immediate legal liability.
  • 30–50 (Moderate Risk): Corruption exists but is often transactional rather than systemic. You can navigate it with strong controls.
  • > 60 (Low Risk): Generally indicates strong rule of law and functioning institutions.

2. Why use the OECD 0-7 Scale?

• The Derivation: The OECD Export Credit Group classifies countries to set minimum insurance premiums for export credits.
• The Logic: This is a proxy for economic collapse, which often precipitates political crises and sanctions.
  • 6-7 (High Risk): Indicates a high probability of sovereign default or inability to service debt. Countries in financial collapse often resort to illicit trade to generate hard currency.
  • 0-2 (Low Risk): These are “Investment Grade” economies. The risk of sudden regime change or capital controls is minimal.

3. Why the EIU “Democracy Index”?

• The Derivation: The Economist Intelligence Unit categorizes regimes into four types based on electoral process, civil liberties, and functioning of government.
• The Logic: This is our Predictive Metric.
  • “Authoritarian Regimes”: These governments are the primary targets of Western sanctions (e.g., Russia, Belarus, Venezuela). If you invest heavily here, you risk your assets becoming “stranded” by future sanctions.
  • “Full Democracies”: Almost never sanctioned by the US/EU/UK.

4. Why “The Worst Score Wins”?

In risk management, positive attributes do not cancel out negative ones.

• Example: The UAE has a high OECD rating (wealthy, stable economy) but has been gray-listed by FATF (money laundering concerns).
• Result: We treat it as High/Moderate Risk. The wealth of the country does not negate the fact that it is a hub for illicit finance. We cannot let a “Green” score on one index hide a “Red” flag on another.

After I asked about what questions to ask in order to draft a sanctions policy, Gemini asked me if it should draft a Risk Appetite statement… why not?

Based on the questions identified in the previous step, I have drafted a Sanctions Risk Appetite Statement.

For this draft, I have adopted a “Managed Risk” profile. This assumes the company is a global operator willing to do business in complex, non-sanctioned emerging markets (accepting some operational friction) but maintains a zero-tolerance stance for willful violations or dealings with comprehensively sanctioned jurisdictions.

---

Draft: Sanctions Risk Appetite Statement

Owner: Global Compliance / Chief Sanctions Officer

Audience: Board of Directors, Executive Leadership, Business Units

1. Overall Statement of Principle

The Company is committed to complying with all economic sanctions and trade embargoes administered by the United States (OFAC), the United Nations, the European Union, and the United Kingdom.

While the Company pursues growth in emerging markets, we prioritize regulatory compliance and reputational integrity over commercial opportunity. We will not engage in any transaction that risks violating strict liability sanctions regimes, nor will we engage in “gray zone” activities that are legally permissible but plainly contradict the foreign policy intent of our primary regulators.

2. Jurisdictional Risk Appetite

• Prohibited Jurisdictions (Zero Tolerance): The Company will not engage in any direct or indirect business, sales, or services involving comprehensively sanctioned countries or regions (currently including, but not limited to, Cuba, Iran, North Korea, Syria, and the occupied regions of Ukraine).
• High-Risk Jurisdictions (Conditional Tolerance): The Company accepts the risk of operating in countries subject to partial or sectoral sanctions (e.g., Venezuela, Russia) only under the following conditions:
  1. The specific activity is explicitly authorized by a General License or is exempt.
  2. Enhanced Due Diligence (EDD) has confirmed the absence of blocked parties.
  3. Legal Counsel has provided a written non-objection.

3. Counterparty Risk & Screening

• SDN / Blocked Persons: We have zero tolerance for transacting with individuals or entities appearing on the OFAC SDN List, the EU Consolidated List, or the UK Sanctions List.
• 50% Rule / Ownership: We will treat any entity owned 50% or aggregate by blocked persons as blocked, regardless of whether the entity itself is named on a list.
• Indirect Risk: We accept a low tolerance for “facilitation risk.” We will not sell to distributors if we identify a significant risk of diversion to a sanctioned end-user. We reserve the right to audit distributor end-user logs.

