Sanctions Due Diligence and Risk Assessment: CGSS Guide

Table of Contents

• • What a Sanctions Risk Assessment Measures
• • Customer and Ownership Due Diligence
• • Transaction, Product and End-Use Review
• • When to Apply Enhanced Due Diligence
• • Periodic and Event-Driven Review
• • CGSS Exam Traps

Quick answer: Sanctions due diligence identifies who is involved, who owns or controls them, what is being supplied or paid for, where value moves, and who ultimately uses or benefits from it. The risk assessment measures inherent exposure, evaluates control effectiveness and records the residual risk and required action.

Screening is one control inside due diligence. A clean name result does not resolve an opaque owner, prohibited end use, restricted territory or deliberately incomplete transaction.

What a Sanctions Risk Assessment Measures

Inherent risk is the exposure before controls. Control effectiveness asks whether policies, data, screening, due diligence, escalation and testing are designed properly and actually work. Residual risk is what remains after those controls.

Relevant factors can include:

• customer and counterparty type;
• beneficial ownership and control;
• jurisdiction and geographic connections;
• product, service, technology or goods;
• delivery and payment channels;
• transaction purpose, value and frequency;
• intermediaries, distributors and other third parties; and
• end user and end use.

The assessment should explain the link between evidence and rating. A label such as “high risk country” without identifying the exposure, source and affected activity is difficult to defend.

Customer and Ownership Due Diligence

Identify the legal customer and every relevant owner, controller, director, signatory and connected party. Verify information through reliable sources, not only a customer declaration.

Trace indirect ownership when companies sit between the customer and ultimate owner. Assess control separately through voting, appointments, contracts, financing and actual decision-making. Apply the ownership and control definitions of the relevant sanctions regime.

The customer’s purpose and expected activity should make commercial sense. An entity formed recently, operating outside its stated sector or using unrelated payment parties may need further explanation, but each fact remains an indicator rather than proof.

Transaction, Product and End-Use Review

A transaction review should answer:

1. Who are all relevant parties, including intermediaries and financial institutions?
2. What goods, services, technology or value are involved?
3. Where do they originate, transit and end?
4. Who is the end user, and what is the stated end use?
5. Do documents, payments and behavior support that explanation?
6. Does a prohibition, licence, exemption or reporting duty apply?

Trade and supply-chain activity may require invoices, contracts, transport documents, product codes, certificates, routing and third-party information. Generic descriptions such as “equipment” or “consulting” may be insufficient when the sanctions risk depends on the specific item or service.

When to Apply Enhanced Due Diligence

Enhanced due diligence should target the unresolved risk. If ownership is opaque, obtain and corroborate corporate records. If origin is unclear, reconcile trade and transport evidence. If a third party funds the deal, establish its relationship and commercial rationale.

More documents do not automatically mean better due diligence. Evidence should be relevant, reliable, current and consistent. A weak copy of the same unsupported assertion does not become strong because it appears in several customer-supplied files.

Possible outcomes include approval with controls, approval under licence conditions, monitoring, further information, escalation, rejection, blocking, reporting or exit. The correct action depends on law, risk, evidence and internal authority.

Periodic and Event-Driven Review

Periodic refresh frequency should reflect risk. Event-driven review matters when a party is designated, ownership changes, a new jurisdiction or product appears, activity departs from expectations, a licence changes or adverse information emerges.

List updates can require prompt rescreening. Corporate and vessel structures can change between scheduled reviews. Controls should identify which data changed, which population was affected, whether past activity needs review and who approved the outcome.

Document the sources, dates, reasoning, conditions and unresolved matters. A reviewer should be able to reconstruct why the organisation proceeded or stopped.

CGSS Exam Traps

• Screening equals due diligence: screening cannot replace ownership, purpose and end-use analysis.
• High risk equals prohibited: higher risk may trigger enhanced measures; prohibition depends on the applicable rule.
• More documents equals stronger evidence: relevance and reliability matter.
• One review lasts forever: use periodic and event-driven refresh.
• Third-party due diligence transfers responsibility: the organisation remains accountable for its decision.
• Residual risk is the same as inherent risk: assess controls before determining what remains.

Deepen the ownership analysis with beneficial ownership and control and connect the result to screening alert decisions. For all five domains, use the CGSS exam guide.