CGSS ACAMS Certified Global Sanctions Specialist (ACAMS CGSS) Free Practice Exam Questions (2025 Updated)

Effective internal controls for virtual asset service providers include:

• Sanctions screening of users, wallets, and transactions.

• IP blocking/geolocation controls to stop access from sanctioned jurisdictions.

• Keyword screening for wallet names, addresses, or known illicit indicators.

• Reviewing and enforcing end-user agreements, including prohibitions on using the platform for sanctioned activity.

Other options include unnecessary or ineffective controls (downsizing staff, screening employees, or vendor-only screening), which are not aligned with sanctions-control best practices.

Sanctions and Compliance Domains explain that fuzzy logic screening includes phonetic algorithms (e.g., Soundex, Metaphone) to identify variations in the spelling or pronunciation of names. This allows a screening tool to detect near matches and transliteration differences that would not match under exact-match logic.

Inequality lists, big data, and whitelists are not fuzzy matching algorithms. Whitelists are used for reducing false positives, not matching logic.

A four-eye check is a standard internal control requiring two independent reviewers to validate decisions, ensuring accuracy, transparency, and reducing the risk of error or inappropriate clearance of alerts.

Sanctions and Compliance Domains identify this as a critical component of the alert-handling process, enabling oversight and minimizing compliance failures.

Fuzzy matching is a screening technique, not a control mechanism. Batch screening and threshold calibration relate to system functionality, not independent quality assurance.

An effective export compliance program must include formalized and documented screening procedures, including payment screening, trade documentation screening, and counterparty checks. This ensures compliance with sanctions, export restrictions, and embargo requirements.

Freight forwarders may assist but do not replace internal compliance responsibilities. Boycott-related terms must be avoided, and collecting vouchers is not an export controls safeguard.

Sanctions and Compliance Domains outline several misunderstandings commonly held by businesses. One misconception is that any USD transaction automatically triggers US sanctions applicability; while USD transactions may be routed through the US financial system, sanctions analysis depends on transaction content, parties involved, and jurisdictional reach, not solely the currency.

Another misconception is assuming no sanctions risk exists if a party is not listed by name. Sanctions regimes include indirect application through ownership and control rules, sectoral sanctions, activity-based sanctions, and geographic sanctions. Entities may be sanctioned due to association, ownership, or activity even if not individually named.

Statements regarding import/export exposure and MandA due diligence are correct program requirements. US sanctions can still apply to US citizens regardless of where they reside or work.

References from Sanctions and Compliance Domains:

Misconceptions regarding currency and sanctions applicability.

Misunderstandings about named-party sanctions versus ownership/activity-based risks.

Clarification on US person obligations regardless of residence.

Under the OFAC 50% Rule, an entity must be treated as a Specially Designated National (SDN) — even if not named on the SDN List — when:

One SDN owns 50% or more of the entity, OR

Multiple SDNs collectively own 50% or more of the entity (ownership must be aggregated).

Applying this rule:

A: 98% ownership by a single SDN → Blocked (exceeds 50%).

B: 35% + 15% = 50% aggregate ownership by two SDNs → Blocked (meets 50%).

C: 20% + 25% = 45%, which does not meet the threshold → Not blocked.

D: 12% + 18% + 28% = 58% aggregate ownership by SDNs → Blocked (exceeds 50%).

E: 45% + 3% = 48%, which is below 50% → Not blocked.

F: 10 SDNs × 4% = 40%, which is below 50% → Not blocked.

Thus, only A, B, and D meet or exceed the 50% aggregate ownership requirement defined by OFAC.

Under UK OFSI rules, entities owned or controlled by a designated person remain subject to asset freeze restrictions. A reduction in ownership from above 50% to below 50%, particularly when occurring immediately after designation, requires enhanced due diligence to determine whether the divestment is genuine or merely an attempt to evade sanctions.

Sanctions and Compliance Domains emphasize the need for verification when documentation claims ownership reduction. Institutions must confirm authenticity, timing, beneficiaries of the transfer, and any continuing control influence by the designated person.

Approving the transaction before verification, removing screening, or rejecting without confirming details contradicts UK sanctions compliance expectations. Enhanced due diligence is the required first step.

References from Sanctions and Compliance Domains:

OFSI ownership and control criteria, including obligations when ownership reductions occur post-designation.

Requirements for enhanced due diligence to confirm legitimacy of divestment or restructuring.

Risk indicators of sanctions evasion through rapid ownership structure changes.

Sanctions and Compliance Domains highlight that sanctioned individuals may attempt to evade restrictions by transferring assets, ownership rights, or operational control to family members or close associates. These transfers may appear legitimate but are often structured to conceal continuing beneficial ownership or influence.

Asset transfers to relatives or trusted associates are recognized as classic sanctions evasion red flags across EU and UK ownership and control guidance.

Opening bank accounts in non-aligned jurisdictions may create exposure, but the specific red flag of evasion is the movement of assets to associates. Changes in corporate strategy or reduced trading activity are not inherently indicative of sanctions evasion.

Risk-based screening controls include:

• Ensuring sanctions lists are current – list freshness is essential to avoid processing transactions with newly designated parties.

• Using fuzzy logic – captures alternative spellings, transliterations, phonetic differences, and reduces missed true matches.

Stopping all transactions (B) is not risk-based. Adding every country’s sanctions list (C) creates operational noise without regulatory justification. Screening only names (D) ignores other critical fields like addresses, intermediaries, and free-text descriptions.

OFAC regulations permit the use of USD for Cuba-related transactions only when explicitly authorized under specific exceptions or general licenses. These include certain remittances, humanitarian transactions, and authorized travel-related transactions.

