Enforcement Action Analysis Amir Fadavi

Enforcement Action Analysis Skill

Produces a structured root cause analysis of any OFAC or OFSI enforcement action as a formatted Excel spreadsheet. The output is a six-column table designed to be used as a working document by compliance officers, in-house counsel, external counsel, and consultants — at financial institutions and non-financial firms alike.

---

Input

The user will provide the enforcement action in one of three ways:

1. URL — fetch and parse the document (PDF or HTML)
2. Pasted text — use the text directly from the conversation
3. Uploaded file — read from /mnt/user-data/uploads/

If none is provided, ask the user to supply the enforcement action before proceeding.

---

Step 1 — Extract the Case Facts

Before identifying root causes, extract the following from the enforcement action:

• Subject (name of the settling party)
• Regulator (OFAC or OFSI; include department/division if stated)
• Date of settlement or enforcement release
• Settlement amount
• Sanctions program (e.g., Iran, Russia, Cuba) and specific regulations cited
• Violation period
• Number of apparent violations
• Egregious / non-egregious
• Voluntarily self-disclosed?

Use this to name the output file and populate the sheet title cell.

---

Step 2 — Identify Root Causes

Read the full enforcement action — especially the Description of the Apparent Violations, the Aggravating Factors, and the Compliance Considerations sections. These are the primary source material for root causes.

Identify all distinct root causes. A root cause is a discrete compliance failure — a gap in policy, process, training, technology, or judgment — that contributed to the violation. Do not consolidate unrelated failures to keep the table short. Typical enforcement actions yield 2–5 root causes; complex cases (e.g., commodity trading, multi-party evasion schemes) may yield more.

For each root cause, draft three things:

Column: What Went Wrong

One to three sentences describing the specific failure as it occurred in this case. Factual, grounded in the enforcement action text. No generic compliance language.

Column: How It Went Wrong

One to three sentences explaining the underlying compliance failure mechanism — why the organization's program did not catch this. Draw from:

• Aggravating factors stated by the regulator
• Compliance Considerations section
• OFAC's Compliance Framework root cause taxonomy (listed below)
• Logical inference from the facts

Column: What Could Have Stopped It

Two to four sentences describing concrete controls that would have prevented or detected the violation. Be specific to the facts of the case. Always reflect OFAC's Compliance Considerations section — these are the regulator's own stated expectations and must not be omitted.

---

OFAC Root Cause Taxonomy (reference)

From OFAC's Compliance Framework appendix. Use as a checklist when identifying root causes:

• Lack of a formal sanctions compliance program
• Inadequate policies and procedures (including failure to update for new business lines)
• Misapplication of OFAC's regulations (including "form over substance" errors)
• Failure to update or use automated screening tools
• Screening tool not configured to cover relevant lists (e.g., SSI/non-SDN lists)
• Failure to identify and escalate red flags
• Lack of due diligence on customers, intermediaries, or counterparties
• Decentralized compliance function with inconsistent application
• Inadequate sanctions compliance training
• Failure to conduct ongoing monitoring of existing relationships
• New business line entered without updating compliance program

---