Gazprombank

Assessment

Entity identity is UNRESOLVED. No corporate registry was queried, because no registry provider was configured. The identity of the screened subject therefore rests entirely on sanctions-list name renderings and open-source media — neither of which is registry evidence.

Screen status: NOT RUN — REGISTRY. Source ledger: "No provider configured for REGISTRY [REGISTRY] → SKIPPED". A skipped source did not check anything; no inference of any kind may be drawn from its silence.

Identity Data Actually Available

What Was Not Retrieved

Each of the following is NOT FOUND / NOT RETRIEVED, not "none":

• Full legal name in Russian and its legal form (the string "Joint Stock Company" derives from an OFAC remarks field, which is a sanctions rendering, not a registry-verified legal name).
• Registration number — OGRN and INN: not retrieved.
• Registered address: not retrieved.
• Incorporation date: not retrieved.
• Share capital and current filing/legal status: not retrieved.
• Directors, officers and authorised signatories: not retrieved. Note the analytical asymmetry: four former employees of the Swiss subsidiary were sentenced by a Swiss court (Section 7), yet not a single current officer of the parent can be named from this evidence.
• Banking licence / regulator authorisation record (e.g. Bank of Russia): not retrieved. No FCA/PRA register check appears in the ledger either.

Risk Implication

• MLR 2017 reg. 28(2) requires identification of the customer and verification of identity from reliable, independent source documents or data. That obligation is not satisfied on this evidence.
• The absence of primary identifiers creates a two-sided error risk: (a) a false-positive risk that the screened subject is a differently-constituted entity sharing the name; and (b) a far more serious under-scoping risk that group members subject to the same freeze are not identified. Both are resolved only by obtaining the OFSI entry (with OFSI Group ID) and the primary OFAC SDN records, and reconciling them to registry identifiers.
• The unnamed "six foreign subsidiaries" are the most operationally dangerous gap: a counterparty screening only the parent name would not detect them. This connects directly to the ownership gap in Section 2 and the sanctions perimeter analysis in Section 3.

Required Next Steps

1. 1.Obtain the OFSI Consolidated List record and the OFAC SDN primary records; capture all listed aliases, addresses and identifiers.
2. 2.Obtain Russian registry extract (OGRN/INN, charter, address, officers) or a documented explanation of why it cannot be obtained under current restrictions.
3. 3.Reconcile BIC GAZPRUMM and BIC RKBZCHZZ against internal payment-message history to establish whether any historic or live exposure exists.

Assessment

No beneficial owner or controlling natural person was established at any verification tier. The UBO screen ran (Google Programmable Search, OKDATA) and returned: "No beneficial owners could be established from available sources." There are **no CONFIRMED entries** (authoritative registry), **no DECLARED entries** (company-filed but unverified) and **not even an UNVERIFIEDLEAD**. Because no registry was queried at all (Section 1), there is no authoritative dataset behind this result.

This is an NOT FOUND result produced by a web search engine, not a verified negative. It must not be recorded as "no beneficial owners".

Ownership Data Position

Threshold and Legal Framework

• The 25% beneficial ownership threshold (MLR 2017 reg. 5; UK PSC register concept of significant control; EU 5AMLD Article 30; FATF Recommendation 24) cannot be tested at all: no shareholding data exists in the evidence set.
• The OFAC 50 Percent Rule cannot be applied downward — entities majority-owned by the designated persons are themselves blocked even if unlisted, and this population is unidentifiable here.
• The UK "ownership or control" test at reg. 7 of the Russia (Sanctions) (EU Exit) Regulations 2019 is unresolvable on this evidence, both as to who controls the subject and as to which entities the subject controls.

Risk Implication

• For a systemically significant bank, total ownership opacity is an extreme transparency signal and is the principal driver of the Transparency Risk sub-score of 85/100 in Section 11.
• The gap is compounded by the unrun PEP screen (Section 4): swissinfo's 2023-03-08 headline refers to "alleged Putin funds", and it is impossible on this evidence to determine whether that allegation concerned customer accounts only or touched ownership/control. No conclusion is drawn either way.
• Sanctions perimeter cannot be defined without ownership data. This materially affects the assessment in Section 3 and is the reason a simple name-screen against the parent is an inadequate control.

Required Next Steps

1. 1.Obtain shareholder register / registry ownership data, or record formally that it is unobtainable and treat the file as unverifiable for ownership purposes.
2. 2.Obtain the named list of the six designated foreign subsidiaries from the OFAC SDN List and Treasury materials and screen each.
3. 3.Identify the Luxembourg subsidiary by legal name (RCS Luxembourg) and screen it against HMT, OFAC, EU and Swiss lists.
4. 4.Do not record any ownership conclusion in the KYC file until CONFIRMED-tier evidence exists.