4. Product & Sectoral Controls

• Dual-Use Goods: For products with potential military application, we accept no risk of diversion. End-Use Certificates (EUCs) are mandatory for all sales of sensitive technology in high-risk regions.
• Sectoral Sanctions: We will strictly adhere to debt and equity restrictions (e.g., OFAC SSI List). We will not extend credit terms exceeding regulatory limits (e.g., 14 days, 30 days) to sectoral targets.

5. US Nexus & Recusal (Facilitation)

To protect the Company and its employees, we enforce a strict Recusal Policy:

• No US Person (citizen, permanent resident, or person physically in the US) may approve, facilitate, or support any transaction involving a target of US sanctions, even if that transaction is legal for a foreign subsidiary under local law.
• If a transaction is legal for a foreign subsidiary but prohibited for the US parent, the decision must be ring-fenced entirely outside the United States.

6. Governance & Exception Authority

• Standard Risk: Approvals for standard transactions in low-risk jurisdictions are delegated to the Sales and Operations teams.
• High Risk: Transactions involving high-risk jurisdictions or “red flag” resolutions require approval from the Chief Sanctions Officer.
• Policy Exceptions: Any deviation from this Risk Appetite Statement requires unanimous approval from the Chief Legal Officer and the CEO.

---

How this document functions:

This document protects you. If a sales executive proposes a deal in a gray-area jurisdiction that promises high revenue but high risk, you can point to Section 1, which the Board has signed, to veto the deal without it becoming a personal argument.

A good starting point, methinks…

My prompt to Gemini:

Assume you are a newly-hired chief sanctions officer, and the company has no sanctions policy. What questions would you ask the board and the C-suite officers to drive your policy and your risk assessment?

Its response:

As the newly appointed Chief Sanctions Officer, my primary goal is to align the sanctions compliance program with the organization’s strategic vision and risk appetite. To build a policy and risk assessment that is both robust and commercially viable, I need to understand the “tone from the top” and the reality of our operations.

Here are the critical questions I would pose to the Board and C-suite, categorized by their impact on the program.

1. Risk Appetite & Strategic Tolerance

To the Board and CEO:

• What is our tolerance for regulatory friction versus commercial growth? Are we a “zero-tolerance” organization that exits any market with even a hint of sanctions risk, or are we willing to manage complex risks in authorized but highly sanctioned jurisdictions (e.g., relying on General Licenses)?
• How do we view “reputational risk” compared to strict legal liability? Would we continue to do business with a legally non-sanctioned entity if they were publicly linked to a sanctioned regime in the press, or would we self-sanction to protect the brand?
• What is our stance on facilitation risk? Specifically, are we comfortable with our foreign subsidiaries doing business that we, as a parent company, cannot touch, or do we apply a single global standard regardless of local law?

2. Business Exposure & Footprint

To the Chief Operating Officer (COO) and Head of Sales:

• Where is our growth coming from in the next 12-36 months? Are we targeting expansion in high-risk regions (e.g., Eastern Europe, the Middle East, or Asia-Pacific) that might trigger sectoral sanctions or export controls?
• Who are our “critical” counterparties? Beyond customers, who are the distributors, joint venture partners, or supply chain nodes we cannot operate without?
• Do we have visibility into the end-users of our products? If we sell through distributors, do we have the contractual rights and audit capabilities to know where the goods actually end up?

3. Products & Technical Controls

To the Chief Technology Officer (CTO) and Product Heads:

• Do our products or services have dual-use potential? Could our software or hardware be repurposed for military or surveillance use, potentially triggering Export Administration Regulations (EAR) alongside sanctions?
• Where is our data stored and who has access to it? If we have support teams in third countries accessing US-based servers, are we inadvertently “exporting” controlled technical data?
• How flexible are our current ERP and payment systems? If a new sanction is imposed tomorrow, can we systematically block a region or a counterparty instantly, or is it a manual process?

