Gazprombank

Assessment

Entity identity is NOT verified. No corporate registry was queried in this assessment. Every identity attribute below is either derived from a sanctions-list remarks field, derived from open-source reporting, or not retrieved. The subject is identifiable with reasonable operational confidence as a large Russian bank, but it has not been resolved to a specific legal person.

Screen status: NOT RUN — REGISTRY. The source ledger records: "No provider configured for REGISTRY → SKIPPED." This is not a nil return; it is an unchecked field.

Evidence

Group entities evidenced

Risk Implication

The SWIFT/BIC and domain identifiers in the OFAC remarks are the only hard identifiers anywhere in this file. They support operational identification of a bank but they do not establish the legal person's registration particulars, which is what a firm needs in order to (a) confirm that the designated party and the customer/counterparty are the same entity, and (b) discharge identification and verification obligations under UK MLR 2017 regulation 28. Recording the entity as "identified" on the strength of a name plus a SWIFT code would be an audit finding.

The unidentified subsidiaries are the sharper problem. Their existence is established by a US government press release; their names are not. This gap propagates directly into Section 3 (screening cannot cover unnamed entities) and Section 2 (group structure is unmapped).

Next step: obtain a certified extract from the Russian companies register (EGRUL) confirming full legal name, OGRN, INN, legal form, address and status, and retrieve the primary OFAC action to enumerate the six designated foreign subsidiaries.

Assessment

No beneficial owner or controller has been established at any verification tier. The UBO search executed and returned data (Google Programmable Search, OKDATA), but produced nothing usable. There is **no CONFIRMED UBO, no DECLARED UBO, and not even an UNVERIFIEDLEAD**. For a banking group of this scale and profile, a complete void is itself a significant finding.

What is missing, precisely

Explicit constraints on inference

Three statements must be recorded to prevent the file being misread:

1. 1.The evidence set does not establish who owns or controls Gazprombank.
2. 2.The evidence set does not establish any ownership or control link between Gazprombank and Gazprom, the Russian state, or any named individual — notwithstanding the entity's name. Any such assumption is analyst inference and is labelled here as unevidenced.
3. 3.The swissinfo headline reference to "alleged Putin funds" [https://www.swissinfo.ch/eng/politics/trial-of-gazprombank-managers-underway-in-switzerland/48342164] describes the reported subject matter of a Swiss prosecution. It is an allegation reported by a news organisation. It is not a judicial finding of beneficial ownership of any account or asset, and it must not be treated as evidence of the entity's ownership structure.

Regulatory threshold and consequence

• UK MLR 2017: a beneficial owner of a body corporate includes any individual who ultimately owns or controls, directly or indirectly, more than 25% of the shares or voting rights, or who otherwise exercises control over management. Where a firm cannot identify the beneficial owner, it must take reasonable measures to verify the identity of the senior person responsible for managing the entity — nothing in this evidence set permits even that fallback, because no officers were retrieved.
• FATF Recommendation 24: adequate, accurate and up-to-date beneficial ownership information must be obtainable. It was not obtained here.
• UK PSC Register / EU 5AMLD Article 30: these frameworks are cited as the applicable comparative standard for ownership transparency; neither applies directly to a Russian-incorporated entity, and no equivalent Russian ownership filing was retrieved.

Risk Implication

The ownership void interacts directly with the sanctions position in Section 3. Under UK and US asset-freeze regimes, control and ownership tests extend restrictions to entities owned or controlled by designated persons. Without a mapped ownership chain, a firm cannot determine whether any other counterparty in its book is caught by ownership/control aggregation rules. Combined with the five unnamed designated foreign subsidiaries identified in Section 1, this makes indirect exposure effectively unmeasurable on the current evidence.

CDD is therefore incomplete, and no relationship decision that depends on knowing the controllers can properly be taken. This gap is the principal driver of the Transparency Risk score of 85/100 in Section 11.

Assessment

Adverse — three matches across two national sanctions regimes, including one exact-confidence match to a UK asset-freeze list. This is the determinative element of the file. A listing by a sanctions authority is an official act, not an allegation, and requires no corroboration.