Assessment

This is the determinative section of the report. The sanctions screen ran (Sanctions Lists — OFAC · UK OFSI · UN, OK_DATA) and returned three adverse results: one CRITICAL and two HIGH. The subject name matches the UK HMT Consolidated List at 100.0% exact confidence, and two associated legal persons match the OFAC SDN List at 90% containment with corroborating operational identifiers.

A 100.0% exact match against a UK asset-freeze list is not, in substance, a "possible match". The "possible match" wording in the retrieved data is a vendor labelling artefact and is flagged as a control weakness below.

Evidence

Independent corroboration of the US designation:

• US Treasury press release: "Nov 21, 2024 ... OFAC is designating Gazprombank Joint Stock Company (Gazprombank) alongside its six foreign subsidiaries." (https://home.treasury.gov/news/press-releases/jy2725) — CORROBORATED, state source.
• "OFAC Designates Gazprombank for Inclusion on SDN List" — blog.volkovlaw.com, dated 2025-01-07 in the evidence with in-text date Jan 6, 2025 (https://blog.volkovlaw.com/2025/01/ofac-designates-gazprombank-for-inclusion-on-sdn-list/) — secondary legal commentary.
• "OFAC Blacklists Gazprombank" — ACAMS weekly roundup (https://www.acams.org/en/news/weekly-roundup-jpmorgan-chase-draws-scrutiny-ofac-blacklists-gazprombank-and-more) — industry media.

Key Findings

• Screening date / currency: the list snapshot version is 2026-08-17, one day before the report date of 18 August 2026. Screening is current.
• Designation dates are missing for all three list entries. The list version is a snapshot date, not a designation date. This matters legally: the designation date determines when prohibitions took effect and therefore whether any historic transaction was lawful at the time. It must be obtained from the primary OFSI and OFAC records.
• Designation reason: not retrieved for the HMT entry (no statement of reasons; no URL supplied). For OFAC, the programme tags EO 13662 and EO 14024 are recorded, and the remarks field is truncated mid-phrase ("Executive Order 13662 Directive Determinatio").
• Analytical inference, labelled as such: the co-presence of an EO 13662 Directive determination reference with SDN listing and the Nov 2024 Treasury release is consistent with a progression from sectoral restriction to full blocking. The evidence does not state this progression expressly, and it is recorded here as inference, not fact. The compliance consequence is unaffected: current status is SDN listing plus UK asset freeze.
• Perimeter is incompletely defined. The parent and the Swiss entity are named; the six foreign subsidiaries are not. The Luxembourg subsidiary referenced by GTR (2022-03-30) is unnamed and unscreened.
• Lists not screened: EU Consolidated List, Swiss SECO, Canadian, Australian and Japanese regimes were not covered by the configured provider. Given a Swiss-incorporated group member and a Luxembourg subsidiary, EU and SECO screening are material omissions.

Data-Integrity Red Flag

The retrieved sanctions records label a 100.0% exact hit as a "possible match". If a screening workflow triages on that label rather than on the confidence figure and list type, exact asset-freeze matches will be systematically under-escalated. This is a systems-and-controls issue under FCA SYSC 6.3 and should be raised with the vendor and captured on the risk register. No instruction-like or manipulative content was otherwise identified in the retrieved data.

Risk Implication

• Legal prohibition, not risk appetite. Under the Russia (Sanctions) (EU Exit) Regulations 2019, dealing with funds or economic resources owned, held or controlled by a designated person, or making funds or economic resources available directly or indirectly to or for the benefit of a designated person, is prohibited absent an OFSI licence. Breach is a criminal offence and OFSI may impose civil monetary penalties on a strict-liability basis.
• US exposure: SDN status means US persons are prohibited from dealings and non-US persons face secondary-sanctions and correspondent-banking risk.
• No mitigation evidence exists. No OFSI or OFAC general or specific licence, no delisting application, no wind-down authorisation appears in the evidence. Absence does not prove none exists, but no mitigating factor can be credited.
• This section overrides the Sanctions & Watchlists sub-score of 11/100 supplied by the model; the override arithmetic is set out in Section 11, and the resulting CDD position in Section 12. The unresolved ownership position in Section 2 prevents completion of the reg. 7 ownership-and-control analysis that would define the full freeze perimeter.

Assessment

Screen status: NOT RUN

No PEP screening was performed. The source ledger records: "No PEP screening provider configured [PEP] → SKIPPED". The coverage statement confirms: "Risk domains NOT reflected in the composite score: PEP."

