From rule to workflow
A practical decision record for regulatory ambiguity
A framework for converting an unclear compliance question into a documented decision, an operational control, and a review loop
Financial Crime Compliance · Sanctions & Regional Risk
I’m a Senior Analyst in Financial Crime Compliance at Goldman Sachs. I write about what sanctions policy toward Russia and Central Asia does after it is written: the screening it drives, the evidence it demands, and the decisions somebody has to make with the file in front of them.

Rule
Interpret sanctions and financial-crime rules against ambiguous or time-sensitive facts.
Decision
Turn analysis into guidance an operations team can actually follow.
Workflow
Turn the question that keeps coming back into a control that answers it, with an owner attached.
A practical decision record for regulatory ambiguity
A framework for converting an unclear compliance question into a documented decision, an operational control, and a review loop
Transliteration variance as a screening control problem
Sanctions screening matches strings rather than people, and when those strings cross alphabets the quality of the match stops being a vendor default and becomes a design decision
Designing a compliance knowledge system
How repeated questions and exceptions reveal policy ambiguity, training gaps, process defects, and opportunities for better controls
Specifying review as a control, rather than naming one
Putting a person in front of an automated decision controls nothing until somebody defines what that person is looking for, what evidence they hold, and what their disagreement is worth
Why sanctions ownership screening needs its own arithmetic
The beneficial-ownership record kept for due diligence and the ownership test a sanctions program applies read the same cap table with different arithmetic, so a control built for one gives the wrong answer to the other
Export-control review for a firm that moves the money and sees none of the goods
Under the Export Administration Regulations a payments firm's exposure turns on what it knows, and its own post-transaction review is where that knowledge arrives, so the control that matters is the hold between a finding and the next payment
Nationality, residence, and location as three separate sanctions tests
Sanctions rules on Russia ask where a person is from, where they live, and where they are, and an onboarding flow that keeps one country field answers all three with the same fact
Sanctions permissions as an evidence problem across three regimes
A sanctions prohibition is enforced against a list the government publishes, and a permission is enforced against a record the firm keeps, which makes the licence layer of a program an evidence system with an owner, a cap, and an expiry date
Rejecting and freezing as two endings for one refused payment
Rejecting a payment ends a firm's involvement with the money, and freezing one begins a custody relationship that takes in credits, accrues interest, outlives the customer, and reports itself every year, so the two outcomes need separate states on the ledger
Sanctions measures other than the asset freeze, and the systems that have to hold them
Each of the three Russia regimes records, for every person it lists, which prohibition that listing imposes, so a confirmed match answers which measure applies and which system has to enforce it, and an alert queue with two outcomes discards both answers
Secondary sanctions exposure as a property of the firm's own book
A sanctions screen answers whether each payment is permitted, and the US authorities aimed at foreign financial institutions ask whether the firm's own pattern of activity is significant, so a program built from alerts and dispositions holds no instrument that answers the second question
Corridor exposure as an item and counterparty control, with the jurisdiction choosing the evidence
Every published anti-circumvention measure names goods, named counterparties, or a contract term, so a jurisdiction risk score answers a question those measures leave alone, and the control that matches them reads a product code against the party that ordered it
I studied International Relations and Russian at the University of Southern California, and spent a stretch of it in Kazakhstan. What that training really teaches you is how to read an institution: what it says, what it does, and the distance between the two. Compliance runs on the same habit. Separate the rule from the assumption, find the decision hiding inside the question, and write the answer so somebody can act on it.
Senior Analyst, Financial Crime Compliance