Screening parameters

Match detail

Match-quality analysis

• The HMT match is exact (100%) on the string "GAZPROMBANK". A single-token exact match on a distinctive trading name is a strong indicator, but the feed returned no designation date, no group ID, no address and no aliases. Those fields are needed to confirm that the listed person is the same legal person as the customer or counterparty.
• The OFAC matches are scored 90% by containment, i.e. the screened string is contained within the listed name. Containment scores are a name-matching artefact and are not, on their own, identity confirmation. Here, however, they are materially reinforced by the SWIFT/BIC and website identifiers in the remarks fields, which are entity-specific.
• What is NOT established: designation dates. All three sanctions items are recorded as UNDATED. The US Treasury press release is source-reported 21 Nov 2024 [https://home.treasury.gov/news/press-releases/jy2725] and legal commentary is dated 6/7 Jan 2025 [https://blog.volkovlaw.com/2025/01/ofac-designates-gazprombank-for-inclusion-on-sdn-list/], but a press-release date is not a verified designation date. The date the restriction bit is legally significant for any lookback or breach analysis and must be obtained from the primary list entry.
• Correction to prior analysis: the OFAC remarks reference an "Executive Order 13662 Directive Determinatio[n]". EO 13662 is a sectoral-measures authority. The entity should therefore not be characterised as having been entirely free of Western sanctions before the 2024 SDN designation; the accurate characterisation is that it was not an SDN. The remarks field is truncated in the extract and the full text was not retrieved.

Scope gaps

• EU consolidated list: not evidenced in the provider scope description; no EU match result was returned. Not a nil finding — a scope question to confirm.
• UN list: within provider scope; no match was returned. This is consistent with an OK_DATA run and may be a genuine nil, but the extract does not state it affirmatively.
• Other regimes (Switzerland SECO, Canada, Australia, Japan, Ukraine): not screened on this evidence.
• The five unnamed designated foreign subsidiaries (Section 1) cannot have been screened because their names are unknown.

Risk Implication

Subject to confirmation of the match against primary records, UK financial sanctions prohibit dealing with the funds or economic resources of a designated person, or making funds or economic resources available to them, without an OFSI licence; the prohibition is strict and does not turn on intent. The OFAC SDN status creates parallel US blocking exposure and, for non-US institutions, secondary-sanctions and correspondent-access risk.

The listing of Gazprombank (Switzerland) Ltd in its own right connects this section directly to Section 6 (FINMA's 2018 AML finding against the same entity) and Section 7 (Zurich criminal proceedings against its former employees). The Swiss subsidiary is the concentration point of the group's evidenced control failure and its Western-facing interface — the highest-consequence location for such a failure.

Next step: retrieve full primary entries (HMT group ID and designation date; OFAC UID and designation date), enumerate the six designated foreign subsidiaries, and confirm whether the Luxembourg entity referenced in Section 7 is among them.

Assessment

Screen status: NOT RUN

PEP screening was not performed. The source ledger records: "No PEP screening provider configured [PEP] → SKIPPED." The coverage statement confirms PEP is a "risk domain NOT reflected in the composite score."

No conclusion of any kind may be drawn. Specifically, this report does not state that the entity or its controllers are PEPs, and it does not state that they are not. Both would be unsupported.

Why this gap is more than formal here

Categories not assessed

• PEP (domestic, foreign, international organisation) — NOT ASSESSED
• RCA (family members and close associates) — NOT ASSESSED
• HIO (heads of international organisations) — NOT ASSESSED
• Position, jurisdiction of office and time period of any such role — NOT ASSESSED

No role-keyword or name-pattern inference has been used to substitute for screening, in line with the instruction that role-keyword matching does not support a "not a PEP" conclusion.

Risk Implication

Under FATF Recommendation 12 and FCA SYSC 12.1, firms must have systems to determine whether a customer or beneficial owner is a PEP and, where so, apply senior-management approval, source-of-wealth and source-of-funds establishment, and enhanced ongoing monitoring. None of that can be evidenced on this file.

The practical effect on the risk score is that the composite of 84/100 is calculated across six domains only, with PEP weight redistributed to the domains that ran (see Section 11). 84 should therefore be read as a floor. A PEP screen returning positive results on identified controllers could only raise it.

