What Bank Boards Should Ask Their OFAC Compliance Counsel

At the last board meeting, the agenda included a standing item on sanctions risk. The chair turned to me, as the director with the least sanctions background, and asked whether our compliance program was adequate. I realized I did not know which questions would actually surface a problem before it became an enforcement action. That experience prompted this briefing memo, which sets out the questions a bank board should put to its OFAC compliance counsel, the red flags that warrant escalation, and a governance checklist for the year ahead. Directors do not need to become sanctions specialists, but they do need to know where the fault lines are, especially when cross-border legal exposure can involve instruments such as an Interpol notice, which is why firms like Avvocati Blu Notice Interpol are sometimes consulted on the international dimensions of a case.

Why the Board, Not Just the Compliance Department, Owns Sanctions Risk

Sanctions compliance is often treated as an operational function, but the consequences of failure are strategic. A designation by the Office of Foreign Assets Control can freeze correspondent banking relationships, trigger secondary sanctions exposure, and invite scrutiny from prudential regulators. These are enterprise-level outcomes, and enterprise-level risk belongs to the board. The board’s role is not to review individual transactions but to confirm that the control environment is designed, funded, and tested. That means asking whether the sanctions program has enough staff, whether screening technology is calibrated to current lists, and whether escalation paths reach the board when thresholds are breached.

Directors should also understand that sanctions exposure rarely arrives alone. A blocked transaction may sit alongside a law enforcement inquiry, a mutual legal assistance request, or a request for information from an international body. In some cases, individuals connected to a matter may face an Interpol notice, and the legal questions that follow can involve both administrative sanctions and criminal procedure. Counsel should be able to explain how these tracks interact, because governance failures in one area often surface in another. A board that only asks about OFAC list screening may miss the wider legal perimeter of a case.

Key Questions Directors Should Ask Compliance Counsel

The most useful questions are specific enough to produce a substantive answer but broad enough to reveal gaps. The following set has proven effective in board sessions, and counsel should be able to answer each without extensive preparation.

First, ask how the bank identifies beneficial owners in high-risk jurisdictions. Shell company structures remain a common method for evading sanctions, and a program that relies only on customer-provided information will have blind spots. Second, ask how often screening lists are updated and how the bank tests whether its filters are working. A filter that produces too many false positives is often quietly weakened, which creates a different risk. Third, ask what happens when a transaction is blocked. The answer should describe the internal escalation, the legal review, and the reporting timeline, not just the software alert.

Fourth, ask whether the bank has a documented position on secondary sanctions. This is where boards often discover that front-line staff are making judgment calls without a policy anchor. Fifth, ask how the bank handles requests from foreign authorities. These requests can intersect with Interpol channels, and the legal response may require coordination between sanctions counsel, criminal defense counsel, and local advisors. Sixth, ask how the compliance function is funded relative to the bank’s risk profile. A program that has not received a budget increase in three years while the bank has expanded into new markets is a governance concern.

Seventh, ask about training. Not the completion rate, but the content. If training has not been updated to reflect recent designations and enforcement trends, it is not doing its job. Eighth, ask whether the bank has conducted a lookback review after any control failure, and what it found. Lookbacks are expensive, but they are far less expensive than a penalty that could have been reduced by voluntary self-disclosure.

Red Flags That Should Trigger Board Escalation

Not every compliance issue needs board attention, but certain patterns should trigger escalation regardless of the dollar amount involved. Repeated blocked transactions involving the same counterparty suggest that the relationship should be reviewed or terminated. A sudden increase in alerts from a particular business line may indicate that the line is being used to test controls. Inconsistent answers from management about the same transaction are a warning sign that records are incomplete or that the facts are still being established.

Another red flag is the involvement of foreign legal proceedings. If a customer or employee is subject to an Interpol notice, the bank may face competing obligations: cooperation with one authority, data protection rules in another, and its own contractual duties. Counsel should be asked whether the bank has a protocol for these situations and whether it has been tested. A board should also be alert to any suggestion that a compliance decision was influenced by revenue considerations. That is the kind of finding that turns a regulatory matter into a governance scandal.

Finally, watch for silence. If compliance counsel reports no issues quarter after quarter in a bank with significant cross-border activity, the board should ask why. Mature programs generate findings, and a program that never finds anything is either under-resourced or not looking. Directors should treat unexplained calm as a question, not a comfort.

A Governance Checklist for the Coming Year

Boards can convert this discussion into a practical checklist. Confirm that the bank has a written sanctions policy approved at the board level and reviewed annually. Confirm that a named executive owns the program and reports to the board at least quarterly. Confirm that screening technology is independently validated and that the validation results are shared with the audit committee. Confirm that the bank has a documented escalation matrix for blocked transactions and designated individuals.

Confirm that legal counsel, including external advisors where needed, have assessed the bank’s exposure in jurisdictions where it operates. Confirm that the bank has a protocol for responding to international legal requests, including those that may involve Interpol notices, and that the protocol has been rehearsed. Confirm that training is current and tailored to the business lines with the highest risk. Confirm that the internal audit plan includes sanctions testing and that findings are tracked to closure.

Finally, confirm that the board itself receives enough information to exercise judgment. Dashboards with alert counts are not sufficient. Directors need narrative context: what changed, what was found, what was fixed, and what remains unresolved. If counsel cannot provide that narrative, the board should ask for it in writing before the next meeting. Sanctions risk will not wait for the board to become comfortable, and the questions asked in the boardroom are often the last line of defense before a matter becomes public.