Knowledge arrives after the payment

Bottom line

A sanctions program is built to stop the payment in front of it. OFAC may impose civil penalties on a strict liability standard, the lists are public, and the check runs before the money moves. Export controls reach a payments firm through a different door. General Prohibition 10 of the Export Administration Regulations forbids financing or otherwise servicing an item with knowledge that an export violation has occurred, is about to occur, or is intended to occur. BIS’s 2024 guidance to financial institutions places most transaction review after the payment, and names what that review can produce: information that may give rise to knowledge for future transactions involving the same customer or counterparties. The export-control program at a payments firm therefore lives in the path from a finding to a hold on the next payment. A review that ends in a suspicious activity report while the same payer keeps getting paid has recorded the knowledge and continued the service.

1. Two regimes, two moments

	Sanctions screening (OFAC)	Export controls (General Prohibition 10)
What creates exposure	Dealing in blocked property or with a blocked person, with civil penalties on a strict liability standard	Servicing an item with knowledge of an export violation
Where the check sits	Before the payment, against the parties it names	Due diligence at onboarding and after it; review after the payment; real-time screening for a narrow set of payments and lists
What a finding stops	The payment in front of it	Future transactions with the same parties
Who holds the decisive facts	The list and the payment message	The exporter holds the item; the firm holds the payment pattern

The convenient response to export controls is to load BIS’s lists into the sanctions screening engine, which concentrates effort in the one place the guidance asks for least. BIS recommends real-time screening only for cross-border payments and other transactions likely associated with exports from the United States, or with reexports and transfers abroad, and only against a short set of lists: the Denied Persons List, the military-intelligence end users named in the regulations, and specific Entity List designations. On a match, BIS recommends declining to proceed until the firm can determine that the underlying export is authorized or outside the regulations. For everything else, BIS recognizes that a financial institution will likely lack the information to assess each transaction before it moves, and asks for due diligence and review instead.

2. What binds, and what advises

Read by layer, as From rule to workflow uses the word:

Law. General Prohibition 10, at 15 CFR 736.2(b)(10), applies to any person, and its verbs include “finance” and “otherwise service.” The knowledge it turns on is defined at 15 CFR 772.1 to include “an awareness of a high probability” of a circumstance, inferred from conscious disregard of known facts and from willful avoidance of facts. Looking away offers no shelter, since the definition reads avoidance as evidence of awareness.
Guidance published in the regulations. Supplement No. 3 to Part 732, BIS’s “Know Your Customer” guidance, written with exporters in mind, describes a duty to check out red flags raised in information that comes to a firm, and warns against cutting off the flow of that information.
Guidance addressed to financial institutions. BIS’s October 2024 notice recommends three practices: EAR-related due diligence before onboarding and periodically after, covering BIS’s restricted-party lists and trade-data lists of entities that have shipped Common High Priority List items to Russia, applied to customers and, where appropriate, to their customers; ongoing review of transactions for red flags; and real-time screening in the narrow case above. It holds financial institutions, like exporters, to the rule against willful self-blinding. The FinCEN and BIS joint alerts of June 2022 and May 2023, and their joint notice of November 2023, supply red flags and the SAR key terms FIN-2022-RUSSIABIS and FIN-2023-GLOBALEXPORT.
Policy. Which payments count as likely associated with exports, which receive review and how soon, which findings place a hold, how far a hold reaches, and who may release it.
Convention. Screening BIS lists in real time and reporting the program complete, and closing a case on the day its SAR is filed. This piece argues against both.

3. Findings that bear weight, and findings that set context

The joint alerts list many red flags, and the guidance cautions that no single financial red flag is necessarily indicative of illicit activity. It then singles out four that, found after a payment and left unresolved, lead to one recommendation: refrain from future transactions with the relevant transaction parties.

A customer refuses to provide details about end users, end use, or company ownership
A party’s name matches, or resembles, an entry on a restricted-party list
A party is physically co-located with an Entity List or SDN List entry, or uses an address BIS has identified as a high diversion risk
A payment previously scheduled from a country of concern is rerouted at the last minute through a different country or company

The guidance introduces these as examples of red flags demonstrating a high probability of evasion, so the four are a floor. A usable policy sorts findings into two tiers. Weight-bearing findings place a hold on the parties until the case resolves. Contextual findings, such as a payer located at a known transshipment point, goods outside the purchaser’s line of business, or a counterparty with little web presence, decide how deeply a case is worked and whether a SAR follows. Where each red flag sits is a policy decision, written down and owned. The November 2023 notice pairs co-location with shared ownership, which a firm sees reliably once it stores ownership as a graph, as One cap table, several answers recommends.

