“Root Causes of OFAC Sanctions Compliance Program Breakdown or Deficiencies Based on Assessment of Prior OFAC Administrative Actions”  

This section of the Framework document contains a compilation of specific root causes associated with apparent violations of the regulations it administers to assist with designing, updating, and amending their respective SCP.  

In other words, these are errors that financial institutions and other entities have made previously for which they most likely incurred penalties and now this information is a part of OFAC’s official guidance. Essentially, they are fair warning to all U.S. persons or persons subject to U.S. jurisdiction, including entities that conduct business in or with the U.S. or with U.S. origin goods or services.  

The issues with DBTCA’s interdiction software mentioned above in the second penalty, is covered in the “Root Causes” section Number VI Sanctions Screening Software or Filter Faults which states:   

“At times, organizations have failed to update their sanctions screening software to incorporate updates to the SDN or SSI List, failed to include pertinent identifiers such as SWIFT Business Identifier Codes for designated, blocked, or sanctioned financial institutions, or did not account for alternative spellings of prohibited countries or parties.” 

If DBTCA had set the filter to display more results the software would have returned possible matches thereby prompting a manual review. 

The risk-based approach mentioned in the Framework includes decisions that must be made with regards to software. It is always a balance to generate quality results and limit time spent on false positives, however, with the publication of this enforcement action financial institutions should think twice on setting the filter to return only Exact Matches.