Sanctions Exposure Assessment Template (EBA/GL/2024/14, OFAC 50% Rule)

Sanctions Exposure Assessment: [Institution name], [Assessment year]

Restrictive measures exposure assessment that identifies which sanctions regimes apply, how likely the institution is to fail to implement them or to be used to circumvent them, and what the impact would be, across geography, customers, products and services, and delivery channels, including exposure through ownership and control. It follows Section 4.2 of the EBA Guidelines EBA/GL/2024/14 (apply from 2025-12-30) and the risk assessment component of the OFAC "A Framework for OFAC Compliance Commitments" (May 2019), and compares the OFAC 50 Percent Rule with the EU and UK ownership and control tests. Replace every [bracketed] value and every row marked Example. Obtain the guidelines and regulations for the normative text and check the consolidated versions. This is a document format, not legal, compliance or financial advice.

Document control

Approvals

Revision history

Contents

• 1. Purpose, scope and basis
• 2. Methodology
• 3. Information sources
• 4. Applicable regimes
• 5. Geographic exposure
• 6. Customer exposure
• 7. Product and service exposure
• 8. Delivery channel exposure
• 9. Ownership and control exposure
• 10. Circumvention typologies
• 11. Control assessment
• 12. Residual exposure and appetite
• 13. Action plan
• 14. Review triggers and refresh
• 15. Glossary and references
• Standard and licence note

1. Purpose, scope and basis

The assessment tells the management body where [Institution name] is exposed to sanctions and how well its controls cover that exposure. It informs the screening scope, list choices, matching calibration, due diligence depth, staffing of the alert teams and training. It does not replace the legal duty to freeze funds and not make them available: that duty applies to every person subject to the regime regardless of the rating in this document.

EBA/GL/2024/14 asks institutions to understand how far each business area is exposed to restrictive measures and vulnerable to their circumvention, considering which regimes apply, the likelihood of non-implementation, the likelihood of circumvention, the impact of a breach, and geographic, customer, product and service, and delivery channel factors. OFAC recommends a routine and, where appropriate, ongoing assessment of customers, supply chain, intermediaries and counterparties, products and services, and geographic locations. This template follows both structures.

The scope covers all legal entities and branches of [Institution name]. For Fernhollow Bank this is the head office and domestic network, the New York branch, the trade finance unit and the custody business. A group parent should ensure each subsidiary performs its own assessment on a common methodology while reflecting local features, and should consolidate the results here.

2. Methodology

Each exposure is scored for likelihood (of non-implementation or circumvention, whichever is higher) and impact on a four-point scale. The inherent score is their product. Control effectiveness is then rated and applied as a factor to reach the residual score.

Rating bands for inherent and residual scores: Low below 5, Medium 5 to below 9, High 9 to below 13, Very high 13 and above. The factors are an illustration of a simple, transparent method; calibrate them to your own testing results and document any change.

3. Information sources

Use a range of sources and date each one. The most informative source is usually the institution's own data: where true matches and near-misses occurred, which customers trade with high-risk jurisdictions, and which payment routes carry the most volume.

Consider whether retroactive screening of customers or past payments is proportionate. EBA/GL/2024/14 suggests it may be, for example, when the institution has reason to believe an earlier screening system was inadequate.

4. Applicable regimes

5. Geographic exposure

Consider where the institution operates, how exposed those places are to sanctions or known as circumvention routes, and the origin and destination of transactions. Include countries that border targeted countries or act as trade hubs for goods that are restricted elsewhere, because circumvention usually runs through third countries rather than directly.

Customer counts here cover the 400,000 retail and 12,000 corporate customers of the example (11,200 SME and commercial, 500 non-profit organisations, trusts and other, and 300 financial institution respondents); flows are the 12-month total of EUR 38,000 million in cross-border payments.

Rate a country group on the flows that actually pass through it, not on its headline risk score. A small group of hub countries carrying 5% of flows can be the largest exposure in the bank, while a long list of higher-risk countries with almost no flows may need only standard controls. Look at both directions: incoming payments from hub countries can be proceeds of restricted exports, and outgoing payments can fund purchases of restricted goods. Include the currency dimension, because USD and GBP payments bring US and UK rules into scope even when neither party is in those countries. For the example, the New York branch carries 1.1 million USD payments a year, so every geographic group is assessed against OFAC programmes as well as EU measures.

6. Customer exposure

Look at customers' and beneficial owners' links to targeted countries or circumvention hubs, the number and complexity of customers (especially where beneficial ownership is hard to establish), and the activities they carry out, including sectors subject to sectoral measures and the frequency and type of their transactions.

Use data to size each segment rather than estimates. Sector codes, nationality and residence fields, beneficial ownership records and payment counterparties are usually enough to build a first cut; refine it with relationship manager input for corporate customers whose activity has changed. Watch for segments where data quality itself is the exposure: if 15% of corporate files lack a verified beneficial owner, the likelihood of failing to detect an owned or controlled entity rises regardless of how good the screening engine is. Record data gaps as findings in section 11 and link them to actions in section 13.

7. Product and service exposure

Products create exposure in different ways. Payment products create exposure at the moment funds move, so the control must work in real time. Custody and lending create exposure through holdings and ongoing relationships: a borrower can become owned by a designated person after a share transfer, and a security can fall under a sectoral ban when a new package is adopted. Assess each product for how quickly a breach could occur, how visible the parties are, and whether the product relies on documents (such as bills of lading) that the bank cannot fully verify. Before launching a new product, add a row here and rate it; the product approval committee should not sign off without that rating.

