Sanctions / TFS / CPF
1. Definition #
Sanctions screening checks whether a customer, counterparty, UBO, controller, asset, vessel, wallet, product, geography or transaction is connected to a designated person, prohibited activity or sanctions evasion risk.
2. Why It Matters #
Sanctions issues can require immediate freeze/no-dealing escalation and may create strict legal obligations. They must not be treated like ordinary adverse media.
3. Common Triggers and Use Context #
- Name or identifier match to UN baseline, internal policy list, or institution-specific sanctions list.
- Ownership/control link to sanctioned person/entity.
- Transaction involves sanctioned sector, product, vessel, wallet, bank or restricted geography under the institution-specific policy.
- PF-sensitive goods, end user or route.
- Attempted payment or onboarding linked to a designated person/entity.
- Customer asks how to avoid sanctions controls.
4. Source Basis #
- SRC-FATF-001: Recommendations 6, 7, 16, 19 and 20.
- SRC-UN-001: UN Security Council Consolidated List.
- Non-UN sanctions programmes should be configured in the institution-specific policy layer if applicable.
- Institution-specific sanctions guidance belongs in internal policy and must be aligned with applicable law and regulator expectations.
- SRC-FATF-007: PF risk assessment and mitigation guidance.
5. Practitioner workflow: sanctions hit #
- Pause normal approval path.
- Capture screening result, source list, date/time and match score.
- Classify match: false positive, possible match, likely match, true match.
- Compare identifiers: name, aliases, date of birth, place of birth, nationality, address, ID, registration number, corporate identifiers, vessel/wallet/account details.
- Check ownership/control and acting-on-behalf-of indicators.
- Check whether the sanctions source is in scope under the institution-specific policy.
- Escalate possible/likely/true matches according to policy; likely/true must go to MLRO/legal process.
- Avoid customer communication that could create tipping-off or sanctions circumvention risk.
- Produce sanctions hit memo.
6. Practitioner workflow: CPF/PF risk #
- Identify goods, technology, end user, end use, route, banks and intermediaries.
- Check UN PF-related sanctions sources and any institution-specific sources defined by the institution.
- Look for PF-sensitive exposure, including sanctioned programmes, restricted end users or evasion patterns relevant under applicable law and institutional policy.
- Check dual-use or controlled goods indicators.
- Check transshipment and end-user opacity.
- Check unusual financing and document inconsistency.
- Escalate high-risk PF indicators to MLRO.
7. Evidence to collect #
- Screening result and source list.
- Sanctions list entry details.
- Customer/counterparty identifiers.
- Ownership/control documents.
- Transaction documents.
- Goods/end-use/end-user documents where relevant.
- Communications log.
- Analyst match rationale.
- MLRO/legal decision log.
8. Match classification #
| Classification | Meaning | Required action |
|---|---|---|
| False positive | Identifiers clearly do not match | Record rationale |
| Possible match | Insufficient data to rule out | Request internal review / additional non-tipping-off data |
| Likely match | Strong identifier overlap | Escalate immediately |
| True match | Confirmed designation or control link | MLRO/legal sanctions process; freeze/no-dealing actions as applicable |
9. Red flags #
High#
- Ownership chain includes entity in restricted geography without clear reason.
- Goods route includes transshipment through high-risk geographies.
- Counterparty uses new intermediary after sanctions restrictions.
- Payment route differs from goods route.
- Customer refuses end-user/end-use information.
Critical#
- True sanctions list match.
- Ownership/control by sanctioned person/entity.
- Attempted transaction with designated person/entity.
- Evidence of sanctions evasion or PF-sensitive procurement.
10. Output Pattern #
# Sanctions Hit Memo
Subject: [customer/counterparty/person/entity/asset/wallet]
List/source: [UN/internal/institution-specific]
Match type: [name/entity/vessel/wallet/ownership/control]
Classification: [false positive/possible/likely/true]
Identifiers compared: [list]
Ownership/control analysis: [summary]
Transaction/activity context: [summary]
Immediate risk: [low/medium/high/critical]
Recommended action: [clear/escalate/freeze/no-dealing/legal review]
Tipping-off controls: [instructions]
Source basis: [source IDs]
Evidence index: [links/files/screenshots]
11. Related pages #
- STR / SAR & Tipping-Off
- 15. TBML
- Geographic Risk
- Evidence Pack Templates
12. Proliferation-financing and sanctions-evasion lens#
PF and sanctions-evasion review may require more than a direct list match. Relevant questions include:
- whether goods or services have a sensitive or dual-use context;
- whether end user, end use, route and payment parties are consistent;
- whether ownership, control or acting-on-behalf relationships are obscured;
- whether counterparties, intermediaries or documentation changed after a designation or restriction;
- whether mandatory targeted-financial-sanctions controls apply.
Use Sanctions Evasion Typologies for the defensive evidence and escalation framework. Technical export classification and legal sanctions scope remain with authorised specialist functions.
References#
- FATF Recommendations and glossary concepts listed in the Source Register.
- Relevant FATF guidance, Wolfsberg resources and official public-source materials where applicable.
- Editorial & Source Policy for source hierarchy and defensive framing.