ACAMS CGSS Certified Global Sanctions Specialist (ACAMS CGSS) Exam Practice Test

Sanctions and Compliance Domains outline several misunderstandings commonly held by businesses. One misconception is that any USD transaction automatically triggers US sanctions applicability; while USD transactions may be routed through the US financial system, sanctions analysis depends on transaction content, parties involved, and jurisdictional reach, not solely the currency.

Another misconception is assuming no sanctions risk exists if a party is not listed by name. Sanctions regimes include indirect application through ownership and control rules, sectoral sanctions, activity-based sanctions, and geographic sanctions. Entities may be sanctioned due to association, ownership, or activity even if not individually named.

Statements regarding import/export exposure and MandA due diligence are correct program requirements. US sanctions can still apply to US citizens regardless of where they reside or work.

References from Sanctions and Compliance Domains:

Misconceptions regarding currency and sanctions applicability.

Misunderstandings about named-party sanctions versus ownership/activity-based risks.

Clarification on US person obligations regardless of residence.

An effective export compliance program must include formalized and documented screening procedures, including payment screening, trade documentation screening, and counterparty checks. This ensures compliance with sanctions, export restrictions, and embargo requirements.

Freight forwarders may assist but do not replace internal compliance responsibilities. Boycott-related terms must be avoided, and collecting vouchers is not an export controls safeguard.

Sanctions and Compliance Domains specify that sanctions screening must include all fields that contain names, identifiers, or descriptive information that could reveal a connection to a sanctioned party or jurisdiction. This includes:

• Remitter and beneficiary fields – Core parties to the transaction must always be screened.

• Agents, intermediaries, correspondent banks, and financial institutions – These fields often contain additional parties that may be sanctioned or present sanctions exposure.

• Free text fields – These can include narrative descriptions, vessel names, ports, goods, or locations that may represent sanctions risk.

Currency, value, dates, and internal references do not contain identifiers relevant to sanctions screening and therefore are not required screening fields.

Under UK OFSI rules, entities owned or controlled by a designated person remain subject to asset freeze restrictions. A reduction in ownership from above 50% to below 50%, particularly when occurring immediately after designation, requires enhanced due diligence to determine whether the divestment is genuine or merely an attempt to evade sanctions.

Sanctions and Compliance Domains emphasize the need for verification when documentation claims ownership reduction. Institutions must confirm authenticity, timing, beneficiaries of the transfer, and any continuing control influence by the designated person.

Approving the transaction before verification, removing screening, or rejecting without confirming details contradicts UK sanctions compliance expectations. Enhanced due diligence is the required first step.

References from Sanctions and Compliance Domains:

OFSI ownership and control criteria, including obligations when ownership reductions occur post-designation.

Requirements for enhanced due diligence to confirm legitimacy of divestment or restructuring.

Risk indicators of sanctions evasion through rapid ownership structure changes.

OFAC regulations permit the use of USD for Cuba-related transactions only when explicitly authorized under specific exceptions or general licenses. These include certain remittances, humanitarian transactions, and authorized travel-related transactions.

General USD use with Cuba is otherwise prohibited unless OFAC has expressly allowed it through a license or regulatory exemption.

EU sanctions apply to:

• All EU nationals,

• All persons within the territory of the EU, including foreign nationals residing or operating within the EU,

• All EU legal entities, regardless of where they operate, and

• Any business conducted within the EU or using EU jurisdictional touchpoints.

EU sanctions do not have general extraterritorial effect. Unlike US sanctions (which can apply based on currency, goods origin, or facilitation), EU sanctions apply within EU territory, including airspace, and to EU persons globally.

EU sanctions do not automatically have a broader scope than US sanctions; in many cases, US sanctions have the broader reach.

Sanctions and Compliance Domains state that when a potential sanctions match occurs, the first step is to conduct a proper investigation to determine whether the alert is a true match or false positive. This includes obtaining additional identifiers such as addresses, IMO numbers, registration numbers, or corporate details.