No conclusion may be drawn. The file cannot state that the entity, its owners or its officers are not PEPs, RCAs or heads of international organisations. Nothing in this report should be read as a negative PEP result.

Why This Gap Is Unusually Material Here

1. 1.Entity profile. The subject is a Russian bank of systemic scale on both the UK and US designation lists — precisely the profile where state connection and PEP-adjacency are most likely.
2. 2.A Swiss criminal proceeding was reported under the framing "alleged Putin funds". swissinfo, 2023-03-08 (https://www.swissinfo.ch/eng/politics/trial-of-gazprombank-managers-underway-in-switzerland/48342164) reports that four employees appeared in court "accused of lacking diligence in financial transactions", and the headline refers to "alleged Putin funds". This is an allegation within a criminal proceeding; the evidence does not show that any court made a finding as to the beneficial ownership of those accounts. It nonetheless defines a PEP-related enquiry that has not been run.
3. 3.Executive-level asset movements were reported alongside a money-laundering investigation. Le Monde, 2024-02-09 (https://www.lemonde.fr/en/les-decodeurs/article/2024/02/09/gazprombank-executives-quietly-sold-their-french-villas-after-the-ukraine-invasion65094868.html). The retrieved extract does not identify who is under investigation, by which authority, or the status of that investigation.
4. 4.No officers are known. Because the registry screen did not run (Section 1), there is no director or officer list to screen against a PEP database even if one were available.

Regulatory Consequence

• FATF Recommendation 12 requires firms to have risk-management systems to determine whether a customer or beneficial owner is a PEP; no such determination has been made.
• MLR 2017 reg. 35 requires enhanced measures where a customer or beneficial owner is a PEP, family member or known close associate. The condition cannot be tested.
• FCA SYSC 12.1 group-wide systems and controls expectations are engaged given the multi-jurisdictional group structure evidenced in Sections 1 and 2.
• Scoring consequence: the composite in Section 11 contains no PEP contribution. The score is therefore understated by an unquantified margin in what is, on this evidence, the highest-probability remaining adverse domain.

Required Next Steps

1. 1.Connect a licensed PEP/RCA data source and re-run screening on the entity, all identified group members, and every officer and beneficial owner obtained under Sections 1–2.
2. 2.Screen specifically for RCA relationships arising from Russian state or state-owned-enterprise connections once ownership data is obtained.
3. 3.Record the outcome as a discrete, dated audit entry. Until then, the PEP domain must be shown as NOT ASSESSED in the client file, not as clear.

Assessment

The adverse-media screen ran via Google Programmable Search (OK_DATA) and returned 10 results: 6 adverse (1 critical, 5 high), 0 positive, 4 neutral. The adverse items are not diffuse allegation; they cluster around a coherent, multi-source fact pattern centred on the Swiss subsidiary's AML controls and, latterly, on sanctions designation. The evidenced time span runs from 1 February 2018 (FINMA) to January 2025 (legal commentary on the SDN designation).

All items other than the FINMA release and the Treasury release are media or commentary, and are reported here strictly as claims made by their publishers.

Evidence

Four returned items were classified neutral and are not described in the supplied evidence; they cannot be characterised here.

Analytical Observations

• Cross-tier corroboration. The same control-failure theme is evidenced by a regulator (FINMA, 2018), a court (Zurich District Court sentences, March 2023, continuing May 2024) and press (NYU blog, WSJ, NBC). Convergence across regulator, court and media on one fact pattern is the strongest form of adverse-media validation available. It supports Sections 6 and 7.
• Recency matters decisively. The 2022 "dodged sanctions" framing predates the Treasury designation dated November 2024 in the source text. Any assessment relying on the 2022 items alone would reach the wrong current conclusion.
• Group-wide distribution. The media set names the Russian parent, the Swiss subsidiary, a Luxembourg subsidiary and executives with French assets — consistent with the multi-jurisdiction exposure analysed in Section 9.
• Attribution discipline. The RFE/RL and Le Monde items are allegations. No court or regulator finding in the evidence supports them. They must not be recorded as facts and must not be described as investigations of the entity absent confirmation of subject and authority.

Coverage Limitations

• Search was performed by a general web search engine, not a licensed adverse-media or structured negative-news database. No de-duplication, no source-reliability grading and no jurisdictional weighting were applied.
• No Russian-language search is evidenced; domestic Russian coverage is therefore likely under-represented.
• Most items carry [UNDATED] feed metadata, with dates recoverable only from in-text strings. Date certainty is consequently lower than the table implies for those rows.
• The OSINT screen returned "No findings returned", which for a globally reported institution is anomalous and should be treated as a tooling limitation, not a clean signal.

