The history of OFAC’s foray into IP Addresses, Dialing Pre-Fixes, and Email Address…

The video above is a high level 1 minute summary. The below article is in depth!

Did you know OFAC’s 2019 settlement with Standard Chartered Bank (SCB) referenced the word “fax” 21 times? It also mentioned email addresses, IP Address, and logins from sanctioned countries.

The web announcement did not include these details, however the lengthy Settlement Agreement did cover these in detail. (For those who have recently started following Settlements, OFAC used to provide two documents: high level summary via a webpost and they’d also provide a settlement agreement providing more details. Nowadays, they’ve combined this into one document per announcement.) I will include all relevant links at the bottom of the article. Now back to the History of OFAC’s first settlement touching on these topics.

Payment Instructions Faxed from Iranian Fax Numbers

The settlement agreement has multiple pages dedicated to “faxed” instructions where the customers would fax in their payment instructions. These faxes were sent from Iranian phone numbers. Thus, putting the bank in a position to carry out payments instructions benefiting persons and/or companies located in comprehensively sanctioned countries.

In its remedial efforts, SCB searched for all received faxes having Iranian dialing codes (“98, +98, or +0098”) “and identified 11,809 faxed payment instructions”. It also took preventative measures to prevent this in the future. However, no details were provided about those measures.

Why is this Important?

Does your company allow users to transmit payment instructions or RFI responses via email, fax, or phone? If so, does your Sanctions Program have controls in place to prevent users located in comprehensively sanctioned countries and/or jurisdictions from using those communication mediums?

Customers / Users may provide telephone, cell, and fax numbers during account opening, KYC / CDD /EDD, Identity Validation, etc. This information is hopefully captured in your institutions CRM and/or KYC system. Potential Considerations:

• Work with your engineering partners to create rules that either prevent adding numbers having a dialing code from a sanctioned country/jurisdiction,
• Work with your engineering partners to create rules that identify customers / users with a document telephone number, cell phone number, or fax number where the dialing code points to a sanctioned country/jurisdiction,
• The rule searching for these phone numbers should trigger a manually created case in your case management tool for review by an experienced analyst.
• If your institution can receive faxed instructions from clients, consider scouring your fax history as SCB (i.e. understand and verify your institution’s exposure, exposure may be hire in those countries physically closer to a sanctioned country or jurisdiction).

“IP Address” makes its OFAC Debut

“IP Address” makes its OFAC debut in the SCB settlement and is mentioned 4 times. The OFAC settlement states: “SCB did not implement any controls to restrict access from jurisdictions subject to comprehensive sanctions until April 2013…”. Although SCB did this for one of its product portals, it failed to apply it enterprise wide and therefore applied it to a 2nd product portal a year later.

Why is this important? Because it reminds us that most global FIs, MSBs, FinTechs, Payment Processors, etc have various products, platforms, domains, and login sites. And, through mergers and acquisitions, they may have acquired legacy products having separate login screens, domains, platforms, etc. OFAC pointing out that SCB implemented IP Address controls for one product in 2013 and another in 2014 reminds us that when working with your engineering, network admins, and security resources it is important to:

• have an inventory of all access points where customers/users can login,
• each of those should be updated equilaterally to prevent logins from comprehensively sanctioned countries and/or jurisdictions,
• your institutions annual audit scope should include sanctions penetration testing to verify if it is possible to logon to any of your companies sites with a IP Address from a comprehensively sanctioned country and/or jurisdiction.
• You may also consider asking your technical and security resources, in the case of Disaster Recovery or Backup Contingency activation, are those IP Address controls applied? Depending on your institution’s DRP and BCP design those IP controls may or may not be applied as expected. Again, its worth testing.

“Email Address” makes its OFAC Debut

SCB was the first to get dinged (officially via an SL) for many themes that most banks had not even considered until the release of their settlement agreement. For those institutions with tech savvy sanctions compliance officers, the writing was on the wall. Their lessons learned should not be lost upon us.

and also listed an email address which contained the name of the Iranian Person and the petrochemical company group. 

