# Sanctions Compliance Procedure: [Institution name]

> Operating procedure for screening customers, related parties and
> payments against applicable sanctions lists, managing those lists,
> calibrating fuzzy matching, handling alerts, escalating potential
> matches, blocking or freezing assets, rejecting transactions and
> reporting to the authorities. It follows the five components of the
> OFAC "A Framework for OFAC Compliance Commitments" (May 2019), the
> EBA Guidelines EBA/GL/2024/14 and EBA/GL/2024/15 on internal
> policies, procedures and controls for Union and national restrictive
> measures (apply from 2025-12-30), the EU sanctions regulations cited
> by number, and HM Treasury OFSI "UK financial sanctions general
> guidance" (updated 2026-05-12). Replace every `[bracketed]` value and
> every row marked *Example*. Obtain the regulation or guidance for the
> normative text, and check the consolidated version before use. This
> is a document format, not legal, compliance or financial advice.

<!--
Guidance: How to use this template
- Fill section 1 first. The regimes that bind the institution (UN as
  implemented, EU, national, US, UK, local) decide which lists, owner-
  ship rules and reporting deadlines apply everywhere else.
- Complete the Sanctions Exposure Assessment
  (`compliance/sanctions-exposure-assessment`) before calibrating
  screening. EBA/GL/2024/14 expects controls to follow from that
  assessment, and OFAC lists risk assessment as the second of its five
  components.
- Keep thresholds, matching parameters and list sources as *Example*
  until they are tested on your own data. A threshold copied from a
  vendor default is the most common finding in sanctions audits.
- Related documents: AML/CFT Programme Policy
  (`compliance/aml-cft-programme-policy`), KYC and CDD Profile
  (`compliance/kyc-cdd-profile`), Transaction Monitoring Scenario
  Specification (`compliance/transaction-monitoring-scenario-spec`),
  SAR/STR Narrative (`compliance/sar-str-narrative`), ISO 20022
  Payments Design (`industry/iso20022-payments-design`), AML
  Independent Test Report (`compliance/aml-independent-test-report`).
- The worked example uses "Fernhollow Bank", a fictional mid-sized EU
  credit institution with a New York state-licensed branch. All names,
  figures and thresholds are fictional.
-->

## Document control

<!-- Guidance: Record who owns the procedure and who approved it. EBA/GL/2024/14 expects a senior staff member in charge of restrictive measures compliance; name that person here. A change of regimes in scope is a new major version. -->

| Field | Value |
|---|---|
| Document ID | [SAN-PROC-001] |
| Institution | [Legal name], [registration number], [LEI] |
| Version | [1.0] |
| Status | [Draft / In review / Approved / Superseded] |
| Owner | [@head-of-sanctions] |
| Senior staff member in charge of restrictive measures | [Name, role] (EBA/GL/2024/14 Section 4.1.3) |
| Approvers/reviewers | [@management-body], [@chief-compliance-officer], [@mlro], [@head-of-payments-operations], [@internal-audit] |
| Regimes in scope | [UN (as implemented) / EU / [Member State] national / US OFAC / UK / [other]] |
| Entities and branches covered | [List of legal entities and branches] |
| Linked exposure assessment | [SAN-EXP-2026] |
| Last updated | YYYY-MM-DD |
| Next scheduled review | YYYY-MM-DD (at least annually) |
| Classification | [Internal / Confidential] |

### Approvals

| Role | Name | Decision | Date |
|---|---|---|---|
| Management body (management function) | [@name] | [Approve / Approve with conditions / Reject] | YYYY-MM-DD |
| Senior staff member in charge of restrictive measures | [@name] | [Decision] | YYYY-MM-DD |
| Chief Compliance Officer | [@name] | [Decision] | YYYY-MM-DD |
| Head of Payments Operations | [@name] | [Decision] | YYYY-MM-DD |
| US branch sanctions compliance officer (if any) | [@name] | [Decision] | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change |
|---|---|---|---|
| 0.1 | YYYY-MM-DD | [@name] | First draft |
| 1.0 | YYYY-MM-DD | [@name] | *Example:* Approved after alignment with EBA/GL/2024/14 and EBA/GL/2024/15 (apply 2025-12-30) |
| 1.1 | YYYY-MM-DD | [@name] | *Example:* UK list source changed to the UK Sanctions List after the OFSI Consolidated List closed on 2026-01-28 |