8. Delivery channel exposure

Channels matter when they reduce the institution's view of the real parties, make it dependent on the screening of a third party, or bring in geographic exposure through where the intermediary operates.

Outsourcing a screening step does not move the obligation: the institution stays responsible for every freeze and every payment it executes. Treat vendors, introducers and respondent banks as channels whose failures become your failures, and size the exposure by what would happen if their control stopped working for a day. For correspondent banking, the key question is visibility: can the bank see the underlying originator and beneficiary, and does it screen the full message, including intermediary agents and free text, rather than relying on the respondent's assurance?

9. Ownership and control exposure

9.1 Tests by regime (as of 2026-10, check current guidance)

EBA/GL/2024/15 asks payment service providers to apply the Council criteria and the beneficial ownership criteria, use public registers, and consider consulting the national competent authority when the analysis stays inconclusive.

9.2 Worked example (fictional)

Two corporate customers of Fernhollow Bank were reviewed after a designation round. The persons and companies are fictional.

The Brightwater case shows why the regimes must be assessed separately: the same facts block the entity under OFAC rules but may leave it outside the EU and UK ownership tests, while the control tests may still bring it in.

9.3 Exposure rating

10. Circumvention typologies

Feed typologies that fit transaction patterns into the transaction monitoring programme (compliance/transaction-monitoring-scenario-spec) and those that depend on names or identifiers into screening lists.

11. Control assessment

Rate controls on evidence. A control rated Strong must have been tested in the last 12 months, by Compliance testing, Internal Audit or an independent reviewer, with no material finding open. Where a control covers several exposures, it may be Strong for one and Adequate for another: payment screening may perform well on name matching but miss goods descriptions in free text, which matters for trade diversion and not for retail flows. Keep the evidence reference so that a reviewer can follow the rating back to a test report, a quality assurance sample or an audit finding.

12. Residual exposure and appetite

Appetite statement (Example): Fernhollow Bank accepts no residual exposure rated High or Very high. Exposures rated High require an action plan approved by the senior staff member, with a target to bring them to Medium within six months, and the management body is informed each quarter until they are closed. The bank does not open relationships with customers whose main business is with countries under comprehensive measures, and it exits relationships where ownership cannot be established.

Read the residual table together with the inherent ratings. A large drop from inherent to residual should be backed by strong, tested controls; if most of the reduction comes from controls rated Adequate, the result depends on the factor chosen in section 2 and should be challenged. Report to the management body the three or four exposures that drive the overall picture, here hub-country flows, complex ownership structures and the related weakness in ownership analysis, rather than the full table. The residual profile of the example is 3 High, 10 Medium and 7 Low exposures. Only the governance control (CTL-001) is rated Strong; every screening control is rated Adequate until a test in the last 12 months supports a higher rating, which is why no residual score in the table uses the 0.4 factor. The overall conclusion (Example): Fernhollow Bank's residual sanctions exposure is Medium overall, with three High exposures (EXP-GEO-003, EXP-CUS-003, EXP-OWN-001) outside appetite that action items ACT-001 and ACT-002 address by the first quarter of 2027.

13. Action plan

Track actions monthly in the sanctions management information and close an action only when its success measure is evidenced. When an action slips, record the reason and the interim mitigation, such as manual review of all payments in the affected corridor until the new screening rule is live. Feed completed actions back into section 11 so that the next assessment rates the improved control on its test result, not on the promise of the action.

14. Review triggers and refresh

Review the assessment at least once a year. Update it, as needed, when new restrictive measures are adopted or existing ones change materially; before launching a product, channel, client group or entering a new geography; after a significant change in activity, customer base, organisation or business model; when a failure to implement a measure or a circumvention case shows the assessment was wrong; and when the institution or its supervisor finds a weakness in the assessment. Document the methodology and outcome and keep them available for the competent authority.

15. Glossary and references

References:

• EBA, Guidelines EBA/GL/2024/14 on internal policies, procedures and controls to ensure the implementation of Union and national restrictive measures, Section 4.2; EBA/GL/2024/15, Section 4.2.3 (final report 2024-11-14, apply from 2025-12-30).
• OFAC, A Framework for OFAC Compliance Commitments (May 2019), risk assessment component and appendix on root causes.
• OFAC, Revised Guidance on Entities Owned by Persons Whose Property and Interests in Property Are Blocked (2014-08-13).
• Council of the EU, Update of the EU Best Practices for the effective implementation of restrictive measures (doc. 11623/24, July 2024).
• HM Treasury OFSI, UK financial sanctions general guidance (updated 2026-05-12).
• Council Regulation (EU) No 833/2014 (Article 8a); Regulation (EU) 2024/1624 (AMLR) Article 10, applies from 2027-07-10.
• Sanctions Compliance Procedure (compliance/sanctions-compliance-procedure); AML Business Risk Assessment (compliance/aml-business-risk-assessment); Risk Methodology (compliance/risk-methodology).

Standard and licence note

Based on the EBA Guidelines EBA/GL/2024/14 and EBA/GL/2024/15 (reproduction authorised with acknowledgement of the EBA as source), the OFAC Framework for OFAC Compliance Commitments and OFAC ownership guidance (US government works, public domain), EU legislation on EUR-Lex and Council documents (reuse with acknowledgement), and HM Treasury OFSI guidance (contains public sector information licensed under the Open Government Licence v3.0). The scoring method, structure, typology wording and examples are original; no guideline text is reproduced. Fernhollow Bank, the persons and companies in section 9 and all figures are fictional. Check the current official version of each source and the competent authority's guidance before use. Template licence: MIT.