US and EU Sanctions Programmes

Why This Topic Matters for the CAMS Exam

Sanctions compliance sits at the intersection of anti-money laundering, counter-terrorist financing and foreign policy. Unlike most AML obligations, which are risk-based, sanctions obligations are largely strict liability: a financial institution can be penalised for processing a prohibited transaction even if it had no knowledge or intent. This is why the CAMS exam places sanctions within the domain of Regulatory Regimes, Risk Assessments and Collaboration – a compliance professional must understand the legal architecture, the mechanics of screening and blocking, and how sanctions interact with the wider AML programme.

Sanctions penalties are among the largest ever imposed on financial institutions. BNP Paribas paid approximately USD 8.9 billion in 2014 largely for stripping information from wire transfers involving Sudan, Iran and Cuba. Standard Chartered, HSBC, Commerzbank, Société Générale and UniCredit have all paid substantial settlements. Beyond fines, sanctions breaches can lead to loss of US dollar clearing access, criminal prosecution of individuals, and severe reputational harm. For an AML professional, understanding sanctions is therefore not optional.

What Are Sanctions?

Sanctions are restrictive measures imposed by governments or international bodies to achieve foreign policy or national security objectives. They may target:
• Countries or governments (e.g., comprehensive programmes against Iran, North Korea, Cuba, Syria, and certain regions of Ukraine such as Crimea).
• Individuals and entities (terrorists, narcotics traffickers, proliferators of weapons of mass destruction, human rights abusers, corrupt officials, cyber actors).
• Sectors of an economy (e.g., restrictions on financing for Russian energy, defence and financial companies).
• Specific activities (e.g., trade in certain goods, dual-use items, luxury goods, or technology).

Sanctions are broadly categorised as:
• Comprehensive sanctions – prohibit virtually all transactions with a country, its government and its residents.
• Targeted (or smart) sanctions – aimed at specific persons, entities or sectors rather than an entire population, designed to minimise humanitarian impact.
• Sectoral sanctions – restrict specific types of dealings (such as new debt or equity beyond a certain maturity) with named entities in particular sectors.
• Secondary sanctions – a US concept that threatens non-US persons with penalties or exclusion from the US financial system for dealing with sanctioned targets, even where there is no US nexus.

The United Nations Framework

Although the question focuses on the US and EU, both build on the United Nations. Under Chapter VII of the UN Charter, the UN Security Council (UNSC) adopts resolutions imposing sanctions that are binding on all member states. UNSC Resolution 1267 (1999) and its successors established the Al-Qaida and Taliban (later ISIL/Da'esh and Al-Qaida) sanctions regime, and Resolution 1373 (2001) required states to criminalise terrorist financing and freeze terrorist assets without delay. FATF Recommendations 6 and 7 require countries to implement targeted financial sanctions related to terrorism and proliferation financing. The UN itself has no enforcement arm; member states must transpose UN measures into domestic law – the EU does so through Council Regulations and the US through OFAC programmes.

The US Sanctions Regime

Administering agency. The Office of Foreign Assets Control (OFAC), a division of the US Department of the Treasury, administers and enforces US economic and trade sanctions. OFAC derives its authority primarily from the International Emergency Economic Powers Act (IEEPA), the Trading with the Enemy Act (TWEA), and specific statutes such as the Iran Sanctions Act, the Countering America's Adversaries Through Sanctions Act (CAATSA) and the Global Magnitsky Act. Sanctions programmes are typically initiated by Presidential Executive Orders declaring a national emergency. The US State Department and Department of Commerce (through the Bureau of Industry and Security and the Export Administration Regulations) also play roles, particularly for export controls.

Who must comply. OFAC regulations apply to all US persons: US citizens and permanent residents wherever located, entities organised under US law (including their foreign branches), and any person physically present in the United States. Certain programmes (Cuba and Iran) also extend to foreign subsidiaries owned or controlled by US companies. Critically, any transaction denominated in US dollars that clears through a US correspondent bank acquires a US nexus, which is why non-US banks have been penalised for dollar transactions with sanctioned parties.