## Contents

- [1. Purpose, scope and legal basis](#1-purpose-scope-and-legal-basis)
- [2. Governance, roles and responsibilities](#2-governance-roles-and-responsibilities)
- [3. Link to the exposure assessment](#3-link-to-the-exposure-assessment)
- [4. Lists and list management](#4-lists-and-list-management)
- [5. Screening scope and timing](#5-screening-scope-and-timing)
- [6. Matching configuration and calibration](#6-matching-configuration-and-calibration)
- [7. Alert handling and escalation](#7-alert-handling-and-escalation)
- [8. Ownership and control checks](#8-ownership-and-control-checks)
- [9. True matches: blocking, freezing, rejecting and reporting](#9-true-matches-blocking-freezing-rejecting-and-reporting)
- [10. Licences, exemptions and delisting](#10-licences-exemptions-and-delisting)
- [11. Breaches, root causes and disclosure](#11-breaches-root-causes-and-disclosure)
- [12. Testing, quality assurance and tuning](#12-testing-quality-assurance-and-tuning)
- [13. Training](#13-training)
- [14. Record keeping](#14-record-keeping)
- [15. Management information](#15-management-information)
- [16. Traceability matrix](#16-traceability-matrix)
- [17. Glossary and references](#17-glossary-and-references)
- [Standard and licence note](#standard-and-licence-note)

## 1. Purpose, scope and legal basis

<!-- Guidance: State which sanctions regimes bind which entity and why (incorporation, location of the branch, currency of the payment, nationality of staff). Pitfall: an EU bank assuming US sanctions do not matter, while it clears USD through a US correspondent. -->

This procedure tells staff how [Institution name] makes sure it never makes funds or
economic resources available to a designated person, freezes what it already holds for
them, and respects sectoral restrictions such as investment, financing, export and service
bans. It covers onboarding, ongoing customer screening, payment screening, trade finance,
securities and any other channel identified in the exposure assessment. It applies to
every employee, contractor and outsourced service provider that performs a screening or
alert review step on behalf of the institution.

Sanctions obligations are strict: a breach can occur without intent, and an alert closed
wrongly is a breach the moment the payment leaves. For that reason the procedure prefers a
delayed payment over an unchecked one, and it requires a documented decision for every
alert.

### 1.1 Regimes in scope (as of 2026-10, check local law)

| Regime | Why it applies to [Institution name] | Main list | Authority for reporting and licences |
|---|---|---|---|
| United Nations Security Council | Implemented through EU and national law; not applied directly | UN Security Council Consolidated List | Through EU and national authorities |
| European Union (CFSP decisions under Article 29 TEU, regulations under Article 215 TFEU) | Institution incorporated in the EU | EU Consolidated Financial Sanctions List | National competent authority of each Member State |
| [Member State] national measures | Head office and branches in [Member State] | [National list] | [National authority] |
| United States (OFAC) | *Example:* Fernhollow Bank's New York branch is a US person; USD clearing through US correspondents | SDN List and Non-SDN lists (for example SSI, NS-MBS) | OFAC (Reporting System, Licensing Division) |
| United Kingdom | *Example:* London representative office and GBP payments through UK banks | UK Sanctions List (sole source since 2026-01-28) | OFSI (financial), OTSI (trade) |
| [Other] | [Reason] | [List] | [Authority] |

### 1.2 Legal and supervisory basis

| Source | Reference | Use in this procedure |
|---|---|---|
| EU regime regulations | *Example:* Council Regulation (EU) No 269/2014 (asset freeze, Ukraine territorial integrity), Council Regulation (EU) No 833/2014 (Russia sectoral measures, including the Article 8a best-efforts obligation for EU parents), Council Regulation (EU) No 267/2012 (Iran), Council Regulation (EC) No 765/2006 (Belarus), Council Regulation (EU) 2017/1509 (DPRK), Council Regulation (EC) No 2580/2001 (terrorism) | Freeze, make-available and sectoral prohibitions; check the EU Sanctions Map for the full list |
| EU criminal law | Directive (EU) 2024/1226 on the definition of criminal offences and penalties for the violation of Union restrictive measures | Breach escalation (section 11) |
| EU payments | Regulation (EU) 2023/1113 (information accompanying transfers of funds and crypto-assets); Regulation (EU) No 260/2012 Article 5d (inserted by Regulation (EU) 2024/886, instant payments) | Payment data to screen; customer-based screening for euro instant payments |
| EBA guidelines | EBA/GL/2024/14 (governance, exposure assessment, effectiveness, training); EBA/GL/2024/15 (screening, alert analysis, freezing, reporting for PSPs and CASPs) | Sections 2 to 13 |
| US | International Emergency Economic Powers Act and programme regulations in 31 CFR Chapter V; 31 CFR Part 501 (reporting, procedures, penalties, Economic Sanctions Enforcement Guidelines at Appendix A); OFAC Framework for OFAC Compliance Commitments (May 2019); New York 3 NYCRR Part 504 (filtering programme) | US branch filtering, reporting, records |
| UK | Sanctions and Anti-Money Laundering Act 2018 and regime regulations; OFSI UK financial sanctions general guidance (updated 2026-05-12) | Ownership and control, reporting, annual frozen asset review |
| FATF | Recommendation 6 (targeted financial sanctions related to terrorism and terrorist financing); Recommendation 7 (targeted financial sanctions related to proliferation) | Context for UN-derived listings |

