Free CGSS Practice Questions: Detecting and Investigating Sanctions Evasion Techniques

Use this focused CGSS page as a short practice test for Detecting and Investigating Sanctions Evasion Techniques. The items are original Finance Prep sample exam questions built for scenario-based practice, not trivia, puzzle questions, official ACAMS questions, copied live-exam content, or exam dumps.

Topic snapshot

Sample questions

These are original Finance Prep practice questions aligned to this topic area. They are not official ACAMS questions, copied live-exam content, or exam dumps. Use them to preview question style and explanation depth before continuing with topic drills, mixed sets, and timed mock exams in Finance Prep.

Question 1

Topic: Detecting and Investigating Sanctions Evasion Techniques

A bank is reviewing export financing for high-pressure wellhead valves. The sanctions regime applicable to the bank prohibits supplying these valves for energy projects in Country X and prohibits dealings involving designated Company S.

The file includes these facts:

• Original documents listed a water-project end user in Country B and a direct route to Country B.
• Revised documents describe the goods only as “machine parts,” remove the project and end-user names, and show a free-zone consignee with “final consignee to be advised.”
• The customer says the route changed because the original vessel was cancelled and separately disputes demurrage charges.
• Payment is now coming from an unrelated trading company that uses the same address and phone number as Company S’s known procurement affiliate.

What is the best compliance conclusion?

• A. Escalate as potential trade-related sanctions evasion and hold processing pending sanctions review.
• B. Classify the matter as a commercial dispute over demurrage and continue processing.
• C. Treat the matter as a routine logistics rerouting caused by the vessel cancellation.
• D. Clear the shipment after updating the missing end-use certificate and vessel details.

Best answer: A

What this tests: Detecting and Investigating Sanctions Evasion Techniques

Explanation: Trade-related sanctions evasion is suggested by facts that obscure a prohibited end use, end user, goods description, route, or payment party within a sanctions-relevant context. Here, the applicable restriction covers the exact goods when tied to Country X energy projects or designated Company S. Ordinary issues are present, including a vessel cancellation and a demurrage dispute, but they do not explain the removal of end-user and project details, the generic goods description, the free-zone routing with no final consignee, or payment from a third party linked by identifiers to Company S’s procurement affiliate. Those facts require a hold and escalation before financing, shipment, or payment processing continues.

• Name screening alone is not enough when trade documents and payment facts suggest concealed end use or end user.
• A vessel cancellation can explain a route change, but not removal of end-user details or generic goods descriptions.
• A demurrage dispute may be ordinary commercial noise; it does not resolve sanctions red flags tied to prohibited trade activity.

The combined document changes, concealed end-user details, free-zone routing, and third-party payer links point to possible evasion of a relevant trade restriction.

Question 2

Topic: Detecting and Investigating Sanctions Evasion Techniques

A bank froze a custody account after the account holder was added to an applicable sanctions list. The account holds listed securities and cash dividends received after the freeze. The customer’s lawyer provides a time-limited license from the competent sanctions authority that permits the bank to sell the listed securities to a non-sanctioned buyer and credit the sale proceeds to the existing frozen account. The license does not authorize releasing funds to the customer or lifting the freeze. The lawyer asks the bank to transfer the sale proceeds to the customer’s overseas account after settlement.

Which action best fits the facts?

• A. Reject the sale because all activity involving frozen assets is prohibited until delisting occurs.
• B. Treat the sale proceeds as ordinary account activity once the buyer is screened as non-sanctioned.
• C. Unfreeze the account because the authority has approved a sale of the securities.
• D. Process the securities sale only within the license terms and keep the proceeds in the frozen account.

Best answer: D

What this tests: Detecting and Investigating Sanctions Evasion Techniques

Explanation: A divestment authorization allows a specific transaction involving restricted assets, such as selling securities, but it is not the same as unfreezing the account or releasing value to the sanctioned customer. The bank should follow the exact scope, conditions, timing, documentation, and reporting requirements of the license. Because the license says the proceeds must be credited to the frozen account and does not authorize release, the funds remain subject to frozen-asset controls after settlement. Screening the buyer and documenting the transaction support compliance, but they do not convert the proceeds into ordinary account activity.

• Treating sale approval as full unfreezing ignores the limited scope of the license.
• Refusing all activity is too broad because licensed activity can permit a controlled divestment.
• Buyer screening is necessary, but it does not remove the freeze or permit payment to the sanctioned customer.

The license permits a controlled divestment but does not authorize unfreezing or ordinary release of the proceeds.

