In the space of a month, Washington signed a major Russia sanctions law, issued new authorisations, and waived significant provisions, while stepping up enforcement against Iran-linked financial activity.

Behaviour-based sanctions surveillance can help close the gap, identifying suspicious transaction, trade and network patterns that name screening alone may not reveal.

For banks exposed to the US financial system, understanding these patterns is becoming an increasingly important part of effective sanctions risk management.

Why Does US Sanctions Risk Extend Beyond the List?

US sanctions combine breadth, speed, and extraterritorial reach. OFAC can impose civil penalties on a strict liability basis, and non-US persons are barred from causing US persons to violate sanctions, whether they mean to or not [1]. The maximum civil penalty under IEEPA is the greater of $377,700 or twice the value of the transaction [2]. 

Secondary sanctions can extend US pressure to foreign financial institutions that facilitate certain significant transactions, including through restrictions on correspondent banking access. Separately, OFAC enforcement demonstrates why exposure cannot always be identified through sanctioned-party screening alone. 

May's $275m settlement with India's Adani Enterprises shows how that plays out. OFAC alleged the company bought more than 30 cargoes of Iranian-origin LPG from a Dubai trader that presented them as Omani and Iraqi products [3]. None of the counterparties were sanctioned at the time [4], and the company's KYC checks returned no matches on OFAC's lists [5]. 

OFAC's case rested instead on red flags it said the company should have acted on, including discounted pricing and repeated third-party warnings about the cargoes' origin. The pattern was visible. The name wasn't.

What Does Behaviour-Based Surveillance Look For in a US Context?

The warning signs in cases like Adani's sit around the transactions, not in the names on them. Behaviour-based surveillance looks for combinations of signals such as:

• Clusters of newly formed trading companies routing payments through the same foreign bank or branch

• Cargo priced consistently below market without commercial explanation

• Declared origin that doesn't match vessel, shipping, or supplier history

• Shared directors, addresses, or owners linking customers to previously designated parties

• Flows concentrated in corridors and sectors under active US enforcement attention

For banks outside the US, dollar clearing and correspondent relationships can create significant sanctions exposure. Understanding where payments ultimately clear, and which customers or counterparties share those routes, can help reveal risks that individual name checks may miss.

FinCEN's proposed action against a bank operating in the UAE, which occurred as part of Treasury's Operation Economic Outcast, shows why. 

Treasury estimates the bank processed about $1.8B between January 2024 and June 2026 for 103 companies that may be part of Iranian shadow banking networks [1], and FinCEN's proposal notes that front companies are predominantly registered in third-country jurisdictions, including the UAE, to obscure beneficial ownership [6]. Shared routes and disguised ownership are exactly the patterns the signals above are designed to surface.

Public actions like this also work as triggers. Treasury says institutions worldwide face heightened sanctions risk from exposure to the bank, and the comment period closed on 1 October, so customers or counterparties linked to it merit an event-driven review. 

That exposure is a reason to look, not evidence of evasion in itself. No single signal proves evasion; read together, they show whether a customer's activity resembles the networks US authorities are targeting.

How Fast Can US Sanctions Exposure Change?

Within weeks, and sometimes without a single change to a sanctions list. The Graham Sanctioning Russia and Iran Act was signed on 18 September, expanding sanctions on Russian banks, energy projects, and shadow fleet vessels [7]. On 9 October, OFAC issued General License 135, authorising transactions involving Russian-origin diesel until 7 April, 2027 [8]. 

Then, on 16 October, an executive order waived the Act's Russia provisions, including tariffs of up to 100% on the largest buyers of Russian energy, citing the national interest, while leaving sanctions imposed under earlier executive orders in place [9].

Each change carries conditions. The question is no longer simply whether a party is listed, but whether the activity is permitted under the rules, licences, and conditions in force at the time.

Where Does Agentic AI Fit?

Identifying suspicious patterns is only the first challenge. Institutions must then investigate the activity, assess the applicable sanctions requirements and document why a particular decision was reached.

This is where AI Agents can support compliance teams. By assembling relevant customer, ownership and transaction context, applying institutional policy, and recording the reasoning behind each outcome, they can help make investigations more consistent, explainable and auditable.

Silent Eight's Iris 7 AI Agents support this approach across customer and payment screening, producing evidence-backed decisions with human oversight, review, and override mechanisms built into the process.

That becomes particularly important when sanctions policy changes quickly. Institutions need to establish which rules, licences and conditions applied at the time of a decision, demonstrate how they were interpreted and ensure similar cases are handled consistently. 

AI Agents can support that process by maintaining a traceable record of the evidence and reasoning behind each outcome.

What to Expect As We Move Towards 2027

The direction of future US sanctions policy remains uncertain, but several developments warrant close attention through the remainder of Q4 and into the new year. 

FinCEN could finalise its proposed rule against the UAE bank, which would make the correspondent-account ban binding. Meanwhile, Treasury has indicated that Operation Economic Outcast will accelerate the pace of US enforcement [1].

OFAC's Sanctions Penalties Regulations, effective from 25 September, consolidate existing enforcement provisions and require penalty information to be published at least monthly. They also retain a 50% reduction in the base penalty for qualifying voluntary self-disclosures [10], reinforcing the importance of identifying and escalating potential violations early.

Sanctions exposure is no longer captured by a name match alone. It depends on who is involved, how transactions move, and which rules apply at the time. For banks, keeping pace means being able to identify those risks, investigate them, and explain the decisions made.

Silent Eight's Iris 7 AI Agents for financial crime compliance help institutions put these principles into practice. 

Across customer and payment screening, AI Agents investigate sanctions alerts using wider context, apply institutional policy consistently, and produce explainable, auditable decisions – helping teams look beyond isolated list matches while keeping human expertise focused on genuine risk.