Assessment

The regulatory screen ran via Google Programmable Search (OK_DATA) and returned 10 results: 4 adverse (2 critical, 2 high), 0 positive, 6 neutral. Two state-determined outcomes are established: a concluded FINMA enforcement action against the Swiss subsidiary (2018), and OFAC designation of the parent and its subsidiaries (Treasury release dated Nov 21, 2024 in the source text). No regulatory fine amount appears anywhere in the evidence.

Evidence

Key Findings

• The 2018 FINMA outcome is a concluded enforcement finding, not an open investigation. It records an identified deficiency in the AML control system of a group member — the most probative non-sanctions adverse finding in the file.
• A six-year continuity is evidenced across independent authority types: regulator-identified AML control shortcomings (FINMA, 2018) → criminal sentences imposed on four former employees of the same subsidiary for lack of diligence in financial transactions (Zurich District Court, sentenced March 2023 per swissinfo; proceedings continued May 2024) → full blocking designation (OFAC, Nov 2024). This is corroboration of a pattern, not repetition of a single event. See Section 7.
• The subject of the FINMA action is the Swiss subsidiary, not the Russian parent. This distinction must be preserved. The evidence does not show any FINMA action against the parent.

Not Retrieved / Not Checked

• Bank of Russia (CBR) licence status, supervisory actions or sanctions: not searched — no registry or regulator-register provider ran.
• FCA/PRA Financial Services Register check: not evidenced in the source ledger.
• OFSI enforcement or penalty records, and any OFSI general or specific licence: not retrieved. No licence may be assumed.
• EU / SECO / Canadian / Australian regulatory or sanctions actions: not screened.
• Delisting applications, remediation attestations or independent AML audit reports: none in evidence. No remediation credit can be given.

Risk Implication

A documented regulatory finding of AML control failure inside a group member, followed by criminal sentences against staff of that same member and then full blocking designation, is the fact pattern regulators expect firms to treat as decisive rather than cumulative. Under MLR 2017 reg. 33 and FCA SYSC 6.3, this profile would require enhanced measures even in the absence of designation; with designation present (Section 3), the analysis moves from due diligence to prohibition (Section 12).

Assessment

The litigation screen ran via Google Programmable Search (OK_DATA) and returned 10 results: 3 adverse (1 critical, 1 high, 1 low), 0 positive, 7 neutral. Court records were not searched directly — all litigation intelligence in this file derives from media reporting of court proceedings. Case numbers, party names and judgment texts were not retrieved.

Evidence

Critical Characterisation Controls

• The convictions are of individuals, not of the bank. The evidence shows four former employees of Gazprombank (Switzerland) sentenced to conditional fines. Nothing in this evidence establishes a criminal conviction of Gazprombank, of Gazprombank (Switzerland) Ltd, or of any Gazprombank legal person. Any statement to the contrary would be a mischaracterisation with legal consequences.
• "Alleged Putin funds" is an allegation, not a judicial finding. The swissinfo headline of 2023-03-08 frames the underlying accounts as allegedly connected to Vladimir Putin. The evidence does not establish that any court made a finding as to beneficial ownership of those accounts. This is recorded as an unresolved allegation only, and it is one of the reasons the unrun PEP screen in Section 4 is materially consequential.
• The UK civil matter is a loss, not misconduct. The rejected claim evidences cross-border trade-finance activity and confirms the existence of a Luxembourg subsidiary — intelligence value in itself for sanctions perimeter mapping (Sections 2, 3, 9) — but it is not an adverse conduct finding.

Pattern Analysis

• Repeat litigation: not established. Three distinct matters across two jurisdictions do not constitute a litigation pattern on this evidence.
• Class actions: none identified.
• Insolvency proceedings: none identified. Absence here reflects the limits of a web search, not a verified negative.
• The genuine pattern is thematic, not procedural: the Swiss criminal matter concerns diligence failures on transactions in the same entity, in the same jurisdiction, in which FINMA had already identified AML control shortcomings (Section 6). Switzerland is the convergence node for regulatory, criminal and sanctions signals.

Required Next Steps

1. 1.Obtain the Zurich District Court judgment(s) and the appellate outcome; confirm the disposition, the precise offences, and whether any legal person was charged.
2. 2.Obtain the primary UK judgment referenced by GTR to identify the Luxembourg subsidiary by legal name and screen it.
3. 3.Search primary court registers (Swiss, English, Luxembourg) directly rather than relying on media reporting.

Assessment

Screen status: NOT RUN — no dedicated ESG, sustainability, human-rights or supply-chain data source was consulted. No ESG rating, controversy score or disclosure framework filing appears anywhere in the evidence set.

