What should I do when I detect a sanctions red flag?

Block the transaction, investigate, document the finding, and escalate to compliance. File SAR and OFAC reports if applicable.

Can I ignore low-level red flags?

No. All red flags must be investigated and documented. Low-level flags may indicate patterns that, combined, indicate sanctions evasion.

Record: red flag detected, investigation steps, evidence reviewed, conclusion, and disposition. Retain for 5 years.

Yes. Annual training should cover jurisdiction-specific red flags, screening procedures, and escalation paths.

Key red flags

Red flag	Description	Risk level
Counterparty in sanctioned jurisdiction	Direct exposure to comprehensively sanctioned country	Critical
Name matches SDN list	Fuzzy match to designated person or entity	Critical
Wallet interaction with designated address	On-chain history shows contact with SDN wallet	Critical
Structured transactions	Payments broken up to avoid thresholds	High
Missing screening documentation	No evidence of pre-transaction screening	High
Rapid in-and-out fund movement	Funds arrive and leave quickly	Medium

Red flag

Description

Risk level

Counterparty in sanctioned jurisdiction

Direct exposure to comprehensively sanctioned country

Critical

Name matches SDN list

Fuzzy match to designated person or entity

Critical

Wallet interaction with designated address

On-chain history shows contact with SDN wallet

Critical

Structured transactions

Payments broken up to avoid thresholds

High

Missing screening documentation

No evidence of pre-transaction screening

High

Rapid in-and-out fund movement

Funds arrive and leave quickly

Medium

Action: Critical red flags should block the transaction immediately. High flags require same-day review.

Check any wallet, name, or entity against OFAC, EU, UN sanctions lists in real time.

What should I do when I detect a sanctions red flag?: Block the transaction, investigate, document the finding, and escalate to compliance. File SAR and OFAC reports if applicable.
Can I ignore low-level red flags?: No. All red flags must be investigated and documented. Low-level flags may indicate patterns that, combined, indicate sanctions evasion.
How do I document red flag investigations?: Record: red flag detected, investigation steps, evidence reviewed, conclusion, and disposition. Retain for 5 years.
Should I train staff on these red flags?: Yes. Annual training should cover jurisdiction-specific red flags, screening procedures, and escalation paths.