Now, the above may seem innocuous, however when you consider its potential implications, the impact is much greater. Additionally, as we have seen with OFAC settlements in recent years (e.g. SCB, Bitgo, BitPay) refer to email addresses as well as the 2020 Berkshire settlement which refers to the contents within the email chains!

despite numerous warning signs over a period of several years regarding the company’s Iranian connections, including direct communications with the petrochemical company, the receipt of emails and faxes from Iranian companies and/or telephone numbers, and the rejection of transactions involving the petrochemical company by U.S. financial institutions. SCB’s failure to connect the information resulted in the bank continuing to process transactions involving the company for several years until blocking its account…

Why is this important? Because most Sanctions programs out there do not consider screening email addresses, having email content rules relating to sanctions countries/jurisdictions, do not have monitoring rules for email domains, nor do they have monitoring rules for website domains. Potential Considerations:

• work with your technical resources to query email addresses maintained by your institution (customers, users, contracts, vendors, etc.) and search for emails matching those on the OFAC list.
• work with your technical resources to query the “top level domain” of email addresses (used to denote country) maintained by your institution (for customers, users, employees, contracts, vendors, etc.) and search for emails ending in: “.CU”, “.IR”, “.KP”, or “.SY”. Here is a website that provides you with a list of Internet Country Codes (top level domains): https://www.worldstandards.eu/other/tlds/
• work with your technical resources to query the “top level domain” of website addresses (used to denote country) maintained by your institution (for customers, users, employees, contracts, vendors, etc.) and search for emails ending in: “.CU”, “.IR”, “.KP”, or “.SY”. Here is a website that provides you with a list of Internet Country Codes (top level domains): https://www.worldstandards.eu/other/tlds/
• Consider creating rules to monitor these and manually create and escalate compliance reviews to your seasoned compliance analysts via your case management tool.
• In addition to having rules for internet country codes, consider screening email addresses and website addresses against those maintained by OFAC on its SDN list.
• your institutions annual audit scope could include sanctions penetration testing aimed at verifying which products allow users to update their details with an email or website address located in a sanctioned country

What the SCB Settlement Agreement Taught Us

1. Do not process payment instructions from SDNs or customers/users located in, travelling through, or being a resident of a sanctioned location. 
2. Do not process customer/user requests from emails, fax numbers, phone calls, or online logins stemming from sanctions locations. 
3. Have controls in place to identify, flag, and prevent customers from being able to connect or transmit instructions from sanctions locations.
4. Augment your sanctions program to include rules and/or screening that monitors internet country codes, as well as email/web addresses provided by OFAC on its SDN list.

If you found this helpful, please Like and Share on Linkedin!!  

Noe Compliance is available to help you. Call Us Today! 

Related Links:

SCB Settlement links:

• https://home.treasury.gov/policy-issues/financial-sanctions/recent-actions/20190409
• https://home.treasury.gov/system/files/126/20190408_scb_webpost.pdf
• https://home.treasury.gov/system/files/126/scb_settlement.pdf
• https://home.treasury.gov/policy-issues/financial-sanctions/civil-penalties-and-enforcement-information

Internet Country Code links:

• https://www.worldstandards.eu/other/tlds/
• https://en.wikipedia.org/wiki/.ir

Links to other OFAC settlements that touch on Monitoring Emails:

• https://home.treasury.gov/system/files/126/20201230_bitgo.pdf
• https://home.treasury.gov/system/files/126/20210218_bp.pdf
• https://home.treasury.gov/system/files/126/20201020_berkshire.pdf

Link to US Treasury page for OFAC civil penalties enforcements:

• https://home.treasury.gov/policy-issues/financial-sanctions/civil-penalties-and-enforcement-information

Are Russia Sanctions Effective at stopping Russia? Sanctions are only as good as the controls that are designed to implement them. For many of us wanting to make a difference and wanting to know that our efforts are making a difference in the #UkraineCrisis, below is a quick tire-kicking list for your Sanctions program.

#REMEMBER most engineers do not understand Sanctions Regulations, most sanctions officers do not have a systems or data background, and at times both of these groups can fail to have a deep understanding of the business they support, its data, or processes. It is nearly impossible to find people that have subject matter expertise on all three.

#CONNECTING #THE #DOTS That being the case, its important to ask yourself, your engineers, and your front line very rudimentary questions to identify and mitigate potential blind spots. These very basic discussions can lead to a world of growth, understanding, improved controls, and even increased efficiencies!!