General USD use with Cuba is otherwise prohibited unless OFAC has expressly allowed it through a license or regulatory exemption.

“Stripping” refers to removing, altering, or replacing material information from payment messages, invoices, or trade documents to conceal a sanctioned party, vessel, location, or jurisdiction. It is a recognized sanctions evasion technique used by actors seeking to bypass automated screening.

Examples include removing the sanctioned port name, omitting the ultimate consignee, or deleting identifying references.

This is distinct from structuring (option A), price manipulation (B), or dual messaging (C).

UN sanctions require agreement among multiple countries, making them more difficult to enact than unilateral national sanctions. The UN Security Council must reach consensus, and all five permanent members must avoid using their veto power. Any negative vote by a permanent member blocks the resolution entirely.

This requirement for global political alignment is the primary barrier to rapid sanctions adoption. UN sanctions are neither autonomous nor inherently ineffective, and they do not exist to intervene in domestic affairs but to protect international peace and security under Chapter VII of the UN Charter.

Within sanctions compliance programs, one of the core components identified as essential for effective management of sanctions risks is audit and testing. The Sanctions and Compliance Domains describe that sanctions programs require independent review, periodic testing, and validation to assess whether internal controls, screening systems, and escalation processes operate effectively. Audit and testing units provide the independent assurance needed to detect program weaknesses, evaluate the adequacy of controls, and confirm compliance with regulatory requirements.

Sanctions frameworks emphasize that the ability to identify deficiencies, monitor adherence to procedures, evaluate risk-control effectiveness, and ensure continuous improvement is fundamental to maintaining a sound sanctions compliance environment. Audit and testing functions are responsible for reviewing the design and effectiveness of sanctions policies, validating the performance of screening tools, and ensuring corrective action is taken where deficiencies are found. For this reason, the function is identified as critical for managing sanctions risks across financial institutions and regulated entities.

References from Sanctions and Compliance Domains:

Requirements for independent auditing and testing as a core component of an effective sanctions compliance program.

Expectations for regular review of sanctions controls, screening performance, and risk assessment processes.

Emphasis on independent validation to ensure ongoing compliance with regulatory obligations and to detect gaps in sanctions controls.

In sanctions compliance frameworks applied globally by bodies such as OFAC, the EU, the UN, the UK, Canada, and Australia, transactions involving humanitarian goods, including medicine and medical supplies, are treated under specific regulatory categories. These frameworks include humanitarian exemptions, general licenses, and permitted transactions for medical or health-related items. The standard compliance expectation requires an analyst to determine whether the activity is already authorized before taking restrictive action.

The Sanctions and Compliance Domains specify that when a transaction involves potential humanitarian goods, the analyst must confirm whether a general license or exemption applies. General licenses commonly authorize exports of medicines, medical devices, and humanitarian materials to sanctioned jurisdictions. The rule requires verification of these authorizations prior to escalation, rejection, or requesting a specific license.

If a general license exists for the type of goods or activity, the transaction may proceed in accordance with regulatory conditions. Only when no exemption or general license applies should a specific license be sought. Therefore, the correct immediate step for the analyst is to check applicable general licenses or exemptions related to medical exports.

References from Sanctions and Compliance Domains:

Regulatory requirements relating to humanitarian exemptions under sanctions programs.

General license structures for medical and humanitarian goods in sanctions regimes.

Compliance procedures directing analysts to verify authorizations or exemptions before rejecting or escalating transactions.

Standard sequencing: determine applicability of general licenses or exemptions prior to requesting a specific license.

A key sanctions-evasion red flag in trade documents is reluctance or refusal to disclose end-use or end-user information. This may indicate diversion to a sanctioned jurisdiction, entity, or prohibited program (e.g., proliferation).

Expiration dates (D) are irrelevant to sanctions. Payment timing and product suitability (A, B) are normal commercial behaviors and not sanctions red flags.

When a bank has a zero-tolerance stance regarding sanctioned jurisdictions and no applicable license or exemption exists, the appropriate response is to reject and return the remittance, informing the sending bank that the transaction cannot be processed for sanctions compliance reasons.

Escalation for consideration is inconsistent with a zero-tolerance policy. Filing a SAR does not authorize processing a prohibited payment. Processing on the assumption of a license without one presents regulatory violations.

OFAC requires that reports of newly blocked property be submitted within 10 business days of the blocking action. The institution must provide full details of the blocked property and the sanctioned party. Any timeline other than 10 business days fails to meet OFAC’s regulatory reporting requirements.

Digital currency providers pose a heightened sanctions risk due to:

• exposure to anonymity-enhancing technologies,

• increased risk of being used for sanctions evasion and illicit finance,

• difficulty tracing the ultimate beneficial owner or origin of funds, and

• vulnerabilities related to mixers, unhosted wallets, and cross-border platforms.

Pharmacies and retail companies generally present lower sanctions risk. Aircraft maintenance companies can pose some risk depending on jurisdictions served, but digital currency firms are consistently recognized as the highest-risk sector for sanctions exposure.

Sanctions and Compliance Domains outline that references to sanctioned ports, locations, or shipping routes in payment instructions require further investigation. Even when the transaction parties are not located in a sanctioned jurisdiction, involvement of a sanctioned port or movement of prohibited goods can trigger sanctions exposure.

The correct approach is to obtain supporting documents such as shipping documents, invoices, bills of lading, and routing information to confirm whether the shipment, goods, transport path, or third parties have any sanctioned involvement. Approving or rejecting a payment without verification contradicts sanctions screening standards.

References from Sanctions and Compliance Domains:

Requirements to investigate references to sanctioned locations in trade or payment messages.

Guidance on obtaining underlying documents to assess sanctions exposure.

Expectations for verifying goods, ports, and shipment paths.