A permitted payment can sanction the firm

Bottom line

A sanctions program is built around one question, asked of each payment: does a rule prohibit this. The US authorities aimed at foreign financial institutions ask a second question, and they ask it about the firm. Section 11 of Executive Order 14024, added by Executive Order 14114, lets Treasury restrict or close a non-US institution’s US correspondent accounts, or block its property, on a determination that the institution conducted or facilitated any significant transaction involving Russia’s military-industrial base. OFAC reads that term to reach every person blocked under the order, plus anyone operating in five named sectors of the Russian economy, and applies it in any currency. The order provides that such a determination needs no prior notice. Public Law 119-111, enacted September 18, 2026, adds a statutory version with a mandatory default and a class defined by ownership. So a payment can clear every screen the firm runs, sit outside every prohibition the firm is subject to, and still be one of the facts that produces the determination. Exposure of that kind is a property of the firm’s own book, measured in value, frequency, and counterparty class, and a program of alerts and dispositions holds nothing that measures it.

1. Two questions, and one screen

The first question is about an act: whether a rule reaches this payment, for this firm, today. A list answers it at the moment of the act, and the answer is a disposition. Every instrument a screening program owns exists to produce it, and the ten pieces before this one are about getting it right. The second question is about the firm: what its activity amounts to, in another government’s judgment, later.

	The transaction question	The firm question
What is being assessed	One payment, or one relationship	A pattern of activity across a period
Who asks	The firm, of itself, before acting	A foreign authority, of the firm, afterward
What settles it	A list, a measure, and an authority	Value, count, frequency, nature, and management’s awareness
What a correct answer produces	A payment made or refused, with the basis recorded	A record of what the firm knew about its own book
What goes wrong on a miss	A prohibited act	A correspondent account closed, or the firm’s property blocked

A firm can answer the first question perfectly and hold no answer at all to the second. That is the ordinary case rather than an alarming one, since nothing in the left column produces the right.

2. What binds, and what advises

Read by layer, as From rule to workflow uses the word:

Law. Executive Order 14114 of December 22, 2023 added a new section 11 to Executive Order 14024. Its subsection (a) authorizes the Secretary of the Treasury to impose the sanctions in subsection (b) on a foreign financial institution “upon determining” that it has conducted or facilitated any significant transaction for or on behalf of a person designated for operating in the technology, defense and related materiel, construction, aerospace, or manufacturing sectors of the Russian economy, or any significant transaction, or any service, involving Russia’s military-industrial base, including the supply of items Treasury determines. Subsection (b) offers two remedies: prohibiting the opening of, or prohibiting or imposing strict conditions on the maintenance of, correspondent or payable-through accounts in the United States; or blocking all property and interests in property in the United States. Subsection (f) reads “foreign financial institution” to cover money services businesses, operators of credit card systems, securities brokers and dealers, insurers, and holding companies, affiliates, or subsidiaries of any of those, which places most of the payments industry inside it. Section 2 of the same order rewrote section 7 of Executive Order 14024 so that “there need be no prior notice of a listing or determination made pursuant to section 1 or section 11 of this order.” Public Law 119-111, the Lindsey O. Graham Sanctioning Russia and Iran Act of 2026, adds a statutory track: section 103(a)(1) directs the President, within 30 days of the September 18, 2026 enactment, to impose all of the sanctions in section 103(d) on any foreign financial institution engaging in significant transactions with a defined set of Russian institutions, and 103(d) bundles blocking, two or more CAATSA sanctions, and the correspondent-account prohibition together rather than offering a menu.
Guidance. OFAC’s sanctions advisory of June 12, 2024, Updated Guidance for Foreign Financial Institutions on OFAC Sanctions Authorities Targeting Support to Russia’s Military-Industrial Base, carries the operational content: the revised reading of the term, examples of exposing activity, examples of controls, three sketches of a high-risk institution, and the permissible transactions. Frequently Asked Question 1151 states how OFAC reads “significant transaction or transactions,” 1181 records the June 12, 2024 revision, and 1152 confirms that the provisions apply in any currency. Guidance of this kind carries no binding force, and it remains the clearest public account of how the authority is meant to be read.
Policy. Which classes the firm measures, how often, at what granularity, which level of each it has decided to carry, what happens at that level, and who reads the number. Each of those is a choice with a cost in revenue, and each belongs in the policy with an owner and a reason.
Convention. Running the screen, closing the queue, and reporting the program complete. Also the habit of answering a question about exposure with the absence of a prohibition, which is the layer this piece argues against, because the two sentences address different questions.