Geography belongs to the second tier. The June 2022 alert names eighteen common transshipment points, Armenia, Georgia, Kazakhstan, Kyrgyzstan, Tajikistan, and Uzbekistan among them, and in the same document warns against wholesale or indiscriminate de-risking of any class of customers. Corridor geography is a good reason to review a payment sooner and a poor reason to hold one. A payer in Bishkek with a verifiable registration and goods consistent with its trade is context. The same payer at an Entity List party’s address is a finding.

4. From finding to the next payment

Review records a finding
Policy classifies it as weight-bearing or contextual
A weight-bearing finding places a hold on the parties, across the firm
Resolution on the evidence the guidance names
Release with a recorded basis, or refusal and exit

The clock. Exposure runs from the moment the review records a finding to the moment the next payment meets a hold. That interval belongs in hours, and the reliable way to keep it there is for opening the case to write the hold, so that nobody has to remember.

The reach. The guidance speaks of future transactions involving the same customer or counterparties. A hold on the account where the finding surfaced leaves the same payer free to pay a second customer of the platform, so the hold attaches to the party, across the firm.

The key. A hold matched on a name string misses the same payer on its next invoice under a different romanization, the problem One person, several spellings describes. Holds key on identifiers that persist: account number and bank identifier, registration number, address.

The resolution. The guidance names evidence that resolves a red flag, among other means: confirmation that the item sits outside the regulations, falls outside the license requirement a listing triggers, or is authorized by a license or license exception. BIS declines to confirm licenses to third parties, so the firm asks its customer for a copy. The guidance accepts reliance on a customer’s representations about compliance unless that reliance would be unreasonable, as when the firm has reason to know they may be false. The person deciding a held payment needs the finding, the evidence, and the authority to release in front of them, as A human in the loop needs a job description specifies, and the basis for each release goes on the record.

The report. A SAR is one output of the case, filed under the key term the joint alerts request. Filing it reports the knowledge and leaves it in place, so the hold outlives the filing and ends on resolution. Knowledge can also arrive from outside: in certain circumstances after a SAR, the guidance notes, BIS may give the firm information establishing it, and then expects the firm to stop servicing the violating trade, by ending the relationship where appropriate. The questions sent to the customer, and the hold itself, stay silent about any SAR, which is confidential under 31 CFR 1020.320(e) for banks and 31 CFR 1022.320(d) for money services businesses.

A worked hypothetical

The following scenario is hypothetical and is included only to illustrate the framework. The companies below are invented.

A US business-banking platform serves a small distributor of electronic components whose buyers, for years, have been manufacturers in Germany and Mexico. The platform’s policy sends cross-border payments received by customers in electronics wholesale to a weekly post-transaction review.

Day 0. A trading company in Bishkek, new to the distributor, pays $48,000 against an invoice for integrated circuits and connectors.

Day 6. The weekly review reaches the payment. The payer’s registered address matches the address of an Entity List entry. The analyst opens a case in the investigations tool and starts a SAR narrative. The same review reads forty other payments from Central Asia and the Caucasus that week; three carry contextual flags, and those customers receive a note on file and an earlier next review.

Day 9. The Bishkek company pays the distributor $51,000 against the next invoice.

Day 11. The Bishkek company pays $36,000 to a second customer of the platform, an electronics reseller, under a different Latin spelling of its name.

Day 13. A company in Yerevan pays the distributor $44,000, citing the Bishkek company’s invoice numbers.

Day 30. The SAR is filed and the case closes. Payments from Bishkek continue, since nothing in the payment system knows the case exists.

Reading it through the framework. Co-location is one of the four, so the finding bore weight on day 6. Three payments moved after it, on days 9, 11, and 13, for $131,000. A hold written when the case opened, keyed on the Bishkek company’s account, bank identifier, and registration number and applied across the firm, meets the payments on days 9 and 11. A hold on the distributor’s payments citing the same invoice series meets the payment on day 13, which carries a contextual flag of its own: a payer in a third country, at a named transshipment point, with no evident role in the trade.