👀 #WANT #MORE #SANCTIONS #GUIDES:

– Like and Follow Crystal Noe, M.S.

– Like and Follow Noe Compliance

– Also, follow NoeCompliance on TikTok

📢 More screening guides and videos are on their way!!

#Russia, #Ukraine, #Cybersecurity, #MoneyLaundering, #Sanctions, #War, #Belarus, #cyberattcks #NLP #Crypto #UkraineCrisis #citi #mufg  #jpmorgan #meta #circle #coinbase #bitcoin U.S. Department of the Treasury #OFAC

RUSSIA SANCTIONS – MINISTRY OF FINANCE OF THE RUSSIAN FEDERATION – NAME SCREENING TESTING GUIDE
🚩#4 Russia Sanctions Testing Guide #4🚩
🔎Does your Filter Detect Variations for “MINISTRY OF FINANCE OF THE RUSSIAN FEDERATION”? OFAC’s does, with scores ranging from 96 to 100. 👊💥Test Your Filter and Verify💥👊

👀 Yesterday, additional names were added to the U.S. Department of the Treasury OFAC list. In reviewing the OFAC entry for “MINISTRY OF FINANCE OF THE RUSSIAN FEDERATION”, I noticed that no AKAs were provided (strong or weak).

Given the length of the entity’s name, its known online name (aliases), the likelihood for its long name being abbreviated, and the fact there were zero weak AKAs provided, 🚦 non-detection of its abbreviated or simple name variations name becomes a gray area for sophisticated institutions bearing greater responsibilities as seen in recent OFAC settlements.

📝HOW TO USE THE GUIDE: Search for the name variations found online, their abbreviated forms, and some that come to mind:

♦️ “Ministry of Finance for the Russian Federation”, 
♦️ “Russian Ministry of Finance”,
♦️ “Finance Ministry of Russia”, 
♦️ “Ministry of Finance RU” 
♦️ “MINFIN”,
♦️ “MOFOTRF”  

🚩NON-DETECTION REMEDIATION: If not generating a match for a variation you believe merits detection, contact your screening vendor to augment screening detection. If your vendor is unable to anything in the short term, add the missed name variation(s) to your in-house screening list as a stop gap.  (Always test to understand the impacts of augmenting your list.)

👀 REMEMBER FILTERS AREN’T LIKE HUMANS: Screening filters are not intuitive, they don’t “see” what you and I “see” and they don’t have common sense.

💡 WANT MORE SANCTIONS GUIDES: Like and Follow 

• Crystal Noe, M.S.
• Noe Compliance
• Follow us on TikTok and Instagram using the icons on the top of the menu bar,

If you would like Noe Compliance to review your filters, please contact us.

📌 DISCLAIMER: 
: These test scenarios don’t focus on typos, testing should always consider fat finger, transliteration, translation, abbreviations, and/or typos.

RUSSIA SANCTIONS – NATIONAL WEALTH FUND OF THE RUSSIAN FEDERATION – NAME SCREENING TESTING GUIDE
🚩🚩🚩Russia Sanctions Testing Guide #3🚩🚩🚩
🔎Does your Filter Detect Variations for ”
NATIONAL WEALTH FUND OF THE RUSSIAN FEDERATION”? OFAC’s does. 👊💥Test Your Filter and Verify💥👊

👀 Yesterday, additional names were added to the OFAC list. In reviewing the U.S. Department of the Treasury OFAC entry for “NATIONAL WEALTH FUND OF THE RUSSIAN FEDERATION”, I noticed that no AKAs were provided (strong or weak).

Given the length of the entity’s name, its known online name (aliases), the likelihood for its long name being abbreviated, and the fact there were zero weak AKAs provided, 🚦 non-detection of its abbreviated or simple name variations name becomes a gray area for sophisticated institutions bearing greater responsibilities as seen in recent OFAC settlements.