3. The population is a class, a sector, and a list of items

A screen needs a list of names. The authority supplies one list of names and two things that are structurally something else.

Blocked persons. Since June 12, 2024, OFAC reads Russia’s military-industrial base to include all persons blocked under Executive Order 14024. This part is a list, the program already holds it, and the ordinary screen covers it.

The specified sectors. The same reading reaches any person operating in the technology, defense and related materiel, construction, aerospace, and manufacturing sectors of the Russian economy. Five sectors of an economy form a population with no published roster. What identifies a member is an attribute of its business, which arrives, where it arrives at all, through registry data, trade documents, invoice descriptions, and what the customer says about itself.

The specified items. OFAC’s determination of December 22, 2023 under section 11(a)(ii) carries an annex of items whose supply to Russia can expose an institution. Eight categories hold twenty-nine item lines.

Category	Item lines
Certain machine tools and manufacturing equipment	CNC machine tools, additive manufacturing machine tools, semiconductor manufacturing equipment
Certain manufacturing materials for semiconductors and related electronics	Silicon boules, silicon wafers, photoresist materials, bare printed circuit boards, printed circuit board substrates
Certain electronic test equipment	Oscilloscopes, automated test equipment, data acquisition systems, signal generators, pulse generators, spectrum analyzers
Certain propellants, chemical precursors for propellants and explosives	Nitrocellulose, smokeless powder, RDX, HMX
Certain lubricants and lubricant additives	Turbine oil, turbine oil additives
Certain bearings	High-precision ball and roller bearings, angular contact bearings
Certain advanced optical systems	Thermal sights, thermal imaging arrays, infrared focal plane arrays, image intensifier tubes
Certain navigation instruments	Inertial navigation systems, inertial measurement units, fiber-optic gyroscopes

The format is the point. These are item names in plain words, carrying no Harmonized System codes, and OFAC draws the contrast itself. Its advisory describes the Common High Priority Items List, the four-tier list of fifty six-digit HS codes that Commerce maintains with the European Union, Japan, and the United Kingdom, as “intended for exporters, reexporters, and customs officials,” while the specified items list “is intended for use by financial institutions in implementing controls to mitigate sanctions risks.” A payments firm holds invoice lines, payment references, merchant descriptors, and whatever its onboarding asked about the business; HS codes reach it rarely. The list written in words is the one its own data can meet, and matching a word list against free text is a different engineering job from matching a name list against a party record.

The statutory class. Section 103 of Public Law 119-111 defines its population a third way. The exposure runs to any foreign financial institution engaging in significant transactions with three named Russian banks, with “any other financial institution organized under the laws of the Russian Federation and owned in whole or in part by the Government of the Russian Federation,” and with any subsidiary or successor of those. Any state stake at all puts a Russian-law institution inside the class. Section 104 of the same statute reaches entities in which the Russian state holds a “controlling or majority ownership interest” or that are “otherwise affiliated” with it. Set those beside OFAC’s 50 percent rule and one cap table faces four thresholds: any stake, a controlling or majority interest, 50 percent in the aggregate, and affiliation. That is the compounding problem One cap table, several answers describes, and here it decides which authority is asking about the firm itself. A record that stores a state holding as a flag answers one of the four.

4. Significance is a property of the book

FAQ 1151 says OFAC assesses whether a transaction is significant on the totality of the facts and circumstances, and lists factors that may include the size, number, and frequency of the transactions, their nature, the awareness of management, the pattern of conduct, any link to a sanctioned person, the use of deceptive practices, and the impact on US national security objectives.

