Running a sanctions compliance program

Screening tools do not make a sanctions program; they are one control inside it. Supervisors and enforcement authorities judge a firm on whether its controls match its actual exposure, whether someone senior owns them, and whether the firm can prove they work. This lesson assembles the pieces from the previous four lessons into a program that can be run, tested and defended.

The sanctions risk assessment

A sanctions risk assessment asks where a prohibited person, place or transaction could enter the business, and how well the controls would stop it. It can sit inside the enterprise-wide risk assessment (see the lesson The risk-based approach), but it needs its own factors, because sanctions risk is about exposure to designations and territories rather than suspicion.

Proliferation financing deserves explicit attention. In October 2020 the FATF amended Recommendation 1 and its Interpretive Note to require countries and private-sector firms to identify, assess and mitigate their proliferation financing risk, defined narrowly as the potential breach, non-implementation or evasion of the targeted financial sanctions in Recommendation 7. The FATF Guidance on Proliferation Financing Risk Assessment and Mitigation (June 2021) explains how. For a VASP, given the documented DPRK activity described in the lesson Sanctions risks specific to crypto, this assessment is rarely low.

The output should be a rating for each factor, the controls that address it, and the residual risk, approved by senior management and refreshed at least annually and whenever a major regime change or new product occurs.

Governance

Ownership comes first. A typical structure:

• the board approves the sanctions policy and risk appetite, including the list of regimes applied and the territories the firm will not serve;
• a named sanctions officer, often within the compliance function and reporting to the compliance officer or MLRO, owns daily operation, escalations and reporting to authorities;
• the business owns first-line controls such as onboarding restrictions and withdrawal holds;
• internal audit tests the whole program independently.

Management information keeps governance real: time from list publication to full rescreening, alert volumes and aging, true matches and frozen assets, geolocation blocks, exceptions granted, and testing results. A board that sees these figures each quarter can challenge them; a board that only approves a policy once a year cannot.

Preventive and detective controls

The control set links each risk to a control and an owner.

Geolocation deserves emphasis because it is cheap to build and easy to neglect. A complete design blocks onboarding from sanctioned territories, checks IP data at every login and withdrawal, flags VPN and hosting IP ranges, compares IP country with document and phone country, and runs a regular batch over existing accounts so that customers who were onboarded before a territory was sanctioned are found and handled.

Escalation and disclosure

An escalation matrix removes guesswork:

Disclosure to authorities takes two forms. Mandatory reports cover frozen assets and, in some regimes, rejected transactions. Voluntary disclosure of an apparent violation, such as a completed transfer to a designated party, is not required everywhere, but many authorities treat prompt, complete self-disclosure and cooperation as mitigating factors. The decision to disclose should be taken by senior management with legal advice and recorded, and the firm should be ready to show its root-cause analysis and remediation.

When a failure is discovered, a lookback may be needed: rescreening past customers or transactions for the period the control was broken. The Wolfsberg Guidance on Sanctions Screening (2019) suggests weighing the root cause, whether the issue was isolated, and the mitigation already in place when deciding whether a lookback is useful.

Testing and audit

A program that is never tested is a policy, not a control. Testing operates at three levels:

1. System testing: Are all lists loaded completely and on time? Are all customers and all transaction flows actually passing through screening? Does fuzzy matching catch seeded variants at the configured threshold? Do geolocation blocks work when tested from a sanctioned-territory IP and through a VPN?
2. Quality assurance: Do alert decisions follow procedure, and are rationales specific? A sample of closed alerts is re-reviewed each month.
3. Independent audit: Internal audit or a qualified third party tests design and operating effectiveness, at a frequency set by risk, and reports findings to the board with tracked remediation.

Data integrity is the most common hidden failure. Customer records that never reached the screening engine because of a missing field, or a new product whose withdrawals bypass the wallet-screening call, will not show up in alert metrics. Reconciling the population screened with the population that exists is the test that finds them.

The evidence an examiner asks for

Supervisors usually begin a sanctions review with a document request. A firm that can produce the following quickly shows that its program operates, not just exists:

• the current sanctions policy, the list of regimes applied and the board approval;
• the latest sanctions and proliferation financing risk assessment;
• list load logs with versions, timestamps and counts for a chosen period;
• screening configuration: thresholds, fuzzy matching settings, exclusions and good-guy list entries, each with its approval;
• alert statistics and a sample of closed alerts with full rationales;
• the register of frozen assets and copies of the reports sent to the competent authority;
• geolocation block statistics and the results of the latest IP review of existing accounts;
• testing, quality assurance and audit reports, with the status of every open finding.

Screening tools bought from a vendor do not shift the responsibility: the firm must understand and evidence how the tool is configured and why.

Lessons from public enforcement actions

Public enforcement actions against exchanges, wallet providers and payment firms in several regions repeat the same findings. Two examples show the pattern:

• In Lithuania in 2024, a crypto exchange and payment service was fined because, for more than a year and a half, it let customers, mainly from Russia, move funds to and from banks under EU sanctions, did not identify its customers adequately and ignored the authority's requests to stop. The fine covered both the sanctions breaches and the AML failures.
• In the United States, several exchanges settled with the authorities between 2022 and 2023 after serving users in comprehensively sanctioned territories for years, although the IP addresses they had collected showed where those users were. Consequences included penalties and, in the largest case, independent monitors.

Described by what failed:

Penalties in these cases were often reduced for cooperation and remediation, and increased where firms knew of the gaps and delayed fixing them.

Exam focus: the factors of a sanctions risk assessment for a crypto business; the October 2020 FATF requirement to assess proliferation financing risk and its narrow definition tied to R.7; governance roles and the management information a board should see; mapping risks to controls, including a complete geolocation design; the escalation matrix and the difference between mandatory reports and voluntary disclosure; lookbacks; system testing, quality assurance and independent audit, and reconciling screened versus existing populations; the recurring failures in public enforcement actions and the control that addresses each.