What can be said is confined to conduct and governance risk inferred from state-determined findings already documented elsewhere in this report, plus attributed media allegations.

Governance and Conduct — Evidenced

Dimensions With No Data

• Environmental violations: NOT FOUND — no environmental data source consulted.
• Labour and human rights (own operations): NOT FOUND. Note: allegations relating to conflict financing (RFE/RL) touch human-rights-adjacent conduct risk but are unadjudicated and concern financial flows, not labour practices.
• Whistleblower reports concerning the entity: NOT FOUND. The phrase "Treasury Accepting Whistleblower Tips on Fraud, Money Laundering, Sanctions Violations" appearing in the Treasury search snippet is generic page furniture on the Treasury website and is not an entity-specific whistleblower finding. It must not be read as one.
• Supply chain risk: NOT ASSESSED.
• Data breaches / cyber incidents: NOT FOUND — no breach-notification or cyber source consulted.
• UN Global Compact participation, TCFD or CSRD reporting, UK Modern Slavery Act statement: NOT RETRIEVED. No conclusion may be drawn as to compliance or non-compliance with any of these frameworks.

Risk Implication

• ESG & Conduct is not a weighted factor in this scoring model (see Section 11); it influences the composite only indirectly through Transparency Risk. Its narrative value here is that the conduct evidence is regulator- and court-determined rather than reputational, which raises its evidential weight above typical ESG controversy data.
• For any firm with sustainability-disclosure or reputational-risk obligations, the combination of a designated counterparty, a regulator-identified AML control failure and unadjudicated conflict-financing allegations would require documented board-level consideration independent of the sanctions position.
• No remediation, governance-reform or independent attestation evidence exists in the file, so no ESG or conduct mitigation can be credited.

Assessment

No financial profile could be constructed. This is a material due-diligence deficiency. The financial screen ran (Google Programmable Search, OK_DATA) and returned 10 results — but the substantive content it surfaced was sanctions and media material, not accounts: the two adverse items are the US Treasury designation release and the RFE/RL allegation. One item was classified "positive" but is not described in the supplied evidence and therefore cannot be characterised.

What Is Missing

For a bank, the absence of any audited financial data means solvency, funding sources, liquidity and counterparty exposure cannot be assessed at all. This is not a thin file at the margins; it is the total absence of the primary financial evidence base.

The Only Financially Relevant Evidence Retrieved

• Blocking measures. The Treasury release (https://home.treasury.gov/news/press-releases/jy2725) records designation of the parent and six foreign subsidiaries. SDN status and HMT designation carry asset-freeze effects that materially and immediately alter the entity's access to funds, correspondent banking and cross-border settlement. No licence evidence exists to mitigate this.
• Allegation as to flow of funds. RFE/RL reported (Jun 28, 2022, https://www.rferl.org/a/ukraine-gazprombank-sanctions-funds-russia-war-soldiers-wages/31920143.html) that its "Schemes" investigative unit found revenue for the assault on Ukraine, including soldiers' wages, being channelled through Gazprombank. This is a journalistic allegation. No court or regulator finding in this evidence set supports it. It is nonetheless directly relevant to any source-of-funds enquiry and must be resolved rather than dismissed.
• Trade-finance exposure. The GTR report (2022-03-30) evidences a claim by the Luxembourg subsidiary against a Swiss-headquartered commodities trader — indicative of commodity trade-finance activity, a recognised higher-risk product line. No transaction values were retrieved.

Risk Implication

• MLR 2017 reg. 28(11) requires understanding of the nature and purpose of the relationship, and reg. 33 requires enhanced measures including, where relevant, establishing source of funds and source of wealth. Neither is achievable on this evidence.
• FATF Recommendation 10 customer due diligence on the financial dimension is unmet.
• The combination of zero financial transparency (this section), zero ownership transparency (Section 2) and no registry record (Section 1) is the substantive basis for the Transparency Risk sub-score of 85/100 in Section 11.
• Practically, the financial gap does not change the outcome in Section 12: designation status determines the decision. But it must be recorded, because it means the firm has no independent basis on which to assess the entity even if licensing were obtained in future.

Assessment

Geographic exposure is multi-jurisdictional and materially wider than the single RU jurisdiction supplied. Country of incorporation is user-provided as RU and remains unverified because no registry screen ran (Section 1).

Evidenced Jurisdictional Footprint

Reference Datasets — Not Consulted

Screen status: NOT RUN for jurisdiction reference data.