Question 3

Topic: Detecting and Investigating Sanctions Evasion Techniques

A securities firm screens its daily sanctions list update and identifies that an existing client was added overnight to a sanctions list that applies to the firm’s booking jurisdiction. The client holds an investment account with a cash balance and listed securities. A standing instruction to transfer cash out is pending settlement today. There is no license or exemption, and legal confirms the listing is a true match. Which response best supports proper frozen asset management?

• A. Close the account and return the cash balance to the client after documenting the sanctions match.
• B. Allow the transfer to proceed if the client certifies that the funds will not be sent to a sanctioned jurisdiction.
• C. Reject only the pending transfer and keep the securities available for sale because no new transaction has settled.
• D. Freeze the account immediately, stop the outgoing transfer, prevent any debit or disposal of the securities, maintain records, and submit the required frozen-asset report to the competent authority.

Best answer: D

What this tests: Detecting and Investigating Sanctions Evasion Techniques

Explanation: Proper frozen asset management requires more than stopping one payment. Once a true match to an applicable sanctions list is confirmed and no license or exemption applies, the firm must prevent the sanctioned person from accessing, moving, selling, pledging, or otherwise dealing in the assets. The firm should place effective restrictions on the account, stop pending debits or transfers, preserve the assets according to applicable rules, keep clear records of the freeze, and report the frozen assets to the competent authority as required. Customer statements or operational convenience do not override the freeze.

• Rejecting only the pending transfer is incomplete because the securities and cash must also be controlled against disposal or access.
• Closing the account and returning funds would release assets to a sanctioned person, which is inconsistent with a freeze.
• A customer certification does not replace sanctions authority, licensing, reporting, and asset-control requirements.

A confirmed listed-party match requires blocking control over the assets, no unauthorized movement, documented records, and reporting to the relevant authority.

Question 4

Topic: Detecting and Investigating Sanctions Evasion Techniques

A sanctions investigator is reviewing whether several unusual facts are connected or merely weak standalone indicators. What does the exhibit support?

• Payment facts:

  • A third-party payer, Mira Trading FZE, paid an invoice issued to Baltic Tools OU.
  • The wire reference included PO-8841, the same purchase order number later found in a customer support ticket about a cryptoasset settlement.

• Trade facts:

  • The invoice describes the goods as industrial controllers.
  • The first draft shipping instruction named Severo Machinery LLC as end user, but the final document replaced it with Orion Engineering two days after Severo appeared on a sanctions list.

• Ownership facts:

  • Mira Trading and Orion Engineering share the same director and office address.
  • Severo’s former majority owner transferred shares to a nominee shortly after designation but retained a power of attorney over Orion’s bank account.

• Cryptoasset facts:

  • The support ticket says the “remaining balance for PO-8841” was paid to a wallet controlled by Orion.
  • Blockchain analytics show recent upstream funding from a wallet cluster associated with Severo’s procurement network.

• A. A linked sanctions evasion pattern involving document changes, third-party payment, retained control, and cryptoasset settlement

• B. A routine payment-screening false positive caused mainly by a third-party payer and abbreviated trade-party names

• C. An unrelated set of weak indicators because each fact could have a legitimate explanation when viewed separately

• D. A trade documentation quality issue that should be resolved by obtaining a corrected final invoice only

Best answer: A

What this tests: Detecting and Investigating Sanctions Evasion Techniques

Explanation: Sanctions evasion analysis looks for connections among indicators, not just whether each indicator is suspicious in isolation. Here, multiple facts converge on the same transaction and parties: the same purchase order appears in the wire and cryptoasset ticket, the end user changed immediately after a designation, the substitute parties share management and address links, the sanctioned party’s former owner retained banking authority, and cryptoasset funding traces back to an associated procurement network. Those links support a coordinated effort to continue activity through substituted parties, altered documents, third-party payment, ownership or control restructuring, and cryptoasset settlement. A single third-party payment or document change might be weak alone, but the combined pattern is stronger evidence of sanctions evasion.

• Treating the facts as unrelated overlooks the shared purchase order, party links, retained control, and cryptoasset trail.
• Calling it a payment-screening false positive focuses too narrowly on the wire and ignores trade, ownership, and cryptoasset evidence.
• Limiting the matter to invoice correction misses the substituted end user and control indicators tied to a sanctioned network.

The same purchase order, substituted end user, shared control links, retained banking authority, and connected cryptoasset flow tie the indicators into one coherent evasion pattern.