Next step: procure PEP/RCA screening and re-run once controllers and senior officials are identified from a registry extract. Until then, the CDD file must carry an explicit unresolved-PEP flag.

Assessment

Adverse. The adverse-media domain returned 10 results: 6 adverse, 0 positive, 4 neutral (critical 1, high 5). The material is credible in source terms — it includes a US government press release and a Swiss regulator's own publication — but it is not 18 independent risk events. Across all domains the adverse items resolve to approximately five event clusters, heavily cross-reported.

Time span of source-reported publication dates: 1 Feb 2018 → 6/7 Jan 2025.

Evidence

4 neutral items were returned but their content is not specified in the extract and they cannot be characterised.

Analytical observations

• Corroboration is by source type, not merely by publisher. A sanctions authority, a prudential regulator and a criminal court converge on the same entity and the same conduct theme (AML control failure at the Swiss unit; Russia-programme designation of the parent). No source in the evidence set contradicts any other.
• Derivation must be discounted. ACAMS (item 2) and Volkov Law (item 5) are derivative of the Treasury action. NYU (item 6) is derivative of the Zurich court outcome. Counting them as independent signals would inflate the picture.
• Item 4 must not be relied upon. The Le Monde extract does not identify who is under investigation, by which authority, or in respect of what conduct. It is retained on file as a retrieval task, not as a finding. Treating it as an allegation against named executives would be a mischaracterisation with defamation exposure.
• A boilerplate artefact requires flagging. The Treasury page text "Treasury Accepting Whistleblower Tips on Fraud, Money Laundering, Sanctions Violations" is site navigation copy captured in the snippet. It is not a whistleblower report concerning Gazprombank and must not be recorded as one (relevant to Section 10).
• Publication dates are not event dates. Only four items across all domains carry pipeline dates (2025-01-07 ×2, 2024-05-27, 2023-03-08, 2022-03-30). All other dates in this section are dates asserted within snippet text.

Risk Implication

The reputational profile is not diffuse negative sentiment; it is a documented sequence of adverse determinations by state bodies. From an AML/CTF perspective the relevant theme is anti-money-laundering control failure at the group's Western private-banking interface, corroborated by the regulator that supervised it (Section 6) and by criminal proceedings against its staff (Section 7). Reputational risk to any institution associated with this entity is high and is compounded, not mitigated, by the ownership opacity in Section 2.

Assessment

Adverse — two distinct state actions are evidenced: a concluded Swiss prudential enforcement matter (2018) and a US Treasury designation (source-reported 2024). The domain returned 10 results: 4 adverse, 0 positive, 6 neutral (critical 2, high 2). The four adverse items reduce to two underlying matters.

Matter 1 — FINMA (Switzerland), concluded

Sources: https://www.finma.ch/en/news/2018/02/20180201-mm-gazprombank-schweiz/ ; https://www.wsj.com/finance/banking/gazprombank-the-big-russian-lender-that-dodged-western-sanctions-11646996338 ; https://www.nbcnews.com/news/world/big-sanction-big-russian-bank-still-operates-freely-global-economy-hel-rcna34123

Matter 2 — OFAC (United States), designation

Sources: https://home.treasury.gov/news/press-releases/jy2725 ; https://blog.volkovlaw.com/2025/01/ofac-designates-gazprombank-for-inclusion-on-sdn-list/

Sequencing — the analytically important point

The FINMA AML finding is source-reported six years before the parent's SDN designation, and the Zurich sentencing (Section 7) is source-reported before it as well. The designation is therefore the terminal point of a documented trajectory, not the origin of the entity's financial-crime profile.

The compliance inference is direct: an institution that onboarded or maintained this relationship pre-2024 on the basis that the entity "was not sanctioned" would have been relying on the absence of a listing while a prudential regulator's adverse AML finding and a live criminal prosecution sat in the public record. That is a recognised reasoning failure under the FCA's expectations for risk assessment.

Screens not performed

• Central Bank of the Russian Federation licensing/enforcement records — NOT SEARCHED.
• FCA Register / PRA — NOT SEARCHED. No UK-authorised group entity is evidenced either way; this is an open question, not a nil finding.
• Other national regulators (Luxembourg CSSF, in light of the Luxembourg subsidiary in Section 7) — NOT SEARCHED.
• The 6 neutral results in this domain are unspecified in the extract and cannot be characterised.