• FATF grey/black list status: not retrieved. No FATF publication was consulted or cited in the evidence set. No FATF listing status is asserted here.
• EU High-Risk Third Countries list: not consulted.
• Transparency International CPI score: not retrieved. No CPI figure or year is available, and none will be invented.
• Offshore/secrecy-jurisdiction indices: not consulted. Note, however, that the FINMA matter arose in a Panama Papers context per the regulator's own release — an offshore-structuring nexus evidenced at the regulatory level, though the specific structures are not identified in this evidence.

Model Sub-Score Challenge

The supplied model assigns Jurisdiction Risk 35/100 at 6.8% applied weight. On the evidence actually in this file — a jurisdiction that is the named programme for both a UK asset freeze and two OFAC SDN designations of the subject group — a score of 35/100 is not reconcilable with the sanctions evidence and appears to reflect a generic country table rather than the entity-specific programme exposure. Because the weight is low (6.8%), the effect on the composite is small (2.38 points), but the sub-score should be recorded as understated and the underlying reference data should be connected. See Section 11.

Risk Implication

• Sanctions perimeter risk is geographically distributed. A counterparty screening only the Russian parent name would miss the Swiss entity, the Luxembourg subsidiary and six unnamed designated foreign subsidiaries. This is the most concrete operational risk arising from the geographic profile.
• Regime overlap. UK, US and (unscreened) EU/Swiss regimes may apply differently to different group members and different products. Legal advice on nexus is required before any action.
• The absence of EU and SECO screening (Section 3) is a specific consequence of a Swiss- and Luxembourg-exposed group being screened against only OFAC, HMT and UN lists.

Model Output as Supplied

The automated model returned Composite 55/100 — "Medium-High" on PARTIAL coverage. The scores and applied (renormalised) weights below are reproduced verbatim from the supplied RISK SCORE block. Weights were renormalised across the six domains that ran; PEP did not run and contributes nothing.

Calculation

Composite Score = Σ(Factor Score × Applied Weight)

• (11 × 0.341) = 3.751
• (88 × 0.227) = 19.976
• (79 × 0.204) = 16.116
• (81 × 0.114) = 9.234
• (35 × 0.068) = 2.380
• (85 × 0.045) = 3.825
• Σ = 55.282 → reported as 55/100 ("Medium-High")

The arithmetic is reproducible and internally consistent. The inputs, not the arithmetic, are defective.

Documented Analyst Override

Override applied. Adjudicated risk level: CRITICAL. Adjudicated score: 84/100.

Grounds:

1. 1.The Sanctions sub-score of 11/100 is unsupportable on the evidence. The same evidence set records a 100.0% exact match to the UK HMT Consolidated List (Russia programme, Entity, version 2026-08-17) and two OFAC SDN matches at 90% containment carrying SWIFT/BIC and domain identifiers (GAZPRUMM / www.gazprombank.ru; RKBZCHZZ / www.gazprombank.ch), independently corroborated by a US Treasury press release (https://home.treasury.gov/news/press-releases/jy2725). This is the highest-severity finding class available.
2. 2.A designation is a legal prohibition, not a risk gradient. No weighted-average model can properly express an asset freeze, because the correct output is a binary control (block, report, licence) rather than a score. Any score-driven CDD routing must be suspended once a confirmed designation is in scope.
3. 3.The vendor labelling contributed to the error. The retrieved record describes a 100.0% exact match as a "possible match", which is a data-formatting artefact capable of causing systematic under-triage. Recorded as a control defect (Section 3).
4. 4.Coverage is PARTIAL and the missing domain is high-probability adverse. PEP never ran; on this entity profile that is the single most likely remaining source of additional adverse findings (Section 4).

Override arithmetic (sanctions re-scored at 95/100; all other supplied scores and applied weights unchanged):

• (95 × 0.341) = 32.395
• Unchanged contributions: 19.976 + 16.116 + 9.234 + 2.380 + 3.825 = 51.531
• Σ = 83.926 → 84/100 — CRITICAL

The override changes one input only and leaves the model structure, all other scores and all weights intact, so the adjustment is fully traceable and auditable. Note that even the overridden figure excludes any PEP contribution and uses a Jurisdiction sub-score assessed above as understated; 84/100 should therefore be read as a floor, not a ceiling.

What Drives the Assessment

Confidence Statement

Overall confidence: MEDIUM. Confidence is HIGH on the sanctions and enforcement findings, which are state-determined and multiply corroborated. Confidence is LOW on entity identity resolution, ownership, financial profile and PEP status, because the registry and PEP screens did not run and the UBO screen returned nothing. The direction of the risk conclusion is not in doubt; the completeness of the file is.

Recommendation

DO NOT ONBOARD. ESCALATE IMMEDIATELY AS A LIVE SANCTIONS MATCH. Where exposure already exists: freeze, report, and take legal advice before any further action.

