# Sanctions Exposure Assessment: [Institution name], [Assessment year]

> Restrictive measures exposure assessment that identifies which
> sanctions regimes apply, how likely the institution is to fail to
> implement them or to be used to circumvent them, and what the impact
> would be, across geography, customers, products and services, and
> delivery channels, including exposure through ownership and control.
> It follows Section 4.2 of the EBA Guidelines EBA/GL/2024/14 (apply
> from 2025-12-30) and the risk assessment component of the OFAC "A
> Framework for OFAC Compliance Commitments" (May 2019), and compares
> the OFAC 50 Percent Rule with the EU and UK ownership and control
> tests. Replace every `[bracketed]` value and every row marked
> *Example*. Obtain the guidelines and regulations for the normative
> text and check the consolidated versions. This is a document format,
> not legal, compliance or financial advice.

<!--
Guidance: How to use this template
- Do the assessment before you set screening scope and thresholds in
  the Sanctions Compliance Procedure
  (`compliance/sanctions-compliance-procedure`), and refresh it at
  least once a year and after any trigger in section 14.
- Use your own data: customer counts, payment flows by country and
  currency, products and channels. A narrative without numbers cannot
  show whether controls are proportionate.
- Keep sanctions exposure separate from, but consistent with, the AML
  business-wide risk assessment (`compliance/aml-business-risk-assessment`).
  From 2027-07-10 Article 10 of the AMLR (Regulation (EU) 2024/1624)
  also brings the risk of non-implementation and evasion of targeted
  financial sanctions into the AML business-wide assessment.
- The worked example uses "Fernhollow Bank", a fictional mid-sized EU
  credit institution with a New York state-licensed branch. Every name,
  entity, person and figure is fictional.
-->

## Document control

<!-- Guidance: Record the assessment period, the data cut-off date and who approved the result. A group parent coordinates subsidiaries under a common methodology (EBA/GL/2024/14 Section 4.2). -->

| Field | Value |
|---|---|
| Document ID | [SAN-EXP-2026] |
| Institution | [Legal name], [LEI] |
| Scope (entities, branches) | [List] |
| Assessment period | [YYYY-MM-DD to YYYY-MM-DD] |
| Data cut-off date | YYYY-MM-DD |
| Version | [1.0] |
| Status | [Draft / In review / Approved / Superseded] |
| Owner | [@head-of-sanctions] |
| Approvers/reviewers | [@senior-staff-member-restrictive-measures], [@management-body], [@mlro], [@cro], [@internal-audit] |
| Methodology version | [SAN-EXP-METH-1.0] |
| Last updated | YYYY-MM-DD |
| Next scheduled review | YYYY-MM-DD |
| Classification | [Confidential] |

### Approvals

| Role | Name | Decision | Date |
|---|---|---|---|
| Senior staff member in charge of restrictive measures | [@name] | [Approve / Approve with conditions / Reject] | YYYY-MM-DD |
| Management body (management function) | [@name] | [Decision] | YYYY-MM-DD |
| MLRO | [@name] | [Consulted / Agreed] | YYYY-MM-DD |
| Chief Risk Officer | [@name] | [Consulted / Agreed] | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change |
|---|---|---|---|
| 0.1 | YYYY-MM-DD | [@name] | First draft |
| 1.0 | YYYY-MM-DD | [@name] | *Example:* First assessment under EBA/GL/2024/14, approved by the management body |

## Contents

- [1. Purpose, scope and basis](#1-purpose-scope-and-basis)
- [2. Methodology](#2-methodology)
- [3. Information sources](#3-information-sources)
- [4. Applicable regimes](#4-applicable-regimes)
- [5. Geographic exposure](#5-geographic-exposure)
- [6. Customer exposure](#6-customer-exposure)
- [7. Product and service exposure](#7-product-and-service-exposure)
- [8. Delivery channel exposure](#8-delivery-channel-exposure)
- [9. Ownership and control exposure](#9-ownership-and-control-exposure)
- [10. Circumvention typologies](#10-circumvention-typologies)
- [11. Control assessment](#11-control-assessment)
- [12. Residual exposure and appetite](#12-residual-exposure-and-appetite)
- [13. Action plan](#13-action-plan)
- [14. Review triggers and refresh](#14-review-triggers-and-refresh)
- [15. Glossary and references](#15-glossary-and-references)
- [Standard and licence note](#standard-and-licence-note)

## 1. Purpose, scope and basis

<!-- Guidance: Say what decisions this assessment informs. Pitfall: an assessment that rates risk but never says which controls should change. -->

The assessment tells the management body where [Institution name] is
exposed to sanctions and how well its controls cover that exposure.
It informs the screening scope, list choices, matching calibration,
due diligence depth, staffing of the alert teams and training. It does
not replace the legal duty to freeze funds and not make them
available: that duty applies to every person subject to the regime
regardless of the rating in this document.

