Free Practice Questions for ACAMS CGSS Exam

Sanctions and Compliance Domains state that sanctions clauses in trade contracts are used to:

• clarify prohibited activities,

• define obligations of the parties in case sanctions become applicable, and

• ensure business partners understand compliance expectations.

A sanctions clause cannot enforce a contract when sanctions apply (B), cannot assign liability for regulatory fines (C) beyond legal requirements, and cannot operate as a license (D). Only regulators (e.g., OFAC, EU authorities) can authorize activities by issuing licenses.

Sanctions and Compliance Domains state that screening calibration must be tied directly to a financial institution’s sanctions risk assessment, which evaluates products, customer base, geography, delivery channels, and transaction volume. Sensitivity adjustments must be justified by an institution’s assessed sanctions exposure.

Staff levels or training do not determine screening thresholds; these are operational considerations. Management commitment supports governance but does not form the technical basis for calibration decisions.

EU Restrictive Measures apply to all persons and entities within the territory of the EU, including airspace and territorial waters, and to any vessel or aircraft under the jurisdiction of an EU Member State. This establishes that sanctions obligations extend to vessels registered under EU jurisdictions regardless of location.

EU sanctions also apply to all legal persons, entities, and bodies incorporated or constituted under the law of an EU Member State, even when those entities operate entirely outside EU territory. Legal incorporation under EU law creates an ongoing obligation to comply with EU sanctions.

EU ownership by itself does not trigger sanctions applicability, so a non-EU company that is 45% owned by an EU national does not fall under EU Restrictive Measures. Additionally, arrangements such as double-taxation conventions or participation in customs union agreements do not extend the territorial or legal applicability of EU sanctions to non-EU jurisdictions.

References from Sanctions and Compliance Domains:

Territorial applicability of EU sanctions, including vessels and aircraft under Member State jurisdiction.

Applicability to companies incorporated under EU Member State law regardless of geographic operations.

Legal and territorial definitions outlining the scope of EU Restrictive Measures.

Sanctions and Compliance Domains outline that references to sanctioned ports, locations, or shipping routes in payment instructions require further investigation. Even when the transaction parties are not located in a sanctioned jurisdiction, involvement of a sanctioned port or movement of prohibited goods can trigger sanctions exposure.

The correct approach is to obtain supporting documents such as shipping documents, invoices, bills of lading, and routing information to confirm whether the shipment, goods, transport path, or third parties have any sanctioned involvement. Approving or rejecting a payment without verification contradicts sanctions screening standards.

References from Sanctions and Compliance Domains:

Requirements to investigate references to sanctioned locations in trade or payment messages.

Guidance on obtaining underlying documents to assess sanctions exposure.

Expectations for verifying goods, ports, and shipment paths.

Under the OFAC 50% Rule, an entity must be treated as a Specially Designated National (SDN) — even if not named on the SDN List — when:

One SDN owns 50% or more of the entity, OR

Multiple SDNs collectively own 50% or more of the entity (ownership must be aggregated).

Applying this rule:

A: 98% ownership by a single SDN → Blocked (exceeds 50%).

B: 35% + 15% = 50% aggregate ownership by two SDNs → Blocked (meets 50%).

C: 20% + 25% = 45%, which does not meet the threshold → Not blocked.

D: 12% + 18% + 28% = 58% aggregate ownership by SDNs → Blocked (exceeds 50%).

E: 45% + 3% = 48%, which is below 50% → Not blocked.

F: 10 SDNs × 4% = 40%, which is below 50% → Not blocked.

Thus, only A, B, and D meet or exceed the 50% aggregate ownership requirement defined by OFAC.

Sanctions and Compliance Domains outline several misunderstandings commonly held by businesses. One misconception is that any USD transaction automatically triggers US sanctions applicability; while USD transactions may be routed through the US financial system, sanctions analysis depends on transaction content, parties involved, and jurisdictional reach, not solely the currency.

Another misconception is assuming no sanctions risk exists if a party is not listed by name. Sanctions regimes include indirect application through ownership and control rules, sectoral sanctions, activity-based sanctions, and geographic sanctions. Entities may be sanctioned due to association, ownership, or activity even if not individually named.

Statements regarding import/export exposure and MandA due diligence are correct program requirements. US sanctions can still apply to US citizens regardless of where they reside or work.

References from Sanctions and Compliance Domains:

Misconceptions regarding currency and sanctions applicability.

Misunderstandings about named-party sanctions versus ownership/activity-based risks.

Clarification on US person obligations regardless of residence.

EU sanctions apply to:

• All EU nationals,

• All persons within the territory of the EU, including foreign nationals residing or operating within the EU,

• All EU legal entities, regardless of where they operate, and

• Any business conducted within the EU or using EU jurisdictional touchpoints.

EU sanctions do not have general extraterritorial effect. Unlike US sanctions (which can apply based on currency, goods origin, or facilitation), EU sanctions apply within EU territory, including airspace, and to EU persons globally.

EU sanctions do not automatically have a broader scope than US sanctions; in many cases, US sanctions have the broader reach.

Sanctions and Compliance Domains state that when entities share similar names, regions, or other characteristics with a sanctioned party — even when executive leadership differs — the institution must perform enhanced due diligence to rule out affiliation, ownership, or control links.

The similarity in names ("Al-Falah" vs. "El-Fallah"), geographic proximity, and the involvement of UN-sanctioned terrorism-related activity require deeper investigation. Compliance teams must confirm corporate records, ownership structure, purpose, and possible indirect connections before making a determination.

Automatic rejection is premature without evidence. Onboarding without further investigation is inappropriate.

Within sanctions compliance programs, one of the core components identified as essential for effective management of sanctions risks is audit and testing. The Sanctions and Compliance Domains describe that sanctions programs require independent review, periodic testing, and validation to assess whether internal controls, screening systems, and escalation processes operate effectively. Audit and testing units provide the independent assurance needed to detect program weaknesses, evaluate the adequacy of controls, and confirm compliance with regulatory requirements.

Sanctions frameworks emphasize that the ability to identify deficiencies, monitor adherence to procedures, evaluate risk-control effectiveness, and ensure continuous improvement is fundamental to maintaining a sound sanctions compliance environment. Audit and testing functions are responsible for reviewing the design and effectiveness of sanctions policies, validating the performance of screening tools, and ensuring corrective action is taken where deficiencies are found. For this reason, the function is identified as critical for managing sanctions risks across financial institutions and regulated entities.

References from Sanctions and Compliance Domains:

Requirements for independent auditing and testing as a core component of an effective sanctions compliance program.

Expectations for regular review of sanctions controls, screening performance, and risk assessment processes.

Emphasis on independent validation to ensure ongoing compliance with regulatory obligations and to detect gaps in sanctions controls.

Vendor contracts must explicitly require that third-party service providers comply with all applicable sanctions laws and regulations. This ensures the bank’s sanctions exposure is minimized when vendors perform outsourced functions.

Tuning procedures, risk assessments, and alert investigation procedures are internal controls—not contract requirements imposed on vendors.