Question 5

Topic: Detecting and Investigating Sanctions Evasion Techniques

A sanctions investigator is preparing to escalate a case. Review the case note:

• Alert: The customer’s outgoing payment message names Baltic Agents OU as beneficiary and describes “machine spares.”
• Invoice: Attached invoice lists the vessel MV Volga Star and consignee Nord Machinery LLC, neither named in the payment message.
• Screening result: MV Volga Star produced a high-confidence vessel match to a current sanctions list; the screenshot shows the list source and update date.
• Ownership review: A registry extract and vendor report show Baltic Agents OU is majority-owned through an intermediate company by a listed individual.
• Investigation status: The investigator documented possible omission of vessel details and indirect ownership risk; legal review is pending.

Which recordkeeping action does this case note best support?

• A. Create a case-file entry retaining the alert output, source documents, list version and timestamps, ownership evidence, analysis, decision, and approvals.
• B. Retain only the final legal decision and remove payment, invoice, and registry extracts as duplicate working material.
• C. Replace the internal analysis with the customer’s attestation and mark the intermediary for lower future screening.
• D. Create a closing note stating that the customer is not directly listed, with no further attachment of source documents or analysis.

Best answer: A

What this tests: Detecting and Investigating Sanctions Evasion Techniques

Explanation: A sanctions investigation file should allow an independent reviewer to understand what was found, why it mattered, and how the case was resolved. Here, the case note contains several evidence points: payment-message omissions, a vessel screening match, source-list context, registry and vendor ownership records, and the investigator’s rationale for escalation. The best recordkeeping action is to preserve the underlying evidence together with the analysis, timestamps, list version or update information, decision, and approval trail. Keeping only a conclusion, or relying on the fact that the customer is not directly listed, would not show how the indirect ownership and vessel concerns were evaluated. Customer attestations may supplement due diligence, but they do not replace sanctions screening records and investigation rationale.

• Closing based only on the customer not being directly listed ignores vessel and indirect ownership evidence.
• Keeping only the final legal decision does not preserve the documents needed to reconstruct the investigation.
• Customer attestations can support due diligence but cannot replace internal sanctions evidence and analysis.
• Comprehensive case-file retention preserves the facts, rationale, decision path, and approval trail.

This preserves both the evidence and the reasoning needed to support escalation, final disposition, and later review.

Question 6

Topic: Detecting and Investigating Sanctions Evasion Techniques

A sanctions investigator at a global bank reviews a held import payment. The customer asks operations to remove a shipping reference so the payment can clear.

• Payment purpose: Ocean freight for vessel Sea Falcon, IMO 9234567
• Beneficiary: Freight agent not found on any sanctions list
• Screening result: Listed vessel SEA FALCON, IMO 9234567, subject to asset-freeze restrictions in the bank’s booking jurisdiction
• Customer note: “The vessel name is only a transport reference; please resend the payment without it.”

Which investigation step best fits the sanctions concern?

• A. Maintain the hold, preserve the original and amended instructions, and escalate for a sanctions determination based on the IMO match and removal request.
• B. Clear the payment because the freight agent is not listed and the vessel is not the named beneficiary.
• C. Ask the customer for a revised invoice that omits the vessel name, then rescreen the payment.
• D. Close the alert as a false positive because the customer provided a business explanation for the vessel reference.

Best answer: A

What this tests: Detecting and Investigating Sanctions Evasion Techniques

Explanation: A vessel’s IMO number is a strong identifier, so an exact match to a listed vessel cannot be treated as a minor name similarity. The customer’s request to remove the vessel reference heightens the concern because it may indicate an attempt to strip sanctions-relevant information from the payment. The appropriate step is to keep the transaction from moving, preserve the evidence, and escalate for a documented sanctions determination under the applicable restrictions. The fact that the freight agent is not listed does not resolve the issue, because sanctions risk can arise from the vessel, goods, routing, ownership, control, or other parties involved in the transaction.

• Focusing only on the freight agent misses the listed vessel involvement and the exact IMO match.
• Requesting a clean invoice would weaken the audit trail and could assist sanctions evasion.
• A customer explanation may be considered, but it does not overcome an exact identifier match and a request to remove relevant information.

The exact vessel identifier and request to remove the reference create a sanctions concern that requires documented escalation before any release.

Question 7

Topic: Detecting and Investigating Sanctions Evasion Techniques

A bank receives a mandatory sanctions list update in a jurisdiction where funds and economic resources of listed persons, and entities they own or control, must be frozen immediately. The rule also states that a listed person’s indirect ownership above 50% creates ownership by the listed person unless a license or exemption applies.