EBA/GL/2024/14 asks institutions to understand how far each business
area is exposed to restrictive measures and vulnerable to their
circumvention, considering which regimes apply, the likelihood of
non-implementation, the likelihood of circumvention, the impact of a
breach, and geographic, customer, product and service, and delivery
channel factors. OFAC recommends a routine and, where appropriate,
ongoing assessment of customers, supply chain, intermediaries and
counterparties, products and services, and geographic locations. This
template follows both structures.

The scope covers all legal entities and branches of [Institution
name]. For Fernhollow Bank this is the head office and domestic
network, the New York branch, the trade finance unit and the custody
business. A group parent should ensure each subsidiary performs its
own assessment on a common methodology while reflecting local
features, and should consolidate the results here.

## 2. Methodology

<!-- Guidance: Define the scales so another assessor reaches the same rating. Pitfall: ratings without stated criteria. -->

Each exposure is scored for likelihood (of non-implementation or
circumvention, whichever is higher) and impact on a four-point scale.
The inherent score is their product. Control effectiveness is then
rated and applied as a factor to reach the residual score.

$$
\text{Inherent} = L \times I, \qquad \text{Residual} = \text{Inherent} \times F_{\text{control}}
$$

| Score | Likelihood (L) | Impact (I) |
|---|---|---|
| 1 | Remote: no meaningful links to targeted countries, sectors or persons | Minor: no breach possible beyond a short delay |
| 2 | Possible: occasional indirect links | Moderate: isolated breach of low value, quickly remedied |
| 3 | Likely: regular links or known circumvention route | Major: breach likely to be reportable and to attract enforcement |
| 4 | Almost certain: frequent direct links or active typologies | Severe: systemic breach, criminal exposure, loss of correspondent access |

| Control rating | Factor F *(Example)* | Meaning |
|---|---|---|
| Strong | 0.4 | Designed for the exposure, tested in the last 12 months with no material finding |
| Adequate | 0.7 | Designed for the exposure, minor findings open |
| Weak | 1.0 | Missing, untested or with material findings |

Rating bands for inherent and residual scores: Low below 5, Medium 5 to
below 9, High 9 to below 13, Very high 13 and above. The factors are
an illustration of a simple, transparent method; calibrate them to your
own testing results and document any change.

## 3. Information sources

<!-- Guidance: Show the evidence base. EBA/GL/2024/14 lists customer due diligence data, information from authorities and FIUs, reliable open and commercial sources, and analysis of past alerts. Pitfall: ignoring your own alert history. -->

Use a range of sources and date each one. The most informative source
is usually the institution's own data: where true matches and
near-misses occurred, which customers trade with high-risk
jurisdictions, and which payment routes carry the most volume.

| Source ID | Source | Date | Use |
|---|---|---|---|
| SRC-001 *(Example)* | Customer due diligence data: nationality, residence, incorporation, beneficial owners, sector codes | Cut-off 2026-09-30 | Customer exposure |
| SRC-002 *(Example)* | Payment data: 12 months of cross-border flows by country, currency and corridor | 2025-10-01 to 2026-09-30 | Geographic and channel exposure |
| SRC-003 *(Example)* | Alert history: 168,400 payment alerts, 31 true matches, 4 circumvention referrals | 12 months | Where true positives occur |
| SRC-004 *(Example)* | Authority publications: competent authority circulars, FIU typology reports, OFAC and OFSI advisories | Various | Typologies |
| SRC-005 *(Example)* | Commercial risk data: ownership databases, vessel tracking, country risk scores | 2026-09 | Ownership and trade exposure |
| SRC-006 *(Example)* | Reputable media reports | Rolling | Emerging risks |

Consider whether retroactive screening of customers or past payments
is proportionate. EBA/GL/2024/14 suggests it may be, for example, when
the institution has reason to believe an earlier screening system was
inadequate.