Read that list as a specification for a control and three things follow.

The measured object is an aggregate. Size, number, frequency, and pattern are properties of a set of payments. No single payment carries them, so no transaction-level control produces them, and a firm holding only transaction-level controls holds no instrument of the right shape.

The alert count describes the screen. Alerts rise and fall with list coverage, vendor configuration, and match thresholds. Two of the three populations above generate no alerts at all, so a quarter with a quiet queue and heavy in-class activity reads as a good quarter and is the dangerous one.

Awareness of management is part of the record. The factor appears in OFAC’s own list, which makes the reading of the number, by a named person, on a date, a component of the control rather than a courtesy to the committee. A number produced and left unread is worse than a missing one, because the record then shows the firm held the facts. The reader needs a brief of the kind A human in the loop needs a job description specifies: what they are looking at, what level obliges them to act, and what their decision changes.

OFAC describes the instrument it has in mind, and it is explicit that the instrument sits elsewhere in the organization. Proactive investigations into suspected sanctions evasion, the advisory says, “are often conducted within a bank’s anti-financial crime division, as they involve post-transaction reviews for typologies, networks, and/or suspicious activity, as opposed to real-time, list-based screening.” The advisory’s examples of controls run the same way: reviewing the customer base to determine exposure, communicating compliance expectations to customers, sending questionnaires to customers known to deal in the specified items, obtaining attestations from higher-risk customers, using open-source information and past transactional activity for proactive investigations, folding these risks into risk assessments and customer risk ratings, and applying mitigation measures that include restricting accounts, limiting permissible activity, exiting relationships, and maintaining internal lists of parties the firm declines to onboard or to process. Every item on that list measures or bounds a population. None of them closes an alert.

5. A determination arrives without notice, so the measurement is self-administered

Section 2 of Executive Order 14114 settles what a firm may wait for. There need be no prior notice of a determination under section 11. There is also no list of institutions under assessment, no inquiry the firm receives, and no currency or jurisdictional filter it might fall outside, since FAQ 1152 confirms the provisions apply in any currency. A firm whose own prohibition analysis returns a clean answer on every payment holds exactly the same exposure as before it ran the analysis.

One signal does reach the firm, and the advisory makes it count. Its third sketch of a high-risk institution is a bank that frequently sent transactions through its foreign correspondent account for customers later blocked under Executive Order 14024, and that gave an unsatisfactory answer when its correspondent asked why so many of its customers had subsequently been sanctioned. A request for information is the one place the firm’s own account of its book becomes visible to somebody else, which makes the quality and the speed of that answer part of the control rather than a service matter.

The remedy decides where the control is owned. Subsection (b) reaches the firm’s US correspondent and payable-through accounts, and General License 84 authorizes US financial institutions to close such an account within ten days once the prohibition applies. The asset at stake belongs to treasury and to partnerships. That is the same reasoning A listing carries its own prohibition applies to measures that reach acts outside the payment path: the measure picks the system, and here it picks a function that reads no alert queue.

Classes defined from the authorities: blocked persons, specified sectors, specified items, statutory class
The firm's own book measured against each class, by value, count, and counterparty
The authorized share of each class separated out, with the authority cited
The number read by its named owner on a date, against a level the firm has decided to carry
Mitigation, exit, or acceptance recorded as a decision with an author

6. The other two regimes act by publishing a list

The Union and the United Kingdom reach a third-country payments institution as well, and they do it in the opposite order.

