When the US removed Syria from the state sponsors of terrorism list, Visa and Mastercard completed their first international card transactions in the country. For payment companies considering similar market re-entries, this moment is more than an opportunity. It's a compliance test.
Markets emerging from sanctions carry distinct risk profiles. Your compliance framework built for stable jurisdictions won't transfer cleanly. This checklist covers what you need in place before processing your first transaction in a post-sanctions market.
Prerequisites
Before you start the checklist, confirm you have:
- Written authorization from your board or executive leadership to pursue operations in the target market.
- Access to current OFAC sanctions lists and the specific Federal Register notice documenting the sanctions removal.
- A dedicated compliance officer assigned to the market entry project.
- Legal counsel familiar with both US sanctions law and the target jurisdiction's financial regulations.
If you're missing any of these, stop. The checklist below assumes you have institutional commitment and the right expertise in the room.
Market Re-Entry Compliance Checklist
1. Verify the sanctions removal scope and timing
Pull the Federal Register notice. Note the effective date and read every exception or carve-out. Sanctions removals often include transition periods or retained restrictions on specific entities, sectors, or transaction types.
Done right: You have a written summary documenting which restrictions lifted, which remain, and what your legal counsel confirms you can and cannot do. You know the exact date processing became permissible.
2. Update your OFAC sanctions screening configuration
Remove the country code from your blocked jurisdictions list. Add any specifically designated nationals or entities that remain sanctioned despite the country-level change. Test your screening engine with sample transactions to confirm it no longer auto-rejects legitimate traffic while still catching individually sanctioned parties.
Done right: Your sanctions screening system passes transactions from the newly accessible market while blocking any residual sanctioned entities. You have test logs proving both behaviors work.
3. Establish enhanced Watchlist Screening for Politically Exposed Persons
Post-sanctions markets often have unstable or transitional governments. Your standard PEP screening won't capture the risk. Configure your system to flag current and former government officials, military leadership, and their immediate family members for enhanced due diligence.
Done right: Your screening rules identify PEPs from the target market and route them to manual review. You've defined what "enhanced due diligence" means for these cases, including source of funds verification and ongoing monitoring frequency.
4. Build a geopolitical risk monitoring process
Sanctions can return. Your compliance team needs a defined process for monitoring US State Department announcements, OFAC updates, and geopolitical developments that could trigger re-imposition. Assign an owner and set a review cadence.
Done right: One person checks OFAC's sanctions list updates weekly and reviews State Department press releases daily. You have a documented escalation path if sanctions risk resurfaces.
5. Configure transaction monitoring for structuring patterns
Markets re-entering the international payment system often see sophisticated actors testing limits. Set your transaction monitoring system to flag patterns consistent with Structuring (Smurfing): multiple transactions just below reporting thresholds, rapid sequences from the same customer or merchant, and unusual cross-border flows.
Done right: Your monitoring rules include thresholds and velocity checks specific to the new market. You've baselined what "normal" looks like so you can spot anomalies. You know your SAR filing timeline if you detect suspicious activity.
6. Verify merchant acquiring due diligence standards
If you're enabling merchant acceptance, your standard merchant onboarding won't suffice. Require business registration verification, site visits for high-risk categories, and proof of physical location. Post-sanctions markets attract shell merchants and front companies.
Done right: Your merchant underwriting team has a separate checklist for this market. You've defined which merchant categories require enhanced verification and what documentation you'll accept as proof of legitimacy.
7. Establish cardholder authentication controls
Fraud risk in newly accessible markets runs high. Implement step-up authentication for high-value transactions and first-time cross-border purchases. Consider requiring Multi-Factor Authentication for e-commerce transactions until you establish baseline fraud rates.
Done right: Your authentication rules include market-specific triggers. You've tested the customer experience to confirm legitimate users can complete transactions while suspicious patterns get challenged.
8. Document your Bank Secrecy Act compliance approach
Your BSA/AML program needs a written addendum covering this market. Document your customer due diligence procedures, transaction monitoring approach, and SAR filing criteria specific to the jurisdiction's risk profile.
Done right: Your BSA officer has reviewed and signed off on the addendum. It references the specific FATF-Style Regional Body guidance applicable to the region and explains how your controls address those standards.
9. Set up segregated reporting for regulatory examination
When regulators examine your BSA/AML program, they'll scrutinize your post-sanctions market activity closely. Configure your reporting systems to isolate transactions, customer counts, and monitoring alerts by jurisdiction so you can produce clean data during examinations.
Done right: You can generate a complete transaction report for the market within one business day. The report includes customer counts, transaction volumes, monitoring alerts generated, and SARs filed.
10. Create an exit plan
If sanctions return or fraud losses exceed projections, you need a documented process for suspending operations. Define your triggers, decision-makers, and customer communication approach before you process your first transaction.
Done right: Your exit plan includes specific thresholds (fraud rate percentage, regulatory action, sanctions re-imposition) that trigger a shutdown decision. You know who makes the call and how quickly you can halt processing.
Common Mistakes
Treating this like a standard market launch. Post-sanctions markets aren't emerging markets with weak infrastructure. They're jurisdictions where financial crime infrastructure may have developed specifically because legitimate channels were blocked. Your risk models need to account for that history.
Relying on outdated sanctions data. Some compliance teams update their screening lists monthly. That cadence is too slow when sanctions lift or reimpose. Move to weekly updates minimum.
Skipping the merchant site visit. Remote verification feels efficient, but post-sanctions markets have high rates of merchant fraud. If you're enabling acceptance for physical goods merchants, verify the location exists.
Next Steps
Run this checklist before you process transactions. After your first 90 days of activity, conduct a formal risk assessment. Review your fraud rates, monitoring alert volumes, and SAR filings. Compare them to your projections. If reality diverges significantly from your assumptions, recalibrate your controls before you scale.
Your compliance framework should be stricter at market entry than it will be long-term. You can loosen controls once you understand the actual risk profile. You can't retroactively fix compliance gaps.