The automated output supplied with this file — "Standard CDD with Enhanced Monitoring", "EDD required: NO", "Monitoring frequency: QUARTERLY" — is formally rejected and must not be actioned. It is inconsistent with a 100.0% exact match to the UK HMT Consolidated List and with two OFAC SDN matches on group legal persons.

Rationale

• Sanctions status is determinative. The subject name matches the HMT Consolidated List at 100.0% exact confidence (Russia programme, Entity). Under the Russia (Sanctions) (EU Exit) Regulations 2019, dealing with funds or economic resources owned, held or controlled by a designated person, or making funds or economic resources available directly or indirectly to or for the benefit of a designated person, is prohibited absent an OFSI licence. OFSI may impose civil monetary penalties on a strict-liability basis; breach may also be a criminal offence.
• US exposure is independent and material. SDN designation of Gazprombank Joint Stock Company and Gazprombank (Switzerland) Ltd (EO 13662 / EO 14024) creates prohibitions for US persons and secondary-sanctions/correspondent-banking risk for others.
• Rejection here is evidence-driven, not gap-driven. Consistent with the rule that a relationship should not be refused solely because information is unavailable, the decision rests on the affirmative designation evidence. The information gaps (registry, UBO, PEP, financials) independently make the file incapable of completion to MLR 2017 reg. 28 standard, which would in any event preclude onboarding.
• No mitigating evidence exists. No OFSI or OFAC licence, no delisting application, no remediation attestation, no independent AML audit appears in the evidence. Absence does not prove non-existence, but nothing may be credited.

Outstanding Information Gaps

Required Actions

1. 1.Within 24 hours: confirm the match against the primary OFSI Consolidated List entry (capture OFSI Group ID, designation date, statement of reasons, all aliases and addresses) and the primary OFAC SDN records for both named legal persons.
2. 2.Within 24 hours: freeze/block all identified exposure; suspend all payments and trade-finance activity involving the entity, BIC GAZPRUMM, BIC RKBZCHZZ, and any identified group member.
3. 3.Within 24 hours: report to OFSI in accordance with the reporting obligations applicable to the firm; assess and, where knowledge or suspicion of criminal property arises, submit a SAR to the NCA under POCA 2002. Do not tip off.
4. 4.Within 48 hours: run a group-wide, cross-book exposure sweep covering the parent, the Swiss entity, the Luxembourg subsidiary and — once identified — the six designated foreign subsidiaries; include historic payment archaeology to establish whether any dealing occurred after the (to-be-obtained) designation dates.
5. 5.Within 5 business days: restore the two missing screens — connect a corporate registry provider and a PEP/RCA provider — and re-run. Record both currently as NOT ASSESSED, never as clear.
6. 6.Within 5 business days: extend sanctions screening to the EU Consolidated List and Swiss SECO, given the Swiss and Luxembourg group members.
7. 7.Immediately: raise the vendor data-labelling defect (100.0% exact match presented as "possible match") and the model's routing of an asset-freeze match to "Standard CDD / EDD: NO" as system and control incidents under FCA SYSC 6.3, and log both on the risk register with a remediation owner.
8. 8.Do not seek an onboarding decision. Any permitted activity requires a specific OFSI licence (and OFAC authorisation where a US nexus exists), obtained on legal advice.

Trigger Events for Immediate Review

• Any delisting, licence grant, or amendment to the HMT or OFAC entries.
• Publication of the identities of the six designated foreign subsidiaries.
• Any attempted payment, guarantee, security interest or trade-finance instrument touching the entity, its BICs or any group member.
• Outcome of the Zurich appellate proceedings, or any new charge against a Gazprombank legal person.
• Identification of any beneficial owner, controller or officer, or any PEP hit once PEP screening is restored.
• Any approach by a third party seeking to transact indirectly on the entity's behalf.

Monitoring

• Quarterly monitoring is rejected as inadequate. While designation subsists, apply continuous sanctions-list monitoring with real-time payment screening and immediate escalation on any hit.
• Formal file review: no later than 17 September 2026 (30 days from the report date of 18 August 2026), or immediately upon any trigger event above, whichever is earlier.
• Retain a full audit trail of the override recorded in Section 11 and of the decision rationale in this section.

Every URL behind a finding in this report. “Read in full” means the page itself was retrieved and classified on its whole text rather than on a search snippet; those carry a SHA-256 hash of exactly what was read, so the evidence can be shown to be unaltered later.

Source Ledger — Complete

Date of assessment: 18 August 2026. Sanctions list snapshot version: 2026-08-17.