## 2. Governance, roles and responsibilities

<!-- Guidance: Name who decides, who reviews, and who can release a held payment. OFAC lists management commitment as its first component; EBA/GL/2024/14 asks for a senior staff member with enough authority and resources. Pitfall: front-office staff able to override a hold. -->

The management body approves this procedure and receives the sanctions management
information described in section 15. It appoints a senior staff member in charge of
restrictive measures compliance who has direct access to the management body, enough staff
and systems, and the authority to stop any transaction or relationship. At Fernhollow Bank
this is the Chief Compliance Officer, supported by a Head of Sanctions; the New York
branch has its own designated sanctions compliance officer who reports to the same Head of
Sanctions and locally to the branch manager.

Business lines own the first-line controls: they collect complete customer and payment
data, they never split, reformat or strip data to avoid an alert, and they hold any
transaction that the screening system stops until compliance releases it. Payments
Operations runs the filters and the queues. The Sanctions team in Compliance reviews level
2 alerts, decides true matches and files reports. Internal Audit tests the whole process
independently.

| Activity | Business line | Payments Operations | Sanctions (level 1) | Sanctions (level 2) | Head of Sanctions | Senior staff member |
|---|---|---|---|---|---|---|
| Collect complete party data | R | C | I | I | I | I |
| List updates in screening engine | I | R | C | C | A | I |
| Level 1 alert review | I | I | R | C | A | I |
| Escalated alert decision | I | I | C | R | A | I |
| Block, freeze or reject | I | R | C | R | A | I |
| Report to authority | I | I | I | R | A | I |
| Calibration change approval | I | C | C | R | A | C |
| Annual review of procedure | C | C | C | R | R | A |

R = responsible, A = accountable, C = consulted, I = informed.

## 3. Link to the exposure assessment

<!-- Guidance: Summarise the latest exposure assessment and show which control in this procedure answers each high exposure. Pitfall: an assessment that is filed and never changes the controls. -->

The restrictive measures exposure assessment (`compliance/sanctions-exposure-assessment`)
identifies where the institution could fail to implement a measure and where customers
could use it to circumvent one. This procedure must answer every exposure rated High or
Medium in that assessment. When the assessment changes, the Head of Sanctions reviews
sections 5, 6 and 12 within [30] days and records any change in the revision history.

| Exposure ID | Exposure (from assessment) | Residual rating | Control in this procedure |
|---|---|---|---|
| EXP-GEO-003 *(Example)* | Correspondent flows through jurisdictions bordering Russia and Belarus | High | 5.2 payment screening of free text and goods descriptions; 6.4 keyword and port lists; 8 ownership checks |
| EXP-CUS-002 *(Example)* | SME exporters of dual-use goods | Medium | 5.1 enhanced onboarding questions; 5.3 trade document screening |
| EXP-CHN-001 *(Example)* | Nested relationships through respondent banks | Medium | 5.2 screening of all agents; 12 sample testing of respondent flows |

## 4. Lists and list management

<!-- Guidance: List every source, how fast each update reaches the screening engine, and who checks it. EBA/GL/2024/15 expects updates immediately after a measure enters into force. Pitfall: a vendor feed delay nobody measures. -->

The institution screens against the official lists named in section 1.1, received through
[vendor name] and checked against the official publication. The list owner in Payments
Operations confirms each update, and the Sanctions team performs a reconciliation sample.
EU designations take effect on publication in the Official Journal, often the same day the
Council adopts them, so the target time for an update must be measured in hours, not days.

| List ID | List | Source | Update target | Check after load |
|---|---|---|---|---|
| SAN-LST-001 *(Example)* | EU Consolidated Financial Sanctions List | Official file feed via [vendor], checked against the Official Journal | Within 2 hours of publication, 24/7 on-call | Count reconciliation and five-name spot check |
| SAN-LST-002 *(Example)* | [Member State] national list | [Authority website] | Within 4 hours | Spot check |
| SAN-LST-003 *(Example)* | OFAC SDN and Non-SDN lists | OFAC Sanctions List Service via [vendor] | Within 2 hours | Count reconciliation |
| SAN-LST-004 *(Example)* | UK Sanctions List | FCDO via [vendor] | Within 4 hours | Count reconciliation |
| SAN-LST-005 *(Example)* | Internal lists: sanctioned ports and cities, vessel IMO numbers, BICs of designated banks, goods keywords | Sanctions team | Same day as trigger | Peer review |
| SAN-LST-006 *(Example)* | Good-guy list (documented false positives) | Sanctions team | Review after every list change and customer data change | Second-person approval |

```mermaid
flowchart LR
  A[Official publication] --> B[Vendor feed]
  B --> C{Reconciled with official source?}
  C -- No --> D[Escalate to vendor and load manually]
  C -- Yes --> E[Load into screening engine]
  D --> E
  E --> F[Trigger rescreen of customer base]
  F --> G[Update log and MI]
```

Each new designation triggers a rescreen of the whole customer base and of pending
payments and standing orders. A good-guy list entry is allowed only when the analyst has
documented why the customer is not the listed person (for example a different date of
birth and nationality). The entry names the list entry it suppresses, and it is reviewed
every time that list entry or the customer's data changes. Never suppress a whole list
entry for all customers.

