The single most useful thing to understand about enforcement in this field is that a large case is almost never handled by one authority.
The division of labour
Financial sanctions authorities — OFAC in the United States, OFSI in the United Kingdom, national competent authorities across the EU — impose civil monetary penalties for dealings with restricted parties or property.
Export control authorities — BIS in the United States and its counterparts elsewhere — handle the movement of controlled items, and can deny export privileges entirely, which for a manufacturer is frequently a graver consequence than any fine.
Prosecutors handle criminal conduct: conspiracy, false statements, smuggling, fraud on a bank.
Financial intelligence units receive suspicious activity reports and are frequently where an investigation begins, though their reports are confidential and never appear as sources.
Why the parallel structure matters when reading a figure
The ZTE resolution documented on this site involved a concurrent OFAC settlement, a BIS settlement and a Department of Justice plea agreement. The OFAC component was around a hundred million dollars; the aggregate was several times that.
A penalty figure quoted without saying which authority imposed it is close to meaningless, and this is the most common error in press coverage of these cases.
How the cases are actually built
Overwhelmingly from the institution’s own records. Comparing the instructions a bank received with the messages it sent, or an exporter’s internal correspondence with its shipping documents, is the standard method, and it is why the facts are so rarely contested.