Risk assessment I: the organisation conducts an OFAC risk assessment at a manner and frequency matching its risks from clients, products, services, supply chain, intermediaries, counterparties, transactions and locations, updated for root causes of apparent violations; it leverages existing information to set due diligence, including a sanctions risk rating at onboarding (KYC or CDD plus independent research) and sanctions due diligence in mergers and acquisitions, with issues escalated and addressed before closing and post-closing audit. OFAC's Risk Matrix in the Annex to Appendix A of Part 501 may be used.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.