What happens when sanctions-screening controls go untested?

A firm builds real geo-blocking or screening controls, then never independently tests whether they still work, so a bug, a disabled setting or a discontinued tool runs unnoticed for months or years.

category: Banking and payments
also known as: control decay, silent screening failure
seen in: Islamic Republic of Iran, Syrian Arab Republic, Russian Federation, Cuba
reviewed: 2026-09-23

Cite this page

APA 7

Sanctions Evasion Reference. (2026, September 23). What happens when sanctions-screening controls go untested? https://sanctionsevasion.org/techniques/untested-screening-controls/

Chicago

Sanctions Evasion Reference. “What happens when sanctions-screening controls go untested?” Last reviewed September 23, 2026. https://sanctionsevasion.org/techniques/untested-screening-controls/.

BibTeX

@misc{ser-techniques-untested-screening-controls,
  author = {{Sanctions Evasion Reference}},
  title  = {What happens when sanctions-screening controls go untested?},
  year   = {2026},
  note   = {Last reviewed 2026-09-23},
  url    = {https://sanctionsevasion.org/techniques/untested-screening-controls/}
}

The date is when this page was last reviewed, not when it was first published.

Nobody in either case documented here defeated a control. The controls existed, were reasonably designed, and had defeated the same conduct successfully for years. What failed was checking that they still did.

How it works

A firm builds a real screening system — IP geo-blocking, know-your-customer onboarding checks, an automated tool that alerts compliance staff to blocked access attempts. At the time it is built, it works. OFAC’s compliance framework is explicit that this is not the end of the job: testing and audit procedures are “important tools to ensure the program is working as designed and identify weaknesses and deficiencies”¹ — confirming a control still works, not merely that it once did — and should be matched to the sophistication of the programme running them² .

Without that recurring check, three ordinary events become invisible failures.

A software update silently breaks the control. TradeStation’s mobile-platform rebuild in 2018 caused its second-tier geo-blocking to check the IP address of TradeStation’s own US server rather than the user’s, which defeated the control’s entire purpose while leaving it outwardly “on.”

A human forgets to turn a control back on. In 2021, a TradeStation employee disabled the firm’s first-tier geo-blocking to install a vendor update and never re-enabled it — “inadvertently failed to reenable the first-tier geo-blocking control after disabling it”³ — leaving the mobile platform’s access control off for nearly a year.

The tool built to catch the first two failures is itself discontinued. TradeStation had built an automated tester that simulated logins from sanctioned-jurisdiction IP addresses specifically to catch this kind of drift. Its own cloud provider began blocking the test traffic, and TradeStation discontinued the tool in November 2021 without replacing it, leaving no mechanism of any kind to confirm the geo-blocking controls were still functioning.

What the record shows

The TradeStation case is the clean version: two independent layers of geo-blocking, a monitoring subscription, and an internal testing tool all existed, and all failed silently, one after another, with nobody checking that any of them still worked. 481 trades from Iran, Syria and Crimea went through over nearly a year before a routine review caught it.

The Interactive Brokers case shows the same root cause at a far larger institution, spread across more systems. OFAC’s finding on the firm’s geo-blocking gaps is stated in exactly these terms: IB “did not adequately audit or test”⁴ the systems that were supposed to keep customers in Iran, Cuba and Syria off its platform. A separate system at the same firm — the trade-execution engine that processed automatic margin-liquidation orders — was never built to check securities sanctions at all, which is a different failure (a gap in design, not in testing) but comes from the same place: nobody had independently confirmed what every part of the platform actually did before it went live.

How it is caught

A dated test log, not a design document. The question that matters is not how a control was built but when it was last independently exercised and what the result was. A firm that can only describe the design has not answered it.

Testing every layer separately. A multi-layer control is only as strong as the assumption that the layers are independent. TradeStation’s first- and second-tier geo-blocking failed at different times, for different reasons, and neither failure was caught by the other layer — each needs its own test.

A named owner for vendor and infrastructure changes. Both failures here began with an ordinary change — a platform rebuild, a cloud provider update — made by someone with no reason to think about sanctions compliance. The fix is not preventing such changes; it is requiring that a compliance-relevant control be re-verified after any change that could plausibly touch it.

Treating a lapsed vendor tool as an incident. When an alerting subscription expires or a testing tool stops working, that is itself a compliance event, not an IT housekeeping item — because from that moment the firm has no way of knowing whether its screening still works.

What the sources say

Each numbered claim above, with the words of the document it rests on and — for the Panel of Experts reports — the paragraph it comes from. Quotes are checked against the source text at build time.

“are important tools to ensure the program is working as designed and identify weaknesses and deficiencies within a compliance program”
A Framework for OFAC Compliance Commitments. U.S. Department of the Treasury, Office of Foreign Assets Control, 2019, General Aspects of an SCP: Testing and Auditing.
“testing or audit procedures appropriate to the level and sophistication of its scp”
A Framework for OFAC Compliance Commitments. U.S. Department of the Treasury, Office of Foreign Assets Control, 2019, General Aspects of an SCP: Testing and Auditing.
“inadvertently failed to reenable the first-tier geo-blocking control after disabling it”
TradeStation Securities, Inc. Settles with OFAC for $1,110,661. U.S. Department of the Treasury, Office of Foreign Assets Control, 2026, Enforcement release, 2026-03-17.
“did not adequately audit or test these systems during this time period”
Interactive Brokers LLC Settles with OFAC for $11,832,136. U.S. Department of the Treasury, Office of Foreign Assets Control, 2025, Enforcement release, 2025-07-15.