## 4. Applicable regimes

<!-- Guidance: Decide which regimes apply and through which nexus. Pitfall: forgetting regimes that apply through currency, US-origin goods or staff nationality. -->

| Regime | Nexus for [Institution name] | Applies to | Notes |
|---|---|---|---|
| EU restrictive measures | *Example:* Incorporated in an EU Member State | All entities and branches | Includes EU parent best-efforts duty for non-EU subsidiaries under Article 8a of Council Regulation (EU) No 833/2014; check current text |
| [Member State] national measures | *Example:* Head office jurisdiction | All | [Notes] |
| US OFAC | *Example:* New York branch is a US person; USD clearing; US-person staff | New York branch fully; head office for USD flows and US-nexus activity | Secondary sanctions risk assessed separately by Legal |
| UK | *Example:* GBP clearing through UK banks; London representative office | GBP flows, London office | UK Sanctions List is the sole UK source since 2026-01-28 |
| UN | Through EU and national law | All | Not applied directly |

## 5. Geographic exposure

<!-- Guidance: Quantify flows and relationships by country, including transit and circumvention-risk countries, not only comprehensively sanctioned ones. Pitfall: looking only at the direct counterparty country. -->

Consider where the institution operates, how exposed those places are
to sanctions or known as circumvention routes, and the origin and
destination of transactions. Include countries that border targeted
countries or act as trade hubs for goods that are restricted
elsewhere, because circumvention usually runs through third countries
rather than directly.

| Exposure ID | Country group | Customers (count) | Cross-border flows, 12 months (EUR m) | Share of flows | L | I | Inherent |
|---|---|---|---|---|---|---|---|
| EXP-GEO-001 *(Example)* | EU and EEA | 402,600 | 27,360 | 72.0% | 1 | 3 | 3 (Low) |
| EXP-GEO-002 *(Example)* | US, UK, other low-exposure third countries | 6,900 | 8,360 | 22.0% | 1 | 3 | 3 (Low) |
| EXP-GEO-003 *(Example)* | Countries identified as circumvention hubs for goods restricted under EU Russia and Belarus measures | 1,850 | 1,900 | 5.0% | 4 | 4 | 16 (Very high) |
| EXP-GEO-004 *(Example)* | Countries subject to comprehensive or near-comprehensive measures | 120 (legacy residents, frozen or restricted accounts) | 0 | 0.0% | 2 | 4 | 8 (Medium) |
| EXP-GEO-005 *(Example)* | Other higher-risk countries (conflict zones, weak controls) | 530 | 380 | 1.0% | 3 | 3 | 9 (High) |
| Total | | 412,000 | 38,000 | 100.0% | | | |

Customer counts here cover the 400,000 retail and 12,000 corporate
customers of the example (11,200 SME and commercial, 500 non-profit
organisations, trusts and other, and 300 financial institution
respondents); flows are the 12-month total of EUR 38,000
million in cross-border payments.

Rate a country group on the flows that actually pass through it, not on
its headline risk score. A small group of hub countries carrying 5% of
flows can be the largest exposure in the bank, while a long list of
higher-risk countries with almost no flows may need only standard
controls. Look at both directions: incoming payments from hub
countries can be proceeds of restricted exports, and outgoing payments
can fund purchases of restricted goods. Include the currency
dimension, because USD and GBP payments bring US and UK rules into
scope even when neither party is in those countries. For the example,
the New York branch carries 1.1 million USD payments a year, so every
geographic group is assessed against OFAC programmes as well as EU
measures.

## 6. Customer exposure

<!-- Guidance: Segment customers by links to targeted countries, ownership complexity and sector. Pitfall: treating all corporate customers as one segment. -->

Look at customers' and beneficial owners' links to targeted countries
or circumvention hubs, the number and complexity of customers
(especially where beneficial ownership is hard to establish), and the
activities they carry out, including sectors subject to sectoral
measures and the frequency and type of their transactions.