Risk Implication

A regulator's finding of AML control-system shortcomings, followed by a business restriction, is direct evidence of control failure at the group entity that interfaced with the EU/EFTA financial system. Combined with the SDN listing of that same entity (Section 3) and the criminal outcomes in Section 7, this supports treating the group's AML control environment as demonstrated deficient, not merely unproven. The absence of any evidence of remediation is itself notable: nothing in the file shows the FINMA restriction being lifted or the control weakness resolved.

Assessment

Adverse. The domain returned 10 results: 3 adverse, 0 positive, 7 neutral (critical 1, high 1, low 1). Two distinct matters are evidenced: Swiss criminal proceedings against four former employees of the Swiss subsidiary, and a UK commercial dispute involving a Luxembourg group entity.

Court registers were NOT searched directly. All litigation intelligence in this section derives from news and trade-press reporting via Google Programmable Search. No case numbers, judgment texts or party schedules were retrieved.

Matter 1 — Zurich District Court (Switzerland), criminal

Sources: https://www.swissinfo.ch/eng/politics/trial-of-gazprombank-managers-underway-in-switzerland/48342164 ; https://www.swissinfo.ch/eng/banking-fintech/zurich-court-continues-gazprombank-trial-against-bank-employees/78809971 ; https://wp.nyu.edu/compliance_enforcement/2023/04/13/swiss-court-convicts-and-sentences-former-gazprombank-switzerland-executives-for-anti-money-laundering-violations/

Precision controls — what this matter does and does not establish

• Established: four former employees were convicted and sentenced to conditional fines by the Zurich District Court, per swissinfo's reporting.
• NOT established: that Gazprombank (Switzerland) Ltd or any Gazprombank corporate entity was convicted of any offence. No corporate conviction appears anywhere in this evidence set.
• NOT established: that any funds were beneficially owned by any named individual. "Alleged Putin funds" is a news headline describing the reported subject of a prosecution, not a determination of beneficial ownership.
• NOT established: that the convictions are final. The 2024 continuation indicates appellate or further proceedings.

Asserting any of the "NOT established" propositions as fact would be a mischaracterisation with live legal exposure.

Matter 2 — United Kingdom, commercial

Source: https://www.gtreview.com/news/global/gazprombanks-court-dispute-with-swiss-trader-rages-on/

This item is analytically valuable beyond its own subject matter: it is the only evidence in the file of a Luxembourg group entity, extending the known footprint into the EU and into the English courts. Whether that entity is among the six designated foreign subsidiaries (Section 1, Section 3) is unresolved.

Pattern analysis

• Repeat litigation: not evidenced. Two matters in different jurisdictions and of different character do not establish a litigation pattern.
• Class actions: none identified.
• Insolvency proceedings: none identified — but note that no insolvency register was searched, so this is NOT FOUND, not "none".
• Severity-classification anomaly (methodological note): the pipeline classified the 8 Mar 2023 trial report as LOW and the 27 May 2024 continuation report as CRITICAL. Since both concern the same proceedings, the automated severity assignment is internally inconsistent and should not be relied upon for prioritisation. Analyst assessment is that both are HIGH relevance.
• The 7 neutral results in this domain are unspecified and cannot be characterised.

Risk Implication

The Swiss criminal outcomes are the strongest available corroboration of the AML control failure identified by FINMA in Section 6: the regulator found a defective control system, and a criminal court subsequently sentenced individuals for lack of diligence in financial transactions at the same institution. That combination — supervisory finding plus adjudicated individual conduct — is materially more probative than either alone.

Next step: obtain the Zurich District Court judgment(s) and current appellate status directly, and identify the English proceedings and the Luxembourg entity by name.

Assessment

Screen status: NOT RUN for ESG.

No dedicated ESG data source was consulted. There is no ESG provider in the source ledger, and the OPEN SOURCE INTELLIGENCE domain returned no findings. The commentary below is therefore limited to conduct and governance risk inferable from evidence gathered for other purposes. It is not an ESG assessment and must not be recorded as one.