A customer, Northbay Minerals Ltd., has a $3.8 million operating account and a pending outgoing wire to a supplier. Updated corporate records show that a newly listed individual owns 60% of Northbay through two holding companies. The match has been confirmed using date of birth, passport number, and address. No license or exemption is on file. The relationship manager asks whether the bank should close the account and return the balance to a non-listed minority shareholder.

What is the best action?

• A. Wait for the customer to provide an ownership attestation before taking restrictive action because the ownership is held through intermediaries.
• B. Freeze the account and pending wire immediately, prevent any unauthorized movement of value, preserve records, escalate internally, and report the frozen assets as required by the competent authority.
• C. Process the pending wire but restrict future activity because the payment beneficiary is not identified as a listed party.
• D. Close the account and send the balance to the non-listed minority shareholder because the customer itself is not named on the sanctions list.

Best answer: B

What this tests: Detecting and Investigating Sanctions Evasion Techniques

Explanation: When a sanctions rule requires freezing assets owned or controlled by listed persons, the obligation usually applies to entities connected through qualifying direct or indirect ownership or control, not only to names appearing directly on a list. Here, the listed individual’s confirmed 60% indirect ownership and the absence of a license or exemption make the customer’s account and pending payment subject to immediate freeze controls. Operationally, the institution should prevent unauthorized debits, transfers, withdrawals, setoffs, or other movement of value; maintain records; escalate to sanctions/legal specialists; and complete required reporting to the competent authority. Closing the account or rerouting funds can itself make assets available contrary to the freeze.

• Sending funds to a minority shareholder would move frozen value and does not cure the listed person’s ownership interest.
• Paying an apparently non-listed supplier still releases value from assets subject to a freeze unless authorized.
• Customer attestations can support due diligence, but confirmed ownership records and a mandatory freeze rule require immediate action.

The confirmed indirect majority ownership connects the customer’s assets to a sanctions target, requiring an immediate freeze, controlled administration, escalation, and required reporting.

Question 8

Topic: Detecting and Investigating Sanctions Evasion Techniques

A sanctions investigator reviews a trade finance file for a customer exporting industrial pressure sensors.

• Invoice: goods sold to a distributor in Country A, with final destination: Country A.
• Packing list: shipment to be consolidated and re-exported after arrival.
• Logistics booking: route includes a free-trade zone in Country B near the border with Country C.
• Sanctions note: Country C is subject to sanctions prohibiting unlicensed exports or re-exports by the bank’s relevant authorities.
• End-user certificate: signed by the distributor, but no operating end user is identified.
• Product sheet: sensors can be used in industrial drones and guidance systems.
• Customer response: final end-user details are “commercially sensitive” and will not be provided.

Which trade due diligence concern do these notes most directly support?

• A. Possible concealment of the final end user or end use, with diversion risk through re-export to sanctioned Country C.
• B. A customs valuation concern based on inconsistent pricing for the exported sensors.
• C. A beneficial ownership concern showing the distributor is owned or controlled by a sanctioned party.
• D. A payment-screening concern involving omitted originator or beneficiary information.

Best answer: A

What this tests: Detecting and Investigating Sanctions Evasion Techniques

Explanation: Trade due diligence should look beyond the immediate buyer when documents indicate possible re-export, sensitive goods, missing end-user information, or routing through a high-risk transshipment point. Here, the distributor is not enough to resolve the risk because the records point to possible diversion: the goods may be dual-use, the shipment will be consolidated and re-exported, the route is close to a sanctioned jurisdiction, and the customer will not identify the operating end user. These facts support escalation for end-use and end-user verification before financing or processing the trade activity.

• Ownership or control analysis would require ownership facts; the file does not show that the distributor is owned or controlled by a sanctioned party.
• Payment-screening issues involve payment-message data, such as missing or altered parties; no such payment data is provided.
• Customs valuation concerns require price, tariff, or valuation inconsistencies; the decisive facts relate to diversion, end use, and end-user concealment.

The re-export language, border routing, sensitive goods, missing operating end user, and refusal to provide details collectively support a concealed end-use or end-user concern.

Question 9

Topic: Detecting and Investigating Sanctions Evasion Techniques

A virtual asset service provider is reviewing a new corporate customer’s attempted deposit. The customer and its directors are not on any sanctions list, and the deposit address itself is not listed. Blockchain analytics shows the funds moved from a wallet attributed to a sanctioned ransomware group, through a mixer, then through two short-hop wallets before reaching the customer’s deposit address. The customer immediately requests conversion to a privacy coin and withdrawal to a newly created self-hosted wallet. When asked for source-of-funds evidence, the customer provides only a short statement that the activity is “market arbitrage.”