Key OFAC lists.
• Specially Designated Nationals and Blocked Persons List (SDN List) – the primary list of individuals, entities, vessels and aircraft whose property and interests in property must be blocked. US persons are generally prohibited from dealing with them.
• Consolidated Sanctions List – includes non-SDN lists such as the Sectoral Sanctions Identifications (SSI) List, the Foreign Sanctions Evaders (FSE) List, the Non-SDN Menu-Based Sanctions (NS-MBS) List, the Non-SDN Chinese Military-Industrial Complex Companies List and others.
• Palestinian Legislative Council (PLC) List and other programme-specific lists.

The 50 Percent Rule. Property and interests in property of entities owned 50 percent or more, directly or indirectly, in the aggregate by one or more blocked persons are themselves considered blocked, even if the entity is not itself named on the SDN List. This rule is a frequent exam point: it concerns ownership, not control. An entity controlled but not 50 percent owned by an SDN is not automatically blocked, although OFAC cautions caution in such dealings.

Blocking versus rejecting. When a transaction involves an SDN or blocked property, the US person must block (freeze) the funds, placing them in an interest-bearing blocked account; the funds cannot be returned. When a transaction is prohibited but there is no blockable interest (for example, a payment involving a comprehensively sanctioned country where no SDN is a party, or certain sectoral sanctions violations), the institution must reject the transaction – refuse to process it and return it to the originator.

Reporting obligations. Blocked property and rejected transactions must be reported to OFAC within 10 business days. An Annual Report of Blocked Property must be filed by 30 September each year. Blocked funds may be released only upon OFAC authorisation.

Licences. OFAC may authorise otherwise prohibited transactions through general licences (published authorisations available to anyone meeting the criteria, such as for humanitarian goods, legal services or wind-down periods) and specific licences (issued to a particular applicant in response to a written request).

Enforcement and penalties. OFAC applies strict liability for civil violations. Civil penalties under IEEPA are adjusted annually for inflation and can reach the greater of a fixed statutory amount (over USD 350,000 per violation) or twice the value of the transaction. Criminal penalties for wilful violations can reach USD 1 million and 20 years imprisonment per violation. OFAC's Economic Sanctions Enforcement Guidelines set out general factors including wilfulness or recklessness, awareness of conduct, harm to programme objectives, individual characteristics of the person, compliance programme adequacy, remedial response, cooperation and voluntary self-disclosure, which can reduce the base penalty by 50 percent. OFAC may issue a Finding of Violation, Cautionary Letter, No Action Letter or a civil monetary penalty.

OFAC's Framework for Compliance Commitments (2019). OFAC identified five essential components of a sanctions compliance programme: (1) management commitment, (2) risk assessment, (3) internal controls, (4) testing and auditing, and (5) training. The exam may ask about these pillars and about root causes of violations OFAC has identified, such as lack of a formal compliance programme, misinterpreting regulations, facilitating transactions by non-US persons, exporting goods or services to sanctioned persons, using the US financial system for commercial transactions with sanctioned parties, screening software deficiencies, improper due diligence on customers or counterparties, decentralised compliance functions, and individual liability.

Other US laws relevant to sanctions. The USA PATRIOT Act Section 311 allows the Treasury to designate jurisdictions or institutions as primary money laundering concerns and impose special measures, which operates alongside sanctions. CAATSA codified many Russia-related sanctions and introduced secondary sanctions. The Global Magnitsky Act permits sanctions against foreign persons involved in human rights abuses or significant corruption anywhere in the world.