Conduct and governance — what the evidence supports

Dimensions with NO evidence either way

Each of the following is NOT FOUND — meaning unchecked, not clean:

• Environmental violations or environmental regulatory action
• Climate-related disclosure (TCFD / CSRD alignment)
• Labour practices and human-rights impacts
• Modern slavery / supply-chain due diligence (UK Modern Slavery Act relevance not assessed)
• Whistleblower reports or retaliation allegations concerning the entity
• Data breaches or information-security incidents
• Board composition, independence or governance-code adherence
• UN Global Compact participation or delisting

Evidence-integrity flag

The Treasury press-release snippet includes the string "Treasury Accepting Whistleblower Tips on Fraud, Money Laundering, Sanctions Violations". This is site navigation boilerplate on the Treasury news page, not a whistleblower report about Gazprombank. It has been excluded from the analysis and is recorded here so that a later reviewer does not mistake it for a substantive whistleblowing finding.

Risk Implication

On the G of ESG, the evidence is materially adverse and comes from primary state sources: a supervisory finding of AML control-system failure, individual criminal sentencing at the same institution, and designation under two national sanctions regimes. That is a governance profile that would fail most institutional conduct-risk thresholds independently of the sanctions position.

On E and S, no conclusion is available. Any ESG rating or narrative asserted about this entity on the current file would be unsupported.

Note that ESG & Conduct is not a weighted factor in the risk model. Its influence reaches the composite only indirectly, via Adverse Media and Regulatory & Enforcement where the same underlying events are already scored — a further reason not to read the domain totals as independent signals.

Assessment

No financial profile could be constructed. The FINANCIAL domain returned 10 results: 2 adverse, 1 positive, 7 neutral — but both adverse items are sanctions/reporting items already captured elsewhere, and the single "positive" item is unspecified in the extract and therefore cannot be relied upon for any purpose. No financial statements, accounts, ratings or filings were retrieved.

What was not retrieved

What the FINANCIAL domain actually returned

On the RFE/RL item: this is an investigative-journalism claim, not a finding of any court or regulator. The extract is truncated and does not itself state what payments were made or to whom. The URL slug references soldiers' wages, which is suggestive but is not a substitute for the article text. It must be reported as a media allegation only and the full report retrieved before any weight is placed on it.

Source-of-wealth assessment

Unresolved and unresolvable on this evidence. Source of wealth and source of funds cannot be established for an entity whose ownership is unknown (Section 2), whose registry particulars are unretrieved (Section 1), and for which no financial statements exist in the file. Where a designated entity is involved, source-of-funds analysis is also secondary to the prior legal question of whether any dealing is permissible at all (Section 3).

Red-flag screen against standard indicators

Risk Implication

This is an explicit due-diligence deficiency, not a neutral absence. UK MLR 2017 requires a firm to understand the nature and purpose of the relationship and, in higher-risk cases, to take adequate measures to establish the source of funds and source of wealth. None of that is achievable here. Combined with the ownership void in Section 2, the file cannot support any assessment of financial soundness, counterparty credit exposure or legitimacy of funds. The influence of this gap on the composite score reaches it only indirectly, through the Transparency Risk factor in Section 11.

Assessment

Elevated, but the quantified jurisdiction score is not reproducible from the supplied evidence. No jurisdiction-risk reference dataset (FATF public statements, EU high-risk third-country list, Transparency International CPI) was retrieved or supplied. The Jurisdiction Risk score of 35/100 in the model therefore cannot be traced to a source in this evidence set and is flagged as an unverified model input.

Jurisdictional footprint on the evidence

Reference datasets — status

Offshore and secrecy exposure

No offshore incorporation is evidenced for the subject itself. However:

• The FINMA matter arose from the Panama Papers [Source: https://www.finma.ch/en/news/2018/02/20180201-mm-gazprombank-schweiz/], which is a direct evidential link between the group's Swiss private-banking unit and offshore-structure-related AML concerns.
• The presence of a Luxembourg entity and of six foreign subsidiaries (five unnamed) indicates a multi-jurisdictional structure whose full geography cannot currently be mapped.