## 5. Screening scope and timing

<!-- Guidance: Define what is screened, when, and against which data. Pitfall: screening the customer name but not beneficial owners, authorised signatories or intermediary banks. -->

### 5.1 Customers and related parties

Screen every customer before the relationship starts and before any service is provided.
Screen beneficial owners through ownership and through control, directors, authorised
signatories and anyone acting on the customer's behalf. Rescreen the full customer base
whenever a list changes, and screen an individual customer again when its name, address,
nationality, ownership or business activity changes.

| Trigger ID | Trigger | Population | Timing |
|---|---|---|---|
| SAN-SCR-001 *(Example)* | Onboarding | Customer, beneficial owners, directors, signatories | Before account opening |
| SAN-SCR-002 *(Example)* | List change | Whole customer base (delta and full) | Within 4 hours of list load |
| SAN-SCR-003 *(Example)* | Customer data change | Changed customer and related parties | Same day |
| SAN-SCR-004 *(Example)* | Full periodic rescreen | Whole customer base | Weekly |
| SAN-SCR-005 *(Example)* | Suspicion of circumvention | Customer, counterparties, related entities | Immediately |

The minimum data screened for a natural person is full name (in the original script and
transliterated) and date of birth; for a legal person, the registered name, trade names
and former names. Add nationality, address and identification numbers so that analysts can
discount false positives quickly.

### 5.2 Payments

Screen every outgoing, incoming and intermediated payment before funds are made available
to the payee. Screen all parties and agents, including intermediary and correspondent
banks by name and BIC, the payment purpose and remittance free text, and addresses. For
trade related payments, also screen goods descriptions, ports, vessels and countries of
origin and destination where the data is available.

ISO 20022 messages improve screening quality because each party has its own element and
structured addresses separate town and country from the street. Map every element you
screen and keep the mapping under change control; details of the canonical model and the
CBPR+ address rules are in the ISO 20022 Payments Design
(`industry/iso20022-payments-design`). Swift deferred the end of fully unstructured postal
addresses in CBPR+ (first set for 2026-11-14) on 2026-08-27; check the current Swift CBPR+ usage guidelines for
the new date before planning the switch.

| Element (pacs.008 path, abbreviated) | Content | Screened against |
|---|---|---|
| `Dbtr/Nm`, `Dbtr/PstlAdr`, `Dbtr/Id` | Debtor name, address, identifiers (for example LEI) | Names, countries, cities, identifier lists |
| `UltmtDbtr`, `UltmtCdtr` | Ultimate parties | Names, countries |
| `Cdtr/Nm`, `Cdtr/PstlAdr` | Creditor name, address | Names, countries, cities |
| `DbtrAgt`, `CdtrAgt`, `IntrmyAgt1..3`, `InstgAgt`, `InstdAgt` | Agents by BIC and name | Designated bank BICs and names |
| `RmtInf/Ustrd`, `Purp`, `InstrForCdtrAgt` | Free text, purpose | Names, goods and port keywords |

In euro instant credit transfers, Article 5d of Regulation (EU) No 260/2012 lets a payment
service provider rely on screening its own customers at least daily (and immediately after
a new designation) instead of screening each instant payment. Fernhollow Bank applies
customer-based screening for SEPA Instant and keeps transaction screening for all other
instant schemes. Confirm the dates that apply in your Member State.

### 5.3 Trade finance, securities and other products

Screen all parties named in letters of credit, collections and guarantees, including
shipping companies, vessels by IMO number, ports and goods. For securities, screen issuers
against sectoral lists, and screen custody holdings whenever a list changes. For loans,
screen guarantors and collateral providers. Record products that are out of scope and the
reason.

## 6. Matching configuration and calibration

<!-- Guidance: Explain how the engine matches and why each setting is where it is. EBA/GL/2024/15 asks for documented calibration that is neither too sensitive nor blind. Pitfall: one global threshold for every list and every field. -->

### 6.1 Matching techniques

The screening engine combines exact matching for identifiers (BIC, IMO number, passport
number), fuzzy name matching for names and addresses, and keyword matching for free text.
Fuzzy matching should handle spelling variation, transliteration, phonetic similarity,
missing or extra name parts, swapped word order, initials, honorifics and joined or split
words. Country and city names need alias tables (for example local-language spellings)
because a program name hidden in an alternative spelling is a well-documented root cause
in OFAC enforcement actions.