The European Union Sanctions Regime

Legal basis. EU sanctions (officially restrictive measures) are adopted under the Common Foreign and Security Policy (CFSP). The process has two steps: the Council of the EU first adopts a CFSP Decision (requiring unanimity among member states, based on Article 29 of the Treaty on European Union), and then, for measures within EU competence such as asset freezes and trade restrictions, a Council Regulation under Article 215 of the Treaty on the Functioning of the European Union. Council Regulations are directly applicable in all member states without national transposition; they have immediate legal force upon publication in the Official Journal of the EU.

Sources of EU sanctions. EU measures either implement UN Security Council resolutions, supplement UN sanctions with additional EU-autonomous measures, or impose wholly autonomous EU sanctions where the UN has not acted (for example, measures against Russia following the annexation of Crimea in 2014 and the 2022 invasion of Ukraine, measures against Belarus, Myanmar, Venezuela and under the EU Global Human Rights Sanctions Regime adopted in 2020).

Scope of application. EU sanctions apply within EU territory, to EU nationals wherever located, to companies incorporated under the law of a member state, to any business done in whole or in part within the EU, and on board aircraft or vessels under member state jurisdiction. The EU does not impose secondary sanctions and, in principle, rejects their extraterritorial application by other states.

Typical measures. EU restrictive measures include asset freezes, prohibitions on making funds or economic resources available directly or indirectly to listed persons, travel bans (implemented by member states), arms embargoes, export and import restrictions on specific goods and technology, restrictions on financial services (such as prohibitions on new debt and equity for designated banks and energy companies), bans on providing certain services, and exclusion of banks from SWIFT messaging. The EU also uses a consolidated list of persons, groups and entities subject to EU financial sanctions, maintained by the European Commission.

Ownership and control. EU guidance treats an entity as owned by a listed person where the listed person holds more than 50 percent of proprietary rights or has a majority interest; control is assessed by considering factors such as the right to appoint or remove a majority of the board, the right to use assets, or management on a unified basis. Unlike the US rule, the EU approach explicitly considers control as well as ownership, and the thresholds and interpretations are set out in Council and Commission guidance rather than a single bright-line rule.

Enforcement. The EU itself has no enforcement authority. National Competent Authorities (NCAs) in each member state – such as HM Treasury's Office of Financial Sanctions Implementation (OFSI) in the UK before Brexit, the Bundesbank and BAFA in Germany, the Direction générale du Trésor in France, and the Dutch Ministry of Finance – are responsible for implementation, licensing (derogations), investigation and penalties. Penalties are set by national law, leading to historically uneven enforcement across the Union. To address this, the EU adopted a Directive in 2024 harmonising the definition of criminal offences and penalties for violating EU sanctions, requiring member states to criminalise serious breaches, including circumvention.

The EU Blocking Statute. Council Regulation (EC) No 2271/96, updated in 2018 following US withdrawal from the Iran nuclear deal (the Joint Comprehensive Plan of Action), prohibits EU operators from complying with specified extraterritorial US sanctions (notably on Cuba and Iran), nullifies the effect in the EU of foreign court rulings based on those laws, and allows EU persons to recover damages caused by their application. This creates a genuine compliance conflict for multinational institutions, which the exam may test conceptually.

Post-Brexit United Kingdom. Since leaving the EU, the UK operates an autonomous regime under the Sanctions and Anti-Money Laundering Act 2018 (SAMLA), administered by OFSI (financial sanctions) and the Foreign, Commonwealth and Development Office (designations), with the Export Control Joint Unit handling trade sanctions. UK sanctions often align with but are legally separate from EU measures. Candidates should not assume UK and EU lists are identical.

Comparing US and EU Approaches

• Administration: US – single federal agency (OFAC); EU – adopted centrally by the Council but enforced nationally by NCAs.
• Legal instrument: US – Executive Orders and OFAC regulations; EU – CFSP Decisions and Council Regulations, directly applicable.
• Extraterritoriality: US – extensive, including secondary sanctions and US dollar nexus; EU – limited to EU persons and territory, with the Blocking Statute opposing foreign extraterritorial measures.
• Ownership rule: US – 50 percent aggregate ownership; EU – more than 50 percent ownership or control.
• Liability: US – strict liability for civil violations; EU – varies by member state, with the new directive harmonising criminal liability for intentional and, in some cases, grossly negligent conduct.
• Licences: US – general and specific licences from OFAC; EU – derogations granted by NCAs under the grounds specified in each regulation.
• Humanitarian exemptions: Both regimes increasingly include humanitarian carve-outs, particularly following UNSC Resolution 2664 (2022), which the US and EU implemented through general licences and regulation amendments.