| Exposure ID | Segment | Count | Key drivers | L | I | Inherent |
|---|---|---|---|---|---|---|
| EXP-CUS-001 *(Example)* | Retail residents of the EU | 395,000 | Nationality and residence links to targeted countries in a small subset | 1 | 2 | 2 (Low) |
| EXP-CUS-002 *(Example)* | SME exporters and importers of goods listed as dual-use or common high-priority items | 640 | Trade with hub countries, new intermediaries, goods descriptions | 3 | 4 | 12 (High) |
| EXP-CUS-003 *(Example)* | Corporate customers with complex ownership (trusts, nominee holdings, offshore holding companies) | 1,100 | Hidden ownership or control by designated persons | 3 | 4 | 12 (High) |
| EXP-CUS-004 *(Example)* | Private banking clients with past links to targeted countries | 420 | Asset transfers to relatives, property and art | 2 | 4 | 8 (Medium) |
| EXP-CUS-005 *(Example)* | Shipping, logistics and commodity traders | 210 | Vessels, ports, ship-to-ship transfers, price cap evidence | 3 | 4 | 12 (High) |

Use data to size each segment rather than estimates. Sector codes,
nationality and residence fields, beneficial ownership records and
payment counterparties are usually enough to build a first cut; refine
it with relationship manager input for corporate customers whose
activity has changed. Watch for segments where data quality itself is
the exposure: if 15% of corporate files lack a verified beneficial
owner, the likelihood of failing to detect an owned or controlled
entity rises regardless of how good the screening engine is. Record
data gaps as findings in section 11 and link them to actions in
section 13.

## 7. Product and service exposure

<!-- Guidance: Assess what each product lets a customer do and how visible the parties are. Pitfall: forgetting custody and lending, where exposure arises without payments. -->

| Exposure ID | Product or service | Volume indicator | Key drivers | L | I | Inherent |
|---|---|---|---|---|---|---|
| EXP-PRD-001 *(Example)* | Trade finance (letters of credit, collections, guarantees) | EUR 1,450 m issued | Goods, vessels, ports, many parties, documents | 3 | 4 | 12 (High) |
| EXP-PRD-002 *(Example)* | SEPA Instant credit transfers | 21 m payments | Speed; customer-based screening under Article 5d of Regulation (EU) No 260/2012 | 2 | 3 | 6 (Medium) |
| EXP-PRD-003 *(Example)* | Securities custody | EUR 9,800 m assets | Issuers under sectoral lists, beneficial holders | 2 | 3 | 6 (Medium) |
| EXP-PRD-004 *(Example)* | USD correspondent payments (New York branch) | 1.1 m payments | US nexus, strict liability, nested flows | 3 | 4 | 12 (High) |
| EXP-PRD-005 *(Example)* | Corporate lending | EUR 6,200 m drawn | Borrower ownership changes, guarantors | 2 | 3 | 6 (Medium) |

Products create exposure in different ways. Payment products create
exposure at the moment funds move, so the control must work in real
time. Custody and lending create exposure through holdings and
ongoing relationships: a borrower can become owned by a designated
person after a share transfer, and a security can fall under a
sectoral ban when a new package is adopted. Assess each product for
how quickly a breach could occur, how visible the parties are, and
whether the product relies on documents (such as bills of lading)
that the bank cannot fully verify. Before launching a new product,
add a row here and rate it; the product approval committee should not
sign off without that rating.

## 8. Delivery channel exposure

<!-- Guidance: Consider intermediaries, agents, correspondents and digital channels that limit visibility or make you depend on others' screening. Pitfall: assuming a respondent bank's screening covers your obligations. -->

Channels matter when they reduce the institution's view of the real
parties, make it dependent on the screening of a third party, or bring
in geographic exposure through where the intermediary operates.

| Exposure ID | Channel | Key drivers | L | I | Inherent |
|---|---|---|---|---|---|
| EXP-CHN-001 *(Example)* | Correspondent banking (300 respondent banks), including nested relationships | Limited view of underlying customers; respondents in hub countries | 3 | 4 | 12 (High) |
| EXP-CHN-002 *(Example)* | Introducers and agents for SME onboarding | Dependence on third-party due diligence | 2 | 3 | 6 (Medium) |
| EXP-CHN-003 *(Example)* | Remote digital onboarding and online banking | Access from targeted countries through proxies | 3 | 2 | 6 (Medium) |
| EXP-CHN-004 *(Example)* | Outsourced screening vendor | List latency, configuration errors | 2 | 4 | 8 (Medium) |

Outsourcing a screening step does not move the obligation: the
institution stays responsible for every freeze and every payment it
executes. Treat vendors, introducers and respondent banks as channels
whose failures become your failures, and size the exposure by what
would happen if their control stopped working for a day. For
correspondent banking, the key question is visibility: can the bank
see the underlying originator and beneficiary, and does it screen the
full message, including intermediary agents and free text, rather than
relying on the respondent's assurance?