### 6.2 Threshold settings (examples)

Scores below are percentages on the engine's own scale. They are illustrative starting
points, not recommended values; each must be set from your testing in section 12.

| Setting ID | List and field | Algorithm | Alert threshold | Rationale |
|---|---|---|---|---|
| SAN-CAL-001 *(Example)* | EU, UN, national, OFAC SDN: individual names | Fuzzy, phonetic and token reordering | 85% | Highest exposure; testing found 100% detection of test variants at 85% |
| SAN-CAL-002 *(Example)* | Same lists: entity names | Fuzzy with noise-word removal (Ltd, LLC, GmbH) | 88% | Fewer variants in entity names |
| SAN-CAL-003 *(Example)* | Sanctioned country and city aliases | Exact and alias table | Exact | Alias list maintained by Sanctions team |
| SAN-CAL-004 *(Example)* | BIC of designated banks | Exact, 8 and 11 characters | Exact | Identifier match |
| SAN-CAL-005 *(Example)* | Remittance free text | Keyword and fuzzy | 90% | Free text produces noise; keyword list covers ports and goods |
| SAN-CAL-006 *(Example)* | OFAC sectoral lists in securities screening | Fuzzy | 90% | Lower volume, issuer names stable |

### 6.3 Calibration method

Calibrate before a new engine goes live, after any material change to lists, data or
algorithm, and at least annually. Build a test file from real list entries with controlled
variations (typos, dropped names, transliteration, reordered tokens, abbreviations, added
noise), run it at several thresholds and record the detection rate and the false positive
volume on a copy of production data. Set the threshold no higher than the highest value
that still detects every test variant judged material. If the alert volume at that
threshold exceeds review capacity, add reviewers or improve data quality and secondary
identifiers (date of birth, nationality, registration number); do not raise the threshold
above the detection limit to save effort. Record the decision, the test results and the
approval in the calibration log.

### 6.4 Change control

Every change to a threshold, rule, good-guy list logic or field mapping needs a ticket, a
test result, and approval by the Head of Sanctions. Emergency changes are allowed only to
make screening stricter. Keep the before and after configuration so that an examiner can
reconstruct the settings in force on any date.

## 7. Alert handling and escalation

<!-- Guidance: Describe the steps from alert to decision, with service levels and the evidence each step needs. Pitfall: closing an alert because the payment is small, or because the customer is long-standing. -->

```mermaid
flowchart TD
  A[Alert generated] --> B[Level 1 review]
  B --> C{Clear false positive with evidence?}
  C -- Yes --> D[Close with reason code and evidence]
  C -- No --> E[Level 2 review by Sanctions]
  E --> F{Decision}
  F -- False positive --> D
  F -- Possible match, insufficient data --> G[Request information, keep payment held]
  G --> E
  F -- True match --> H[Block, freeze or reject]
  H --> I[Report to authority and inform MLRO]
  F -- Circumvention concern --> J[Escalate to Head of Sanctions and MLRO]
  J --> H
  J --> K[Release with documented rationale]
```

Level 1 reviewers compare the alert against the listed entry using the secondary
identifiers available: date of birth, nationality, address, registration number and the
counterparty's business. They close an alert only when the evidence clearly shows a
different person, and they record which identifiers differ. Anything else goes to level 2.
Level 2 reviewers may request information from the customer or the remitting bank, but
they must not tell the customer which list or which person caused the hold. A payment
stays held while information is requested; it is never released on a promise to send
documents later.

When a match remains unresolved after due diligence, the payment is not executed and the
case goes to the Head of Sanctions, who may consult the national competent authority.
Higher-exposure situations (for example any alert involving a sanctioned jurisdiction)
need two people to agree before release.

| Step ID | Step | Owner | Service level *(Example)* | Evidence |
|---|---|---|---|---|
| SAN-ALR-001 | Level 1 review of payment alert | Payments Operations analyst | 2 business hours | Identifiers compared, reason code |
| SAN-ALR-002 | Level 1 review of customer alert | Sanctions analyst | 1 business day | Same |
| SAN-ALR-003 | Level 2 review | Senior sanctions analyst | 4 business hours for payments | Research notes, sources |
| SAN-ALR-004 | Four-eyes release for higher exposure | Two level 2 reviewers | Same day | Both approvals |
| SAN-ALR-005 | True match decision | Head of Sanctions | Immediately | Decision record |
| SAN-ALR-006 | Escalation to MLRO for suspicion | Head of Sanctions | Same day | Referral |

Reason codes are limited to a controlled list: different date of birth, different
nationality, different entity type, different registration, good-guy list, list entry
delisted, and true match. "Customer known to us" is not a reason code.