How Sanctions Compliance Works in Practice

1. Risk assessment. The institution assesses its sanctions exposure by customer base, geography, products, delivery channels, correspondent relationships and transaction flows. High-risk indicators include customers in or near sanctioned jurisdictions, trade finance involving dual-use goods, shipping and maritime clients, and correspondent banking with institutions in high-risk regions.

2. Screening. Customers, beneficial owners, directors, counterparties, vessels and payment messages are screened against relevant lists at onboarding, periodically, upon list updates and in real time for transactions. Screening uses fuzzy logic to catch spelling variations, transliterations, aliases and partial matches. Institutions must also screen for geographic terms, ports, and identifiers such as IMO numbers, BICs and passport numbers. Over-tuning filters produce excessive false positives; under-tuning risks missed true matches.

3. Alert investigation and escalation. Potential matches are reviewed to determine whether they are true hits or false positives, using secondary identifiers such as date of birth, nationality, address and identification numbers. True matches are escalated to the sanctions compliance function for a blocking, rejecting or licensing decision.

4. Blocking, rejecting and reporting. Funds are frozen or payments refused in accordance with the applicable regime, and regulatory reports are filed within required deadlines (10 business days to OFAC; reporting to the relevant NCA in the EU, often without delay or within a short set period).

5. Preventing evasion. Common evasion typologies include stripping or omitting originator and beneficiary information from payment messages (wire stripping), use of front companies and nominees, routing through third countries, misdeclaring goods, ship-to-ship transfers, disabling vessel AIS transponders, and use of cryptocurrency or alternative payment channels. Trade finance staff should watch for vague goods descriptions, unusual routing, and parties in free trade zones adjacent to sanctioned countries.

6. Governance, testing and training. Senior management must set the tone, allocate resources and receive reporting. Independent testing validates list management, screening logic and alert handling. Staff receive role-based training. Policies must address list update frequency, name-matching thresholds, escalation procedures and record retention (OFAC requires records for five years).

7. Collaboration. Sanctions compliance benefits from information sharing: with regulators through reporting and licence applications, with other institutions through public-private partnerships, and within groups through consolidated screening. OFAC and EU NCAs publish advisories (for example, on maritime evasion, North Korean IT workers, and Russian export control circumvention) which should be embedded into risk assessments.

Interaction with AML Programmes

Sanctions compliance is distinct from, but complementary to, AML. AML is risk-based and focused on detecting and reporting suspicious activity; sanctions compliance is rules-based and focused on preventing prohibited transactions regardless of suspicion. However, sanctions hits may also warrant a suspicious activity report, and customer due diligence information (beneficial ownership, nationality, business purpose) is essential for effective sanctions screening. The exam often tests whether candidates can distinguish a sanctions obligation (block, reject, report to OFAC or NCA) from an AML obligation (file a SAR or STR with the FIU).

Exam Tips: Answering Questions on US and EU Sanctions Programmes

Tip 1 – Know the institutional map. OFAC administers US sanctions and sits within the Treasury. The Council of the EU adopts EU restrictive measures; national competent authorities enforce them. The UN Security Council imposes global sanctions that both regimes implement. If a question asks who enforces EU sanctions, the answer is the member states, not the European Commission or European Central Bank.

Tip 2 – Distinguish blocking from rejecting. If an SDN or blocked property is involved, the correct action is to block (freeze) the funds and report within 10 business days. If the transaction is prohibited but there is no blockable interest, reject it and report. Never choose an answer that returns blocked funds to the sender or simply declines the transaction without reporting.