	United States	European Union	United Kingdom
The instrument	A determination about the firm under section 11 of Executive Order 14024	A listing of the firm in an annex to Regulation 833/2014	A designation of the firm under the Russia Regulations
Who is bound	Treasury acts against the firm’s US accounts and property	Union operators, who are barred from transacting with the listed firm	UK credit and financial institutions, barred from correspondent relationships and from processing payments
When the firm learns	At the determination, with no prior notice owed	At publication, with an entry-into-force date beside the name	At publication, with the measure recorded in the entry
What the firm can monitor	Its own book	Its own book, and the annex	Its own book, and the list

Article 5ad of Regulation 833/2014 bars any direct or indirect transaction with a credit or financial institution, or an entity providing crypto-asset services or payment services, established outside the Union, where it serves persons listed under Regulation 833/2014 or Regulation 269/2014 or is “otherwise significantly frustrating the purpose of the prohibitions in those Regulations” — and then the operative words, “as listed in Part A of Annex XLV.” Three further criteria fill Parts B, C, and D. In each case the firm’s conduct is the listing criterion, and the legal effect arrives with the listing. Annex XLV records an entry into force beside each name, entries join and leave it by amendment, and Article 5ad(3) carries wind-down paragraphs tied to contracts concluded before a stated date, so the Union’s instrument has a published start, a published end, and a transition. Dated permissions of that kind are the evidence problem A licence leaves the proof with the firm takes up.

Regulation 17A of the Russia (Sanctions) (EU Exit) Regulations 2019 runs the same way: it bars a UK credit or financial institution from establishing or continuing a correspondent banking relationship with, or processing a payment to, from, or via, a designated person or an institution owned or controlled by one, where it knows or has reasonable cause to suspect as much. The designated person is one designated under regulation 5 for the purposes of that regulation, so the gate is a published designation and the prohibition falls on UK institutions.

A Union-licensed firm does carry one exposure of its own shape. Article 12 bars participating “knowingly and intentionally” in activities whose object or effect is circumvention, including participating “without deliberately seeking that object or effect but being aware that the participation may have that object or effect and accepting that possibility.” That question is about the firm’s conduct rather than about a counterparty’s name, and the measurement this piece describes is the instrument that answers it.

Here is the asymmetry that justifies the whole exercise. For every counterparty the firm screens, all three regimes present a list problem, and list problems are what a screening program solves. For the firm itself, two of the three stay list problems, visible in advance to the firm and to everyone else at the same moment. The third is a judgment about the firm that arrives complete. A firm can monitor a list on behalf of its counterparties. On its own behalf it has its book.

Measuring exposure to a class and stopping there produces a number that overstates what the firm carries, and the usual response to an overstated number is to exit the corridor. The correction belongs inside the measurement rather than beside it.

OFAC’s position is that foreign persons face no sanctions risk for engaging in transactions authorized for US persons under the Russia program’s general licenses, or exempt from it. Its advisory frames the risk as reaching an institution except where it is solely facilitating permissible transactions such as those related to food, agriculture, medicine, energy, and telecommunications, and FAQ 1182 names the authorizations an institution may rely on: General License 6D for agricultural commodities and equipment, medicine, medical devices, their replacement parts, and medical device software updates; General License 8J for energy; General License 25C for telecommunications and internet-based communications; General License 27 for certain non-governmental organization activity; General License 20 for the official business of third-country diplomatic and consular missions in Russia; and 31 CFR 587.510 for certain international organizations. The International Emergency Economic Powers Act separately exempts informational materials and transactions ordinarily incident to travel.

The statute carries its own version, and the difference in layer matters. Section 114(a) of Public Law 119-111 places outside the title’s sanctions and other measures the conduct or facilitation of a transaction for agricultural commodities, food, medicine, medical devices, humanitarian assistance, or humanitarian purposes, together with transactions necessary for or related to those. A general license is an instrument OFAC may amend or let lapse; a statutory exception is one Congress wrote, and withdrawing it takes an act. Two carve-outs of similar scope, with different owners and different notice, which is exactly the distinction a decision record is for.

So the measurement has two columns rather than one: activity inside a class, and the share of it resting on a named authorization or exception, with the citation recorded on each payment. A firm that reports only the first column has built an argument for de-risking and called it a risk metric. The warning against indiscriminate exit that the 2022 joint alert makes about corridor geography, discussed in Knowledge arrives after the payment, applies to a number this easy to misread.

A worked hypothetical

The following scenario is hypothetical and is included only to illustrate the framework. The firm, its customers, and its counterparties below are invented.