## 9. Ownership and control exposure

<!-- Guidance: Name screening alone does not find entities owned or controlled by designated persons. Apply each regime's own test and record the analysis. Pitfall: using one rule for all regimes. -->

### 9.1 Tests by regime (as of 2026-10, check current guidance)

| Aspect | US (OFAC) | EU | UK (OFSI) |
|---|---|---|---|
| Source | Revised guidance on entities owned by blocked persons (2014-08-13) and OFAC FAQs | Regime regulations and Council best practices for the effective implementation of restrictive measures (doc. 11623/24, July 2024) | UK financial sanctions general guidance, section 4 (updated 2026-05-12) |
| Ownership threshold | 50% or more | More than 50% of proprietary rights, or majority interest | More than 50% of shares or voting rights |
| Aggregation across designated persons | Yes, holdings of different blocked persons are added, across programmes | Check the best practices and the national authority; do not assume OFAC aggregation | No, unless held under a joint arrangement or one designated person controls the other's rights (OFSI general guidance 4.1.3 to 4.1.4) |
| Indirect ownership | Counts through entities that are themselves blocked | Counts through owned or controlled entities | Counts, directly or indirectly |
| Control | Not by itself a basis for blocking under the 50% rule; OFAC advises caution and may designate | Control criteria apply (for example right to appoint or remove most board members, control of voting rights, dominant influence) | Control test applies (power to appoint or remove most of the board, or reasonable expectation that affairs follow the designated person's wishes) |

EBA/GL/2024/15 asks payment service providers to apply the Council
criteria and the beneficial ownership criteria, use public registers,
and consider consulting the national competent authority when the
analysis stays inconclusive.

### 9.2 Worked example (fictional)

Two corporate customers of Fernhollow Bank were reviewed after a
designation round. The persons and companies are fictional.

```mermaid
flowchart TD
  A["Person A: listed EU, UK, US"] -- 35% --> T["Tarnmoor Freight Ltd"]
  B["Person B: listed US only"] -- 20% --> T
  A -- 60% --> V["Valemark Holdings"]
  V -- 45% --> T
  B -- 30% --> S["Brightwater Shipping BV"]
  C["Person C: listed EU, UK, US"] -- 25% --> S
  O["Unlisted investors"] -- 45% --> S
```

| Entity | US (OFAC) | EU | UK | Outcome |
|---|---|---|---|---|
| Valemark Holdings | Owned 60% by Person A: blocked | Owned more than 50% by Person A: frozen | Owned more than 50% by Person A: frozen | Freeze or block under all three regimes |
| Tarnmoor Freight Ltd | Blocked persons hold 35% + 20% + 45% (Valemark, blocked) = 100%: blocked | Person A holds 35% directly and 45% through Valemark, which A owns: 80%, more than 50%: frozen (confirm the indirect attribution with the competent authority) | Same attribution through Valemark: 80%: frozen | Freeze or block under all three regimes |
| Brightwater Shipping BV | Persons B and C hold 30% + 25% = 55%, aggregated: blocked | Only Person C is EU-listed: 25%, not owned; assess control (C is managing director, so control analysis needed) | Only Person C is UK-listed, 25%, no joint arrangement and no control over another holder's rights: not owned; assess control | Block at New York branch and for any USD activity; EU and UK decision depends on the control analysis, documented and escalated |

The Brightwater case shows why the regimes must be assessed
separately: the same facts block the entity under OFAC rules but may
leave it outside the EU and UK ownership tests, while the control
tests may still bring it in.

