Sanctions / TFS / CPF

Topic TypeAML ConceptPrimary UseCDD, EDD, screening, risk understanding and reviewer reasoningScopeJurisdiction-neutral public referenceLast Reviewed2026

1. Definition #

Sanctions screening checks whether a customer, counterparty, UBO, controller, asset, vessel, wallet, product, geography or transaction is connected to a designated person, prohibited activity or sanctions evasion risk.

2. Why It Matters #

Sanctions issues can require immediate freeze/no-dealing escalation and may create strict legal obligations. They must not be treated like ordinary adverse media.

3. Common Triggers and Use Context #

  • Name or identifier match to UN baseline, internal policy list, or adopter-specific sanctions list.
  • Ownership/control link to sanctioned person/entity.
  • Transaction involves sanctioned sector, product, vessel, wallet, bank or restricted geography under the adopter policy overlay.
  • PF-sensitive goods, end user or route.
  • Attempted payment or onboarding linked to a designated person/entity.
  • Customer asks how to avoid sanctions controls.

4. Source Basis #

  • SRC-FATF-001: Recommendations 6, 7, 16, 19 and 20.
  • SRC-UN-001: UN Security Council Consolidated List.
  • Non-UN sanctions programmes should be configured in the adopter configuration layer if applicable.
  • Adopter-specific sanctions guidance should be configured outside the open knowledge base.
  • SRC-FATF-007: PF risk assessment and mitigation guidance.

5. Agent workflow: sanctions hit #

  1. Pause normal approval path.
  2. Capture screening result, source list, date/time and match score.
  3. Classify match: false positive, possible match, likely match, true match.
  4. Compare identifiers: name, aliases, date of birth, place of birth, nationality, address, ID, registration number, corporate identifiers, vessel/wallet/account details.
  5. Check ownership/control and acting-on-behalf-of indicators.
  6. Check whether the sanctions source is in scope under the adopter policy overlay.
  7. Escalate possible/likely/true matches according to policy; likely/true must go to MLRO/legal process.
  8. Avoid customer communication that could create tipping-off or sanctions circumvention risk.
  9. Produce sanctions hit memo.

6. Agent workflow: CPF/PF risk #

  1. Identify goods, technology, end user, end use, route, banks and intermediaries.
  2. Check UN PF-related sanctions sources and any adopter-specific sources configured by the adopter.
  3. Look for PF-sensitive exposure, including sanctioned programmes, restricted end users or evasion patterns configured by the adopter policy overlay.
  4. Check dual-use or controlled goods indicators.
  5. Check transshipment and end-user opacity.
  6. Check unusual financing and document inconsistency.
  7. Escalate high-risk PF indicators to MLRO.

7. Evidence to collect #

  • Screening result and source list.
  • Sanctions list entry details.
  • Customer/counterparty identifiers.
  • Ownership/control documents.
  • Transaction documents.
  • Goods/end-use/end-user documents where relevant.
  • Communications log.
  • Analyst match rationale.
  • MLRO/legal decision log.

8. Match classification #

Classification Meaning Agent action
False positive Identifiers clearly do not match Record rationale
Possible match Insufficient data to rule out Request internal review / additional non-tipping-off data
Likely match Strong identifier overlap Escalate immediately
True match Confirmed designation or control link MLRO/legal sanctions process; freeze/no-dealing actions as applicable

9. Red flags #

High#

  • Ownership chain includes entity in restricted geography without clear reason.
  • Goods route includes transshipment through high-risk geographies.
  • Counterparty uses new intermediary after sanctions restrictions.
  • Payment route differs from goods route.
  • Customer refuses end-user/end-use information.

Critical#

  • True sanctions list match.
  • Ownership/control by sanctioned person/entity.
  • Attempted transaction with designated person/entity.
  • Evidence of sanctions evasion or PF-sensitive procurement.

10. Output Pattern #

# Sanctions Hit Memo

Subject: [customer/counterparty/person/entity/asset/wallet]
List/source: [UN/internal/adopter-specific]
Match type: [name/entity/vessel/wallet/ownership/control]
Classification: [false positive/possible/likely/true]
Identifiers compared: [list]
Ownership/control analysis: [summary]
Transaction/activity context: [summary]
Immediate risk: [low/medium/high/critical]
Recommended action: [clear/escalate/freeze/no-dealing/legal review]
Tipping-off controls: [instructions]
Source basis: [source IDs]
Evidence index: [links/files/screenshots]
  • STR / SAR & Tipping-Off
  • 15. TBML
  • Geographic Risk
  • Evidence Pack Templates

12. Proliferation-financing and sanctions-evasion lens#

PF and sanctions-evasion review may require more than a direct list match. Relevant questions include:

  • whether goods or services have a sensitive or dual-use context;
  • whether end user, end use, route and payment parties are consistent;
  • whether ownership, control or acting-on-behalf relationships are obscured;
  • whether counterparties, intermediaries or documentation changed after a designation or restriction;
  • whether mandatory targeted-financial-sanctions controls apply.

Use Sanctions Evasion Typologies for the defensive evidence and escalation framework. Technical export classification and legal sanctions scope remain with authorised specialist functions.

References#

  • FATF Recommendations and glossary concepts listed in the Source Register.
  • Relevant FATF guidance, Wolfsberg resources and official public-source materials where applicable.
  • Editorial & Source Policy for source hierarchy and defensive framing.
Tom Custos AML Knowledge BaseLearning & OperationsDownload source .md