A payment institution licensed in an EU member state, with a UK subsidiary, serves marketplaces and merchants across the Caucasus and Central Asia. It screens customers, payers, and payees at onboarding and again at payment, against a consolidated feed of asset-freeze listings from the three regimes, and its analysts close each alert as a release or as a freeze with a report. It holds US dollar clearing through two correspondent banks, and most of its volume settles in euros and in local currencies. Over one quarter the queue is quiet and every analyst conclusion is correct. Four things are true of the book.

What is in the book	Why every screen stays silent	Which class it sits in
Inbound settlements of €6.1 million across 412 transfers from a Russian-law bank carrying no listing in any of the three regimes, whose shareholder register shows a 9 percent holding by a Russian state body	The counterparty appears on no list, and a 50 percent computation returns nothing	The statutory class under section 103, which reads any state stake
One merchant onboarded eight months earlier, whose invoice lines read “spectrum analyzers” and “signal generators” and whose payees sit in two third countries	Every party clears, and the item sits in a free-text field no screen reads	The specified items, two lines of the twenty-nine
2,900 personal remittances averaging €180 to family accounts in the region	Nothing is listed, and nothing is unusual	None, and it inflates any volume figure the firm reports
A correspondent’s request for information about three customers blocked four months after onboarding, answered on day 31 with two of the three files	A request for information reaches relationship management rather than the alert queue	The advisory’s third sketch of a high-risk institution

Reading it through the framework.

The settlements. The analysts were right twice over: the counterparty carries no designation, and the Union’s prohibitions leave the relationship open. The statutory class asks a different question, and a minority state holding answers it. Currency offers no shelter, since FAQ 1152 applies the provisions to any currency, and the euro leg counts the same as a dollar one. What the firm needs here is a stored ownership percentage and a computation per threshold, rather than a flag.
The merchant. Two of the specified items appear in the firm’s own data, in the one field its controls treat as narrative. Reading invoice lines against a twenty-nine-line word list is a tractable job, and nobody had been given it. The advisory’s own instruments fit this case exactly: a questionnaire to a customer known to deal in such items, an attestation, and a note of the compliance expectation that the account stays clear of Russia’s military-industrial base.
The remittances. This is the column that makes an exposure number dangerous. It is the largest count in the book, it belongs to no class, and a measurement built on raw transaction counts puts it at the top of the report. Measuring by class, with the authorized share separated out, leaves it where it belongs.
The request for information. The firm’s answer is the only part of its book another institution reads. Thirty-one days and two of three files is the fact pattern the advisory describes, and it was produced by a routing decision rather than by a judgment.

What would have caught it. A quarterly exposure record with one row per class and two columns per row, value and count, with the authorized share separated and the authority cited. Counterparty state ownership stored as a percentage, computed against each of the four thresholds. A match of invoice lines and payment references against the specified items, running where the free text lives rather than against the party record. Requests for information from correspondent banks routed to the sanctions owner with a published internal deadline. And a named executive, holding the correspondent relationships, whose signature on the record each quarter is what the phrase “awareness of management” describes.

8. Failure modes, and the measures that expose them

The absent denominator. Whether the firm can state, for each class the authorities define, its own value, count, and counterparty count for the last period. A firm lacking the figure has decided to carry an exposure of unknown size, and recorded the decision nowhere.
The alert count standing in for the exposure. Share of the exposure measurement drawn from sources other than the screening queue. A figure near zero describes the screen rather than the book.
The unclassified authorization. Share of in-class activity carrying a cited general license, exemption, or statutory exception. The remainder is the part of the number that invites an exit decision on no evidence.
The ownership flag. Count of counterparties inside the statutory class of any state participation that fall outside a 50 percent computation. A stored percentage holds this at zero; a stored flag leaves it unknown.
The unread field. Share of payments whose invoice lines, references, or trade documents are read against the specified items, against the share screened on party names alone.
The unread number. Date the current measurement was last read by its named owner, reported beside the date it was produced. The gap between the two dates is the one metric the significance factors read back.
The slow answer. Time to answer a correspondent’s request for information, as a distribution, with the longest beside the median.