Risk Implication

The operative jurisdictional risk here is not generic country risk — it is the specific fact that the entity is designated under Russia-related sanctions programmes by both the UK and the US, and that its principal Western-facing subsidiary sits inside the EU/EFTA financial system in Switzerland. That combination is what makes the exposure acute: the interface layer between a designated Russian banking group and the European financial system is precisely where the FINMA control failure (Section 6) and the Zurich convictions (Section 7) occurred.

Model observation for the risk committee: a Jurisdiction Risk score of 35/100 appears low relative to the designation evidence and is not supported by any retrieved dataset. Because that factor carries only 6.8% applied weight, correcting it upward would raise the composite modestly (see Section 11 sensitivity note) — but the input should still be evidenced rather than assumed.

Composite result

Weighted factor table

Scores and applied (renormalised) weights are taken verbatim from the supplied RISK SCORE block.

Calculation

Composite Score = Σ(Factor Score × Applied Weight)

• Sanctions & Watchlists: 95 × 0.341 = 32.395
• Adverse Media: 88 × 0.227 = 19.976
• Regulatory & Enforcement: 79 × 0.204 = 16.116
• Politically Exposed Persons: UNDETERMINED × 0 = 0.000 (screen not run; weight redistributed)
• Litigation: 81 × 0.114 = 9.234
• Jurisdiction Risk: 35 × 0.068 = 2.380
• Transparency Risk: 85 × 0.045 = 3.825

Σ = 32.395 + 19.976 + 16.116 + 0.000 + 9.234 + 2.380 + 3.825 = 83.926 → 84 (HIGH)

Applied weights sum to 100.0% (34.1 + 22.7 + 20.4 + 11.4 + 6.8 + 4.5), confirming that the PEP weight has been redistributed across the six domains that ran.

What actually drives the score

1. 1.Sanctions dominates — 32.4 of 83.9 points (39% of the composite) from a single factor. This is appropriate: the factor rests on official listings by two governments, which require no corroboration and admit of no rebuttal short of delisting.
2. 2.Adverse Media and Regulatory together contribute 36.1 points, but they substantially re-express the same underlying events as the sanctions factor plus the FINMA matter. The model therefore contains a degree of event double-counting across domains. This does not make 84 wrong — the events are individually grave — but the risk committee should understand that the composite is driven by the gravity of roughly five event clusters, not by the breadth of eighteen independent adverse signals.
3. 3.Transparency Risk is under-weighted relative to its practical significance. At 4.5% applied weight, a score of 85 contributes only 3.8 points. Yet the total absence of ownership data is the single obstacle that makes CDD impossible to complete, and the five unnamed designated subsidiaries create an unmeasurable indirect-exposure surface. The narrative weight of this gap exceeds its arithmetical weight.

Sensitivity and limitations of the score

Band consistency

84/100 sits in the HIGH band and the assigned risk level is HIGH, consistent with the supplied model output. Confidence is assessed as MEDIUM: the sanctions and regulatory evidence is strong and drawn from primary state sources, but two screens did not run and neither identity nor ownership is verified.

A necessary qualification for the committee: the score describes risk, whereas the sanctions match raises a question of legality. A HIGH band would ordinarily route to EDD and continued monitoring. Here, the 100% exact HMT match means that — subject to match confirmation — the relationship is likely prohibited rather than merely high-risk. Sections 3 and 12 govern that point; the score does not override it.

Recommendation

Primary: SANCTIONS ESCALATION AND PRESUMPTIVE PROHIBITION. Secondary (model output, retained): ENHANCED DUE DILIGENCE (EDD), monthly monitoring.

No onboarding, payment, or continuation decision may be taken at business level. The file must be escalated immediately to the sanctions function and the MLRO, and — given the profile — to the senior risk committee.

Rationale

1. 1.The entity matches a UK asset-freeze designation at 100% exact confidence [HMT_CONSOLIDATED, Russia programme, Entity, list version 2026-08-17] and appears twice on the OFAC SDN List with corroborating SWIFT/BIC and domain identifiers (Section 3). Subject to confirming that the listed person is the same legal person as the counterparty, UK financial sanctions prohibit dealing with its funds or economic resources and making funds or economic resources available to it, without an OFSI licence. This is a legality question that precedes any risk-appetite question.
2. 2.A prudential regulator has found AML control-system shortcomings at the group's Swiss subsidiary and imposed a business restriction (Section 6), and a criminal court has sentenced four of that subsidiary's former employees (Section 7). The financial-crime profile is documented by state bodies, not merely alleged in media.
3. 3.CDD cannot be completed. There is no registry record and no beneficial owner at any verification tier (Sections 1–2). Identity itself is unverified.
4. 4.Two screens did not run — REGISTRY and PEP. Neither may be recorded as clear.
5. 5.Recommending refusal or termination here is evidence-driven (a live designation match), not a default reaction to missing information.