📝HOW TO USE THE GUIDE: Search for the name variations found online as well as their abbreviated forms:

♦️ “National Welfare Fund of the Russian Federation”, 
♦️”Russia National Wealth Fund”,
♦️ “National Welfare Fund”,
♦️”National Wealth Fund”,
♦️”NWF”  

🚩NON-DETECTION REMEDIATION: If not generating a match for a variation you believe merits detection, contact your screening vendor to augment screening detection. If your vendor is unable to anything in the short term, add the missed name variation(s) to your in-house screening list as a stop gap.  (Always test to understand the impacts of augmenting your list.)

👀 REMEMBER FILTERS AREN’T LIKE HUMANS: Screening filters are not intuitive, they don’t “see” what you and I “see” and they don’t have common sense.

💡 WANT MORE SANCTIONS GUIDES: Like and Follow 

• Crystal Noe, M.S.
• Noe Compliance
• Follow us on TikTok and Instgram using the icons on the top of the menu bar,

If you would like Noe Compliance to review your filters, please contact us.

📌 DISCLAIMER: 
: These test scenarios don’t focus on typos, testing should always consider fat finger, transliteration, translation, abbreviations, and/or typos.

🔎Russia Sanction Screening Penetration Test Guide🔍
👊💥Ensure your Screening Filter Packs a Punch💥👊

Many of us feel helpless watching the #UkraineCrisis unfold.
🔥🔥!!But, we can make a difference!! We can make sure these sanctions stick it to them. 🔥🔥

And, we can do that by making sure that the names added by the U.S. Department of the Treasury #OFAC and their variations, are stopped in our screening filters!!

📝#HOW #TO #USE #THE #GUIDE: Below is a Screening Penetration Test guide aimed at assessing your filter’s day-to-day effectiveness. The guide was created using one name from the OFAC list. The entity’s names/AKAs contain PAO and/or PJSC, and was selected as they tend to lead to high non-detection rates (entity’s with non-western prefix and suffix corporate identifiers tend to yield high non-detection during testing of most systems). 🤓 The same test should be run for all sanctioned names/aliases containing the long or short form of: OAO OOO, ZAO, IP, and GP as well as any non-western, new, or non- traditional Corp identifier as most name variations with these typically lead to non-detection. 🤓

🚩#NON–#DETECTION #REMEDIATION: For those test scenarios not generating a match, contact your screening vendor to augment screening detection. If your vendor is unable to anything in the short term, add the missed name variations to your in-house screening list as a stop gap.  

💡 #REMEMBER #FILTERS #ARENT #HUMAN: Screening filters are not intuitive, they don’t “see” what you and I “see”. They typically read from left to right, and assume that every known name-variation has been included on your screening lists. Since we know filters aren’t intuitive and that OFAC lists are not exhaustive of all realistic name combinations…things go un-detected.

👀 #WANT #MORE #SANCTIONS #GUIDES:
– Like and Follow Crystal Noe, M.S.
– Like and Follow Noe Compliance
– Also, follow NoeCompliance on TikTok
📢 More screening guides and videos are on their way!!

📌 #DISCLAIMER: These test scenarios don’t focus on typos, but simply re-arranging the words in manners consistent with what I have seen in real life as the root cause of non-detection. For rigorous testing, the test should be run again at least 3 more times to include typos in the name variations: 1) type in first letter of a name, 2) typo in the middle of a name, 3) typo as the last letter of the name, 4.) followed by any combos of those.

#Russia, #Ukraine, #Cybersecurity, #MoneyLaundering, #Sanctions, #War, #Belarus,  #cyberattcks #NLP #Crypto #UkraineCrisis 

More about how this post came to be: While reviewing names on the OFAC list, I am reminded of the many non-detection scenarios I have seen in my career that are caused by Corporate Prefixes/Suffixes such as PJSC, PAO, and PUBLICHNOE AKTSIONERNOY OBSHCHESTVO.  Because screening filters typically read from left to right, they are not intuitive enough to know that PJSC ROSTELEKOM is the same as ROSTELEKOM PJSC. Most would not generate that match. 

Now there are some cases, where an institution or the vendor themselves has created logic for the system to ignore PJSC altogether from the screening text and the list name, and can therefore create these matches. But, honestly that is most often not the case. 

To ensure that your system will detect these like names, test these scenarios. For those scenarios not generating a match, you should ask your screening vendor how to create detection for these variations.  If they are unable to do anything in the short term, add the names to a manual list.