4. Governance & Resources

To the Chief Financial Officer (CFO) and General Counsel:

• What is the budget for screening tools and external counsel? Do we have the resources to automate daily screening against updated lists (OFAC, UK HMT, EU, UN), or are we relying on periodic manual checks?
• What is the escalation path for a blocked transaction? Does the business have the authority to override a compliance “hold,” and if so, who signs off on that risk?
• How do we handle voluntary self-disclosure? If we find a historical violation during my initial risk assessment, is the leadership team prepared to disclose it to regulators to mitigate penalties, or is the preference to remediate quietly?

---

Summary of Intent

These questions serve two purposes:

1. Calibration: They tell me if I need to build a “fortress” compliance program (highly restrictive, low risk) or a “facilitative” program (risk-managed, high complexity).
2. Education: They force the leadership to acknowledge that sanctions compliance is not just a legal check-box, but a strategic constraint on how and where we do business.

And its justification of the sources it used:

To validate the questions I posed in my initial response, I have mapped them below to the specific, authoritative industry frameworks from which they were derived. These are not hallucinations; they are the foundational documents used by US and international regulators to evaluate compliance programs.

Here are the sources, categorized by the questions they informed.

1. Source for “Risk Appetite & Management Commitment”

Question context: Asking the Board about tolerance for regulatory friction and “tone from the top.”

• Primary Source:“A Framework for OFAC Compliance Commitments” (Published by the US Dept. of Treasury, May 2019).
  • Validation: This is the definitive guidance from OFAC. It explicitly lists “Management Commitment” as one of the five essential components of a compliance program. It states that senior management must “ensure that the SCP receives adequate resources” and “legitimize the program.”
  • Specific Reference: Section I (Management Commitment) and Section II (Risk Assessment).
• Secondary Source:“Evaluation of Corporate Compliance Programs” (US Dept. of Justice, Criminal Division, Updated September 2024).
  • Validation: The DOJ uses this document to decide whether to prosecute companies. It asks prosecutors to evaluate: “How have senior leaders, through their words and actions, encouraged or discouraged compliance?”

2. Source for “Technical Controls & Screening”

Question context: Asking about “fuzzy logic,” data quality, and screening tools.

• Primary Source:“Wolfsberg Guidance on Sanctions Screening” (The Wolfsberg Group, 2019).
  • Validation: The Wolfsberg Group is the global standard-setter for financial crime compliance. Their guidance specifically addresses “fuzzy matching,” data integrity, and the calibration of screening tools to avoid false negatives.
  • Specific Reference: Section 3 (Technology) and Section 4 (Alert Generation).

3. Source for “Ownership & The 50% Rule”

Question context: Asking about “indirect risk” and joint ventures.

• Primary Source:OFAC “Entities Owned by Blocked Persons” Guidance (The 50% Rule) (Feb 2008 / Revised Aug 2014).
  • Validation: This is a strict liability rule, not just a guideline. It states that any entity owned 50% or more in the aggregate by sanctioned persons is automatically sanctioned, even if not named on a list.
  • Specific Reference: OFAC FAQs 398–403.

4. Source for “Export Controls & Dual-Use Goods”

Question context: Asking about product diversion and end-users.

• Primary Source:“Export Compliance Guidelines: The Elements of an Effective Export Compliance Program” (Bureau of Industry and Security – BIS).
  • Validation: BIS regulates dual-use goods (commercial items with military applications). Their guidelines emphasize “Cradle-to-Grave” security—knowing the ultimate end-use of a product, not just the initial buyer.
  • Specific Reference: Element 2 (Continuous Risk Assessment) and Element 8 (Program for Handling Export Violations).

5. Source for “Voluntary Self-Disclosure (VSD)”

Question context: Asking if the leadership is prepared to disclose historical violations.

• Primary Source:OFAC Enforcement Guidelines (31 C.F.R. Part 501, Appendix A).
  • Validation: This legal text defines how penalties are calculated. It explicitly lists “Voluntary Self-Disclosure” as a mitigating factor that can reduce base penalties by up to 50%.
  • Specific Reference: General Factor F (Remedial Response) and General Factor I (Cooperation with OFAC).

Summary of Validation

The questions I proposed were not invented; they were reverse-engineered from these regulatory expectations. If a company cannot answer “Yes” or provide data for these questions, they are effectively compliant-deficient according to the OFAC Framework and DOJ Guidelines.