Outstanding information gaps

Required Actions

1. 1.Same day: suspend all activity, applications and payments involving the entity or any known group member (including Gazprombank (Switzerland) Ltd, SWIFT RKBZCHZZ) and refer to the sanctions team. Screen SWIFT identifiers GAZPRUMM and RKBZCHZZ across the payments estate.
2. 2.Same day: confirm the HMT and OFAC matches against primary list records; document the designation dates.
3. 3.Within 48 hours: determine whether any existing exposure exists (accounts, correspondent relationships, custody, collateral, guarantees, trade finance). If frozen funds or economic resources are identified, assess the OFSI reporting obligation and whether a SAR is required.
4. 4.Within 5 business days: obtain the primary OFAC action and enumerate the six designated foreign subsidiaries; load all names into screening.
5. 5.Within 10 business days: obtain an official Russian registry extract and construct the ownership chain to ultimate natural persons; then commission PEP/RCA screening.
6. 6.Retrospective lookback: review any exposure arising between the earliest source-reported non-SDN reporting (Mar 2022) and the source-reported designation (21 Nov 2024). This window is significant because two independent outlets (WSJ, NBC News) publicly identified the entity as a large Russian bank outside SDN designation, and RFE/RL alleged its use for Russia-related flows. Counterparties or payment chains introduced during that period carry elevated retrospective sanctions-evasion exposure. Note the necessary qualification from Section 3: the OFAC remarks reference an EO 13662 directive determination, so the entity was not wholly unsanctioned in that period.
7. 7.Do not record any residual-risk rating until the registry and PEP screens have been completed.

Trigger events for immediate re-review

• Any change to the HMT or OFAC entries (addition, amendment, delisting) or issuance/variation of an OFSI or OFAC licence
• Identification of any of the five currently unnamed designated subsidiaries in the firm's book
• Any final appellate outcome in the Zurich proceedings, or the initiation of proceedings against a corporate Gazprombank entity
• Any new FINMA, CBR or other supervisory action concerning any group entity
• Discovery of indirect exposure through an intermediary, nominee or ownership/control chain
• Any payment attempt referencing GAZPRUMM or RKBZCHZZ

Monitoring and review

Every URL behind a finding in this report. “Read in full” means the page itself was retrieved and classified on its whole text rather than on a search snippet; those carry a SHA-256 hash of exactly what was read, so the evidence can be shown to be unaltered later.

Assessment parameters

Complete source ledger

Methodology

1. 1.Evidence-integrity check. All third-party content was treated as data, never as instruction. The retrieved material was inspected for prompt-injection or score-direction attempts. None was found — the content reads as ordinary search-result metadata and sanctions-list extracts. This clean result is recorded affirmatively as a control outcome. One artefact was isolated and excluded: Treasury site boilerplate on whistleblower tips, which is not a finding about the entity.
2. 2.Evaluation of the pre-synthesis brief. The prior analytical work product was tested against the evidence rather than adopted. Its principal conclusions on corroboration, the Swiss concentration point, the UBO void and the limits of the Zurich convictions are supported. Three corrections were made: (a) the brief did not capture the NYU Program on Corporate Compliance & Enforcement item; (b) the brief did not record that the GTR item evidences a Luxembourg group subsidiary; (c) the brief's framing of the entity as having "avoided Western sanctions" until Nov 2024 requires qualification, because the OFAC remarks reference an EO 13662 directive determination, indicating restrictive measures predating SDN designation. The brief's attribution of "channelling war-related payments" to NBC News was also reassigned — that claim appears in the RFE/RL item.
3. 3.De-duplication before weighting. The 18 adverse items across domains were mapped to approximately five underlying event clusters (OFAC designation; FINMA 2018; Zurich criminal proceedings; the 2022 non-designation reporting; the UK commercial dispute). Severity was assessed on the gravity of the clusters, not on item counts.
4. 4.Source-authority tiering. Determinative weight was given only to official acts: sanctions listings (state authorities), the FINMA finding (prudential regulator), and the Zurich sentencing (criminal court). Journalism and legal commentary were treated as attributed claims.
5. 5.Date discipline. Only four items carry pipeline dates (2025-01-07 ×2, 2024-05-27, 2023-03-08, 2022-03-30). All other dates are publication dates asserted inside snippet text and are labelled "source-reported" throughout.
6. 6.Score reproduction. Factor scores and applied weights were taken verbatim from the supplied RISK SCORE block and the arithmetic reproduced in full in Section 11. No factor score or weight was modified, and no value was imputed for the unrun PEP factor.