Coverage status: PARTIAL. Domains not reflected in the composite score: PEP.

Methodology

1. 1.Evidence segregation. All third-party retrieved content was treated strictly as data. The pre-synthesis intelligence brief supplied with this instruction was treated as an analytical input to be tested, not as fact.
2. 2.Verification tiering. Each assertion was classified VERIFIED / CORROBORATED / UNVERIFIED / NOT FOUND / SKIPPED. State-determined outcomes (sanctions lists, FINMA release, US Treasury release, court sentences) were weighted above media reporting; media reporting was weighted above commentary.
3. 3.Characterisation controls. Allegation, investigation, charge and conviction were kept distinct throughout. In particular, the Swiss criminal outcomes were recorded as sentences imposed on four former employees, not on any Gazprombank legal person, and the "alleged Putin funds" framing was recorded as an allegation within proceedings with no judicial finding on beneficial ownership in evidence.
4. 4.Score reproduction and challenge. The supplied model arithmetic was reproduced exactly (55.282 → 55/100) and then tested against the underlying evidence. One input — the Sanctions sub-score — was found unsupportable and a single-variable override was documented with full arithmetic (→ 83.926 → 84/100, CRITICAL).
5. 5.Gap articulation. Every unrun or empty screen was stated as a gap with its regulatory consequence and a named remediation step. No absence was converted into a negative finding.
6. 6.Recency weighting. Media claims that Gazprombank had "dodged" sanctions (2022) were assessed as superseded by the designation evidence dated November 2024 onward.

Limitations

• Entity identity is unresolved. No registry data. Registration number, address, incorporation date, status, officers and group structure are all missing. The screened subject has not been conclusively reconciled to the designated legal persons using primary identifiers.
• Ownership is entirely unknown. No UBO at any tier; the reg. 7 ownership-and-control test and the OFAC 50 Percent Rule cannot be applied.
• PEP screening never ran — a material omission on this entity profile.
• No designation dates for any of the three sanctions entries; the list version (2026-08-17) is a snapshot date only.
• The six designated foreign subsidiaries are unnamed, so the sanctions perimeter is incompletely defined; the Luxembourg subsidiary is likewise unnamed and unscreened.
• No financial data at all for a banking institution.
• Litigation intelligence is media-derived; no primary court records were obtained.
• Truncated source text affects three items: the FINMA release (scope of the ban), the OFAC remarks fields ("Executive Order 13662 Directive Determinatio"), and the NYU blog extract ("the accounts that Gazprombank ..."). Conclusions were not extended beyond the visible text.
• The pre-synthesis brief itself is incomplete — it terminates mid-sentence in its cross-signal correlation section — and its inferential claims (notably a sectoral-to-blocking "escalation curve") are recorded in Section 3 as inference rather than as evidenced fact. Its central recommendation to override the sanctions sub-score is supported by the evidence and has been adopted with independent arithmetic.
• No prompt-injection or instruction-like content was identified within the untrusted retrieved evidence. Two data-integrity concerns are recorded instead: the "possible match" mislabelling of a 100.0% exact match, and the model's routing of an asset-freeze match to "Standard CDD / EDD: NO".

Legal and Regulatory Framework Referenced

• Russia (Sanctions) (EU Exit) Regulations 2019 — asset-freeze prohibitions; reg. 7 ownership and control
• Sanctions and Anti-Money Laundering Act 2018; OFSI reporting and civil penalty regime
• Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 — regs. 5, 28, 33, 35
• Proceeds of Crime Act 2002 — SAR obligations; tipping-off
• FCA SYSC 6.3 (financial crime systems and controls); SYSC 12.1 (group-wide systems)
• FATF Recommendations 10, 12, 24
• EU 5AMLD Article 30; UK PSC register 25% threshold concept
• US Executive Orders 13662 and 14024; OFAC 50 Percent Rule
• Referenced but not consulted: FATF grey/black lists, EU High-Risk Third Countries list, Transparency International CPI, UN Global Compact, TCFD, CSRD, UK Modern Slavery Act 2015

Confidence

Overall confidence: MEDIUM.

• HIGH confidence in the sanctions and enforcement conclusions: they rest on a 100.0% exact UK list match, two OFAC SDN entries carrying institution-specific identifiers, a regulator's own publication and a US Treasury press release — mutually corroborating, state-determined sources.
• LOW confidence in entity identity, ownership, financial profile and PEP status: two screens did not run, the UBO screen returned nothing, and no primary registry or court records were obtained.
• The direction of the risk assessment is not in doubt. The completeness of the file is materially deficient, and the CRITICAL adjudication in Section 11 should be treated as a floor pending restoration of the registry and PEP screens.