Transaction screening can flag potential sanctions hits, but a clean match result says little about the real exposure behind a payment.
According to RegTech firm Quantifind, compliance teams must dig deeper into where funds originated, what activity they are financing, and whether that activity is lawful at the moment the transaction takes place.
A series of sanctions developments in September highlights the problem. Payments routed through third countries, Swiss restrictions on Sudanese gold and changes to Iran authorisations each present challenges that name screening alone cannot solve.
On 10 September, OFAC reached a $1.43m settlement with an individual over apparent breaches of Iran sanctions. The case involved Iranian-origin dividends paid into US bank accounts via banks in Türkiye, the United Arab Emirates and Singapore. The individual had co-founded an Iranian software business, kept ties with its leadership and bought four properties in Iran.
For banks, the lesson is clear: the immediate sender and originating bank may conceal the true source of funds. Investigators need to understand a customer’s source of wealth, business interests and how payment flows align with what the institution already knows.
Switzerland’s restrictions, effective from the same date, ban the purchase, import and transit of Sudanese-origin gold, together with related services and financial assistance. Screening buyers and sellers does not settle the question.
Institutions dealing in gold may need to verify its origin and assess whether their financing supports prohibited activity. Scrutiny of refineries and intermediaries, adverse media and past government actions can raise red flags, although none of these prove the origin of gold in a current deal. This is where sanctions compliance overlaps with trade finance, customer due diligence and transaction monitoring, with relevant data often scattered across teams and systems.
Permissions can also shift. From 8 September, OFAC suspended several Iran-related authorisations and a licensing policy covering areas such as overflight payments, aircraft safety, bunkering, emergency repairs and certain civil aircraft visits, alongside a limited wind-down authorisation running to 23 September.
A transaction processed before is not automatically permissible now, so teams must track which authorisation applied, whether it still stands and how changes affect existing customers.
Quantifind argues that institutions, which retain responsibility for their sanctions programmes, need defensible and traceable evidence. Its Graphyte AI Risk Intelligence Platform combines Name Science and AI-native entity resolution with company, ownership, network and adverse media intelligence. The firm says this reduces false positives, reveals indirect relationships and supports auditable decisions.
In an illustrative gold-sourcing case, a bank customer is linked to a Swiss refinery that buys from a UAE trader with a Sudanese supplier carrying a money laundering risk factor. Such connections guide investigation rather than prove a violation, but they show how relevant risk can sit several steps away from a bank’s own customer.
Read the full Quantifind post here.
Copyright © 2026 RegTech Analyst
Copyright © 2026 RegTech Analyst