Limitations

• Identity is unverified. No registry ran. The entity has not been resolved to a specific legal person with a registration number.
• Ownership is entirely unknown. Zero beneficial owners at any verification tier. No link between Gazprombank and Gazprom, the Russian state or any individual is established by this evidence.
• PEP screening was not performed. The composite of 84 excludes PEP entirely and should be read as a floor.
• Sanctions entries are incomplete. Designation dates, group IDs and full remarks were not returned; remarks fields are truncated mid-sentence.
• Five designated foreign subsidiaries are known to exist and are unnamed, so screening coverage of the group is necessarily incomplete.
• No court records were searched directly. Litigation findings rest on news and trade-press reporting; no case numbers exist in the file.
• No financial data. Revenue, assets, capital, ratings and source of funds are all unretrieved.
• No ESG source and no jurisdiction reference datasets were consulted; the Jurisdiction Risk input is not traceable to supplied evidence.
• Unspecified neutral and positive items. 24 neutral results and 1 positive result across domains have no stated content and could not be assessed; none has been treated as mitigating.
• Finality is unestablished in the Zurich matter; proceedings continued in 2024.
• The Le Monde and RFE/RL extracts are fragmentary and are recorded as retrieval tasks, not findings.

Confidence

Overall confidence: MEDIUM.

Supporting higher confidence:

• The decisive findings come from primary state sources — two national sanctions authorities, a prudential regulator, and a criminal court.
• The OFAC entries carry entity-specific hard identifiers (SWIFT/BIC, domain names) that materially reinforce the name matches.
• Independent source types converge; no source in the evidence set contradicts any other.
• The evidence-integrity check was clean.

Constraining confidence:

• Two screens did not run (REGISTRY, PEP), one of which (PEP) is excluded from the score.
• Neither identity nor ownership is verified, so the match between the listed person and the assessed subject is operationally probable but not formally confirmed.
• Substantial event duplication across domains means the composite is directionally sound rather than precisely calibrated.
• Most dates are source-reported rather than verified.

Confidence would move to HIGH on retrieval of a Russian registry extract confirming legal identity, the full primary sanctions entries with designation dates, and a completed PEP screen on identified controllers.

Legal and regulatory framework referenced

• UK Money Laundering Regulations 2017 — customer identification and verification, beneficial ownership identification, enhanced due diligence, ongoing monitoring
• FCA SYSC 6.3 and SYSC 12.1 — financial-crime systems and controls; group-wide and PEP-related obligations
• FATF Recommendations — R.10 (CDD), R.12 (PEPs), R.20 (suspicious transaction reporting), R.24 (beneficial ownership transparency)
• UK financial sanctions regime / OFSI — asset-freeze prohibitions, ownership and control provisions, reporting obligations
• US sanctions authorities cited in the list entries — Executive Order 13662; Executive Order 14024 (per OFAC programme labels)
• EU 5AMLD Article 30 — beneficial ownership registers (cited as comparative standard)
• EU 6AMLD — cited as part of the applicable European framework
• UN Global Compact, TCFD, CSRD, UK Modern Slavery Act — cited in Section 10 as the ESG frameworks not assessed
• FATF Grey/Black Lists, EU High-Risk Third Countries, Transparency International CPI — cited in Section 9 as reference datasets not consulted