### 9.3 Exposure rating

| Exposure ID | Exposure | L | I | Inherent |
|---|---|---|---|---|
| EXP-OWN-001 *(Example)* | Corporate customers and counterparties owned or controlled by designated persons but not listed themselves | 3 | 4 | 12 (High) |

## 10. Circumvention typologies

<!-- Guidance: List the patterns relevant to your business, sourced from authority publications, in your own words. Pitfall: copying a generic list that ignores your products. -->

| Typology ID | Pattern | Where it would appear | Indicator for screening or monitoring |
|---|---|---|---|
| TYP-001 *(Example)* | Trade diversion through third countries | Trade finance, SME payments | Goods consistent with restricted lists shipped to hubs with no prior trade history |
| TYP-002 *(Example)* | Front companies and new intermediaries | Onboarding, payments | Recently incorporated entity, nominee directors, shared addresses with other customers |
| TYP-003 *(Example)* | Asset transfers to family members or associates shortly before or after designation | Private banking, custody | Transfers of securities or property to relatives, changes of beneficial owner |
| TYP-004 *(Example)* | Altered or incomplete payment data | Correspondent payments | Missing ultimate parties, generic remittance text, repeated repairs |
| TYP-005 *(Example)* | Shipping deception | Trade finance, commodity traders | Ship-to-ship transfers, gaps in vessel tracking, flag changes |
| TYP-006 *(Example)* | Access from targeted countries through proxies | Digital channels | Login IP addresses or devices linked to targeted countries |

Feed typologies that fit transaction patterns into the transaction
monitoring programme (`compliance/transaction-monitoring-scenario-spec`)
and those that depend on names or identifiers into screening lists.

## 11. Control assessment

<!-- Guidance: Rate the design and the tested operation of each control family against the exposures it covers. Pitfall: rating a control Strong because it exists, without test evidence. -->

| Control ID | Control family | Covers | Evidence | Rating |
|---|---|---|---|---|
| CTL-001 *(Example)* | Governance, senior staff member, management reporting | All | Approved procedure, MI packs | Strong |
| CTL-002 *(Example)* | Customer screening (onboarding, list-change and weekly rescreen) | EXP-GEO-001, 002, 004, EXP-CUS-001 to 005, EXP-PRD-002, EXP-PRD-005, EXP-CHN-003, EXP-OWN-001 | Test results 2026-Q2 | Adequate |
| CTL-003 *(Example)* | Payment screening including free text and agents | EXP-GEO-001 to 005, EXP-PRD-004, EXP-CHN-001 | Calibration test 2026-06 | Adequate |
| CTL-004 *(Example)* | Trade finance document checks (goods, vessels, ports) | EXP-PRD-001, EXP-CUS-005 | QA review: 3 of 40 files lacked vessel checks | Adequate |
| CTL-005 *(Example)* | Ownership and control analysis | EXP-OWN-001, EXP-CUS-003 | Manual process, no test yet | Weak |
| CTL-006 *(Example)* | Correspondent due diligence and nested flow review | EXP-CHN-001 | Annual reviews current | Adequate |
| CTL-007 *(Example)* | Introducer oversight | EXP-CHN-002 | No oversight testing in 24 months | Weak |
| CTL-008 *(Example)* | Vendor oversight and list latency monitoring | EXP-CHN-004 | Latency alerting live since 2026-08; first test scheduled 2027-Q1 | Adequate |
| CTL-009 *(Example)* | Custody holdings screening (issuers against sectoral lists, beneficial holders against asset-freeze lists) | EXP-PRD-003 | Monthly holdings run; QA sample 2026-Q1, one late review | Adequate |

Rate controls on evidence. A control rated Strong must have been
tested in the last 12 months, by Compliance testing, Internal Audit or
an independent reviewer, with no material finding open. Where a control
covers several exposures, it may be Strong for one and Adequate for
another: payment screening may perform well on name matching but miss
goods descriptions in free text, which matters for trade diversion and
not for retail flows. Keep the evidence reference so that a reviewer
can follow the rating back to a test report, a quality assurance sample
or an audit finding.