Immediate rejection or reporting is only appropriate after confirming a true match. Premature rejection without verification violates due diligence expectations. Closing the customer account is not justified without confirmed sanctions involvement.

Sanctions screening systems rely on key personal identifiers to distinguish between true matches and false positives. The Sanctions and Compliance Domains highlight that the most essential variables for screening individuals include name, date of birth, and identification numbers. These identifiers significantly enhance matching accuracy and reduce false positives, especially when screening against common or high-frequency names.

Location, account numbers, and employers are not primary screening variables for matching against sanctions lists. Although these fields may support enhanced due diligence, they are not core identity attributes used for automated sanctions screening.

References from Sanctions and Compliance Domains:

Essential identity attributes required for automated sanctions screening.

Use of names, birth dates, and identification numbers to improve match accuracy.

Guidance on minimizing false positives using reliable personal identifiers.

Sanctions and Compliance Domains highlight that sanctioned individuals may attempt to evade restrictions by transferring assets, ownership rights, or operational control to family members or close associates. These transfers may appear legitimate but are often structured to conceal continuing beneficial ownership or influence.

Asset transfers to relatives or trusted associates are recognized as classic sanctions evasion red flags across EU and UK ownership and control guidance.

Opening bank accounts in non-aligned jurisdictions may create exposure, but the specific red flag of evasion is the movement of assets to associates. Changes in corporate strategy or reduced trading activity are not inherently indicative of sanctions evasion.

Transshipment and intermediary hubs present sanctions risks because they obscure the true origin, destination, and end-user of goods. High-risk jurisdictions use intermediary shipping points to bypass controls, hide diversion routes, and disguise connections to sanctioned countries or entities.

Documentation may be incomplete, manipulated, or replaced during transshipment, making the true jurisdiction unclear—the core risk.

Canadian sanctions law requires that Canadian persons ensure all commercial dealings comply with Canadian sanctions regulations, including those concerning Iran. Contracts involving sanctioned countries must incorporate compliance clauses reflecting applicable Canadian law.

The EU Blocking Statute does not apply to Canadian entities. Avoiding references to Iran is ineffective and does not eliminate sanctions exposure. USD payments may introduce US sanctions exposure and are not advisable in this context.

When a sham divestment (false or deceptive attempt to hide sanctioned ownership) is suspected, the first step is to conduct sufficient due diligence to confirm whether the organizational restructuring is legitimate.

This may include reviewing ownership documents, corporate registries, control structures, and transaction activity.

Only after confirming the facts should the institution escalate internally, report externally, or terminate the relationship.

The Wolfsberg Guidance identifies that effective sanctions screening depends on high-quality, risk-relevant reference data. Institutions must regularly review and remove outdated or irrelevant data to avoid generating unnecessary alerts and ensure screening outputs remain meaningful. Maintaining accurate and current data reduces noise and increases the productivity of alerts.

The Guidance also emphasizes that institutions may use “good guy lists” to reduce false positives, but these lists must be maintained in a controlled way to ensure they do not unintentionally suppress alerts that could indicate sanctions risk. Proper governance must accompany good-guy lists so that risk-relevant entities are not excluded from screening.

The Guidance does not support reducing thresholds to generate more alerts, nor does it promote removing low-risk parties without structured criteria. It also does not recommend manual jurisdiction-specific screening as a method of improving alert quality.

References from Sanctions and Compliance Domains:

Wolfsberg principles on management of reference data for sanctions screening.

Guidance on proper use and governance of “good guy lists.”

Recommendations for ensuring alerts remain relevant, accurate, and risk-based.

Sanctions and Compliance Domains explain that fuzzy logic screening includes phonetic algorithms (e.g., Soundex, Metaphone) to identify variations in the spelling or pronunciation of names. This allows a screening tool to detect near matches and transliteration differences that would not match under exact-match logic.