Red-flag indicators

3 listed

01 A firm has never run a test simulating access or a transaction from a sanctioned jurisdiction to confirm its own screening or geo-blocking controls actually stop it. OFAC, 2019

“are important tools to ensure the program is working as designed and identify weaknesses and deficiencies within a compliance program”

OFAC, A Framework for OFAC Compliance Commitments (2019). Read the source document

02 A screening or geo-blocking control was disabled for a software update, a migration or a vendor change, and nothing in the process required confirming it was switched back on. OFAC, 2026

“inadvertently failed to reenable the first-tier geo-blocking control after disabling it”

OFAC, Enforcement release: TradeStation Securities, Inc. Settles with OFAC for $1,110,661 (2026). Read the source document

03 An automated tool built to test that screening or geo-blocking controls actually work is quietly discontinued, disabled, or blocked by the firm's own infrastructure, and never replaced. OFAC, 2026

“discontinued the use of this tool in november 2021 without replacing it”

OFAC, Enforcement release: TradeStation Securities, Inc. Settles with OFAC for $1,110,661 (2026). Read the source document

Each indicator above is quoted or paraphrased from the advisory or typology report named beside it. Expand a row for the citation. These are recognition aids drawn from published guidance, not a compliance checklist.

How it is detected

The failure is invisible from inside the system that failed, which is why OFAC's compliance framework treats testing and audit as a distinct, mandatory component rather than a byproduct of having controls at all: a control that is never independently exercised cannot report its own breakage. The practical tests are simple and recurring — does a simulated login or transaction from a sanctioned jurisdiction's IP range actually get blocked today, not only on the day the control was built; is every layer of a multi-layer control (geo-blocking, KYC screening, an alerting subscription) tested on its own rather than assumed to be covered by the others; and is there a named owner who is notified, and who acts, when a test fails or a vendor tool lapses. A firm that can produce a dated test log for its screening controls has answered the question. A firm that can only describe how the controls were designed has not.

Enforcement record

Documented outcomes on this site that turned on this technique.
Case	Outcome	Authority	Date	Penalty
Interactive Brokers: six failures across one platform 2016–2024	Settlement	OFAC	2025-07-15	$11,832,136
TradeStation: two layers of geo-blocking, both down 2018–2022	Settlement	OFAC	2026-03-17	$1,110,661
State Street: redated invoices inside an acquisition 2014–2020	Settlement	OFAC	2024-07-26	$7,452,501
Wells Fargo: software built to host what the bank wouldn't process 2007–2015	Settlement	OFAC	2023-03-30	$30,000,000

Related techniques

How is cryptocurrency used to evade sanctions? — Settling obligations in virtual assets so that value moves without a correspondent bank, a payment message or a screening system in the path, and without any institution able to block it in transit.
How are omnibus securities accounts used to evade sanctions? — Holding a sanctioned party's securities in a custodian's own name inside a pooled account shared with other clients, so the institution that can screen and block never sees who actually owns the position.
How do gaps in acquisition integration create sanctions exposure? — A company buys a foreign business and keeps running its systems separately, so the acquired unit's transactions never pass through the parent's sanctions screening until someone thinks to connect them.
How is correspondent banking used to evade sanctions? — Using a chain of banks that each know only their own customer, so that a payment for a restricted party reaches a currency it could not access directly, without any bank in the chain seeing the whole transaction.

Where this appears

Sanctions programmes

Iran sanctions — A layered set of US, EU and UN measures dating from 1979 and substantially rebuilt after 2018, covering energy, finance, shipping, and proliferation-related procurement.
Syria sanctions — US, EU and UK measures restricting dealings with the Syrian government, its energy sector and designated parties, with substantial humanitarian carve-outs.
Russia sanctions — Measures imposed from 2014 and greatly expanded from 2022, combining designations, sectoral restrictions, export controls and a price cap on seaborne oil.
Cuba sanctions — The oldest US embargo still administered by OFAC: the Cuban Assets Control Regulations of 1963, layered with later statutes, that prohibit most transactions involving Cuba or its nationals unless licensed.

Terms used on this page

Screening — Automated comparison of names, identifiers and other transaction data against sanctions lists and internal watchlists, at onboarding and on each payment.
Know your customer — The obligation on a regulated firm to identify its customer, verify that identity, and understand the purpose of the relationship before providing services.
Specially Designated Nationals and Blocked Persons List — The principal United States sanctions list. Property of anyone on it is blocked and US persons are generally prohibited from dealing with them.
Strict liability — Civil liability that does not depend on knowing or having reason to know a transaction was prohibited. OFAC applies it, and the UK's OFSI has since 15 June 2022.