Tip 3 – Remember the 50 Percent Rule precisely. Aggregate ownership of 50 percent or more by one or more blocked persons makes an unlisted entity blocked. It is based on ownership, not control. For the EU, recall that control is also relevant and the threshold is more than 50 percent.

Tip 4 – Understand the US nexus. Many scenario questions involve a non-US bank processing a US dollar payment. Because dollar clearing passes through US correspondent banks, OFAC jurisdiction attaches. Recognise that stripping payment details to avoid detection is a serious violation, not a compliance workaround.

Tip 5 – Apply strict liability thinking. Answers suggesting an institution is excused because it was unaware or lacked intent are usually wrong for US civil sanctions. Intent affects penalty severity, not the existence of a violation. Voluntary self-disclosure and a strong compliance programme are mitigating factors.

Tip 6 – Separate sanctions obligations from AML obligations. A match to the SDN List triggers blocking and an OFAC report; it does not primarily trigger a SAR, though one may also be appropriate. A question asking about the first or required step after a confirmed sanctions match is looking for the freeze and regulatory report.

Tip 7 – Recognise the EU two-step process and direct applicability. CFSP Decision followed by Council Regulation; the regulation applies directly in all member states without national legislation. Unanimity is required in the Council.

Tip 8 – Know the EU Blocking Statute. It prohibits EU persons from complying with specified US extraterritorial sanctions (Cuba, Iran). If a scenario describes a European company caught between US secondary sanctions and EU law, the Blocking Statute is the relevant concept.

Tip 9 – Use secondary identifiers to resolve alerts. When a question describes a name match, the best practice answer involves comparing additional identifiers (date of birth, nationality, address, ID numbers) before deciding, rather than immediately blocking or immediately dismissing on name alone.

Tip 10 – Favour the risk-based, programme-level answer. When asked how to improve sanctions compliance, choose answers reflecting OFAC's five pillars: management commitment, risk assessment, internal controls, testing and auditing, training. Avoid answers that rely solely on technology or that eliminate screening for low-risk customers entirely.

Tip 11 – Watch for evasion red flags. Questions may describe vessels switching off AIS, payments routed through third-country shell companies, vague goods descriptions, or instructions to omit a party's name from a SWIFT message. These point to sanctions evasion and require escalation, not processing.

Tip 12 – Read the question for the jurisdiction. Some answer options are correct for the US but wrong for the EU and vice versa (for example, secondary sanctions exist in the US but not the EU; enforcement is centralised in the US but national in the EU). Identify the regime before selecting.

Tip 13 – Eliminate absolutes carefully. Options stating that sanctions never permit humanitarian transactions, or that all transactions with a sanctioned country are always blocked, are typically incorrect because of general licences and derogations.

Tip 14 – Remember key timeframes and record retention. 10 business days for OFAC blocked and rejected transaction reports, 30 September for the annual blocked property report, five years for record retention. Timing details are classic exam distractors.

Quick Revision Summary

• OFAC: US Treasury; SDN List; IEEPA and TWEA; strict liability; 50 Percent Rule; block versus reject; 10 business day reporting; general and specific licences; five compliance pillars.
• EU: CFSP Decision plus Council Regulation; directly applicable; unanimity; enforced by national competent authorities; ownership or control test; Blocking Statute; new directive harmonising criminal penalties.
• UN: Security Council Chapter VII resolutions; binding on member states; Resolution 1267 and 1373; FATF Recommendations 6 and 7.
• Practice: risk assessment, screening with fuzzy logic, alert investigation using secondary identifiers, blocking or rejecting, reporting, evasion detection, governance and training, collaboration with authorities.

Mastering these concepts allows a CAMS candidate to answer both knowledge-based and scenario-based questions on sanctions with confidence, and more importantly, to protect their institution from one of the most severe categories of regulatory risk.