Inequality lists, big data, and whitelists are not fuzzy matching algorithms. Whitelists are used for reducing false positives, not matching logic.

OFAC regulations require that blocked funds must be placed into an interest-bearing account, held separately, and reported to OFAC. This does not require preauthorization from OFAC.

However, no debits or credits may occur without OFAC authorization, including:

• settling standing bills or checks (A),

• charging interest or loan/corporate card fees (C),

• deducting credit-card service charges (B).

Only OFAC can authorize movement or use of blocked property.

OFAC regulations apply broadly to US persons, which include US citizens, permanent residents, entities organized under US law, and individuals located in the United States. These obligations apply regardless of where the US person is physically located.

Foreign companies, foreign financial institutions, or foreign persons are only obligated under OFAC regulations when a US nexus exists (e.g., US origin goods, US dollars, US-based transactions). US persons, however, must always comply.

Sanctions and Compliance Domains highlight that the high-value art market is characterized by anonymity, confidentiality, private sales, intermediaries, and limited transparency. These conditions create vulnerabilities for sanctions evasion and illicit finance, including the possibility that sanctioned individuals may use art transactions to move value discreetly.

The Berman Amendment does not exempt high-value art transactions from OFAC regulations where value transfer is involved. OFAC has published guidance clearly stating that art transactions remain subject to sanctions rules. There is no value threshold such as USD 50,000 that determines compliance responsibilities.

US sanctions and export-control laws apply to US companies and their owned or controlled foreign subsidiaries. Shipping dual-use items to Iran and falsifying end-user location information constitutes a serious sanctions violation and potential export-control breach.

Sanctions and Compliance Domains emphasize that upon discovery of such activity, the company must immediately cease the shipment of goods to sanctioned destinations and strengthen its sanctions compliance program. This must include enhanced oversight, stricter internal controls, and remediation of misconduct.

Reliance on subsidiary attestations or attempts to route transactions through non-US institutions does not eliminate US sanctions liability.

A historical review or lookback is warranted when previously unidentified data elements, missing reference data, or newly discovered customer attributes are detected that may have impacted earlier screening results. Sanctions and Compliance Domains explain that such scenarios indicate that past alerts may not have been correctly generated or evaluated, necessitating a retrospective review.

Routine list updates or daily refreshes do not automatically trigger lookbacks. New sanctions programs may require enhanced forward-looking monitoring, but only missing or newly uncovered data affecting past screening results justify a historical lookback.

OFAC's 2015 Guidelines indicate that internal sanctions lists must be updated:

• when changes occur to sanctions target listing information, and

• when enhanced restrictions or new requirements are imposed, including new Executive Orders, program changes, or sector restrictions.

OFAC does not mandate monthly reviews, daily reviews following system upgrades, or reviews based on percentage changes in customer data. Updates must correspond to regulatory changes, not arbitrary timelines.

“Stripping” refers to removing, altering, or replacing material information from payment messages, invoices, or trade documents to conceal a sanctioned party, vessel, location, or jurisdiction. It is a recognized sanctions evasion technique used by actors seeking to bypass automated screening.

Examples include removing the sanctioned port name, omitting the ultimate consignee, or deleting identifying references.

This is distinct from structuring (option A), price manipulation (B), or dual messaging (C).

INSTEX was established by EU member states as an operational mechanism designed to facilitate limited and compliant trade with Iran after the re-imposition of U.S. secondary sanctions in 2018. According to the Sanctions and Compliance Domains, INSTEX is categorized as a special purpose vehicle, created specifically to permit trade transactions without reliance on traditional cross-border payment routes exposed to U.S. sanctions risk.

Special purpose vehicles are defined within sanctions frameworks as structured entities created to conduct or support specific categories of trade or payments where direct financial transfers are restricted or exposed to sanctions risk. INSTEX was designed to match European exporters and importers with Iranian counterparts through a barter-style internal clearing arrangement, avoiding external USD payment flows.