What this changes operationally

A sanctions owner publishes the classes the firm measures, the level of each it has decided to carry, and the action at each level, and names the executive who reads the number and signs it.

A data lead stores counterparty state ownership as a percentage rather than a flag, and computes it against each threshold separately, since one authority asks whether any stake exists, another asks for a controlling or majority interest, a third asks for 50 percent in the aggregate, and a fourth asks about affiliation.

An onboarding or product lead collects what a business actually sells in terms a word list can meet — item descriptions, invoice lines, trade documents — rather than one industry code, and keeps that text where a control can read it.

A treasury or partnerships lead owns the correspondent-account exposure, since that is the asset the remedy reaches, and answers requests for information from correspondents on a deadline the firm has set for itself.

A compliance lead reports in-class activity and its authorized share side by side, so that any exit decision rests on the part of the book that carries no authorization, and reads each quarter’s record against the level the policy says the firm will carry.

Limitations

This concerns how a firm measures its own exposure under authorities addressed to foreign financial institutions. It offers no legal view on any firm, counterparty, item, or payment, no thresholds, and no screening configuration, and it describes no institution’s program. Whether a given entity sits inside the statutory class, whether an item is the same as one on the specified list, and whether any pattern of activity is significant are questions for counsel on the facts, and the last of them is decided by somebody else.

These authorities move faster than most. The specified items rest on a determination Treasury may amend; OFAC’s reading of Russia’s military-industrial base changed on June 12, 2024; Annex XLV gains and loses entries by amendment; and Public Law 119-111 carries implementation deadlines, a waiver route requiring certification to Congress, a termination route, and an expiry five years after enactment. The twenty-nine item lines, the fifty HS codes, and the four ownership thresholds described here reflect the instruments as they stood when this was written, and each is the kind of figure to re-read rather than to remember. A firm’s dollar clearing arrangements, its local licensing, its partner-bank agreements, and its own reporting duties each add obligations this piece leaves aside. Belarus, Iran, and other programs carry secondary-sanctions structures of their own, which resemble these without matching them.

Measuring exposure also leaves the harder decision untouched. A firm that knows its in-class volume precisely still has to choose how much of it to carry, and that choice belongs to the business. The value of the number is that it makes the choice visible, dated, and attributable, in the way From recurring question to durable control asks of any answer given more than twice.

Primary sources

The President. Executive Order 14114 of December 22, 2023, Taking Additional Steps With Respect to the Russian Federation’s Harmful Activities, Federal Register volume 88, number 246 (December 26, 2023), sections 1 and 2, adding section 11 to Executive Order 14024 and amending its section 7.
US Department of the Treasury, OFAC. Determination Pursuant to Section 11(a)(ii) of Executive Order 14024 (December 22, 2023), and its Annex of specified items.
US Department of the Treasury, OFAC. Sanctions Advisory: Updated Guidance for Foreign Financial Institutions on OFAC Sanctions Authorities Targeting Support to Russia’s Military-Industrial Base (June 12, 2024).
US Department of the Treasury, OFAC. Frequently Asked Questions 1146, 1147, 1148, 1149, 1150, 1151, 1152, 1181, and 1182, and Russia-related General Licenses 6D, 8J, 20, 25C, 27, and 84.
United States. Lindsey O. Graham Sanctioning Russia and Iran Act of 2026, Public Law 119-111 (September 18, 2026), sections 101, 103, 104, 114, 115, 116, 117, and 203.
Council of the European Union. Council Regulation (EU) No 833/2014, consolidated text as of July 24, 2026, Articles 5ad and 12, with Annex XLV; and Council Regulation (EU) No 269/2014.
United Kingdom. The Russia (Sanctions) (EU Exit) Regulations 2019, regulations 5 and 17A.
US Department of Commerce, Bureau of Industry and Security. Common High Priority Items List, developed with the European Union, Japan, and the United Kingdom.