What’s happening:
A new merchant applies for onboarding. Company name screens clean. During KYB, a beneficial owner shows a close match to a designated person.
Why it matters:
List-based sanctions + ownership/control risk. A non-listed company may be restricted if owned/controlled by a designated party.
Red flags:
UBO name match (especially with overlapping DOB/nationality/address)
complex ownership chain with offshore entities
unwillingness to provide UBO evidence
Controls that should trigger:
onboarding screening for UBOs/principals
KYB risk scoring and enhanced due diligence workflow
“UBO mismatch / missing data” escalation rule
What you do (Stop–Escalate–Document):
Stop: do not activate the merchant account or settlement.
Escalate: open a sanctions case with UBO screening output and KYB documents.
Document: log the hold, what checks ran, and what data was missing.
What’s happening:
A cross-border transfer is initiated. Sender and recipient look clean, but the beneficiary bank is in a high-risk corridor or restricted region.
Why it matters:
Country/region-based sanctions and routing risk. Some restrictions apply due to geography and financial routing even without listed parties.
Red flags:
beneficiary bank country conflicts with stated purpose
What’s happening:
Buyer and seller are not listed. The shipping address is in a restricted region, or the buyer requests rerouting via a third country.
Why it matters:
Country/region-based sanctions. Shipping/delivery can trigger restrictions even without listed parties.
Red flags:
shipping address in restricted area
repeated address changes near shipment
“forwarder address” used to obscure final destination
Stop: stop fulfillment and associated payment release.
Escalate: include order details + destination + rerouting attempts.
Document: log the policy trigger and customer requests.
Evidence to capture:
original and updated shipping addresses
order SKU/category and description
fulfillment warehouse location (if relevant)
customer messages requesting reroute
Scenario B3 — Digital services delivery into restricted geographies
What’s happening:
A platform sells digital services (software access, subscriptions, downloads). The user accesses from a restricted geography via IP/device signals.
Why it matters:
Country/region restrictions + export-controls-adjacent risk. Digital delivery may be treated as a cross-border service/export.
Red flags:
repeated logins from restricted geographies
billing country and usage location inconsistent
sudden changes in account profile data
Controls that should trigger:
geofencing access controls (if policy mandates)
account review for conflicting geo signals
risk-based temporary access restriction
What you do:
Stop: apply temporary access restriction (per policy) and hold refunds.
Escalate: provide geo evidence and account history.
Document: record signals and what control triggered.
Evidence to capture:
IP/device geo signals, timestamps (as permitted by privacy policy)
billing/shipping/residence country data
account change history (email, address, payment method)
product/service delivered
Scenario set C — Fintech/Crypto
Scenario C1 — Wallet/customer name is clean, blockchain exposure is not
What’s happening:
A customer wants to cash out crypto to fiat. Name screens clean. Blockchain analytics (if used) flags exposure to sanctioned services or addresses.
Why it matters:
List-based + secondary risk + commercial risk. Exposure to sanctioned actors/services can lead to banking partner de-risking even beyond strict legal scope.
Red flags:
funds sourced from high-risk services
repeated small inbound transfers then a large cash-out
customer refuses source-of-funds explanation
Controls that should trigger:
crypto transfer risk scoring / blockchain analytics alerts
enhanced due diligence (SoF/SoW) workflow
cash-out hold pending review
What you do:
Stop: hold the cash-out.
Escalate: include the alert details and requested SoF info.
Document: record the basis for hold and customer communications.
Evidence to capture:
transaction hashes and risk indicators (as your tooling provides)
What’s happening:
A user repeatedly fails transfers, then tries different beneficiaries, different corridors, and asks support for workarounds.
Why it matters:
Evasion risk. Even if the person is not listed, this pattern increases the probability of sanctions breach and partner de-risking.
Red flags:
multiple failed attempts across corridors
beneficiary changes shortly before execution
support requests: “How can I make this go through?”
Controls that should trigger:
velocity rules on failed transfers
beneficiary change monitoring
account restriction triggers
What you do:
Stop: restrict transfers and place holds as required.
Escalate: case creation with full pattern timeline.
Document: document attempted workarounds and your response.
Evidence to capture:
timeline of retries, corridors, beneficiaries
support conversation excerpts (verbatim, where allowed)
device/account linkage signals
relevant screening and transaction monitoring outputs
Scenario C3 — High-risk sector: trade finance-like features in a fintech product
What’s happening:
A fintech offers invoice financing or advance payouts to merchants engaged in high-risk cross-border trade.
Why it matters:
Sectoral risk and secondary sanctions exposure. Financing-like products can intensify sanctions sensitivity.
Red flags:
goods/services linked to restricted sectors
unusual third-party payments
merchants in high-risk corridors without credible documentation
Controls that should trigger:
enhanced underwriting for high-risk merchant sectors
corridor restrictions and EDD
financing feature approval controls
What you do:
Stop: pause financing activation or disbursement.
Escalate: provide merchant trade profile, counterparties, and corridor details.
Document: record the basis and decision outcome.
Evidence to capture:
merchant business model and trade counterparties
invoices/contracts and goods descriptions
shipping/incoterms (if available)
screening outputs for counterparties
Scenario set D — Freight Forwarder
Scenario D1 — Shipping to restricted region (no listed parties)
What’s happening:
A client requests shipment to a restricted region. The client is not listed. They propose a “transshipment” route via a third country.
Why it matters:
Country/region-based sanctions + evasion risk. Routing can create prohibited delivery or facilitation.
Red flags:
vague end-destination documentation
unusual routing that increases complexity
forwarder address or multiple intermediaries
Controls that should trigger:
destination and route screening
end-user/end-use documentation requirements
escalation for transshipment patterns
What you do:
Stop: pause shipment booking and cargo release.
Escalate: include route plan, end-destination, and documentation gaps.
Document: record the route change request and decision.
Evidence to capture:
shipper/consignee and end-user details
full routing plan (ports, carriers, intermediaries)
What’s happening:
A customer ships “industrial components” with vague descriptions. The cargo appears dual-use or inconsistent with the customer’s profile.
Why it matters:
Export-controls-adjacent + sanctions program risk. Dual-use items often intersect with sanctioned programs.
Escalate: include commodity details and documentation gaps.
Document: record what was requested and what was provided.
Evidence to capture:
HS codes, technical specifications, datasheets
shipper/consignee/end-user identities
destination and end-use statement
prior shipment history (if available)
Scenario D3 — Listed entity appears in shipping documents
What’s happening:
A listed entity name appears in shipping documents (consignee, notify party, or intermediary) even though the contracting party is different.
Why it matters:
List-based sanctions. Indirect involvement can still be prohibited facilitation.
Red flags:
listed name appears as “notify party”
discrepancies between invoice party and consignee
last-minute document changes
Controls that should trigger:
document-based screening (names on shipping docs)
mismatch checks (contracting party vs consignee)
high-priority escalation
What you do:
Stop: hold shipment.
Escalate: provide all documents and the match details.
Document: keep a full audit trail of document versions.
Evidence to capture:
all versions of shipping docs (BL/AWB, invoice, packing list)