## 12. Residual exposure and appetite

<!-- Guidance: Show the arithmetic and compare each residual rating with the appetite. Pitfall: residual risk lower than inherent with no control evidence. -->

| Exposure ID | Inherent | Main control | Control rating (F) | Residual score | Residual band | Within appetite? |
|---|---|---|---|---|---|---|
| EXP-GEO-001 *(Example)* | 3 | CTL-002, CTL-003 | Adequate (0.7) | 2.1 | Low | Yes |
| EXP-GEO-002 *(Example)* | 3 | CTL-002, CTL-003 | Adequate (0.7) | 2.1 | Low | Yes |
| EXP-GEO-003 *(Example)* | 16 | CTL-003 | Adequate (0.7) | 11.2 | High | No |
| EXP-GEO-004 *(Example)* | 8 | CTL-002 | Adequate (0.7) | 5.6 | Medium | Yes, with monitoring |
| EXP-GEO-005 *(Example)* | 9 | CTL-003 | Adequate (0.7) | 6.3 | Medium | Yes, with monitoring |
| EXP-CUS-001 *(Example)* | 2 | CTL-002 | Adequate (0.7) | 1.4 | Low | Yes |
| EXP-CUS-002 *(Example)* | 12 | CTL-002, CTL-004 | Adequate (0.7) | 8.4 | Medium | Yes, with monitoring |
| EXP-CUS-003 *(Example)* | 12 | CTL-005 | Weak (1.0) | 12.0 | High | No |
| EXP-CUS-004 *(Example)* | 8 | CTL-002 | Adequate (0.7) | 5.6 | Medium | Yes, with monitoring |
| EXP-CUS-005 *(Example)* | 12 | CTL-004 | Adequate (0.7) | 8.4 | Medium | Yes, with monitoring |
| EXP-PRD-001 *(Example)* | 12 | CTL-004 | Adequate (0.7) | 8.4 | Medium | Yes, with monitoring |
| EXP-PRD-002 *(Example)* | 6 | CTL-002 | Adequate (0.7) | 4.2 | Low | Yes |
| EXP-PRD-003 *(Example)* | 6 | CTL-009 | Adequate (0.7) | 4.2 | Low | Yes |
| EXP-PRD-004 *(Example)* | 12 | CTL-003 | Adequate (0.7) | 8.4 | Medium | Yes, with monitoring |
| EXP-PRD-005 *(Example)* | 6 | CTL-002 | Adequate (0.7) | 4.2 | Low | Yes |
| EXP-CHN-001 *(Example)* | 12 | CTL-006 | Adequate (0.7) | 8.4 | Medium | Yes, with monitoring |
| EXP-CHN-002 *(Example)* | 6 | CTL-007 | Weak (1.0) | 6.0 | Medium | Yes, action required |
| EXP-CHN-003 *(Example)* | 6 | CTL-002 | Adequate (0.7) | 4.2 | Low | Yes |
| EXP-CHN-004 *(Example)* | 8 | CTL-008 | Adequate (0.7) | 5.6 | Medium | Yes, with monitoring |
| EXP-OWN-001 *(Example)* | 12 | CTL-005 | Weak (1.0) | 12.0 | High | No |

Appetite statement *(Example)*: Fernhollow Bank accepts no residual
exposure rated High or Very high. Exposures rated High require an
action plan approved by the senior staff member, with a target to
bring them to Medium within six months, and the management body is
informed each quarter until they are closed. The bank does not open
relationships with customers whose main business is with countries
under comprehensive measures, and it exits relationships where
ownership cannot be established.

Read the residual table together with the inherent ratings. A large
drop from inherent to residual should be backed by strong, tested
controls; if most of the reduction comes from controls rated Adequate,
the result depends on the factor chosen in section 2 and should be
challenged. Report to the management body the three or four exposures
that drive the overall picture, here hub-country flows, complex
ownership structures and the related weakness in ownership analysis,
rather than the full table. The residual profile of the example is 3
High, 10 Medium and 7 Low exposures. Only the governance control
(CTL-001) is rated Strong; every screening control is rated Adequate
until a test in the last 12 months supports a higher rating, which is
why no residual score in the table uses the 0.4 factor. The overall conclusion *(Example)*:
Fernhollow Bank's residual sanctions exposure is Medium overall, with
three High exposures (EXP-GEO-003, EXP-CUS-003, EXP-OWN-001) outside appetite that action items ACT-001 and
ACT-002 address by the first quarter of 2027.

