CSS CSS Financial Institution Obligations & Controls 1 — Questions and Answers
Question 1: Which U.S. regulatory expectation requires financial institutions to implement a risk-based sanctions compliance program?
- OFAC's Framework for OFAC Compliance Commitments (2019) (Correct answer)
- FinCEN's Customer Identification Program rule only
- The Bank Secrecy Act AML program requirement
- The Dodd-Frank Act compliance program mandate
Correct answer: OFAC's Framework for OFAC Compliance Commitments (2019)
OFAC's 2019 Framework for OFAC Compliance Commitments outlines five essential components of an effective sanctions compliance program, which OFAC uses to evaluate organizational compliance.
Question 2: Under OFAC's Compliance Commitments Framework, which element focuses on ensuring senior management understands and supports sanctions compliance?
- Internal Controls
- Management Commitment (Correct answer)
- Testing and Auditing
- Training
Correct answer: Management Commitment
Management Commitment is identified by OFAC as a foundational element, requiring that senior management and the board of directors actively support and resource the sanctions compliance program.
Question 3: A financial institution's sanctions compliance officer discovers that its automated screening system has a known deficiency allowing certain SDN names to go unmatched. The appropriate response is to:
- Document the deficiency and wait for the next scheduled system upgrade
- Immediately remediate the deficiency or implement compensating controls while remediation is underway (Correct answer)
- Notify OFAC first before taking any internal corrective action
- Reduce screening frequency until the deficiency is corrected
Correct answer: Immediately remediate the deficiency or implement compensating controls while remediation is underway
Known screening system deficiencies must be addressed promptly — OFAC expects institutions to remediate gaps and implement compensating controls to prevent violations during the remediation period.
Question 4: Which financial institution activity is most commonly cited in OFAC enforcement actions involving wire transfers?
- Failure to file Currency Transaction Reports
- Stripping or omitting sanctions-relevant information from payment messages (Correct answer)
- Accepting deposits from foreign banks without KYC
- Failing to screen correspondent banks for AML risk
Correct answer: Stripping or omitting sanctions-relevant information from payment messages
OFAC enforcement actions frequently involve financial institutions that stripped, omitted, or altered sanctions-relevant information (e.g., beneficiary names, originator details) in SWIFT messages to process prohibited transactions.
Question 5: What is the significance of a 'U-turn' transaction in sanctions compliance for financial institutions?
- It refers to a transaction that is reversed after a false positive screening hit
- It is a specific general license allowing certain dollar-clearing transactions involving otherwise sanctioned countries to transit U.S. correspondent banks under defined conditions (Correct answer)
- It is an OFAC term for circular payment schemes used in evasion
- It describes transactions that are voluntarily unwound by a financial institution post-blocking
Correct answer: It is a specific general license allowing certain dollar-clearing transactions involving otherwise sanctioned countries to transit U.S. correspondent banks under defined conditions
A U-turn transaction historically referred to a general license allowing certain payments to or from Iran (or other sanctioned countries) to pass through U.S. correspondent banks as long as U.S. persons were not directly involved — these authorizations have changed over time by program.
Question 6: When a financial institution rejects (rather than blocks) a transaction involving a sanctions concern, it typically means:
- The transaction involved a country-level prohibition where no property interest is created, so blocking is not required (Correct answer)
- The transaction was processed in error and reversed
- The institution filed a SAR and returned funds with OFAC notification
- The customer requested cancellation before sanctions screening was complete
Correct answer: The transaction involved a country-level prohibition where no property interest is created, so blocking is not required
Rejection (rather than blocking) applies when a transaction involves a country or activity prohibition under sanctions where no property interest is being held — for example, a transaction from a comprehensively sanctioned country that does not involve blocked property.
CSS CSS Financial Institution Obligations & Controls 1
Which U.S. regulatory expectation requires financial institutions to implement a risk-based sanctions compliance program?