Building an OFAC Escalation Protocol Banks Can Actually Follow
Two branches of the same bank receive almost identical sanctions alerts on the same Tuesday morning. Both involve a corporate customer whose name is a close match to an entry on a screening list, both involve a payment routed through a correspondent in a high-risk corridor, and both land on the desk of a relationship manager who has never handled a sanctions escalation before. By Friday, one branch has frozen the payment, documented a clear rationale, notified the compliance officer, and closed the file with a defensible record. The other branch has released the payment after a phone call with the customer, left a two-line note in the case management system, and created a problem that will only surface during the next regulatory examination or, worse, when a foreign authority asks why funds moved through the institution.
This is not a story about bad employees. It is a story about missing structure. When sanctions alerts are handled ad hoc, outcomes depend on who happens to be at the desk, how much they remember from last year’s training, and whether they feel comfortable pushing back on a commercial relationship. The fix is not more training slides. The fix is a written escalation protocol that tells every branch, in advance, exactly what happens at each tier of risk, who owns the decision, and when outside counsel is brought in. Firms that handle cross-border exposure, such as https://avvocatiestradizione.it/servizi/estradizione/, see the consequences of unstructured escalation regularly, and the pattern is remarkably consistent across institutions of very different sizes.
Why Ad Hoc Escalation Fails Even When Staff Are Careful
Most banks already have a sanctions policy. The problem is that policies describe principles while escalation requires decisions. A policy says the bank will not process transactions that violate applicable sanctions. It rarely says who may release a payment when the match confidence score is 82 percent, whether the branch manager can approve a release without compliance, or how long a frozen payment may sit before the customer must be told something. When those questions have no written answer, staff invent answers. Invented answers drift. Two branches drift in opposite directions.
The drift becomes expensive in three ways. First, inconsistent decisions are hard to defend. A regulator reviewing twenty similar alerts will notice that eleven were escalated and nine were cleared with no documented reason, and will reasonably ask what the actual standard is. Second, staff who lack a clear path tend to escalate everything upward, which floods compliance with low-value cases and delays the genuinely serious ones. Third, staff who lack a clear path sometimes do the opposite and resolve matters quietly to avoid looking incompetent, which is how a sanctions issue becomes a sanctions violation.
A protocol solves all three problems at once because it converts judgment into a defined sequence. Judgment is still required, but it happens inside a structure rather than in a vacuum.
Designing the Tier Structure Around Match Confidence and Exposure
A workable protocol needs tiers, and the tiers need objective triggers so that two different employees reach the same tier from the same facts. The most practical design uses two dimensions: match confidence and exposure. Match confidence comes from the screening tool. Exposure comes from the payment amount, the corridor, the customer’s ownership structure, and whether the counterparty is a financial institution or an end user.
Tier one covers low-confidence matches with limited exposure, typically where the screening score is below a defined threshold and the payment is domestic or within a low-risk corridor. These can be resolved at branch level, but only with a written rationale recorded in the case system and a defined retention period. The key word is written. A verbal resolution is not a resolution.
Tier two covers moderate confidence or moderate exposure, including cases where the customer is a legal entity with layered ownership or where the corridor touches a jurisdiction with known sanctions-evasion patterns. These require compliance review within a fixed window, generally same business day, and the payment stays frozen until compliance signs off. The branch may not release on its own authority, and the protocol should say so in plain language.
Tier three covers high confidence matches, any match against a designated person or entity, and any case involving a potential blocked property interest. These require immediate freeze, immediate notification to the compliance officer and the bank’s sanctions lead, and a decision about whether to engage external counsel. Tier three is where the protocol earns its value, because these cases move quickly and mistakes are difficult to reverse.
Some institutions add a tier four for cases with cross-border criminal exposure, where a foreign authority may already be interested or where the customer is subject to an international notice. Those cases sit at the intersection of sanctions compliance and international criminal defense, and they benefit from counsel who understands both. This is precisely the territory covered by https://avvocatiestradizione.it/servizi/estradizione/, and the earlier counsel is involved, the more options remain open.
Assigning Roles So Nobody Has to Guess Who Decides
The most common failure in escalation protocols is ambiguity about ownership. A protocol that says “compliance will review” without naming a role, a backup, and a response window will stall the moment the named person is on leave. Every tier should specify four roles: the initiator, the reviewer, the approver, and the recorder.
The initiator is the person who first sees the alert, usually a branch employee or an operations analyst. Their job is not to decide the case. Their job is to gather the facts, complete the tier assessment, and route the case correctly. Making this explicit protects junior staff from pressure to make calls they are not equipped to make.