It is not a general license, nor is it a blocking statute. It also does not constitute sanctions evasion because it was formally established, publicly announced, and structured within EU legal parameters. Its purpose was to ensure compliance while maintaining limited humanitarian and permitted trade channels.

References from Sanctions and Compliance Domains:

Definitions and characteristics of special purpose vehicles in sanctions environments.

Description of EU mechanisms facilitating compliant trade with sanctioned jurisdictions.

Distinction between SPVs, blocking statutes, and licensing frameworks.

Regulatory context regarding INSTEX as an EU-created structured trade mechanism.

Comprehensive sanctions prohibit nearly all exports, imports, services, financial transactions, and business dealings with a specific jurisdiction. These sanctions apply broadly to the entire territory and often include embargoes, trade restrictions, and full financial prohibitions.

Sectoral sanctions apply only to certain industries. Targeted sanctions apply to specific individuals or entities. Thematic sanctions focus on conduct (e.g., cybercrime, human rights abuses).

OFAC has designated:

• Hackers and cyber actors involved in cryptocurrency theft.

• Cryptocurrency exchanges facilitating illicit transactions or supporting sanctioned jurisdictions.

• Mixers (tumblers) known to anonymize blockchain transactions and facilitate laundering and sanctions evasion.

Software developers (D) are generally not designated unless directly linked to illicit activity. Credit unions and central banks are not typical OFAC digital-asset designations.

Sanctions and Compliance Domains state that when entities share similar names, regions, or other characteristics with a sanctioned party — even when executive leadership differs — the institution must perform enhanced due diligence to rule out affiliation, ownership, or control links.

The similarity in names ("Al-Falah" vs. "El-Fallah"), geographic proximity, and the involvement of UN-sanctioned terrorism-related activity require deeper investigation. Compliance teams must confirm corporate records, ownership structure, purpose, and possible indirect connections before making a determination.

Automatic rejection is premature without evidence. Onboarding without further investigation is inappropriate.

Sanctions evasion commonly occurs through:

• Trade finance — manipulating bills of lading, transshipment, falsified documents.

• Correspondent banking — indirect access to the financial system through other banks.

• Shell companies — concealment of ownership, diversion of goods, and masking sanctioned parties.

Corporate, online, and retail banking may have risks but are not primary evasion channels highlighted in sanctions-evasion typologies.

Vendor contracts must explicitly require that third-party service providers comply with all applicable sanctions laws and regulations. This ensures the bank’s sanctions exposure is minimized when vendors perform outsourced functions.

Tuning procedures, risk assessments, and alert investigation procedures are internal controls—not contract requirements imposed on vendors.

Under the UN Charter, all United Nations member states are obligated to accept and carry out decisions of the UN Security Council. Sanctions and Compliance Domains emphasize that UN Security Council Resolutions issued under Chapter VII are binding on all UN members, not just Security Council members or targeted states.

Only member states have this obligation. Permanent membership or targeted status does not change the scope of obligation.

References from Sanctions and Compliance Domains:

UN Charter obligations for all Member States to implement Security Council Resolutions.

Binding nature of Chapter VII resolutions across all UN members.

EU best practices allow processing of payments that fall under permitted exemptions such as basic needs and reasonable living expenses. These may include essential subscriptions such as newspapers or communication services, provided proper authorization or notification is followed.

Salary payments generally require strict conditions and may not be allowed directly for designated persons. Taxi rides and luxury purchases are not considered basic or essential needs and cannot be processed.

The Wolfsberg 2019 Guidance identifies risk assessment as a foundational component of sanctions screening programs. Screening systems, list management, and alert handling must reflect the institution’s assessed sanctions risk exposure.

External audit and reporting are relevant compliance functions but are not listed as fundamental pillars of screening programs in the Wolfsberg framework. Risk management is a broader corporate discipline, while screening specifically starts with a clear sanctions risk assessment.