## 8. Ownership and control checks

<!-- Guidance: Screening names does not find entities owned or controlled by a designated person. Describe how you find them and which test each regime uses. Pitfall: applying the OFAC aggregation rule to EU or UK decisions, or the reverse. -->

An entity that is not listed can still be subject to an asset freeze because a designated
person owns or controls it. Use beneficial ownership data, corporate registers and
commercial ownership data to identify such entities, and document the analysis in the
customer file. The detailed tests and a worked example sit in the exposure assessment
(`compliance/sanctions-exposure-assessment`, section 9).

| Regime | Ownership test | Aggregation | Control |
|---|---|---|---|
| US (OFAC 50 Percent Rule, revised guidance 2014-08-13) | Owned 50% or more, directly or indirectly, by one or more blocked persons | Holdings of different blocked persons are added together | Control alone does not block under the rule; OFAC advises caution and may designate controlled entities |
| EU (Council best practices, doc. 11623/24, and regime regulations) | More than 50% of proprietary rights or a majority interest | Check the current best practices text and national authority guidance | Control criteria apply (for example power to appoint most board members, dominant influence) |
| UK (OFSI general guidance, section 4) | More than 50% of shares or voting rights, directly or indirectly | Not aggregated unless the designated persons hold under a joint arrangement or one controls the other's rights (OFSI general guidance 4.1.3 to 4.1.4) | Power to appoint or remove most of the board, or reasonable expectation that affairs follow the designated person's wishes |

## 9. True matches: blocking, freezing, rejecting and reporting

<!-- Guidance: Spell out, regime by regime, what happens to the money and who is told by when. Pitfall: returning funds to the remitter when the law requires them to be frozen. -->

When a true match is confirmed, act at once. Under EU and UK asset freezes, the
institution freezes the funds and does not make funds available to the designated person.
Under OFAC programmes, property of a blocked person that comes within US jurisdiction is
blocked and placed in a blocked, interest-bearing account where required, while
transactions that are prohibited but involve no blocked property interest are rejected.
Never return funds to the originator unless the applicable law or a licence allows it.

| Regime | Action | Report to | Deadline | Reference |
|---|---|---|---|---|
| EU | Freeze; suspend the transfer | National competent authority of the Member State | Without delay, as set by the regime regulation and national law | Regime regulation reporting article; EBA/GL/2024/15 Section 4.3 |
| US | Block and hold, or reject | OFAC via the OFAC Reporting System | Within 10 business days of blocking or rejecting; annual report of blocked property held as of 30 June, due by 30 September | 31 CFR 501.603 and 501.604 |
| UK | Freeze | OFSI | As soon as practicable after knowledge or reasonable suspicion; annual frozen asset review: holdings at 30 September reported by 30 November | OFSI general guidance sections 5.1.1 and 5.8 |
| [Member State] | [Action] | [Authority] | [Deadline] | [Law] |

A sanctions match is not by itself a suspicion of money laundering, but circumvention
attempts, false documents or structuring around the filter often are. The Head of
Sanctions informs the MLRO of every true match and every circumvention concern, and the
MLRO decides on a suspicious activity or transaction report
(`compliance/sar-str-narrative`). Tipping-off rules apply to that report even when the
sanctions report itself is not confidential.

| Case ID | Date | Regime | Action | Amount (EUR) | Report reference | Reported on |
|---|---|---|---|---|---|---|
| SAN-CASE-2026-007 *(Example)* | 2026-09-14 | EU | Frozen incoming credit for an EU-listed entity | 48,250.00 | [NCA reference] | 2026-09-14 |
| SAN-CASE-2026-008 *(Example)* | 2026-09-22 | US (New York branch) | Rejected USD payment for goods routed to a comprehensively sanctioned jurisdiction (no blocked property interest) | 120,000.00 | [OFAC report ID] | 2026-10-02 |

## 10. Licences, exemptions and delisting

<!-- Guidance: Explain how frozen funds may be released or used. Pitfall: acting on a customer's copy of a licence without verifying it with the issuing authority. -->

Frozen or blocked funds may only be released or used under a licence, authorisation or
general exemption issued by the competent authority, or after a delisting. The Sanctions
team verifies every licence with the issuing authority, records its scope, conditions and
expiry, and sets a reminder before expiry. A specific licence covers only the acts it
names. When a person is delisted, confirm the delisting in the official publication,
update the lists, remove good-guy entries that referenced the entry, and release funds
only after legal review of any remaining designation under another regime.

| Licence ID | Regime | Type | Scope | Verified with authority | Expiry |
|---|---|---|---|---|---|
| SAN-LIC-001 *(Example)* | EU | Specific authorisation for payment of basic needs from frozen account | Monthly EUR 2,000 for rent and utilities | YYYY-MM-DD | YYYY-MM-DD |
| SAN-LIC-002 *(Example)* | US | OFAC general licence | Wind-down of transactions with a newly listed entity | YYYY-MM-DD | YYYY-MM-DD |

## 11. Breaches, root causes and disclosure

<!-- Guidance: Treat every missed match as a potential breach. Record root cause and remediation. Pitfall: fixing the payment but not the cause. -->

A potential breach is any case where funds or services may have reached a designated
person, a freeze was applied late, or a sectoral restriction was not respected. The Head
of Sanctions opens a breach record the same day, informs the senior staff member and
Legal, and decides with Legal whether to notify the authority. In the EU, violations of
restrictive measures are criminal offences under national laws transposing Directive (EU)
2024/1226. For US matters, OFAC weighs a voluntary self-disclosure and an effective
compliance programme as mitigating factors under its Economic Sanctions Enforcement
Guidelines. In the UK, OFSI expects prompt voluntary disclosure.