The reviewer is a compliance analyst who validates the match, checks the customer file, and documents the analysis. The approver is a named compliance officer or sanctions lead with authority to release, freeze, or escalate further. The recorder is whoever maintains the audit trail, and in most banks the recorder is the case management system itself, provided the protocol requires entries at each step rather than only at the end.
Two additional roles matter at the higher tiers. The first is the relationship manager, who should be informed but should not be the decision-maker, because commercial pressure and sanctions judgment do not belong in the same hands. The second is external counsel, who should be engaged on a defined trigger rather than on a feeling. A trigger such as “any tier three case involving a customer with cross-border criminal exposure” removes the hesitation that causes delays.
A Sample Flow Described Step by Step
Consider a mid-sized bank with a correspondent relationship in Europe and a customer base that includes importers. An alert fires at 9:14 on a Monday. The payment is 480,000 euros to a supplier in a jurisdiction that appears on a watch list but is not subject to comprehensive sanctions. The customer name returns an 87 percent match to an entry on a designation list.
Under the protocol, the branch employee opens the case, records the alert time, attaches the screening output, and completes the tier assessment. The score and the amount place the case in tier two, but the designation-list match pushes it to tier three. The employee freezes the payment immediately and notifies the compliance officer within fifteen minutes. The compliance officer confirms the freeze, opens a review file, and contacts the bank’s sanctions lead.
By 11:00, the sanctions lead has confirmed that the match is to a designated entity with a similar but not identical name and address. The customer file shows a different registration number and a different beneficial owner. The lead documents this analysis and decides that the case remains tier three pending confirmation from the customer, because the address overlap is unexplained.
By 14:00, the bank has requested documentation from the customer and has engaged external counsel because the customer’s ownership structure includes an entity in a jurisdiction with active enforcement activity. Counsel reviews the screening evidence, the customer documentation, and the payment purpose, and advises on whether the match can be discounted or whether a blocking report is required.
By end of day, the case file contains the alert, the tier assessment, the freeze confirmation, the compliance analysis, the customer correspondence, the counsel engagement note, and the final decision with its rationale. If a regulator asks six months later why the payment was released or blocked, the answer is in the file, in order, with timestamps.
Now compare that to the branch that handled a similar alert with a phone call and a two-line note. The difference is not intelligence or diligence. The difference is that one institution had a protocol and the other had a policy.
Testing, Training, and Keeping the Protocol Alive
A protocol written once and filed away will decay within a year. Sanctions lists change, corridors shift, and staff turn over. The protocol needs a maintenance rhythm. A quarterly review of tier thresholds against actual case data will show whether tier one is absorbing too much or too little, whether tier three triggers are firing appropriately, and whether response windows are realistic.
Testing should include tabletop exercises where branch staff walk through a realistic alert and produce the actual documentation the protocol requires. This reveals gaps that a policy reading never will. If staff cannot find the tier assessment form, or if the case system does not have a field for the rationale, the protocol is not yet operational.
Training should be role-specific. Branch staff need to know how to initiate and route. Compliance analysts need to know how to validate and document. Approvers need to know when to engage counsel and when to file reports. A single general training session for everyone satisfies an audit checkbox but does not build the muscle memory that escalation actually requires.
Finally, the protocol should include a feedback loop. Every tier three case should generate a short after-action note: what triggered it, how long each step took, what documentation was missing, and what should change. Over a year, those notes become the most useful compliance document the bank owns, because they are grounded in real cases rather than hypothetical risk assessments.
Frequently Asked Questions
How detailed should the tier definitions be?
Detailed enough that two employees reading the same alert reach the same tier. That usually means numeric thresholds for match confidence and payment amounts, plus qualitative triggers for ownership structure, corridor risk, and designation-list matches. If the definitions require interpretation at every step, they are too vague.
When should a bank involve external counsel in a sanctions escalation?
At a defined trigger rather than at a feeling. Common triggers include any match against a designated person or entity, any case with cross-border criminal exposure, any case where a foreign authority has made contact, and any case where the bank’s own analysis is genuinely divided. Engaging counsel early preserves options that close quickly once a payment has moved or a report has been filed.
Can a small bank run this protocol without a large compliance team?
Yes, provided the roles are assigned to named individuals with backups rather than to departments. A small bank may combine the reviewer and approver roles in one person for tier one and tier two, but tier three should always involve a second set of eyes and a clear path to external counsel. The structure matters more than the headcount.
What is the biggest mistake banks make when writing these protocols?
Writing them for the regulator instead of for the branch. A protocol that reads well in an examination but cannot be followed at 9:14 on a Monday morning will be ignored in practice, and an ignored protocol is worse than no protocol because it creates a documented standard the bank is not meeting.