Resolution. The platform asks the distributor what it shipped, to whom, for what end use, and under what authorization, in words that refer to no report. The distributor supplies its commercial invoices and states that its shipments to Kyrgyzstan needed no license. On end use it can only relay the buyer’s answer: the Bishkek company declines to name its customers. The evidence addresses the goods and leaves the co-location finding exactly where it was. With the finding unresolved, the owner refuses further transactions with the Bishkek and Yerevan companies, puts the distributor relationship to a decision with exit among the options, and sends the three payments serviced after day 6 to counsel as a disclosure question.

What would have caught it. One rule, written in policy and built into the platform: a weight-bearing finding writes a firm-wide hold on persistent identifiers the moment the case opens, and the case closes on resolution. The SAR still goes in on day 30. The payments on days 9, 11, and 13 meet a reviewer instead of the ledger. It is the repair From recurring question to durable control reaches for in a different queue: a trigger built into the product, in place of a step somebody has to remember.

5. Failure modes, and the measures that expose them

The sanctions template. BIS lists added to real-time screening and the program reported complete. Measure the share of weight-bearing findings that came from post-transaction review; a figure near zero describes a review that exists on paper.
The SAR as the last step. Cases closed on filing, with no hold placed or the hold lifted at filing. Measure payments serviced to a flagged party after its finding date, a number a working control holds at zero.
The slow hold. Measure the time from a recorded finding to a hold in force, as a distribution, with the maximum reported beside the median.
The account-scoped hold. Measure flagged parties paying more than one customer, and the share of holds applied across the firm.
The name-keyed hold. Measure the share of holds keyed to at least one identifier beyond a name.
The corridor exit. Measure exits resting on contextual findings alone, by jurisdiction. A rising count for Central Asia and the Caucasus is de-risking by geography, the pattern the 2022 alert warns against.

What this changes operationally

An export-control owner writes the finding tiers into policy, with BIS’s four red flags as the floor of the weight-bearing tier, and names who may release a hold and on what evidence.

A payments or platform lead builds the hold as a primitive: keyed on persistent identifiers, applied across customers, written when a case opens, and checked at the moment a payment is processed.

An investigations lead closes cases on resolution, treats the SAR as one output of the case, and reports every payment serviced to a flagged party after its finding date.

A risk lead uses corridor geography to set how soon and how deeply payments are reviewed, and leaves holds to findings.

Limitations

This addresses the design of export-control review at a payments firm under US rules. It offers no legal view on any transaction, no review intervals, and no thresholds, and it describes no institution’s program. BIS’s notice is guidance; the obligation is General Prohibition 10 read with the knowledge standard, and what a given set of facts amounts to is a question for counsel. EU and UK measures reach financial services through their own prohibitions, which this piece leaves aside.

It also assumes the platform sees its counterparties. Many platforms see a payer name, a bank, and a free-text reference. Where the data is thin, the hold keys on what exists, and the record says which identifiers it rests on. In a bank partnership the review may run at the platform while the payment settles at the bank, and the program agreement then has to say who places the hold, and how fast.

Primary sources

US Department of Commerce, Bureau of Industry and Security. Guidance to Financial Institutions on Best Practices for Compliance with the Export Administration Regulations (October 9, 2024).
Export Administration Regulations. 15 CFR 736.2(b)(10), General Prohibition 10; 15 CFR 772.1, definition of “knowledge”; and Supplement No. 3 to Part 732, BIS’s “Know Your Customer” Guidance and Red Flags.
FinCEN and BIS. FinCEN and the U.S. Department of Commerce’s Bureau of Industry and Security Urge Increased Vigilance for Potential Russian and Belarusian Export Control Evasion Attempts, FIN-2022-Alert003 (June 28, 2022).
FinCEN and BIS. Supplemental Alert: FinCEN and the U.S. Department of Commerce’s Bureau of Industry and Security Urge Continued Vigilance for Potential Russian Export Control Evasion Attempts, FIN-2023-Alert004 (May 19, 2023).
FinCEN and BIS. FinCEN and the U.S. Department of Commerce’s Bureau of Industry and Security Announce New Reporting Key Term and Highlight Red Flags Relating to Global Evasion of U.S. Export Controls, FIN-2023-NTC2 (November 6, 2023).
OFAC and HM Treasury’s Office of Financial Sanctions Implementation. U.S. and UK Economic Sanctions Authorities: A Comparative Overview (June 23, 2026), on OFAC’s strict liability standard.
FinCEN. Confidentiality of suspicious activity reports, 31 CFR 1020.320(e) for banks and 31 CFR 1022.320(d) for money services businesses.