What is the best sanctions compliance conclusion?

• A. Clear the activity because neither the customer name nor the deposit address is directly listed on a sanctions list.
• B. Handle the matter only as a generic AML unusual-activity alert because sanctions controls apply only to fiat payments.
• C. Process the withdrawal after documenting the customer’s arbitrage explanation as enhanced due diligence.
• D. Treat the activity as potential sanctions evasion, restrict processing pending review, preserve the blockchain evidence, and escalate for sanctions reporting or blocking analysis.

Best answer: D

What this tests: Detecting and Investigating Sanctions Evasion Techniques

Explanation: Virtual asset sanctions risk is not limited to exact name matches or directly listed wallet addresses. Sanctions evasion can involve mixers, peel chains, short-hop wallets, privacy coins, rapid conversion, newly created self-hosted wallets, and weak or unsupported source-of-funds explanations. Here, the on-chain path from a sanctioned ransomware-linked wallet, followed by concealment techniques and immediate withdrawal behavior, supports a sanctions escalation. The appropriate response is to restrict processing while the matter is reviewed, retain the blockchain and customer evidence, and determine applicable blocking, freezing, rejection, or reporting obligations under the institution’s authority and procedures.

• A clean customer-name screen does not resolve exposure to a sanctioned wallet or sanctions evasion typologies.
• A brief arbitrage explanation is not enough when the transaction pattern shows concealment and sanctioned-source exposure.
• Virtual asset activity can create sanctions obligations; it is not only an AML monitoring issue or limited to fiat transfers.

The mixer use, short-hop movement from a sanctioned wallet, privacy-coin conversion, and weak source-of-funds response together indicate potential virtual asset sanctions evasion.

Question 10

Topic: Detecting and Investigating Sanctions Evasion Techniques

During an overnight sanctions list update, a broker-dealer identifies a potential issue with Atlas Trading Ltd., an existing corporate client. Review of current registry records and board documents confirms that a newly designated individual owns 60% of Atlas and can appoint its chief executive. Atlas is not separately named on the list. The account holds cash and securities, and the trading desk has a pending sell order that Atlas submitted before the designation. No license or exemption has been identified. Applicable rules and firm policy require assets owned or controlled by a sanctions target to be frozen and reported to the competent authority. What is the best next action?

• A. Execute the pending sell order because it was submitted before the designation, then hold only the sale proceeds until legal review is complete.
• B. Freeze the Atlas account and pending sell order, prevent any movement or disposal of assets, document the ownership/control basis, and escalate for required reporting.
• C. Close the Atlas account and return the cash and securities because Atlas is not separately named on the sanctions list.
• D. Ask the relationship manager to notify Atlas and obtain an updated ownership attestation before applying account restrictions.

Best answer: B

What this tests: Detecting and Investigating Sanctions Evasion Techniques

Explanation: Freezing obligations apply not only to named sanctions targets but also to assets owned or controlled by them when the applicable regime and policy require that treatment. Once the broker-dealer verifies the ownership/control link and no license or exemption applies, it should stop pending activity, restrict account movement, preserve the assets, document the basis for the decision, and escalate for required regulatory and internal reporting. A pending order does not become permissible merely because it was submitted before the designation if execution would involve dealing in frozen assets. Operational handling should also avoid unauthorized liquidation, return of assets, or customer communication that could undermine restrictions or investigation integrity.

• Executing the sell order would involve dealing in restricted assets after the designation, even if the instruction arrived earlier.
• Returning or closing out the account ignores the confirmed ownership/control connection to the designated person.
• Seeking an attestation before restricting the account delays the required freeze and may create inappropriate target notification risk.

Atlas is owned and controlled by a designated person, so the assets and pending activity must be frozen and handled through documented escalation and reporting.

Continue in the web app

Use Finance Prep for interactive CGSS practice with mixed sets, timed mock exams, topic drills, explanations, and progress tracking.

Related focused pages

• Free ACAMS CGSS Practice Exam: Global Sanctions
• Free CGSS Practice Questions: Sanctions Frameworks and Governance
• Free CGSS Practice Questions: Building a Sanctions Compliance Program

Practice next step

Use the Finance Prep web app above when you want interactive practice beyond this static page.