Use the root cause categories that OFAC drew from past enforcement actions as a checklist:
no formal programme; misreading which regulations apply; facilitating by non-US persons or
affiliates; re-exporting US-origin goods; using the US financial system for sanctioned
business; screening software or filter faults; inadequate due diligence on customers and
ownership; decentralised and inconsistent compliance; non-standard payment or commercial
practices; and individual liability. Name the cause in each breach record so trends show
up in management information.

| Breach ID | Date found | Description | Root cause category | Remediation | Owner | Due |
|---|---|---|---|---|---|---|
| SAN-BR-2026-001 *(Example)* | 2026-07-03 | Customer rescreen after a list update ran 26 hours late | Screening software or filter faults | Monitoring of feed latency with paging; weekly reconciliation | [@payments-ops] | 2026-08-31 |

## 12. Testing, quality assurance and tuning

<!-- Guidance: OFAC lists testing and auditing as its fourth component; New York Part 504 requires end-to-end pre- and post-implementation testing of the filtering programme; EBA/GL/2024/15 asks for at least an annual review of the screening system. Pitfall: testing only the engine, not the data feeding it. -->

Testing has four layers. First, list testing confirms that each list loaded completely and
on time. Second, matching testing runs the controlled-variation file from section 6.3
against each list and field. Third, data testing confirms that every source system sends
complete fields to the engine (no truncated names, no dropped intermediary agents) using
reconciliations between source and engine counts. Fourth, quality assurance re-reviews a
sample of closed alerts each month to check decisions and evidence.

Internal Audit or an independent party tests the whole programme at least annually as part
of the AML independent test (`compliance/aml-independent-test-report`). For the New York
branch, filtering programme documentation and test evidence support the annual Part 504
compliance finding due by 15 April.

| Test ID | Test | Frequency | Pass criterion *(Example)* | Last result |
|---|---|---|---|---|
| SAN-TST-001 | List completeness and latency | Every update | Counts match official source; load within target | [Result] |
| SAN-TST-002 | Matching effectiveness (controlled variations) | Quarterly and after change | 100% of material variants alerted | [Result] |
| SAN-TST-003 | Data integrity source to engine | Monthly | No unexplained difference in counts or field fill rates | [Result] |
| SAN-TST-004 | Alert QA sample | Monthly, 5% of closed alerts, minimum 50 | Error rate below 2%, no wrong closure of a true match | [Result] |
| SAN-TST-005 | Annual screening system review | Annual | Findings tracked to closure | [Result] |

## 13. Training

<!-- Guidance: Train by role and record completion. EBA/GL/2024/14 expects training on applicable measures, the outcome of the exposure assessment and the procedures. Pitfall: one generic e-learning module for everyone. -->

All staff complete annual sanctions awareness training covering what sanctions are, why
stripping or altering payment data is prohibited, and how to escalate. Analysts receive
role training on the engine, the matching logic, research techniques and the reporting
process, and refresher sessions after every major new regime or package. Relationship
managers in high-exposure segments receive training on circumvention red flags such as
sudden changes of trade routes, newly incorporated intermediaries and goods that do not
fit the customer's business. Keep attendance, test scores and content versions.

## 14. Record keeping

<!-- Guidance: Keep enough to reconstruct every decision. Pitfall: keeping alert outcomes but not the list version and threshold in force at the time. -->

Retain for every alert: the alert, the list entry and list version, the configuration in
force, the analyst's research and decision, and any approval. Retain licences, reports and
correspondence with authorities. Retention periods (as of 2026-10, check local law):

| Regime | Retention | Reference |
|---|---|---|
| US (OFAC) | 10 years for records of transactions subject to OFAC regulations (extended from five years; interim final rule effective 2025-03-12, finalised 2025-03-21) | 31 CFR 501.601 |
| EU AML framework | 5 years after the end of the relationship or the occasional transaction under current national law; AMLR Article 77 from 2027-07-10 (5 years, extendable by up to 5 more) | Directive (EU) 2015/849 as transposed; Regulation (EU) 2024/1624; record of screening decisions under EBA/GL/2024/15 Section 4.4 |
| [Member State] | [Period] | [Law] |

Apply the longest period that applies to a record, and make sure deletion schedules do not
remove sanctions evidence early.