## 13. Action plan

<!-- Guidance: Every residual exposure outside appetite needs a specific action, owner and date. Pitfall: actions like "enhance controls" with no measurable outcome. -->

| Action ID | Exposure | Action | Owner | Due | Success measure |
|---|---|---|---|---|---|
| ACT-001 *(Example)* | EXP-GEO-003 | Add goods keyword and port lists to payment free-text screening for hub corridors; require invoice and transport document for payments above EUR 50,000 in those corridors | [@head-of-sanctions] | 2027-01-31 | Calibration test passed; CTL-003 rated Strong |
| ACT-002 *(Example)* | EXP-CUS-003, EXP-OWN-001 | Introduce ownership data feed and a documented ownership and control analysis for all complex structures; test 60 files | [@kyc-head] | 2027-03-31 | CTL-005 rated Adequate or better |
| ACT-003 *(Example)* | EXP-CHN-002 | Annual introducer review with sample re-performance of 25 files per introducer | [@sme-onboarding] | 2027-02-28 | CTL-007 rated Adequate |

Track actions monthly in the sanctions management information and
close an action only when its success measure is evidenced. When an
action slips, record the reason and the interim mitigation, such as
manual review of all payments in the affected corridor until the new
screening rule is live. Feed completed actions back into section 11 so
that the next assessment rates the improved control on its test
result, not on the promise of the action.

## 14. Review triggers and refresh

<!-- Guidance: List the events that force an update outside the annual cycle. EBA/GL/2024/14 names new or changed measures, new products, channels, client groups or geographies, major business changes, and identified failures. -->

Review the assessment at least once a year. Update it, as needed,
when new restrictive measures are adopted or existing ones change
materially; before launching a product, channel, client group or
entering a new geography; after a significant change in activity,
customer base, organisation or business model; when a failure to
implement a measure or a circumvention case shows the assessment was
wrong; and when the institution or its supervisor finds a weakness in
the assessment. Document the methodology and outcome and keep them
available for the competent authority.

| Trigger ID | Date | Event | Sections updated | Approved by |
|---|---|---|---|---|
| TRG-001 *(Example)* | 2026-07-21 | New EU package extending sectoral measures | 4, 5, 10, 12 | [@name] |

## 15. Glossary and references

<!-- Guidance: Keep terms consistent with the Sanctions Compliance Procedure. -->

| Term | Meaning |
|---|---|
| Restrictive measures | EU term for sanctions adopted under Article 29 TEU and Article 215 TFEU |
| Exposure | The degree to which a business area could fail to implement, or be used to circumvent, a measure |
| Non-implementation | Failure to apply a freeze, prohibition or restriction that applies |
| Circumvention | Activity that intends or results in avoiding a measure |
| Inherent score | Likelihood times impact before controls |
| Residual score | Inherent score after applying the control factor |
| 50 Percent Rule | OFAC rule that entities owned 50% or more, in aggregate, by blocked persons are themselves blocked |

References:

- EBA, Guidelines EBA/GL/2024/14 on internal policies, procedures and controls to ensure the implementation of Union and national restrictive measures, Section 4.2; EBA/GL/2024/15, Section 4.2.3 (final report 2024-11-14, apply from 2025-12-30).
- OFAC, A Framework for OFAC Compliance Commitments (May 2019), risk assessment component and appendix on root causes.
- OFAC, Revised Guidance on Entities Owned by Persons Whose Property and Interests in Property Are Blocked (2014-08-13).
- Council of the EU, Update of the EU Best Practices for the effective implementation of restrictive measures (doc. 11623/24, July 2024).
- HM Treasury OFSI, UK financial sanctions general guidance (updated 2026-05-12).
- Council Regulation (EU) No 833/2014 (Article 8a); Regulation (EU) 2024/1624 (AMLR) Article 10, applies from 2027-07-10.
- Sanctions Compliance Procedure (`compliance/sanctions-compliance-procedure`); AML Business Risk Assessment (`compliance/aml-business-risk-assessment`); Risk Methodology (`compliance/risk-methodology`).

## Standard and licence note

Based on the EBA Guidelines EBA/GL/2024/14 and EBA/GL/2024/15
(reproduction authorised with acknowledgement of the EBA as source),
the OFAC Framework for OFAC Compliance Commitments and OFAC ownership
guidance (US government works, public domain), EU legislation on
EUR-Lex and Council documents (reuse with acknowledgement), and HM
Treasury OFSI guidance (contains public sector information licensed
under the Open Government Licence v3.0). The scoring method, structure,
typology wording and examples are original; no guideline text is
reproduced. Fernhollow Bank, the persons and companies in section 9
and all figures are fictional. Check the current official version of
each source and the competent authority's guidance before use.
Template licence: MIT.