## 15. Management information

<!-- Guidance: Report numbers that show effectiveness, not just volume. Pitfall: reporting alert counts without false positive rate, backlog or list latency. -->

The Head of Sanctions reports monthly to the compliance committee and quarterly to the
management body.

| Metric ID | Metric | Target *(Example)* | Sep 2026 *(Example)* |
|---|---|---|---|
| SAN-MI-001 | Payment alerts generated | Trend only | 14,820 |
| SAN-MI-002 | Payment alerts closed within service level | 98% or more | 98.6% |
| SAN-MI-003 | True matches (all regimes) | Trend only | 3 |
| SAN-MI-004 | Maximum list load latency (hours) | 2 or less | 1.4 |
| SAN-MI-005 | Alert QA error rate | Below 2% | 1.2% |
| SAN-MI-006 | Open breach remediation actions past due | 0 | 0 |

## 16. Traceability matrix

<!-- Guidance: Map each requirement to the section and the evidence an examiner would ask for. -->

| Requirement | Source | Section | Evidence |
|---|---|---|---|
| Management commitment and resources | OFAC Framework component 1; EBA/GL/2024/14 Section 4.1 | 2 | Approval minutes, resourcing plan |
| Risk or exposure assessment | OFAC Framework component 2; EBA/GL/2024/14 Section 4.2 | 3 | Exposure assessment |
| Internal controls: lists, screening, calibration, alerts | OFAC Framework component 3; EBA/GL/2024/15 Sections 4.1 and 4.2 | 4 to 8 | Configuration, calibration log, alert records |
| Freezing and reporting | Regime regulations; 31 CFR 501.603 and 501.604; OFSI guidance | 9 | Reports, case log |
| Testing and auditing | OFAC Framework component 4; 3 NYCRR 504.3(b); EBA/GL/2024/15 Section 4.4 | 12 | Test results, audit report |
| Training | OFAC Framework component 5; EBA/GL/2024/14 Section 4.4 | 13 | Training records |
| Record keeping | 31 CFR 501.601; national AML law | 14 | Retention schedule |

## 17. Glossary and references

<!-- Guidance: Define terms used differently across regimes. -->

| Term | Meaning in this procedure |
|---|---|
| Designated person | A person, entity or body listed under a sanctions regime for an asset freeze |
| Freeze (EU, UK) / Block (US) | Prevent any movement, transfer or use of funds or economic resources |
| Reject | Refuse to process a prohibited transaction that involves no blocked property interest (US) |
| Sectoral measure | A restriction on a type of activity (finance, trade, services) rather than a named person |
| Fuzzy matching | Matching that tolerates differences in spelling, order or sound |
| Good-guy list | Documented list of customers confirmed not to be a specific list entry |
| Circumvention | Activity designed to avoid a restrictive measure, for example through intermediaries |
| True match | A screened party confirmed to be the designated person or a person owned or controlled by one |

References:

- OFAC, A Framework for OFAC Compliance Commitments (May 2019), ofac.treasury.gov.
- 31 CFR Part 501, Reporting, Procedures and Penalties Regulations, including Appendix A Economic Sanctions Enforcement Guidelines, ecfr.gov.
- OFAC, Revised Guidance on Entities Owned by Persons Whose Property and Interests in Property Are Blocked (2014-08-13).
- EBA, Guidelines EBA/GL/2024/14 and EBA/GL/2024/15, final report 2024-11-14, apply from 2025-12-30, eba.europa.eu.
- Council of the EU, Update of the EU Best Practices for the effective implementation of restrictive measures (doc. 11623/24, July 2024).
- Directive (EU) 2024/1226; Regulation (EU) 2023/1113; Regulation (EU) No 260/2012 as amended by Regulation (EU) 2024/886; EU regime regulations cited in section 1.2, eur-lex.europa.eu.
- HM Treasury OFSI, UK financial sanctions general guidance (updated 2026-05-12), gov.uk; UK Sanctions List, gov.uk.
- New York 3 NYCRR Part 504, Banking Division Transaction Monitoring and Filtering Program Requirements and Certifications.
- FATF Recommendations 6 and 7 (names only).

## Standard and licence note

Based on the OFAC Framework for OFAC Compliance Commitments (May 2019) and 31 CFR Part 501
(US government works, public domain), the EBA Guidelines EBA/GL/2024/14 and EBA/GL/2024/15
(reproduction authorised with acknowledgement of the EBA as source), EU regulations and
directives published on EUR-Lex (reuse under Commission Decision 2011/833/EU), and HM
Treasury OFSI guidance and the UK Sanctions List page (contains public sector information
licensed under the Open Government Licence v3.0). New York 3 NYCRR Part 504 and FATF
Recommendations are cited by number only. The text, structure, examples and thresholds are
original; no guideline or regulatory text is reproduced. Fernhollow Bank and all figures
are fictional. Check the current official version of each source, the EU Sanctions Map and
the national competent authority's guidance before use. Template licence: MIT.